'''
# IAM Floyd

[![Source](https://img.shields.io/github/stars/udondan/iam-floyd?logo=github&label=GitHub%20Stars)](https://github.com/udondan/iam-floyd)
[![iam-floyd](https://img.shields.io/github/v/release/udondan/iam-floyd)](https://github.com/udondan/iam-floyd)
[![Mastodon](https://badgen.net/badge/Mastodon/iamfloyd@awscommunity.social/blue)](https://awscommunity.social/@iamfloyd)
[![libraries.io](https://img.shields.io/badge/packages-libraries.io-yellow)](https://libraries.io/search?q=iam-floyd)
[![Documentation](https://img.shields.io/badge/Documentation-Read%20the%20Docs-orange)](https://iam-floyd.readthedocs.io/en/latest/)
[![GitHub](https://img.shields.io/github/license/udondan/iam-floyd)](https://github.com/udondan/iam-floyd/blob/main/LICENSE)

<!-- put back - when we actually have tests
[![Test Coverage](https://api.codeclimate.com/v1/badges/cdb84b5646c6805b1a23/test_coverage)](https://codeclimate.com/github/udondan/iam-floyd/test_coverage)
-->

**AWS [IAM policy statement](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_statement.html) generator with fluent interface.**

<!-- stats -->

Support for:

* 354 Services
* 14139 Actions
* 1495 Resource Types
* 1494 Condition keys

<!-- /stats -->

![EXPERIMENTAL](https://img.shields.io/badge/stability-experimantal-orange?style=for-the-badge)**<br>This is an early version of the package. The API will change while I implement new features. Therefore make sure you use an exact version in your `package.json` before it reaches 1.0.0.**

## Documentation

Find the documentation at [Read the Docs](https://iam-floyd.readthedocs.io/en/latest/).

[![Auto completion demo](https://raw.githubusercontent.com/udondan/iam-floyd/main/docs/movie-preview.png)](https://www.youtube.com/watch?v=4dHY8qPHbKA)

## Packages

There are two different package variants available:

* **iam-floyd**: Can be used in AWS SDK, Boto 3 or for whatever you need an IAM policy statement for <br>[![npm](https://img.shields.io/npm/dt/iam-floyd?label=npm&color=blueviolet)](https://www.npmjs.com/package/iam-floyd)
  [![PyPI](https://img.shields.io/pypi/dm/iam-floyd?label=pypi&color=blueviolet)](https://pypi.org/project/iam-floyd/)
* **cdk-iam-floyd**: Integrates into [AWS CDK](https://aws.amazon.com/cdk/) and extends [`iam.PolicyStatement`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-iam.PolicyStatement.html)<br>[![npm](https://img.shields.io/npm/dt/cdk-iam-floyd?label=npm&color=orange)](https://www.npmjs.com/package/cdk-iam-floyd)
  [![PyPI](https://img.shields.io/pypi/dm/cdk-iam-floyd?label=pypi&color=orange)](https://pypi.org/project/cdk-iam-floyd/)

  **Starting with version 0.300.0, the packages are compatible with CDK v2.** For CDK v1 you can use any version up to:<br>
  [![npm CDK v1](https://img.shields.io/badge/npm-0.286.0-yellow)](https://www.npmjs.com/package/cdk-iam-floyd/v/0.286.0)
  [![PyPI CDK v1](https://img.shields.io/badge/pypi-0.286.0-yellow)](https://pypi.org/project/cdk-iam-floyd/0.286.0/)

  Find them all on [libraries.io](https://libraries.io/search?q=iam-floyd).

## CDK Compatibility Matrix

| CDK        | cdk-iam-floyd              |
| ---------- | -------------              |
| <= 1.151.0 | <= 0.285.0                 |
| >= 1.152.0 | 0.286.0                    |
| >= 1.158.0 | **No compatible version!** |
| >= 2.0.0   | >= 0.300.0                 |
| >= 2.20.0  | >= 0.351.0                 |
| >= 2.26.0  | >= 0.377.0                 |
| 2.29.x     | **No compatible version!** |
| >= 2.30.0  | >= 0.391.0                 |

---


## Legal

The code contained in the [lib/generated](https://github.com/udondan/iam-floyd/tree/main/lib/generated) folder is generated from the [AWS documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_actions-resources-contextkeys.html). The class- and function-names and their description therefore are property of AWS.

AWS and their services are trademarks, registered trademarks or trade dress of AWS in the U.S. and/or other countries.

This project is not affiliated, funded, or in any way associated with AWS.

IAM Floyd is licensed under [Apache License 2.0](https://github.com/udondan/iam-floyd/blob/main/LICENSE). Dependencies might be released under different licenses. Especially the bundled packages [regex-parser](https://www.npmjs.com/package/regex-parser) and [common-substrings](https://www.npmjs.com/package/common-substrings) are released under the MIT License.
'''
import abc
import builtins
import datetime
import enum
import typing

import jsii
import publication
import typing_extensions

from typeguard import check_type

from ._jsii import *


@jsii.data_type(
    jsii_type="iam-floyd.AccessLevelList",
    jsii_struct_bases=[],
    name_mapping={},
)
class AccessLevelList:
    def __init__(self) -> None:
        '''
        :stability: experimental
        '''
        self._values: typing.Dict[builtins.str, typing.Any] = {}

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "AccessLevelList(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


class Collection(metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Collection"):
    '''
    :stability: experimental
    '''

    def __init__(self) -> None:
        '''
        :stability: experimental
        '''
        jsii.create(self.__class__, self, [])

    @jsii.member(jsii_name="allowEc2InstanceDeleteByOwner")
    def allow_ec2_instance_delete_by_owner(self) -> typing.List["Ec2"]:
        '''
        :stability: experimental
        '''
        return typing.cast(typing.List["Ec2"], jsii.invoke(self, "allowEc2InstanceDeleteByOwner", []))


@jsii.data_type(
    jsii_type="iam-floyd.Conditions",
    jsii_struct_bases=[],
    name_mapping={},
)
class Conditions:
    def __init__(self) -> None:
        '''(experimental) A collection of Condition's.

        :stability: experimental
        '''
        self._values: typing.Dict[builtins.str, typing.Any] = {}

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "Conditions(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.enum(jsii_type="iam-floyd.Effect")
class Effect(enum.Enum):
    '''(experimental) Policy effects.

    :stability: experimental
    '''

    ALLOW = "ALLOW"
    '''
    :stability: experimental
    '''
    DENY = "DENY"
    '''
    :stability: experimental
    '''


class Operator(metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Operator"):
    '''(experimental) Use condition operators in the ``Condition`` element to match the condition key and value in the policy against values in the request context.

    For more information about the ``Condition`` element, see `IAM JSON Policy Elements: Condition <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html>`_.

    The condition operator that you can use in a policy depends on the condition key you choose. You can choose a global condition key or a service-specific condition key. To learn which condition operator you can use for a global condition key, see `AWS Global Condition Context Keys <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html>`_. To learn which condition operator you can use for a service-specific condition key, see `Actions, Resources, and Condition Keys for AWS Services <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_actions-resources-contextkeys.html>`_ and choose the service that you want to view.

    https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html

    :stability: experimental
    '''

    def __init__(self) -> None:
        '''
        :stability: experimental
        '''
        jsii.create(self.__class__, self, [])

    @jsii.member(jsii_name="arnEquals")
    def arn_equals(self) -> "Operator":
        '''(experimental) Match of the ARN, case sensitive.

        Each of the six colon-delimited components of the ARN is checked separately and each can include a multi-character match wildcard (``*``) or a single-character match wildcard (``?``).

        ``ArnEquals`` and ``ArnLike`` behave identical.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "arnEquals", []))

    @jsii.member(jsii_name="arnLike")
    def arn_like(self) -> "Operator":
        '''(experimental) Match of the ARN, case sensitive.

        Each of the six colon-delimited components of the ARN is checked separately and each can include a multi-character match wildcard (``*``) or a single-character match wildcard (``?``).

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "arnLike", []))

    @jsii.member(jsii_name="arnNotEquals")
    def arn_not_equals(self) -> "Operator":
        '''(experimental) Negated match of the ARN, case sensitive.

        Each of the six colon-delimited components of the ARN is checked separately and each can include a multi-character match wildcard (``*``) or a single-character match wildcard (``?``).

        ``ArnNotEquals`` and ``ArnNotLike`` behave identical.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "arnNotEquals", []))

    @jsii.member(jsii_name="arnNotLike")
    def arn_not_like(self) -> "Operator":
        '''(experimental) Negated match of the ARN, case sensitive.

        Each of the six colon-delimited components of the ARN is checked separately and each can include a multi-character match wildcard (``*``) or a single-character match wildcard (``?``).

        ``ArnNotEquals`` and ``ArnNotLike`` behave identical.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "arnNotLike", []))

    @jsii.member(jsii_name="binaryEquals")
    def binary_equals(self) -> "Operator":
        '''(experimental) The BinaryEquals condition operator lets you construct Condition elements that test key values that are in binary format.

        It compares the value of the specified key byte for byte against a `base-64 <https://en.wikipedia.org/wiki/Base64>`_ encoded representation of the binary value in the policy.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "binaryEquals", []))

    @jsii.member(jsii_name="bool")
    def bool(self) -> "Operator":
        '''(experimental) Boolean match.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "bool", []))

    @jsii.member(jsii_name="dateEquals")
    def date_equals(self) -> "Operator":
        '''(experimental) Match a specific date: ``=``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "dateEquals", []))

    @jsii.member(jsii_name="dateGreaterThan")
    def date_greater_than(self) -> "Operator":
        '''(experimental) Match after a specific a date and time: ``>``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "dateGreaterThan", []))

    @jsii.member(jsii_name="dateGreaterThanEquals")
    def date_greater_than_equals(self) -> "Operator":
        '''(experimental) Match at or after a specific date and time: ``>=``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "dateGreaterThanEquals", []))

    @jsii.member(jsii_name="dateLessThan")
    def date_less_than(self) -> "Operator":
        '''(experimental) Match before a specific date and time: ``<``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "dateLessThan", []))

    @jsii.member(jsii_name="dateLessThanEquals")
    def date_less_than_equals(self) -> "Operator":
        '''(experimental) Match at or before a specific date and time: ``<=``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "dateLessThanEquals", []))

    @jsii.member(jsii_name="dateNotEquals")
    def date_not_equals(self) -> "Operator":
        '''(experimental) Negated match for a specific date: ``!=``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "dateNotEquals", []))

    @jsii.member(jsii_name="forAllValues")
    def for_all_values(self) -> "Operator":
        '''(experimental) Tests whether the value of every member of the request set is a subset of the condition key set.

        The condition returns true if every key value in the request matches at least one value in the policy. It also returns true if there are no keys in the request, or if the key values resolve to a null data set, such as an empty string.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "forAllValues", []))

    @jsii.member(jsii_name="forAnyValue")
    def for_any_value(self) -> "Operator":
        '''(experimental) Tests whether at least one member of the set of request values matches at least one member of the set of condition key values.

        The condition returns true if any one of the key values in the request matches any one of the condition values in the policy. For no matching key or a null dataset, the condition returns false.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "forAnyValue", []))

    @jsii.member(jsii_name="ifExists")
    def if_exists(self) -> "Operator":
        '''(experimental) You can add ``IfExists`` to the end of any condition operator name except the ``Null`` condition.

        For example, ``StringLikeIfExists``. You do this to say "If the policy key is present in the context of the request, process the key as specified in the policy. If the key is not present, evaluate the condition element as true." Other condition elements in the statement can still result in a nonmatch, but not a missing key when checked with ``...IfExists``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "ifExists", []))

    @jsii.member(jsii_name="ipAddress")
    def ip_address(self) -> "Operator":
        '''(experimental) Match an IP address or range: ``=``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "ipAddress", []))

    @jsii.member(jsii_name="notIpAddress")
    def not_ip_address(self) -> "Operator":
        '''(experimental) All IP addresses except the specified IP address or range ``!=``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "notIpAddress", []))

    @jsii.member(jsii_name="null")
    def null(self) -> "Operator":
        '''(experimental) Check if a key is present at the time of authorization.

        In the policy statement, use either true (the key doesn't exist — it is null) or false (the key exists and its value is not null).

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "null", []))

    @jsii.member(jsii_name="numericEquals")
    def numeric_equals(self) -> "Operator":
        '''(experimental) Exact match.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "numericEquals", []))

    @jsii.member(jsii_name="numericGreaterThan")
    def numeric_greater_than(self) -> "Operator":
        '''(experimental) Match numbers higher than value: ``>``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "numericGreaterThan", []))

    @jsii.member(jsii_name="numericGreaterThanEquals")
    def numeric_greater_than_equals(self) -> "Operator":
        '''(experimental) Match numbers higher or equal value: ``>=``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "numericGreaterThanEquals", []))

    @jsii.member(jsii_name="numericLessThan")
    def numeric_less_than(self) -> "Operator":
        '''(experimental) Match numbers lower than value: ``<``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "numericLessThan", []))

    @jsii.member(jsii_name="numericLessThanEquals")
    def numeric_less_than_equals(self) -> "Operator":
        '''(experimental) Match numbers lower or equal to value: ``<=``.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "numericLessThanEquals", []))

    @jsii.member(jsii_name="numericNotEquals")
    def numeric_not_equals(self) -> "Operator":
        '''(experimental) Negated exact match.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "numericNotEquals", []))

    @jsii.member(jsii_name="stringEquals")
    def string_equals(self) -> "Operator":
        '''(experimental) Exact match, case sensitive.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "stringEquals", []))

    @jsii.member(jsii_name="stringEqualsIgnoreCase")
    def string_equals_ignore_case(self) -> "Operator":
        '''(experimental) Exact match, ignore case.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "stringEqualsIgnoreCase", []))

    @jsii.member(jsii_name="stringLike")
    def string_like(self) -> "Operator":
        '''(experimental) Case-sensitive match.

        The values can include a multi-character match wildcard (``*``) or a single-character match wildcard (``?``) anywhere in the string.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "stringLike", []))

    @jsii.member(jsii_name="stringNotEquals")
    def string_not_equals(self) -> "Operator":
        '''(experimental) Negated exact match, case sensitive.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "stringNotEquals", []))

    @jsii.member(jsii_name="stringNotEqualsIgnoreCase")
    def string_not_equals_ignore_case(self) -> "Operator":
        '''(experimental) Exact exact match, ignore case.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "stringNotEqualsIgnoreCase", []))

    @jsii.member(jsii_name="stringNotLike")
    def string_not_like(self) -> "Operator":
        '''(experimental) Negated case-sensitive matching.

        The values can include a multi-character match wildcard (``*``) or a single-character match wildcard (``?``) anywhere in the string.

        :stability: experimental
        '''
        return typing.cast("Operator", jsii.invoke(self, "stringNotLike", []))

    @jsii.member(jsii_name="toString")
    def to_string(self) -> builtins.str:
        '''
        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.invoke(self, "toString", []))


class PolicyStatementBase(
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.PolicyStatementBase",
):
    '''(experimental) Base class for the Policy Statement.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''
        :param sid: -

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__72d37775c42581cdbb670fd68b7157d8318000dbfa4394e5d115eb6834d7e5e1)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toJSON")
    def to_json(self) -> typing.Any:
        '''(experimental) JSON-ify the policy statement.

        Used when JSON.stringify() is called

        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toJSON", []))

    @jsii.python.classproperty
    @jsii.member(jsii_name="defaultPartition")
    def DEFAULT_PARTITION(cls) -> builtins.str:
        '''(experimental) The default partition for ARNs (such as one of [aws, aws-us-gov, aws-cn]).

        In
        CDK applications, this is a reference to the current partition, otherwise, 'aws'.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.sget(cls, "defaultPartition"))

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4142de54e87055936d594b8dbdb0981ee88ec5912bbdb2b62595d24464705d6d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)

    @builtins.property
    @jsii.member(jsii_name="sid")
    def sid(self) -> builtins.str:
        '''
        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "sid"))

    @sid.setter
    def sid(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__182d7f96c5a7e153de558514fc854a34b0fa0ab607426a14d00e60bc309ed64e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "sid", value)


class PolicyStatementWithCondition(
    PolicyStatementBase,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.PolicyStatementWithCondition",
):
    '''(experimental) Adds "condition" functionality to the Policy Statement.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''
        :param sid: -

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e2b547f6cec706e0492b2d84c3e2a59b5c7e6e266c223abca5022d896b6d45ab)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="freeze")
    def freeze(self) -> typing.Any:
        '''
        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "freeze", []))

    @jsii.member(jsii_name="hasConditions")
    def has_conditions(self) -> builtins.bool:
        '''(experimental) Checks weather a condition was applied to the policy.

        :stability: experimental
        '''
        return typing.cast(builtins.bool, jsii.invoke(self, "hasConditions", []))

    @jsii.member(jsii_name="if")
    def if_(
        self,
        key: builtins.str,
        value: typing.Any,
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Adds a condition to the statement.

        :param key: The key of the condition.
        :param value: The value(s) to check for.
        :param operator: `Operator <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html>`_ of the condition. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f869ce9e35996c3eab103799b2e032789f86ae7f0fca53de5044fbbbdc995c36)
            check_type(argname="argument key", value=key, expected_type=type_hints["key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "if", [key, value, operator]))

    @jsii.member(jsii_name="ifAwsCalledVia")
    def if_aws_called_via(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the services with the services that made requests on behalf of the IAM principal (user or role).

        When a principal makes a request to an AWS service, that service might use the principal's credentials to make subsequent requests to other services.

        The ``aws:CalledVia`` key contains an ordered list of each service in the chain that made requests on the principal's behalf.

        **Availability:** This key is present in the request when a service that supports aws:CalledVia uses the credentials of an IAM principal to make a request to another service. This key is not present if the service uses a `service role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-role>`_ or `service-linked role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role>`_ to make a call on the principal's behalf. This key is also not present when the principal makes the call directly.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-calledvia

        :param value: The service(s) to check for.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``ForAnyValue:StringEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__92877fa5ca833dff290c39fc6287324425022283060b299d280fe90639ea08b7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsCalledVia", [value, operator]))

    @jsii.member(jsii_name="ifAwsCalledViaFirst")
    def if_aws_called_via_first(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the services with the first service that made a request on behalf of the IAM principal (user or role).

        For more information, see `aws:CalledVia <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-calledvia>`_.

        **Availability:** This key is present in the request when a service that supports aws:CalledVia uses the credentials of an IAM principal to make a request to another service. This key is not present if the service uses a `service role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-role>`_ or `service-linked role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role>`_ to make a call on the principal's behalf. This key is also not present when the principal makes the call directly.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-calledviafirst

        :param value: The service(s) to check for.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eaf39c85f2af81b764537224bdc27b53b6b7eb05ee0c6a2d7816d86eba47e18c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsCalledViaFirst", [value, operator]))

    @jsii.member(jsii_name="ifAwsCalledViaLast")
    def if_aws_called_via_last(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the services with the last service that made a request on behalf of the IAM principal (user or role).

        For more information, see `aws:CalledVia <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-calledvia>`_.

        **Availability:** This key is present in the request when a service that supports aws:CalledVia uses the credentials of an IAM principal to make a request to another service. This key is not present if the service uses a `service role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-role>`_ or `service-linked role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role>`_ to make a call on the principal's behalf. This key is also not present when the principal makes the call directly.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-calledvialast

        :param value: The service(s) to check for.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d7fe33c2e7fb3c3fd22d15722d5ce596f6b2601c1d5e002406a7a6a09c40b6ce)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsCalledViaLast", [value, operator]))

    @jsii.member(jsii_name="ifAwsCurrentTime")
    def if_aws_current_time(
        self,
        value: typing.Union[builtins.str, datetime.datetime, typing.Sequence[typing.Union[builtins.str, datetime.datetime]]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the date and time of the request with the date and time that you specify.

        To view an example policy that uses this condition key, see `AWS: Allows Access Within Specific Dates <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws-dates.html>`_.

        **Availability:** This key is always included in the request context.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-currenttime

        :param value: The date and time to check for. Can be a string in one of the `W3C implementations of the ISO 8601 date <https://www.w3.org/TR/NOTE-datetime>`_ (e.g. ``2020-04-01T00:00:00Z``) or in epoch (UNIX) time or a ``Date()`` object (JavaScript only)
        :param operator: Works with `date operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Date>`_. **Default:** ``DateLessThanEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ad874f1f9d0783c902570b6b453a20a6db9c31a395ef6c6f602e3671ca279fc6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsCurrentTime", [value, operator]))

    @jsii.member(jsii_name="ifAwsEc2InstanceSourcePrivateIPv4")
    def if_aws_ec2_instance_source_private_i_pv4(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) This key identifies the private IPv4 address of the primary elastic network interface to which Amazon EC2 IAM role credentials were delivered.

        You must use this condition key with its companion key ``aws:Ec2InstanceSourceVpc`` to ensure that you have a globally unique combination of VPC ID and source private IP. Use this key with ``aws:Ec2InstanceSourceVpc`` to ensure that a request was made from the same private IP address that the credentials were delivered to.

        **Availability:** This key is included in the request context whenever the requester is signing requests with an Amazon EC2 role credential. It can be used in IAM policies, service control policies, VPC endpoint policies, and resource policies.

        **Note:** This condition key is not available in EC2-Classic.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-vpcsourceip

        :param value: The private IPv4 address.
        :param operator: Works with IP `address operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_IPAddress>`_. **Default:** ``IpAddress``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5c1b196a8276597333f3988ce4e427ad5be20653b2baa16471d14e4117d62246)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsEc2InstanceSourcePrivateIPv4", [value, operator]))

    @jsii.member(jsii_name="ifAwsEc2InstanceSourceVpc")
    def if_aws_ec2_instance_source_vpc(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) This key identifies the VPC to which Amazon EC2 IAM role credentials were delivered to.

        You can use this key in a policy with the `aws:SourceVPC <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcevpc>`_ global key to check if a call is made from a VPC (``aws:SourceVPC``) that matches the VPC where a credential was delivered to (``aws:Ec2InstanceSourceVpc``).

        **Availability:** This key is included in the request context whenever the requester is signing requests with an Amazon EC2 role credential. It can be used in IAM policies, service control policies, VPC endpoint policies, and resource policies.

        This key can be used with VPC identifier values, but is most useful when used as a variable combined with the ``aws:SourceVpc`` context key. The ``aws:SourceVpc`` context key is included in the request context only if the requester uses a VPC endpoint to make the request. Using ``aws:Ec2InstanceSourceVpc`` with ``aws:SourceVpc`` allows you to use ``aws:Ec2InstanceSourceVpc`` more broadly since it compares values that typically change together.

        **Note:** This condition key is not available in EC2-Classic.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-ec2instancesourcevpc

        :param value: The VPS ID.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__955c28b57ca7ce2f0777e4401b0547ec990400a9943ec8e635100f3d95a4762b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsEc2InstanceSourceVpc", [value, operator]))

    @jsii.member(jsii_name="ifAwsEpochTime")
    def if_aws_epoch_time(
        self,
        value: typing.Union[builtins.str, jsii.Number, datetime.datetime, typing.Sequence[typing.Union[builtins.str, jsii.Number, datetime.datetime]]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the date and time of the request in epoch or Unix time with the value that you specify.

        This key also accepts the number of seconds since January 1, 1970.

        **Availability:** This key is always included in the request context.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-epochtime

        :param value: The date and time to check for. Can be a string in one of the `W3C implementations of the ISO 8601 date <https://www.w3.org/TR/NOTE-datetime>`_ (e.g. ``2020-04-01T00:00:00Z``) or in epoch (UNIX) time or a ``Date()`` object (JavaScript only)
        :param operator: Works with `date <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Date>`_ and `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``DateLessThanEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6df58998c25fe88b23c9591832eb9bf231dd2e9c2941198bdbc8a1be5d6fb8cd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsEpochTime", [value, operator]))

    @jsii.member(jsii_name="ifAwsFederatedProvider")
    def if_aws_federated_provider(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Use this key to compare the principal's issuing identity provider (IdP) with the IdP that you specify in the policy.

        This means that an IAM role was assumed using the ``AssumeRoleWithWebIdentity`` or ``AssumeRoleWithSAML`` AWS STS operations. When the resulting role session's temporary credentials are used to make a request, the request context identifies the IdP that authenticated the original federated identity.

        **Availability:** This key is present when the principal is a role session principal and that session was issued using a third-party identity provider.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-federatedprovider

        :param value: The principal's issuing identity provider (IdP).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e209c2c156a1a6c358acb461233a213d29e75eb3af157421fb2181b478664075)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsFederatedProvider", [value, operator]))

    @jsii.member(jsii_name="ifAwsMultiFactorAuthAge")
    def if_aws_multi_factor_auth_age(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the number of seconds since the requesting principal was authorized using MFA with the number that you specify.

        For more information about MFA, see `Using Multi-Factor Authentication (MFA) in AWS <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html>`_.

        **Availability:** This key is included in the request context only if the principal was authenticated using MFA. If MFA was not used, this key is not present.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-multifactorauthage

        :param value: Number of seconds.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericLessThan``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__04a0c7ee05c314ea9c0e46853f4c0ff61b41601c4a8ca24f9d6593c4a0625359)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsMultiFactorAuthAge", [value, operator]))

    @jsii.member(jsii_name="ifAwsMultiFactorAuthPresent")
    def if_aws_multi_factor_auth_present(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Check whether multi-factor authentication (MFA) was used to validate the temporary security credentials that made the request.

        **Availability:** This key is included in the request context only when the principal uses temporary credentials to make the request. The key is not present in AWS CLI, AWS API, or AWS SDK requests that are made using long-term credentials.

        Temporary credentials are used to authenticate IAM roles, federated users, IAM users with temporary tokens from ``sts:GetSessionToken``, and users of the AWS Management Console. IAM users in the AWS Management Console unknowingly use temporary credentials. Users sign into the console using their user name and password, which are long-term credentials. However, in the background, the console generates temporary credentials on behalf of the user. To learn which services support using temporary credentials, see `AWS Services That Work with IAM <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html>`_.

        The ``aws:MultiFactorAuthPresent`` key is not present when an API or CLI command is called with long-term credentials, such as user access key pairs. Therefore we recommend that when you check for this key that you use the `...IfExists <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_IfExists>`_ versions of the condition operators.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-multifactorauthpresent

        :param value: Weather the MFA should be present or absent. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__91973e1fda06329f6c5c65a85fe4fa1c18c2cceef60940a73c75748aa7037e9a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsMultiFactorAuthPresent", [value]))

    @jsii.member(jsii_name="ifAwsPrincipalAccount")
    def if_aws_principal_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the account to which the requesting principal belongs with the account identifier that you specify.

        **Availability:** This key is always included in the request context.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalaccount

        :param value: Account identifier(s).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1cb0683c53cc71b6f4ba8cf3556245efa880c21db413846110499f17878d04a7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsPrincipalAccount", [value, operator]))

    @jsii.member(jsii_name="ifAwsPrincipalArn")
    def if_aws_principal_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the `Amazon Resource Name <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns>`_ (ARN) of the principal that made the request with the ARN that you specify.

        For IAM roles, the request context returns the ARN of the role, not the ARN of the user that assumed the role. To learn which types of principals you can specify in this condition key, see `Specifying a Principal <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#Principal_specifying>`_.

        **Availability:** This key is always included in the request context.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalarn

        :param value: Principle ARN(s).
        :param operator: Works with `ARN operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_ and `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1c886ae886d3725fae853f688db984847230ab912e415988123b0afbf06017e7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsPrincipalArn", [value, operator]))

    @jsii.member(jsii_name="ifAwsPrincipalIsAWSService")
    def if_aws_principal_is_aws_service(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Check whether the call to your resource is being made directly by an AWS `service principal <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services>`_. For example, AWS CloudTrail uses the service principal ``cloudtrail.amazonaws.com`` to write logs to your Amazon S3 bucket. The request context key is set to true when a service uses a service principal to perform a direct action on your resources. The context key is set to false if the service uses the credentials of an IAM principal to make a request on the principal's behalf. It is also set to false if the service uses a `service role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-role>`_ or `service-linked role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role>`_ to make a call on the principal's behalf.

        **Availability:** This key is present in the request context for all signed API requests that use AWS credentials.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalisawsservice

        :param value: Weather the call to your resource is being made directly by an AWS service principal. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2e4cb513803791882cb775de121cc7542289b474eaa4b1d45b41e6e85f7046cf)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsPrincipalIsAWSService", [value]))

    @jsii.member(jsii_name="ifAwsPrincipalOrgID")
    def if_aws_principal_org_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the identifier of the organization in AWS Organizations to which the requesting principal belongs with the identifier you specify.

        **Availability:** This key is included in the request context only if the principal is a member of an organization.

        This global key provides an alternative to listing all the account IDs for all AWS accounts in an organization. You can use this condition key to simplify specifying the ``Principal`` element in a resource-based policy. You can specify the organization ID in the condition element. When you add and remove accounts, policies that include the ``aws:PrincipalOrgID`` key automatically include the correct accounts and don't require manual updating.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalorgid

        :param value: Organization ID(s) in format ``o-xxxxxxxxxxx``.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a14ef324ec25bb000cc61c92f34edff4fa6e68e248fcad3fc600bf916f69ec7c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsPrincipalOrgID", [value, operator]))

    @jsii.member(jsii_name="ifAwsPrincipalOrgPaths")
    def if_aws_principal_org_paths(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the AWS Organizations path for the principal who is making the request to the path you provide.

        That principal can be an IAM user, IAM role, federated user, or AWS account root user.

        This condition ensures that the requester is an account member within the specified organization root or organizational units (OUs) in AWS Organizations. An AWS Organizations path is a text representation of the structure of an Organizations entity. For more information about using and understanding paths, see Understand the `AWS Organizations Entity Path <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor-view-data-orgs.html#access_policies_access-advisor-viewing-orgs-entity-path>`_.

        **Availability:** This key is included in the request context only if the principal is a member of an organization.

        **Note:** Organization IDs are globally unique but OU IDs and root IDs are unique only within an organization. This means that no two organizations share the same organization ID. However, another organization might have an OU or root with the same ID as yours. We recommend that you always include the organization ID when you specify an OU or root.

        ``aws:PrincipalOrgPaths`` is a multivalued condition key. Multivalued keys include one or more values in a list format. The result is a logical ``OR``. When you use multiple values with the ``ForAnyValue:`` condition operator, the principal's path must match one of the paths provided. For policies that include multiple values for a single key, you must enclose the conditions within brackets like an array (``"Key":["Value1", "Value2"]``). You should also include these brackets when there is a single value. For more information about multivalued condition keys, see `Creating a Condition with Multiple Keys or Values <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html>`_.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalorgpaths

        :param value: Organization path(s) in the format of ``o-xxxxxxxxxxx/r-xxxxxxxxxx/ou-xxxx-xxxxxxxx/ou-xxxx-xxxxxxxx/``.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__951bfd260e8386e5e0f7fc828f074a10c32515575fcaa11ceaedd6b989a9be45)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsPrincipalOrgPaths", [value, operator]))

    @jsii.member(jsii_name="ifAwsPrincipalServiceName")
    def if_aws_principal_service_name(
        self,
        value: builtins.str,
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the `service principal <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services>`_ name in the policy with the service principal that is making requests to your resources. You can use this key to check whether this call is made by a specific service principal. When a service principal makes a direct request to your resource, the ``aws:PrincipalServiceName`` key contains the name of the service principal. For example, the AWS CloudTrail service principal name is ``cloudtrail.amazonaws.com``.

        **Availability:** This key is present in the request when the call is made by an AWS service principal. This key is not present in any other situation, including the following:

        - If the service uses a `service role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-role>`_ or `service-linked role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role>`_ to make a call on the principal's behalf.
        - If the service uses the credentials of an IAM principal to make a request on the principal's behalf.
        - If the call is made directly by an IAM principal.

        You can use this condition key to limit access to your trusted identities and expected network locations, while safely granting access to an AWS service.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalservicename

        :param value: AWS service name, e.g. ``cloudtrail.amazonaws.com``.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b6188068715614948a82ee9db6a69e469e37780b6028885ef8302dda0e0d2079)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsPrincipalServiceName", [value, operator]))

    @jsii.member(jsii_name="ifAwsPrincipalServiceNamesList")
    def if_aws_principal_service_names_list(
        self,
        value: typing.Sequence[builtins.str],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) This key provides a list of all `service principal <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services>`_ names that belong to the service. This is an advanced condition key. You can use it to restrict the service from accessing your resource from a specific Region only. Some services may create Regional service principals to indicate a particular instance of the service within a specific Region. You can limit access to a resource to a particular instance of the service. When a service principal makes a direct request to your resource, the ``aws:PrincipalServiceNamesList`` contains an unordered list of all service principal names associated with the Regional instance of the service.

        **Availability:** This key is present in the request when the call is made by an AWS service principal. This key is not present in any other situation, including the following:

        - If the service uses a `service role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-role>`_ or `service-linked role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role>`_ to make a call on the principal's behalf.
        - If the service uses the credentials of an IAM principal to make a request on the principal's behalf.
        - If the call is made directly by an IAM principal.

        ``aws:PrincipalServiceNamesList`` is a multivalued condition key. Multivalued keys include one or more values in a list format. The result is a logical ``OR``. You must use the ``ForAnyValue`` or ``ForAllValues`` set operators with the ``StringLike`` `condition operator <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_ when you use this key. For policies that include multiple values for a single key, you must enclose the conditions within brackets like an array, such as ``("Key":["Value1", "Value2"])``. You should also include these brackets when there is a single value. For more information about multivalued condition keys, see `Using multiple keys and values <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html#reference_policies_multi-key-or-value-conditions>`_.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalservicenameslist

        :param value: AWS service name list.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``ForAnyValue:StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ac8258373923b2923766e5c412c7cf0643549db886d63ef9c4e9ecccf0b31fdb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsPrincipalServiceNamesList", [value, operator]))

    @jsii.member(jsii_name="ifAwsPrincipalTag")
    def if_aws_principal_tag(
        self,
        key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the tag attached to the principal making the request with the tag that you specify.

        If the principal has more than one tag attached, the request context includes one aws:PrincipalTag key for each attached tag key.

        **Availability:** This key is included in the request context if the principal is using an IAM user with attached tags. It is included for a principal using an IAM role with attached tags or `session tags <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html>`_.

        You can add custom attributes to a user or role in the form of a key-value pair. For more information about IAM tags, see `Tagging IAM Users and Roles <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html>`_. You can use ``aws:PrincipalTag`` to `control access <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_iam-tags.html#access_iam-tags_control-resources>`_ for AWS principals.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principaltag

        :param key: The tag key to check.
        :param value: The tag value(s) to check against.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__67808cdafa295eb10f078c24f43054eba2f5cabab0a5cd0cd089ce976f16a405)
            check_type(argname="argument key", value=key, expected_type=type_hints["key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsPrincipalTag", [key, value, operator]))

    @jsii.member(jsii_name="ifAwsPrincipalType")
    def if_aws_principal_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the type of principal making the request with the principal type that you specify.

        For details about how the information appears in the request context for different principals, see `Specifying a Principal <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#Principal_specifying>`_.

        **Availability:** This key is always included in the request context.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principaltype

        :param value: The principal type(s). Any of ``Account``, ``User``, ``FederatedUser``, ``AssumedRole``, ``Anonymous``
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d2f1f303a488b7caa7d1592314e1b5af8f4ec07ea31fa0ede2bbdd3f079c4309)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsPrincipalType", [value, operator]))

    @jsii.member(jsii_name="ifAwsReferer")
    def if_aws_referer(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare who referred the request in the client browser with the referer that you specify.

        The ``aws:referer`` request context value is provided by the caller in an HTTP header.

        **Availability:** This key is included in the request context only if the request was invoked using a URL in the browser.

        For example, you can call `Amazon S3 API operations directly using a web browser <https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html#example-bucket-policies-use-case-4>`_. This means that you can view S3 objects, such as images and documents, directly through a web browser. The ``aws:referer`` condition allows you to restrict access to specific values in the HTTP or HTTPS request based on the value of the referrer header.

        **Warning:** This condition should be used carefully. It is dangerous to include a publicly known referer header value. Unauthorized parties can use modified or custom browsers to provide any ``aws:referer`` value that they choose. As a result, ``aws:referer`` should not be used to prevent unauthorized parties from making direct AWS requests. It is offered only to allow customers to protect their digital content, such as content stored in Amazon S3, from being referenced on unauthorized third-party sites.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-referer

        :param value: The referer url(s).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5c814044424dc09802ab8a20e1b196186835511c3f7689b71cd873c3a79900b2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsReferer", [value, operator]))

    @jsii.member(jsii_name="ifAwsRequestedRegion")
    def if_aws_requested_region(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the AWS Region that was called in the request with the Region that you specify.

        You can use this global condition key to control which Regions can be requested. To view the AWS Regions for each service, see `Service endpoints and quotas <https://docs.aws.amazon.com/general/latest/gr/aws-service-information.html>`_ in the Amazon Web Services General Reference.

        **Availability:** This key is always included in the request context.

        Some global services, such as IAM, have a single endpoint. Because this endpoint is physically located in the US East (N. Virginia) Region, IAM calls are always made to the us-east-1 Region. For example, if you create a policy that denies access to all services if the requested Region is not us-west-2, then IAM calls always fail. To view an example of how to work around this, see `NotAction with Deny <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notaction.html>`_.

        **Note:** The ``aws:RequestedRegion`` condition key allows you to control which endpoint of a service is invoked but does not control the impact of the operation. Some services have cross-Region impacts. For example, Amazon S3 has API operations that control cross-Region replication. You can invoke ``s3:PutBucketReplication`` in one Region (which is affected by the ``aws:RequestedRegion`` condition key), but other Regions are affected based on the replications configuration settings.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-requestedregion

        :param value: The region(s).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fa825264744a110a82c5dc1c66b258a8e9133ce01b5d7aec53ad0f8ade6d5afc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsRequestedRegion", [value, operator]))

    @jsii.member(jsii_name="ifAwsRequestTag")
    def if_aws_request_tag(
        self,
        key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the tag key-value pair that was passed in the request with the tag pair that you specify.

        For example, you could check whether the request includes the tag key ``Dept`` and that it has the value ``Accounting``. For more information, see `Controlling Access During AWS Requests <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html#access_tags_control-requests>`_.

        **Availability:** This key is included in the request context when tags are passed in the request. When multiple tags are passed in the request, there is one context key for each tag key-value pair.

        Because you can include multiple tag key-value pairs in a request, the request content could be a multivalued request. In this case, you should consider using the ``ForAllValues`` or ``ForAnyValue`` set operators. For more information, see `Using Multiple Keys and Values <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html#reference_policies_multi-key-or-value-conditions>`_.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-requesttag

        :param key: The tag key to check.
        :param value: The tag value(s) to check against.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d5b81ad2b642de83d2311aca2dc2036d8e29d647786967a04cc3a20217b68e46)
            check_type(argname="argument key", value=key, expected_type=type_hints["key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsRequestTag", [key, value, operator]))

    @jsii.member(jsii_name="ifAwsResourceAccount")
    def if_aws_resource_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Use this key to compare the requested resource owner's `AWS account ID <https://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html>`_ with the resource account in the policy. You can then allow or deny access to that resource based on the account that owns the resource.

        This key is equal to the AWS account ID for the account with the resources evaluated in the request.

        For most resources in your account, the ARN contains the owner account ID for that resource. For certain resources, such as Amazon S3 buckets, the resource ARN does not include the account ID. The following two examples show the difference between a resource with an account ID in the ARN, and an Amazon S3 ARN without an account ID:

        - ``arn:aws:iam::123456789012:role/AWSExampleRole`` - IAM role created and owned within the account 123456789012.
        - ``arn:aws:s3:::DOC-EXAMPLE-BUCKET2`` - Amazon S3 bucket created and owned within the account 111122223333, not displayed in the ARN.

        **Availability:** This key is always included in the request context for most service actions. The following actions don't support this key:

        - Amazon Elastic Block Store - All actions
        - Amazon EC2

          - ``ec2:CopyFpgaImage``
          - ``ec2:CopyImage``
          - ``ec2:CopySnapshot``
          - ``ec2:CreateTransitGatewayPeeringAttachment``
          - ``ec2:CreateVolume``
          - ``ec2:CreateVpcPeeringConnection``

        - Amazon EventBridge - All actions
        - Amazon WorkSpaces

          - ``workspaces:CopyWorkspaceImage``
          - ``workspaces:DescribeWorkspaceImages``

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourceaccount

        :param value: The account ID.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0a84b9e9c46e7a92d6c814fa1b7df61a241c2c7c4f6b7823d1e0dc8727ea6336)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsResourceAccount", [value, operator]))

    @jsii.member(jsii_name="ifAwsResourceOrgID")
    def if_aws_resource_org_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Use this key to compare the identifier of the organization in AWS Organizations to which the requested resource belongs with the identifier specified in the policy.

        This global key returns the resource organization ID for a given request. It allows you to create rules that apply to all resources in an organization that are specified in the Resource element of an `identity-based policy <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_identity-vs-resource.html>`_. You can specify the `organization ID <https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_details.html>`_ in the condition element. When you add and remove accounts, policies that include the aws:ResourceOrgID key automatically include the correct accounts and you don't have to manually update it.

        **Note:** Some AWS services require access to AWS owned resources that are hosted in another AWS account. Using ``aws:ResourceOrgID`` in your identity-based policies might impact your identity's ability to access these resources.

        **Availability:** This key is included in the request context only if the account that owns the resource is a member of an organization. This global condition key does not support the following actions:

        - Amazon Elastic Block Store - All actions
        - Amazon EC2

          - ``ec2:CopyFpgaImage``
          - ``ec2:CopyImage``
          - ``ec2:CopySnapshot``
          - ``ec2:CreateTransitGatewayPeeringAttachment``
          - ``ec2:CreateVolume``
          - ``ec2:CreateVpcPeeringConnection``

        - Amazon EventBridge - All actions

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourceorgid

        :param value: ID of an organization.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fab7795ff9d0f347f79a69e670065fc55595fad2b3a21f68c357daa237c79a3d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsResourceOrgID", [value, operator]))

    @jsii.member(jsii_name="ifAwsResourceOrgPaths")
    def if_aws_resource_org_paths(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Use this key to compare the AWS Organizations path for the accessed resource to the path in the policy.

        In a policy, this condition key ensures that the resource belongs to an account member within the specified organization root or organizational units (OUs) in AWS Organizations. An AWS Organizations path is a text representation of the structure of an Organizations entity. For more information about using and understanding paths, see `Understand the AWS Organizations entity path <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor-view-data-orgs.html#access_policies_access-advisor-viewing-orgs-entity-path>`_.

        ``aws:ResourceOrgPaths`` is a multivalued condition key. Multivalued keys can have multiple values in the request context. You must use the ``ForAnyValue`` or ``ForAllValues`` set operators with `string condition operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_ for this key. For more information about multivalued condition keys, see `Using multiple keys and values <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html#reference_policies_multi-key-or-value-conditions>`_.

        **Note:** Some AWS services require access to AWS owned resources that are hosted in another AWS account. Using aws:ResourceOrgPaths in your identity-based policies might impact your identity's ability to access these resources.

        **Availability:** This key is included in the request context only if the account that owns the resource is a member of an organization. This global condition key does not support the following actions:

        - Amazon Elastic Block Store - All actions
        - Amazon EC2

          - ``ec2:CopyFpgaImage``
          - ``ec2:CopyImage``
          - ``ec2:CopySnapshot``
          - ``ec2:CreateTransitGatewayPeeringAttachment``
          - ``ec2:CreateVolume``
          - ``ec2:CreateVpcPeeringConnection``

        - Amazon EventBridge - All actions
        - Amazon WorkSpaces

          - ``workspaces:CopyWorkspaceImage``
          - ``workspaces:DescribeWorkspaceImages``

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourceorgpaths

        :param value: The path of an organization.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0d2164d86c743d4a898e7b372ce9b0f6627f5d715883f8140947f2740d52975e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsResourceOrgPaths", [value, operator]))

    @jsii.member(jsii_name="ifAwsResourceTag")
    def if_aws_resource_tag(
        self,
        key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the tag key-value pair that you specify with the key-value pair that is attached to the resource.

        For example, you could require that access to a resource is allowed only if the resource has the attached tag key ``Dept`` with the value ``Marketing``. For more information, see `Controlling Access to AWS Resources <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html#access_tags_control-resources>`_.

        **Availability:** This key is included in the request context when the requested resource already has attached tags. This key is returned only for resources that `support authorization based on tags <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html>`_. There is one context key for each tag key-value pair.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag

        :param key: The tag key to check.
        :param value: The tag value(s) to check against.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__141746fd17b652e11b2c73b6317d24ae7d324a9901b14fce43386d64f7707c54)
            check_type(argname="argument key", value=key, expected_type=type_hints["key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsResourceTag", [key, value, operator]))

    @jsii.member(jsii_name="ifAwsSecureTransport")
    def if_aws_secure_transport(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Check whether the request was sent using SSL.

        The request context returns ``true`` or ``false``. In a policy, you can allow specific actions only if the request is sent using SSL.

        **Availability:** This key is always included in the request context.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-securetransport

        :param value: Weather request was sent using SSL. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f55d5a2e4666b33d273577cd0f5db4493133bf556a3d9ec173cf432b664a5548)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsSecureTransport", [value]))

    @jsii.member(jsii_name="ifAwsSourceAccount")
    def if_aws_source_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the account ID of the resource making a service-to-service request with the account ID that you specify.

        **Availability:** This key is included in the request context only if accessing a resource triggers an AWS service to call another service on behalf of the resource owner. The calling service must pass the resource ARN of the source to the called service. This ARN includes the source account ID.

        You can use this condition key to check that Amazon S3 is not being used as a `confused deputy <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html#confused-deputy>`_. For example, when an Amazon S3 bucket update triggers an Amazon SNS topic post, the Amazon S3 service invokes the ``sns:Publish`` API operation. The bucket is considered the source of the SNS request and the value of the key is the account ID from the bucket's ARN.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourceaccount

        :param value: The account ID(s).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4eaa633410511f81090082df61a822592a05855c120fc21292c8380c73fa7f74)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsSourceAccount", [value, operator]))

    @jsii.member(jsii_name="ifAwsSourceArn")
    def if_aws_source_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the `Amazon Resource Name (ARN) <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-arns>`_ of the resource making a service-to-service request with the ARN that you specify.

        This key does not work with the ARN of the principal making the request. Instead, use `aws:PrincipalArn <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalarn>`_. The source's ARN includes the account ID, so it is not necessary to use ``aws:SourceAccount`` with ``aws:SourceArn``.

        **Availability:** This key is included in the request context only if accessing a resource triggers an AWS service to call another service on behalf of the resource owner. The calling service must pass the ARN of the original resource to the called service.

        You can use this condition key to check that Amazon S3 is not being used as a `confused deputy <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html#confused-deputy>`_. For example, when an Amazon S3 bucket update triggers an Amazon SNS topic post, the Amazon S3 service invokes the ``sns:Publish`` API operation. The bucket is considered the source of the SNS request and the value of the key is the bucket's ARN.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcearn

        :param value: The source ARN(s).
        :param operator: Works with `ARN operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_ and `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bacc036d62f9cef7c873de6b00f5215910e3ff72382d19d601eb6f2b5dced128)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsSourceArn", [value, operator]))

    @jsii.member(jsii_name="ifAwsSourceIdentity")
    def if_aws_source_identity(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the source identity that was set by the principal with the source identity that you specify in the policy.

        **Availability:** This key is included in the request context after a source identity has been set when a role is assumed using any AWS STS assume-role CLI command, or AWS STS ``AssumeRole`` API operation.

        You can use this key in a policy to allow actions in AWS by principals that have set a source identity when assuming a role. Activity for the role's specified source identity appears in `AWS CloudTrail <https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html#cloudtrail-integration_signin-tempcreds>`_. This makes it easier for administrators to determine who or what performed actions with a role in AWS.

        Unlike `sts:RoleSessionName <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_rolesessionname>`_, after the source identity is set, the value cannot be changed. It is present in the request context for all actions taken by the role. The value persists into subsequent role sessions when you use the session credentials to assume another role. Assuming one role from another is called `role chaining <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-role-chaining>`_.

        The `sts:SourceIdentity <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_sourceidentity>`_ key is present in the request when the principal initially sets a source identity while assuming a role using any AWS STS assume-role CLI command, or AWS STS ``AssumeRole`` API operation. The ``aws:SourceIdentity`` key is present in the request for any actions that are taken with a role session that has a source identity set.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourceidentity

        :param value: The source identity.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d407ee32015418e0e247b4105dd5ace34e3c830908739f643df3ee9b2c195f92)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsSourceIdentity", [value, operator]))

    @jsii.member(jsii_name="ifAwsSourceIp")
    def if_aws_source_ip(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the requester's IP address with the IP address that you specify.

        **Availability:** This key is included in the request context, except when the requester uses a VPC endpoint to make the request.

        The ``aws:SourceIp`` condition key can be used in a policy to allow principals to make requests only from within a specified IP range. However, this policy denies access if an AWS service makes calls on the principal's behalf. In this case, you can use ``aws:SourceIp`` with the `aws:ViaAWSService <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-viaawsservice>`_ key to ensure that the source IP restriction applies only to requests made directly by a principal.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourceip

        :param value: The source IP(s).
        :param operator: Works with IP `address operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_IPAddress>`_. **Default:** ``IpAddress``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9584d23ab9608164ec626e741c1effc7ee2eeb752ddba7ce565b34199c49a376)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsSourceIp", [value, operator]))

    @jsii.member(jsii_name="ifAwsSourceVpc")
    def if_aws_source_vpc(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Check whether the request comes from the VPC that you specify.

        In a policy, you can use this condition to allow access to only a specific VPC. For more information, see `Restricting Access to a Specific VPC <https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies-vpc-endpoint.html#example-bucket-policies-restrict-access-vpc>`_ in the *Amazon Simple Storage Service Developer Guide*.

        **Availability:** This key is included in the request context only if the requester uses a VPC endpoint to make the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcevpc

        :param value: The VPS ID(s).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__26040638818240caee8d929c92f7c94c436e1cfd2db5e6b5b64c61576b83b659)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsSourceVpc", [value, operator]))

    @jsii.member(jsii_name="ifAwsSourceVpce")
    def if_aws_source_vpce(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the VPC endpoint identifier of the request with the endpoint ID that you specify.

        In a policy, you can use this condition to restrict access to a specific VPC endpoint. For more information, see `Restricting Access to a Specific VPC Endpoint <https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies-vpc-endpoint.html#example-bucket-policies-restrict-access-vpc-endpoint>`_ in the *Amazon Simple Storage Service Developer Guide*.

        **Availability:** This key is included in the request context only if the requester uses a VPC endpoint to make the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcevpce

        :param value: The VPC Endpoint ID(s).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5ef8327bfdcd66662814c5334ae63d21ea2df82a97692d188933d79f329866dc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsSourceVpce", [value, operator]))

    @jsii.member(jsii_name="ifAwsTagKeys")
    def if_aws_tag_keys(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the tag keys in a request with the keys that you specify.

        As a best practice when you use policies to control access using tags, use the ``aws:TagKeys`` condition key to define what tag keys are allowed. For example policies and more information, see `Controlling Access Based on Tag Keys <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html#access_tags_control-tag-keys>`_.

        **Availability:** This key is included in the request context only if the operation supports attaching tags to resources.

        Because you can include multiple tag key-value pairs in a request, the request content could be a `multivalued <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html>`_ request. In this case, you should consider using the ``ForAllValues`` or ``ForAnyValue`` set operators. For more information, see Using Multiple Keys and Values.

        Some services support tagging with resource operations, such as creating, modifying, or deleting a resource. To allow tagging and operations as a single call, you must create a policy that includes both the tagging action and the resource-modifying action. You can then use the ``aws:TagKeys`` condition key to enforce using specific tag keys in the request. For example, to limit tags when someone creates an Amazon EC2 snapshot, you must include the ``ec2:CreateSnapshot`` creation action ***and*** the ``ec2:CreateTags`` tagging action in the policy. To view a policy for this scenario that uses ``aws:TagKeys``, see `Creating a Snapshot with Tags <https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-creating-snapshot-with-tags>`_ in the *Amazon EC2 User Guide for Linux Instances*.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-tagkeys

        :param value: The tag key(s).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d95392644fec828e1cc941d232f83bca7047bcc3a3e82f3b058a536fa86bea41)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsTagKeys", [value, operator]))

    @jsii.member(jsii_name="ifAwsTokenIssueTime")
    def if_aws_token_issue_time(
        self,
        value: typing.Union[builtins.str, datetime.datetime],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the date and time that temporary security credentials were issued with the date and time that you specify.

        **Availability:** This key is included in the request context only when the principal uses temporary credentials to make the request. They key is not present in AWS CLI, AWS API, or AWS SDK requests that are made using access keys.

        To learn which services support using temporary credentials, see `AWS Services That Work with IAM <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html>`_.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-tokenissuetime

        :param value: The date and time to check for. Can be a string in one of the `W3C implementations of the ISO 8601 date <https://www.w3.org/TR/NOTE-datetime>`_ (e.g. ``2020-04-01T00:00:00Z``) or in epoch (UNIX) time or a ``Date()`` object (JavaScript only)
        :param operator: Works with `date operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Date>`_. **Default:** ``DateGreaterThanEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__738df271406b1f2b35a9978194656f9d48da9cfb1b44b4fbac3c7985d68d1ae3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsTokenIssueTime", [value, operator]))

    @jsii.member(jsii_name="ifAwsUserAgent")
    def if_aws_user_agent(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the requester's client application with the application that you specify.

        **Availability:** This key is always included in the request context.

        **Warning:** This key should be used carefully. Since the ``aws:UserAgent`` value is provided by the caller in an HTTP header, unauthorized parties can use modified or custom browsers to provide any ``aws:UserAgent`` value that they choose. As a result, ``aws:UserAgent`` should not be used to prevent unauthorized parties from making direct AWS requests. You can use it to allow only specific client applications, and only after testing your policy.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-useragent

        :param value: The User Agent string(s).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c548a90e633ac0af4601910e9ce787666ca4c1afdaf5f2e05ea43f9ea29e52ce)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsUserAgent", [value, operator]))

    @jsii.member(jsii_name="ifAwsUserid")
    def if_aws_userid(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the requester's principal identifier with the ID that you specify.

        For IAM users, the request context value is the user ID. For IAM roles, this value format can vary. For details about how the information appears for different principals, see `Specifying a Principal <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#Principal_specifying>`_.

        **Availability:** This key is included in the request context for all signed requests. Anonymous requests do not include this key.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-userid

        :param value: The principal identifier(s).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c14032c0deddabeedd95074b4df64be980f756f8704ad5d7a9ef7c5693d63770)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsUserid", [value, operator]))

    @jsii.member(jsii_name="ifAwsUsername")
    def if_aws_username(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the requester's user name with the user name that you specify.

        For details about how the information appears for different principals, see `Specifying a Principal <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#Principal_specifying>`_.

        **Availability:** This key is always included in the request context for IAM users. Anonymous requests and requests that are made using the AWS account root user or IAM roles do not include this key.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-username

        :param value: The user name(s).
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c497c2604db3b035f77d501996f9a0c8fb1fda191d301b88edb120660946a71c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsUsername", [value, operator]))

    @jsii.member(jsii_name="ifAwsViaAWSService")
    def if_aws_via_aws_service(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Check whether an AWS service makes a request to another service on your behalf.

        The request context key returns ``true`` when a service uses the credentials of an IAM principal to make a request on behalf of the principal. The context key returns ``false`` if the service uses a `service role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-role>`_ or `service-linked role <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role>`_ to make a call on the principal's behalf. The request context key also returns ``false`` when the principal makes the call directly.

        **Availability:** This key is always included in the request context for most services.

        The following services do not currently support ``aws:ViaAWSService``:

        - Amazon EC2
        - AWS Glue
        - AWS Lake Formation
        - AWS OpsWorks

        You can use this condition key to allow or deny access based on whether a request was made by a service. To view an example policy, see `AWS: Denies Access to AWS Based on the Source IP <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_deny-ip.html>`_.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-viaawsservice

        :param value: Whether a request was made by a service. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b9fde46ecc3d76d3a2a749d75929e8fbdea476b903151216fbf3266d74965ae4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsViaAWSService", [value]))

    @jsii.member(jsii_name="ifAwsVpcSourceIp")
    def if_aws_vpc_source_ip(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "PolicyStatementWithCondition":
        '''(experimental) Compare the IP address from which a request was made with the IP address that you specify.

        In a policy, the key matches only if the request originates from the specified IP address and it goes through a VPC endpoint.

        **Availability:** This key is included in the request context only if the request is made using a VPC endpoint.

        For more information, see `Controlling Access to Services with VPC Endpoints <https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-access.html>`_ in the *Amazon VPC User Guide*.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-vpcsourceip

        :param value: The VPC source IP(s).
        :param operator: Works with IP `address operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_IPAddress>`_. **Default:** ``IpAddress``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a55d20a092f3bb4be0e35fb8b65bdd768ff283f7f34a741a09bd277e1d8bbf83)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("PolicyStatementWithCondition", jsii.invoke(self, "ifAwsVpcSourceIp", [value, operator]))

    @jsii.member(jsii_name="toJSON")
    def to_json(self) -> typing.Any:
        '''(experimental) Injects conditions into the statement.

        Only relevant for the main package. In CDK mode this only calls super.

        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toJSON", []))

    @jsii.member(jsii_name="toStatementJson")
    def to_statement_json(self) -> typing.Any:
        '''
        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toStatementJson", []))

    @builtins.property
    @jsii.member(jsii_name="floydConditions")
    def _floyd_conditions(self) -> Conditions:
        '''
        :stability: experimental
        '''
        return typing.cast(Conditions, jsii.get(self, "floydConditions"))

    @_floyd_conditions.setter
    def _floyd_conditions(self, value: Conditions) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__abaef68aa342dc89c1ebbb4ffb5fc88ebbc118aadb78f2db4f0d1b8aa84ec536)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "floydConditions", value)


@jsii.data_type(
    jsii_type="iam-floyd.Principals",
    jsii_struct_bases=[],
    name_mapping={},
)
class Principals:
    def __init__(self) -> None:
        '''(experimental) A collection of Principal's.

        :stability: experimental
        '''
        self._values: typing.Dict[builtins.str, typing.Any] = {}

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "Principals(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


@jsii.data_type(
    jsii_type="iam-floyd.ResourceTypes",
    jsii_struct_bases=[],
    name_mapping={},
)
class ResourceTypes:
    def __init__(self) -> None:
        '''
        :stability: experimental
        '''
        self._values: typing.Dict[builtins.str, typing.Any] = {}

    def __eq__(self, rhs: typing.Any) -> builtins.bool:
        return isinstance(rhs, self.__class__) and rhs._values == self._values

    def __ne__(self, rhs: typing.Any) -> builtins.bool:
        return not (rhs == self)

    def __repr__(self) -> str:
        return "ResourceTypes(%s)" % ", ".join(
            k + "=" + repr(v) for k, v in self._values.items()
        )


class PolicyStatementWithActions(
    PolicyStatementWithCondition,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.PolicyStatementWithActions",
):
    '''(experimental) Adds "action" functionality to the Policy Statement.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''
        :param sid: -

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__093d23988cc4ea975381aa62cf894828b269ca1dec2f78c8f11bd47a174fc179)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="allActions")
    def all_actions(self) -> "PolicyStatementWithActions":
        '''(experimental) Adds all actions of the statement provider to the statement, e.g. ``actions: 'ec2:*'``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithActions", jsii.invoke(self, "allActions", []))

    @jsii.member(jsii_name="allListActions")
    def all_list_actions(self) -> "PolicyStatementWithActions":
        '''(experimental) Adds all actions with `access level <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_understand-policy-summary-access-level-summaries.html#access_policies_access-level>`_ LIST to the statement.

        Permission to list resources within the service to determine whether an object exists.

        Actions with this level of access can list objects but cannot see the contents of a resource.

        For example, the Amazon S3 action ``ListBucket`` has the List access level.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithActions", jsii.invoke(self, "allListActions", []))

    @jsii.member(jsii_name="allMatchingActions")
    def all_matching_actions(
        self,
        *expressions: builtins.str,
    ) -> "PolicyStatementWithActions":
        '''(experimental) Adds all actions that match one of the given regular expressions.

        :param expressions: One or more regular expressions. The regular expressions need to be in `Perl/JavaScript literal style <https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions>`_ and need to be passed as strings, For example:: allMatchingActions('/vpn/i')

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0e661ada3b2bce9f47803c1fedb5fd7f294305c15395106cc09b9f2879946aa8)
            check_type(argname="argument expressions", value=expressions, expected_type=typing.Tuple[type_hints["expressions"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("PolicyStatementWithActions", jsii.invoke(self, "allMatchingActions", [*expressions]))

    @jsii.member(jsii_name="allPermissionManagementActions")
    def all_permission_management_actions(self) -> "PolicyStatementWithActions":
        '''(experimental) Adds all actions with `access level <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_understand-policy-summary-access-level-summaries.html#access_policies_access-level>`_ PERMISSION MANAGEMENT to the statement.

        Permission to grant or modify resource permissions in the service.

        For example, most IAM and AWS Organizations actions, as well as actions like the Amazon S3 actions ``PutBucketPolicy`` and ``DeleteBucketPolicy`` have the Permissions management access level.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithActions", jsii.invoke(self, "allPermissionManagementActions", []))

    @jsii.member(jsii_name="allReadActions")
    def all_read_actions(self) -> "PolicyStatementWithActions":
        '''(experimental) Adds all actions with `access level <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_understand-policy-summary-access-level-summaries.html#access_policies_access-level>`_ READ to the statement.

        Permission to read but not edit the contents and attributes of resources in the service.

        For example, the Amazon S3 actions ``GetObject`` and ``GetBucketLocation`` have the Read access level.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithActions", jsii.invoke(self, "allReadActions", []))

    @jsii.member(jsii_name="allTaggingActions")
    def all_tagging_actions(self) -> "PolicyStatementWithActions":
        '''(experimental) Adds all actions with `access level <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_understand-policy-summary-access-level-summaries.html#access_policies_access-level>`_ TAGGING to the statement.

        Permission to perform actions that only change the state of resource tags.

        For example, the IAM actions ``TagRole`` and ``UntagRole`` have the Tagging access level because they allow only tagging or untagging a role. However, the ``CreateRole`` action allows tagging a role resource when you create that role. Because the action does not only add a tag, it has the Write access level.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithActions", jsii.invoke(self, "allTaggingActions", []))

    @jsii.member(jsii_name="allWriteActions")
    def all_write_actions(self) -> "PolicyStatementWithActions":
        '''(experimental) Adds all actions with `access level <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_understand-policy-summary-access-level-summaries.html#access_policies_access-level>`_ WRITE to the statement.

        Permission to create, delete, or modify resources in the service.

        For example, the Amazon S3 actions ``CreateBucket``, ``DeleteBucket`` and ``PutObject`` have the Write access level.

        Write actions might also allow modifying a resource tag. However, an action that allows only changes to tags has the Tagging access level.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithActions", jsii.invoke(self, "allWriteActions", []))

    @jsii.member(jsii_name="compact")
    def compact(self) -> "PolicyStatementWithActions":
        '''(experimental) Condense action list down to a list of patterns.

        Using this method can help to reduce the policy size.

        For example, all actions with access level ``list`` could be reduced to a small pattern ``List*``.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithActions", jsii.invoke(self, "compact", []))

    @jsii.member(jsii_name="freeze")
    def freeze(self) -> typing.Any:
        '''
        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "freeze", []))

    @jsii.member(jsii_name="hasActions")
    def has_actions(self) -> builtins.bool:
        '''(experimental) Checks weather actions have been applied to the policy.

        :stability: experimental
        '''
        return typing.cast(builtins.bool, jsii.invoke(self, "hasActions", []))

    @jsii.member(jsii_name="notAction")
    def not_action(self) -> "PolicyStatementWithActions":
        '''(experimental) Switches the statement to use ```NotAction`` <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notaction.html>`_.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithActions", jsii.invoke(self, "notAction", []))

    @jsii.member(jsii_name="to")
    def to(self, action: builtins.str) -> "PolicyStatementWithActions":
        '''(experimental) Adds actions by name.

        Depending on the "mode", actions will be either added to the list of ```Actions`` <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_action.html>`_ or ```NotAction`` <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notaction.html>`_.

        The mode can be switched by calling ``notAction()``.

        If the action does not contain a colon, the action will be prefixed with the service prefix of the class, e.g. ``ec2:``

        :param action: Actions that will be added to the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4bb088cb4d336ef7471f543ab978ff56b4dec26240ac0d6855c79f8304213e6e)
            check_type(argname="argument action", value=action, expected_type=type_hints["action"])
        return typing.cast("PolicyStatementWithActions", jsii.invoke(self, "to", [action]))

    @jsii.member(jsii_name="toJSON")
    def to_json(self) -> typing.Any:
        '''(experimental) Injects actions into the statement.

        Only relevant for the main package. In CDK mode this only calls super.

        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toJSON", []))

    @jsii.member(jsii_name="toStatementJson")
    def to_statement_json(self) -> typing.Any:
        '''
        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toStatementJson", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__70bc750a316df6c18f2ef1b9639d5bee3924253038f53441ec16e0ad872ccb57)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="floydActions")
    def _floyd_actions(self) -> typing.List[builtins.str]:
        '''
        :stability: experimental
        '''
        return typing.cast(typing.List[builtins.str], jsii.get(self, "floydActions"))

    @_floyd_actions.setter
    def _floyd_actions(self, value: typing.List[builtins.str]) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__88771298f7f17a0d0acdf694dbed722afd6140718bc02cc6ef2e154b60feb663)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "floydActions", value)


class PolicyStatementWithResources(
    PolicyStatementWithActions,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.PolicyStatementWithResources",
):
    '''(experimental) Adds "resource" functionality to the Policy Statement.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''
        :param sid: -

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__71418682b5c967665f77f3b181e1c66f722c341d76aa545c6ce78362360697e7)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="freeze")
    def freeze(self) -> typing.Any:
        '''
        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "freeze", []))

    @jsii.member(jsii_name="hasResources")
    def has_resources(self) -> builtins.bool:
        '''(experimental) Checks weather any resource was applied to the policy.

        :stability: experimental
        '''
        return typing.cast(builtins.bool, jsii.invoke(self, "hasResources", []))

    @jsii.member(jsii_name="notResource")
    def not_resource(self) -> "PolicyStatementWithResources":
        '''(experimental) Switches the statement to use ```NotResource`` <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notresource.html>`_.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithResources", jsii.invoke(self, "notResource", []))

    @jsii.member(jsii_name="on")
    def on(self, *arns: builtins.str) -> "PolicyStatementWithResources":
        '''(experimental) Limit statement to specified resources.

        To allow all resources, pass ``*``

        :param arns: -

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__289ffa51b0659b40c0a36d5a3eefc470307d1fe178d5dc6f89cc3e0aa6ff72ae)
            check_type(argname="argument arns", value=arns, expected_type=typing.Tuple[type_hints["arns"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("PolicyStatementWithResources", jsii.invoke(self, "on", [*arns]))

    @jsii.member(jsii_name="onAllResources")
    def on_all_resources(self) -> "PolicyStatementWithResources":
        '''(experimental) Add all resources (``*``) to the statement.

        This is the default behavior, unless the statement has principals.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithResources", jsii.invoke(self, "onAllResources", []))

    @jsii.member(jsii_name="toJSON")
    def to_json(self) -> typing.Any:
        '''(experimental) Injects resources into the statement.

        Only relevant for the main package. In CDK mode this only calls super.

        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toJSON", []))

    @jsii.member(jsii_name="toStatementJson")
    def to_statement_json(self) -> typing.Any:
        '''
        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toStatementJson", []))

    @builtins.property
    @jsii.member(jsii_name="floydResources")
    def _floyd_resources(self) -> typing.List[builtins.str]:
        '''
        :stability: experimental
        '''
        return typing.cast(typing.List[builtins.str], jsii.get(self, "floydResources"))

    @_floyd_resources.setter
    def _floyd_resources(self, value: typing.List[builtins.str]) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4e34071d28c632daa6cd6a4c16a335070f5fc62110d1e3324fe697a18d76aea8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "floydResources", value)

    @builtins.property
    @jsii.member(jsii_name="skipAutoResource")
    def _skip_auto_resource(self) -> builtins.bool:
        '''
        :stability: experimental
        '''
        return typing.cast(builtins.bool, jsii.get(self, "skipAutoResource"))

    @_skip_auto_resource.setter
    def _skip_auto_resource(self, value: builtins.bool) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__845a5aa0ae395783f65395d684d175028e27e3a75b802ca3d9db219d736109cc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "skipAutoResource", value)


class PolicyStatementWithEffect(
    PolicyStatementWithResources,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.PolicyStatementWithEffect",
):
    '''(experimental) Adds "effect" functionality to the Policy Statement.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''
        :param sid: -

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4465fee9053bdfe4b149fdc083264e021432dc42d93a3959546cd8bd1e0aa16b)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="allow")
    def allow(self) -> "PolicyStatementWithEffect":
        '''(experimental) Allow the actions in this statement.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithEffect", jsii.invoke(self, "allow", []))

    @jsii.member(jsii_name="deny")
    def deny(self) -> "PolicyStatementWithEffect":
        '''(experimental) Deny the actions in this statement.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithEffect", jsii.invoke(self, "deny", []))

    @jsii.member(jsii_name="toJSON")
    def to_json(self) -> typing.Any:
        '''(experimental) Injects effect into the statement.

        Only relevant for the main package. In CDK mode this only calls super.

        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toJSON", []))

    @builtins.property
    @jsii.member(jsii_name="effect")
    def effect(self) -> Effect:
        '''
        :stability: experimental
        '''
        return typing.cast(Effect, jsii.get(self, "effect"))

    @effect.setter
    def effect(self, value: Effect) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__94441803d0dbeb3dfea7eae55172786aa200b4c86b577219f659c77e12785cb1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "effect", value)


class PolicyStatementWithPrincipal(
    PolicyStatementWithEffect,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.PolicyStatementWithPrincipal",
):
    '''(experimental) Adds "principal" functionality to the Policy Statement.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''
        :param sid: -

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1a3cff3121729641292e305bd0d07adb5b3b38720476d80db35c4e1fd9b9ff8f)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="addPrincipal")
    def _add_principal(
        self,
        prefix: builtins.str,
        principal: builtins.str,
    ) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds a principal to the statement.

        :param prefix: One of **AWS**, **Federated**, **CanonicalUser** or **Service**.
        :param principal: The principal string.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0f43da71badcc29a12f8a9ee1b7f26b46fbfaf282916e4d10bc0ba7099d9d9f1)
            check_type(argname="argument prefix", value=prefix, expected_type=type_hints["prefix"])
            check_type(argname="argument principal", value=principal, expected_type=type_hints["principal"])
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "addPrincipal", [prefix, principal]))

    @jsii.member(jsii_name="cdkApplyPrincipals")
    def _cdk_apply_principals(self) -> None:
        '''
        :stability: experimental
        '''
        return typing.cast(None, jsii.invoke(self, "cdkApplyPrincipals", []))

    @jsii.member(jsii_name="for")
    def for_(
        self,
        arn: builtins.str,
        prefix: typing.Optional[builtins.str] = None,
    ) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds any principal to the statement.

        :param arn: The ARN of the principal.
        :param prefix: One of **AWS**, **Federated**, **CanonicalUser** or **Service** - Default: **AWS**.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c6aa5866d7483abcba1edab3f1753719c023644bddc35894c623579a08b9f6e7)
            check_type(argname="argument arn", value=arn, expected_type=type_hints["arn"])
            check_type(argname="argument prefix", value=prefix, expected_type=type_hints["prefix"])
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "for", [arn, prefix]))

    @jsii.member(jsii_name="forAccount")
    def for_account(self, *accounts: builtins.str) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds one or more account principals to the statement.

        :param accounts: ID of the AWS account.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__11f7611db3676293bae1562dfb78f937406ef384ea68773e9070c46deed9cb55)
            check_type(argname="argument accounts", value=accounts, expected_type=typing.Tuple[type_hints["accounts"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forAccount", [*accounts]))

    @jsii.member(jsii_name="forAssumedRoleSession")
    def for_assumed_role_session(
        self,
        account: builtins.str,
        role_name: builtins.str,
        *session_names: builtins.str,
    ) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds one or more specific assumed role session principals to the statement.

        :param account: ID of the AWS account.
        :param role_name: Name of the IAM role.
        :param session_names: Name of the session. You cannot use a wildcard (``*``) to mean *all sessions*. Principals must always name a specific session

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5177533b9df3edb2f58583f5b3da6024a5d7ff4e650d527ef4b6e9813bf399bf)
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument role_name", value=role_name, expected_type=type_hints["role_name"])
            check_type(argname="argument session_names", value=session_names, expected_type=typing.Tuple[type_hints["session_names"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forAssumedRoleSession", [account, role_name, *session_names]))

    @jsii.member(jsii_name="forCanonicalUser")
    def for_canonical_user(
        self,
        *user_i_ds: builtins.str,
    ) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds one or more canonical user principals to the statement.

        :param user_i_ds: The user ID. You can `find the canonical user ID <https://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html#FindingCanonicalId>`_ for your AWS account in the AWS Management Console. The canonical user ID for an AWS account is specific to the account. You can retrieve the canonical user ID for your AWS account as either the root user or an IAM user.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__46f209a44ea976f720f05020848956383e7c02a0ee28eaec9e6f0e26a4ef11f9)
            check_type(argname="argument user_i_ds", value=user_i_ds, expected_type=typing.Tuple[type_hints["user_i_ds"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forCanonicalUser", [*user_i_ds]))

    @jsii.member(jsii_name="forFederated")
    def for_federated(self, *providers: builtins.str) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds one or more `federated <https://aws.amazon.com/identity/federation/>`_ (web identity) principals to the statement.

        :param providers: ID of the AWS account.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a398adb2e076db82229943e33f593b9571a89fceddadbe48258788e64c88fcd5)
            check_type(argname="argument providers", value=providers, expected_type=typing.Tuple[type_hints["providers"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forFederated", [*providers]))

    @jsii.member(jsii_name="forFederatedAmazon")
    def for_federated_amazon(self) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds a federated `Amazon <https://login.amazon.com/>`_ principal to the statement.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forFederatedAmazon", []))

    @jsii.member(jsii_name="forFederatedCognito")
    def for_federated_cognito(self) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds a federated `AWS Cognito <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc_cognito.html>`_ principal to the statement.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forFederatedCognito", []))

    @jsii.member(jsii_name="forFederatedFacebook")
    def for_federated_facebook(self) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds a federated `Facebook <https://developers.facebook.com/docs/facebook-login>`_ principal to the statement.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forFederatedFacebook", []))

    @jsii.member(jsii_name="forFederatedGoogle")
    def for_federated_google(self) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds a federated `Google <https://developers.google.com/identity/protocols/oauth2/openid-connect>`_ principal to the statement.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forFederatedGoogle", []))

    @jsii.member(jsii_name="forPublic")
    def for_public(self) -> "PolicyStatementWithPrincipal":
        '''(experimental) Grants public asses.

        **EVERYONE IN THE WORLD HAS ACCESS**

        We strongly recommend that you do not use a wildcard in the Principal element in a role's trust policy unless you otherwise restrict access through a Condition element in the policy. Otherwise, any IAM user in any account in your partition can access the role.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forPublic", []))

    @jsii.member(jsii_name="forRole")
    def for_role(
        self,
        account: builtins.str,
        *roles: builtins.str,
    ) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds one or more IAM role principals to the statement.

        :param account: ID of the AWS account.
        :param roles: Name of the IAM role.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__52b4d0ac664eb61a852b4dcc26d9023f222abe7307e0f1a3983eaf871d2b05b0)
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument roles", value=roles, expected_type=typing.Tuple[type_hints["roles"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forRole", [account, *roles]))

    @jsii.member(jsii_name="forSaml")
    def for_saml(
        self,
        account: builtins.str,
        *provider_names: builtins.str,
    ) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds one or more federated SAML principals to the statement.

        :param account: ID of the AWS account.
        :param provider_names: Name of the SAML provider.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__98209c9cd4748c3e32123aa1c26a1a628553387024bb9eafd66c7e9be61ab55d)
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument provider_names", value=provider_names, expected_type=typing.Tuple[type_hints["provider_names"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forSaml", [account, *provider_names]))

    @jsii.member(jsii_name="forService")
    def for_service(self, *services: builtins.str) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds one or more service principals to the statement.

        :param services: Long version of the service name. Usually in the format: ``long_service-name.amazonaws.com``. The service principal is defined by the service. To learn the service principal for a service, see the documentation for that service. For some services, see `AWS Services That Work with IAM <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html>`_ and look for the services that have **Yes** in the **Service-Linked Role** column. Choose a **Yes** with a link to view the service-linked role documentation for that service. View the **Service-Linked Role Permissions** section for that service to view the service principal.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e17956887090b4bfb55fcf8ddc8caa37832e121a7a2f06ee5d1b50ef2c2727dc)
            check_type(argname="argument services", value=services, expected_type=typing.Tuple[type_hints["services"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forService", [*services]))

    @jsii.member(jsii_name="forUser")
    def for_user(
        self,
        account: builtins.str,
        *users: builtins.str,
    ) -> "PolicyStatementWithPrincipal":
        '''(experimental) Adds one or more IAM user principals to the statement.

        :param account: ID of the AWS account.
        :param users: Name of the IAM user.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fbbd754f3c05dc4e15cc9c7b3a99afcc314e434bf8c8ac4ea9d016c03509ff4f)
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument users", value=users, expected_type=typing.Tuple[type_hints["users"], ...]) # pyright: ignore [reportGeneralTypeIssues]
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "forUser", [account, *users]))

    @jsii.member(jsii_name="freeze")
    def freeze(self) -> typing.Any:
        '''
        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "freeze", []))

    @jsii.member(jsii_name="hasPrincipals")
    def has_principals(self) -> builtins.bool:
        '''(experimental) Checks weather a principal was applied to the policy.

        :stability: experimental
        '''
        return typing.cast(builtins.bool, jsii.invoke(self, "hasPrincipals", []))

    @jsii.member(jsii_name="notPrincipal")
    def not_principal(self) -> "PolicyStatementWithPrincipal":
        '''(experimental) Switches the statement to use ```notPrincipal`` <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notprincipal.html>`_.

        :stability: experimental
        '''
        return typing.cast("PolicyStatementWithPrincipal", jsii.invoke(self, "notPrincipal", []))

    @jsii.member(jsii_name="toJSON")
    def to_json(self) -> typing.Any:
        '''(experimental) Injects principals into the statement.

        Only relevant for the main package. In CDK mode this only calls super.

        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toJSON", []))

    @jsii.member(jsii_name="toStatementJson")
    def to_statement_json(self) -> typing.Any:
        '''
        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toStatementJson", []))

    @builtins.property
    @jsii.member(jsii_name="myPrincipals")
    def _my_principals(self) -> Principals:
        '''
        :stability: experimental
        '''
        return typing.cast(Principals, jsii.get(self, "myPrincipals"))

    @_my_principals.setter
    def _my_principals(self, value: Principals) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__975d6c3b1ffe9cc28a898caebcec4a48a6e0205dceb7df1b9dbcafaa4caa92cd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "myPrincipals", value)

    @builtins.property
    @jsii.member(jsii_name="useNotPrincipal")
    def _use_not_principal(self) -> builtins.bool:
        '''
        :stability: experimental
        '''
        return typing.cast(builtins.bool, jsii.get(self, "useNotPrincipal"))

    @_use_not_principal.setter
    def _use_not_principal(self, value: builtins.bool) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0446e0f0791a09b6cb0e75e4afb14085c1f32aeca22b06564a6641a25a8dc48d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "useNotPrincipal", value)


class PolicyStatement(
    PolicyStatementWithPrincipal,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.PolicyStatement",
):
    '''(experimental) Represents a statement in an IAM policy document.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''
        :param sid: -

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__41bafffffee539105d25c03dc13e5d345febb0f4eaf59cb4132893d8763157dd)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toJSON")
    def to_json(self) -> typing.Any:
        '''(experimental) JSON-ify the policy statement.

        :stability: experimental
        '''
        return typing.cast(typing.Any, jsii.invoke(self, "toJSON", []))

    @builtins.property
    @jsii.member(jsii_name="cdkApplied")
    def _cdk_applied(self) -> builtins.bool:
        '''
        :stability: experimental
        '''
        return typing.cast(builtins.bool, jsii.get(self, "cdkApplied"))

    @_cdk_applied.setter
    def _cdk_applied(self, value: builtins.bool) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d71f9438f8164fef39daa58b6e821bdef745c5794c99f571912c94dc5bcd942c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "cdkApplied", value)


class Polly(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Polly"):
    '''(experimental) Statement provider for service `polly <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpolly.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `polly <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpolly.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__20b69a7493c8c6f609b89c4f159face2081504633fc70f61dc30c6914495f2e3)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onLexicon")
    def on_lexicon(
        self,
        lexicon_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Polly":
        '''(experimental) Adds a resource of type lexicon to the statement.

        https://docs.aws.amazon.com/polly/latest/dg/managing-lexicons.html

        :param lexicon_name: - Identifier for the lexiconName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bb7da2da458aba491da64d937f36a87bc1fb4f6a35eaa814d665a979902753b8)
            check_type(argname="argument lexicon_name", value=lexicon_name, expected_type=type_hints["lexicon_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Polly", jsii.invoke(self, "onLexicon", [lexicon_name, account, region, partition]))

    @jsii.member(jsii_name="toDeleteLexicon")
    def to_delete_lexicon(self) -> "Polly":
        '''(experimental) Grants permission to delete the specified pronunciation lexicon stored in an AWS Region.

        Access Level: Write

        https://docs.aws.amazon.com/polly/latest/dg/API_DeleteLexicon.html

        :stability: experimental
        '''
        return typing.cast("Polly", jsii.invoke(self, "toDeleteLexicon", []))

    @jsii.member(jsii_name="toDescribeVoices")
    def to_describe_voices(self) -> "Polly":
        '''(experimental) Grants permission to describe the list of voices that are available for use when requesting speech synthesis.

        Access Level: List

        https://docs.aws.amazon.com/polly/latest/dg/API_DescribeVoices.html

        :stability: experimental
        '''
        return typing.cast("Polly", jsii.invoke(self, "toDescribeVoices", []))

    @jsii.member(jsii_name="toGetLexicon")
    def to_get_lexicon(self) -> "Polly":
        '''(experimental) Grants permission to retrieve the content of the specified pronunciation lexicon stored in an AWS Region.

        Access Level: Read

        https://docs.aws.amazon.com/polly/latest/dg/API_GetLexicon.html

        :stability: experimental
        '''
        return typing.cast("Polly", jsii.invoke(self, "toGetLexicon", []))

    @jsii.member(jsii_name="toGetSpeechSynthesisTask")
    def to_get_speech_synthesis_task(self) -> "Polly":
        '''(experimental) Grants permission to get information about specific speech synthesis task.

        Access Level: Read

        https://docs.aws.amazon.com/polly/latest/dg/API_GetSpeechSynthesisTask.html

        :stability: experimental
        '''
        return typing.cast("Polly", jsii.invoke(self, "toGetSpeechSynthesisTask", []))

    @jsii.member(jsii_name="toListLexicons")
    def to_list_lexicons(self) -> "Polly":
        '''(experimental) Grants permission to list the pronunciation lexicons stored in an AWS Region.

        Access Level: List

        https://docs.aws.amazon.com/polly/latest/dg/API_ListLexicons.html

        :stability: experimental
        '''
        return typing.cast("Polly", jsii.invoke(self, "toListLexicons", []))

    @jsii.member(jsii_name="toListSpeechSynthesisTasks")
    def to_list_speech_synthesis_tasks(self) -> "Polly":
        '''(experimental) Grants permission to list requested speech synthesis tasks.

        Access Level: List

        https://docs.aws.amazon.com/polly/latest/dg/API_ListSpeechSynthesisTasks.html

        :stability: experimental
        '''
        return typing.cast("Polly", jsii.invoke(self, "toListSpeechSynthesisTasks", []))

    @jsii.member(jsii_name="toPutLexicon")
    def to_put_lexicon(self) -> "Polly":
        '''(experimental) Grants permission to store a pronunciation lexicon in an AWS Region.

        Access Level: Write

        https://docs.aws.amazon.com/polly/latest/dg/API_PutLexicon.html

        :stability: experimental
        '''
        return typing.cast("Polly", jsii.invoke(self, "toPutLexicon", []))

    @jsii.member(jsii_name="toStartSpeechSynthesisTask")
    def to_start_speech_synthesis_task(self) -> "Polly":
        '''(experimental) Grants permission to synthesize long inputs to the provided S3 location.

        Access Level: Write

        Dependent actions:

        - s3:PutObject

        https://docs.aws.amazon.com/polly/latest/dg/API_StartSpeechSynthesisTask.html

        :stability: experimental
        '''
        return typing.cast("Polly", jsii.invoke(self, "toStartSpeechSynthesisTask", []))

    @jsii.member(jsii_name="toSynthesizeSpeech")
    def to_synthesize_speech(self) -> "Polly":
        '''(experimental) Grants permission to synthesize speech.

        Access Level: Read

        https://docs.aws.amazon.com/polly/latest/dg/API_SynthesizeSpeech.html

        :stability: experimental
        '''
        return typing.cast("Polly", jsii.invoke(self, "toSynthesizeSpeech", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__85dbfdae27012d6f5e7725efc8a274ee01ee8d1ddd42dce7175ad9e040c16966)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fffd147f444775c264f07ca6ebb9b8f1b02ce6d6a595c539c3238891ee1331e5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Pricing(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Pricing"):
    '''(experimental) Statement provider for service `pricing <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awspricelist.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `pricing <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awspricelist.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4b0c9aff2ca48a23be2ef2fd56f4d823682698da291a78d4b6ca70417046ebc7)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toDescribeServices")
    def to_describe_services(self) -> "Pricing":
        '''(experimental) Grants permission to retrieve service details for all (paginated) services (if serviceCode is not set) or service detail for a particular service (if given serviceCode).

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_pricing_DescribeServices.html

        :stability: experimental
        '''
        return typing.cast("Pricing", jsii.invoke(self, "toDescribeServices", []))

    @jsii.member(jsii_name="toGetAttributeValues")
    def to_get_attribute_values(self) -> "Pricing":
        '''(experimental) Grants permission to retrieve all (paginated) possible values for a given attribute.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_pricing_GetAttributeValues.html

        :stability: experimental
        '''
        return typing.cast("Pricing", jsii.invoke(self, "toGetAttributeValues", []))

    @jsii.member(jsii_name="toGetPriceListFileUrl")
    def to_get_price_list_file_url(self) -> "Pricing":
        '''(experimental) Grants permission to retrieve the price list file URL for the given parameters.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_pricing_GetPriceListFileUrl.html

        :stability: experimental
        '''
        return typing.cast("Pricing", jsii.invoke(self, "toGetPriceListFileUrl", []))

    @jsii.member(jsii_name="toGetProducts")
    def to_get_products(self) -> "Pricing":
        '''(experimental) Grants permission to retrieve all matching products with given search criteria.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_pricing_GetProducts.html

        :stability: experimental
        '''
        return typing.cast("Pricing", jsii.invoke(self, "toGetProducts", []))

    @jsii.member(jsii_name="toListPriceLists")
    def to_list_price_lists(self) -> "Pricing":
        '''(experimental) Grants permission to list all (paginated) eligible price lists for the given parameters.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_pricing_ListPriceLists.html

        :stability: experimental
        '''
        return typing.cast("Pricing", jsii.invoke(self, "toListPriceLists", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0b410851fc6dd6a5be90a3ac3510040d03363efac4412a16e2e752db488cb584)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e8ff737b4ab33bfbf661818c732a7d9cbf2cb904f9847356e442ec135f7d87b3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class PrivateNetworks(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.PrivateNetworks",
):
    '''(experimental) Statement provider for service `private-networks <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsserviceprovidingmanagedprivatenetworks.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `private-networks <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsserviceprovidingmanagedprivatenetworks.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__baccef44bf8dc7cfae1350b6d0c0287848d486387725dc69566dec5f0b83f6b4)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDeviceIdentifier")
    def on_device_identifier(
        self,
        network_name: builtins.str,
        device_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "PrivateNetworks":
        '''(experimental) Adds a resource of type device-identifier to the statement.

        https://docs.aws.amazon.com/private-networks/latest/userguide/identity-access-management.html

        :param network_name: - Identifier for the networkName.
        :param device_id: - Identifier for the deviceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8f673f1ba37433ce3f65d2654ff2f7b57c850769ba348dec778eac9ee88186ef)
            check_type(argname="argument network_name", value=network_name, expected_type=type_hints["network_name"])
            check_type(argname="argument device_id", value=device_id, expected_type=type_hints["device_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("PrivateNetworks", jsii.invoke(self, "onDeviceIdentifier", [network_name, device_id, account, region, partition]))

    @jsii.member(jsii_name="onNetwork")
    def on_network(
        self,
        network_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "PrivateNetworks":
        '''(experimental) Adds a resource of type network to the statement.

        https://docs.aws.amazon.com/private-networks/latest/userguide/identity-access-management.html

        :param network_name: - Identifier for the networkName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__84b89780d71ba72dda333b6deab64b907536a908a1747f1112328e99b0c0bbe6)
            check_type(argname="argument network_name", value=network_name, expected_type=type_hints["network_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("PrivateNetworks", jsii.invoke(self, "onNetwork", [network_name, account, region, partition]))

    @jsii.member(jsii_name="onNetworkResource")
    def on_network_resource(
        self,
        network_name: builtins.str,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "PrivateNetworks":
        '''(experimental) Adds a resource of type network-resource to the statement.

        https://docs.aws.amazon.com/private-networks/latest/userguide/identity-access-management.html

        :param network_name: - Identifier for the networkName.
        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a54334d8aec7668ec473d7c5169485e82ee39df5603b53f1de0d16335f37b564)
            check_type(argname="argument network_name", value=network_name, expected_type=type_hints["network_name"])
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("PrivateNetworks", jsii.invoke(self, "onNetworkResource", [network_name, resource_id, account, region, partition]))

    @jsii.member(jsii_name="onNetworkSite")
    def on_network_site(
        self,
        network_name: builtins.str,
        network_site_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "PrivateNetworks":
        '''(experimental) Adds a resource of type network-site to the statement.

        https://docs.aws.amazon.com/private-networks/latest/userguide/identity-access-management.html

        :param network_name: - Identifier for the networkName.
        :param network_site_name: - Identifier for the networkSiteName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__24ba70bd44af487912a7feff466b6ae9ad6684a8c546affb2fb209624f99fbfe)
            check_type(argname="argument network_name", value=network_name, expected_type=type_hints["network_name"])
            check_type(argname="argument network_site_name", value=network_site_name, expected_type=type_hints["network_site_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("PrivateNetworks", jsii.invoke(self, "onNetworkSite", [network_name, network_site_name, account, region, partition]))

    @jsii.member(jsii_name="onOrder")
    def on_order(
        self,
        network_name: builtins.str,
        order_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "PrivateNetworks":
        '''(experimental) Adds a resource of type order to the statement.

        https://docs.aws.amazon.com/private-networks/latest/userguide/identity-access-management.html

        :param network_name: - Identifier for the networkName.
        :param order_id: - Identifier for the orderId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6da6913535d67ef2f293d2eaba8b7efd8679f083be4ef8d8032265248ea4cedc)
            check_type(argname="argument network_name", value=network_name, expected_type=type_hints["network_name"])
            check_type(argname="argument order_id", value=order_id, expected_type=type_hints["order_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("PrivateNetworks", jsii.invoke(self, "onOrder", [network_name, order_id, account, region, partition]))

    @jsii.member(jsii_name="toAcknowledgeOrderReceipt")
    def to_acknowledge_order_receipt(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to acknowledge that an order has been received.

        Access Level: Write

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_AcknowledgeOrderReceipt.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toAcknowledgeOrderReceipt", []))

    @jsii.member(jsii_name="toActivateDeviceIdentifier")
    def to_activate_device_identifier(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to activate a device identifier.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_ActivateDeviceIdentifier.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toActivateDeviceIdentifier", []))

    @jsii.member(jsii_name="toActivateNetworkSite")
    def to_activate_network_site(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to activate a network site.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_ActivateNetworkSite.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toActivateNetworkSite", []))

    @jsii.member(jsii_name="toConfigureAccessPoint")
    def to_configure_access_point(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to configure an access point.

        Access Level: Write

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_ConfigureAccessPoint.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toConfigureAccessPoint", []))

    @jsii.member(jsii_name="toCreateNetwork")
    def to_create_network(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to create a network.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_CreateNetwork.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toCreateNetwork", []))

    @jsii.member(jsii_name="toCreateNetworkSite")
    def to_create_network_site(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to create a network site.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_CreateNetworkSite.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toCreateNetworkSite", []))

    @jsii.member(jsii_name="toDeactivateDeviceIdentifier")
    def to_deactivate_device_identifier(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to deactivate a device identifier.

        Access Level: Write

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_DeactivateDeviceIdentifier.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toDeactivateDeviceIdentifier", []))

    @jsii.member(jsii_name="toDeleteNetwork")
    def to_delete_network(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to delete a network.

        Access Level: Write

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_DeleteNetwork.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toDeleteNetwork", []))

    @jsii.member(jsii_name="toDeleteNetworkSite")
    def to_delete_network_site(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to delete a network site.

        Access Level: Write

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_DeleteNetworkSite.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toDeleteNetworkSite", []))

    @jsii.member(jsii_name="toGetDeviceIdentifier")
    def to_get_device_identifier(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to get a device identifier.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_GetDeviceIdentifier.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toGetDeviceIdentifier", []))

    @jsii.member(jsii_name="toGetNetwork")
    def to_get_network(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to get a network.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_GetNetwork.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toGetNetwork", []))

    @jsii.member(jsii_name="toGetNetworkResource")
    def to_get_network_resource(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to get a network resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_GetNetworkResource.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toGetNetworkResource", []))

    @jsii.member(jsii_name="toGetNetworkSite")
    def to_get_network_site(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to get a network site.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_GetNetworkSite.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toGetNetworkSite", []))

    @jsii.member(jsii_name="toGetOrder")
    def to_get_order(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to get a network order.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_GetOrder.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toGetOrder", []))

    @jsii.member(jsii_name="toListDeviceIdentifiers")
    def to_list_device_identifiers(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to list device identifiers.

        Access Level: List

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_ListDeviceIdentifiers.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toListDeviceIdentifiers", []))

    @jsii.member(jsii_name="toListNetworkResources")
    def to_list_network_resources(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to list network resources.

        Access Level: List

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_ListNetworkResources.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toListNetworkResources", []))

    @jsii.member(jsii_name="toListNetworks")
    def to_list_networks(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to list networks.

        Access Level: List

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_ListNetworks.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toListNetworks", []))

    @jsii.member(jsii_name="toListNetworkSites")
    def to_list_network_sites(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to list network sites.

        Access Level: List

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_ListNetworkSites.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toListNetworkSites", []))

    @jsii.member(jsii_name="toListOrders")
    def to_list_orders(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to list network orders.

        Access Level: List

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_ListOrders.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toListOrders", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to return a list of tags for a resource.

        Access Level: List

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPing")
    def to_ping(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to check the health of the service.

        Access Level: Read

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_Ping.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toPing", []))

    @jsii.member(jsii_name="toStartNetworkResourceUpdate")
    def to_start_network_resource_update(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to start an update on the specified network resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_StartNetworkResourceUpdate.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toStartNetworkResourceUpdate", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to adds tags to the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to removes tags from the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateNetworkSite")
    def to_update_network_site(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to update a network site.

        Access Level: Write

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_UpdateNetworkSite.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toUpdateNetworkSite", []))

    @jsii.member(jsii_name="toUpdateNetworkSitePlan")
    def to_update_network_site_plan(self) -> "PrivateNetworks":
        '''(experimental) Grants permission to update a plan at a network site.

        Access Level: Write

        https://docs.aws.amazon.com/private-networks/latest/APIReference/API_UpdateNetworkSitePlan.html

        :stability: experimental
        '''
        return typing.cast("PrivateNetworks", jsii.invoke(self, "toUpdateNetworkSitePlan", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__51df11bf202a2eee7fc67df36023d6fec84f878797572f5a3687675805b602ee)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__23b8ddb356e5af6dd5785e81edd3fb367d3d23eef111c041864bc6bff20a2768)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Profile(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Profile"):
    '''(experimental) Statement provider for service `profile <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonconnectcustomerprofiles.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `profile <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonconnectcustomerprofiles.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__487679b6cc1ef2e8d7475001dd028d2e87e64dda04781923c0d0594192d77c75)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDomains")
    def on_domains(
        self,
        domain_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Profile":
        '''(experimental) Adds a resource of type domains to the statement.

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/

        :param domain_name: - Identifier for the domainName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0f847af9cf62aab87723898d2ae7a030051b64579aa7456e9e0b1ee46a249d74)
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Profile", jsii.invoke(self, "onDomains", [domain_name, account, region, partition]))

    @jsii.member(jsii_name="onIntegrations")
    def on_integrations(
        self,
        domain_name: builtins.str,
        uri: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Profile":
        '''(experimental) Adds a resource of type integrations to the statement.

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/

        :param domain_name: - Identifier for the domainName.
        :param uri: - Identifier for the uri.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fe14e7266240222e4a843b36bd6b1d1973b9a57a6c3f2aa6a7f331c146ba78fc)
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
            check_type(argname="argument uri", value=uri, expected_type=type_hints["uri"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Profile", jsii.invoke(self, "onIntegrations", [domain_name, uri, account, region, partition]))

    @jsii.member(jsii_name="onObjectTypes")
    def on_object_types(
        self,
        domain_name: builtins.str,
        object_type_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Profile":
        '''(experimental) Adds a resource of type object-types to the statement.

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/

        :param domain_name: - Identifier for the domainName.
        :param object_type_name: - Identifier for the objectTypeName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__410a2d4b5bed7d238a65b0afb4ac2f5dd673a14a55ccd7860caac9876e04686f)
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
            check_type(argname="argument object_type_name", value=object_type_name, expected_type=type_hints["object_type_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Profile", jsii.invoke(self, "onObjectTypes", [domain_name, object_type_name, account, region, partition]))

    @jsii.member(jsii_name="toAddProfileKey")
    def to_add_profile_key(self) -> "Profile":
        '''(experimental) Grants permission to add a profile key.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_AddProfileKey.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toAddProfileKey", []))

    @jsii.member(jsii_name="toCreateDomain")
    def to_create_domain(self) -> "Profile":
        '''(experimental) Grants permission to create a Domain.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_CreateDomain.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toCreateDomain", []))

    @jsii.member(jsii_name="toCreateIntegrationWorkflow")
    def to_create_integration_workflow(self) -> "Profile":
        '''(experimental) Grants permission to create an integration workflow in a domain.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_CreateIntegrationWorkflow.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toCreateIntegrationWorkflow", []))

    @jsii.member(jsii_name="toCreateProfile")
    def to_create_profile(self) -> "Profile":
        '''(experimental) Grants permission to create a profile in the domain.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_CreateProfile.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toCreateProfile", []))

    @jsii.member(jsii_name="toDeleteDomain")
    def to_delete_domain(self) -> "Profile":
        '''(experimental) Grants permission to delete a Domain.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_DeleteDomain.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toDeleteDomain", []))

    @jsii.member(jsii_name="toDeleteIntegration")
    def to_delete_integration(self) -> "Profile":
        '''(experimental) Grants permission to delete a integration in a domain.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_DeleteIntegration.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toDeleteIntegration", []))

    @jsii.member(jsii_name="toDeleteProfile")
    def to_delete_profile(self) -> "Profile":
        '''(experimental) Grants permission to delete a profile.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_DeleteProfile.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toDeleteProfile", []))

    @jsii.member(jsii_name="toDeleteProfileKey")
    def to_delete_profile_key(self) -> "Profile":
        '''(experimental) Grants permission to delete a profile key.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_DeleteProfileKey.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toDeleteProfileKey", []))

    @jsii.member(jsii_name="toDeleteProfileObject")
    def to_delete_profile_object(self) -> "Profile":
        '''(experimental) Grants permission to delete a profile object.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_DeleteProfileObject.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toDeleteProfileObject", []))

    @jsii.member(jsii_name="toDeleteProfileObjectType")
    def to_delete_profile_object_type(self) -> "Profile":
        '''(experimental) Grants permission to delete a specific profile object type in the domain.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_DeleteProfileObjectType.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toDeleteProfileObjectType", []))

    @jsii.member(jsii_name="toDeleteWorkflow")
    def to_delete_workflow(self) -> "Profile":
        '''(experimental) Grants permission to delete a workflow in a domain.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_DeleteWorkflow.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toDeleteWorkflow", []))

    @jsii.member(jsii_name="toGetAutoMergingPreview")
    def to_get_auto_merging_preview(self) -> "Profile":
        '''(experimental) Grants permission to get a preview of auto merging in a domain.

        Access Level: Read

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_GetAutoMergingPreview.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toGetAutoMergingPreview", []))

    @jsii.member(jsii_name="toGetDomain")
    def to_get_domain(self) -> "Profile":
        '''(experimental) Grants permission to get a specific domain in an account.

        Access Level: Read

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_GetDomain.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toGetDomain", []))

    @jsii.member(jsii_name="toGetIdentityResolutionJob")
    def to_get_identity_resolution_job(self) -> "Profile":
        '''(experimental) Grants permission to get an identity resolution job in a domain.

        Access Level: Read

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_GetIdentityResolutionJob.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toGetIdentityResolutionJob", []))

    @jsii.member(jsii_name="toGetIntegration")
    def to_get_integration(self) -> "Profile":
        '''(experimental) Grants permission to get a specific integrations in a domain.

        Access Level: Read

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_GetIntegration.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toGetIntegration", []))

    @jsii.member(jsii_name="toGetMatches")
    def to_get_matches(self) -> "Profile":
        '''(experimental) Grants permission to get profile matches in a domain.

        Access Level: List

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_GetMatches.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toGetMatches", []))

    @jsii.member(jsii_name="toGetProfileObjectType")
    def to_get_profile_object_type(self) -> "Profile":
        '''(experimental) Grants permission to get a specific profile object type in the domain.

        Access Level: Read

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_GetProfileObjectType.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toGetProfileObjectType", []))

    @jsii.member(jsii_name="toGetProfileObjectTypeTemplate")
    def to_get_profile_object_type_template(self) -> "Profile":
        '''(experimental) Grants permission to get a specific object type template.

        Access Level: Read

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_GetProfileObjectTypeTemplate.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toGetProfileObjectTypeTemplate", []))

    @jsii.member(jsii_name="toGetWorkflow")
    def to_get_workflow(self) -> "Profile":
        '''(experimental) Grants permission to get workflow details in a domain.

        Access Level: Read

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_GetWorkflow.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toGetWorkflow", []))

    @jsii.member(jsii_name="toGetWorkflowSteps")
    def to_get_workflow_steps(self) -> "Profile":
        '''(experimental) Grants permission to get workflow step details in a domain.

        Access Level: Read

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_GetWorkflowSteps.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toGetWorkflowSteps", []))

    @jsii.member(jsii_name="toListAccountIntegrations")
    def to_list_account_integrations(self) -> "Profile":
        '''(experimental) Grants permission to list all the integrations in the account.

        Access Level: List

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_ListAccountIntegrations.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toListAccountIntegrations", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Profile":
        '''(experimental) Grants permission to list all the domains in an account.

        Access Level: List

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_ListDomains.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toListIdentityResolutionJobs")
    def to_list_identity_resolution_jobs(self) -> "Profile":
        '''(experimental) Grants permission to list identity resolution jobs in a domain.

        Access Level: List

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_ListIdentityResolutionJobs.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toListIdentityResolutionJobs", []))

    @jsii.member(jsii_name="toListIntegrations")
    def to_list_integrations(self) -> "Profile":
        '''(experimental) Grants permission to list all the integrations in a specific domain.

        Access Level: List

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_ListIntegrations.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toListIntegrations", []))

    @jsii.member(jsii_name="toListProfileObjects")
    def to_list_profile_objects(self) -> "Profile":
        '''(experimental) Grants permission to list all the profile objects for a profile.

        Access Level: List

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_ListProfileObjects.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toListProfileObjects", []))

    @jsii.member(jsii_name="toListProfileObjectTypes")
    def to_list_profile_object_types(self) -> "Profile":
        '''(experimental) Grants permission to list all the profile object types in the domain.

        Access Level: List

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_ListProfileObjectTypes.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toListProfileObjectTypes", []))

    @jsii.member(jsii_name="toListProfileObjectTypeTemplates")
    def to_list_profile_object_type_templates(self) -> "Profile":
        '''(experimental) Grants permission to list all the profile object type templates in the account.

        Access Level: List

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_ListProfileObjectTypeTemplates.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toListProfileObjectTypeTemplates", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Profile":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWorkflows")
    def to_list_workflows(self) -> "Profile":
        '''(experimental) Grants permission to list all the workflows in a specific domain.

        Access Level: List

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_ListWorkflows.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toListWorkflows", []))

    @jsii.member(jsii_name="toMergeProfiles")
    def to_merge_profiles(self) -> "Profile":
        '''(experimental) Grants permission to merge profiles in a domain.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_MergeProfiles.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toMergeProfiles", []))

    @jsii.member(jsii_name="toPutIntegration")
    def to_put_integration(self) -> "Profile":
        '''(experimental) Grants permission to put a integration in a domain.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_PutIntegration.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toPutIntegration", []))

    @jsii.member(jsii_name="toPutProfileObject")
    def to_put_profile_object(self) -> "Profile":
        '''(experimental) Grants permission to put an object for a profile.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_PutProfileObject.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toPutProfileObject", []))

    @jsii.member(jsii_name="toPutProfileObjectType")
    def to_put_profile_object_type(self) -> "Profile":
        '''(experimental) Grants permission to put a specific profile object type in the domain.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_PutProfileObjectType.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toPutProfileObjectType", []))

    @jsii.member(jsii_name="toSearchProfiles")
    def to_search_profiles(self) -> "Profile":
        '''(experimental) Grants permission to search for profiles in a domain.

        Access Level: Read

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_SearchProfiles.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toSearchProfiles", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Profile":
        '''(experimental) Grants permission to adds tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Profile":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDomain")
    def to_update_domain(self) -> "Profile":
        '''(experimental) Grants permission to update a Domain.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_UpdateDomain.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toUpdateDomain", []))

    @jsii.member(jsii_name="toUpdateProfile")
    def to_update_profile(self) -> "Profile":
        '''(experimental) Grants permission to update a profile in the domain.

        Access Level: Write

        https://docs.aws.amazon.com/customerprofiles/latest/APIReference/API_UpdateProfile.html

        :stability: experimental
        '''
        return typing.cast("Profile", jsii.invoke(self, "toUpdateProfile", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8de96bf088ad2cdd56f1d21c7157755e743c135fafdecd7aacd5c6c4ab78d343)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dc376c9fb3f9712d79afc10768d730afc00a2a6d3cd6be4bbe6ac08b057cc4ae)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Proton(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Proton"):
    '''(experimental) Statement provider for service `proton <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsproton.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `proton <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsproton.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__da733e70a4a0a10536c0f8047bd23dd6ae98ac9a0f27e8feb682fb24558e2a0b)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifEnvironmentTemplate")
    def if_environment_template(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Proton":
        '''(experimental) Filters access by specified environment template related to resource.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html

        Applies to actions:

        - .toCancelEnvironmentDeployment()
        - .toCreateEnvironment()
        - .toDeleteEnvironment()
        - .toUpdateEnvironment()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__be7736f36cca90930baf87c7d52e2937052928cfd1aa3ec51e99441f5b6d7c04)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Proton", jsii.invoke(self, "ifEnvironmentTemplate", [value, operator]))

    @jsii.member(jsii_name="ifServiceTemplate")
    def if_service_template(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Proton":
        '''(experimental) Filters access by specified service template related to resource.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html

        Applies to actions:

        - .toCancelServiceInstanceDeployment()
        - .toCancelServicePipelineDeployment()
        - .toCreateService()
        - .toDeleteService()
        - .toUpdateService()
        - .toUpdateServiceInstance()
        - .toUpdateServicePipeline()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8eefc3c2db58084a8f6f8f4ee64cba3860fbb63fc0612d037dea70b83946c28e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Proton", jsii.invoke(self, "ifServiceTemplate", [value, operator]))

    @jsii.member(jsii_name="onComponent")
    def on_component(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type component to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/ag-components.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d3d44f3d30515fe9165f4974d8304863fac8510b653e5d02610f03073a30d7ef)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Proton", jsii.invoke(self, "onComponent", [id, account, region, partition]))

    @jsii.member(jsii_name="onEnvironment")
    def on_environment(
        self,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type environment to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/ag-environments.html

        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4aca36f626e2a0310264fb01cd6ecc3758715d2bec0aeaf8362f645b2496ad9c)
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Proton", jsii.invoke(self, "onEnvironment", [name, account, region, partition]))

    @jsii.member(jsii_name="onEnvironmentAccountConnection")
    def on_environment_account_connection(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type environment-account-connection to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/ag-env-account-connections.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e2b54ea363fde1814fd37da12b5325dea3e41c9c9f248f2197d189a80660d0ab)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Proton", jsii.invoke(self, "onEnvironmentAccountConnection", [id, account, region, partition]))

    @jsii.member(jsii_name="onEnvironmentTemplate")
    def on_environment_template(
        self,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type environment-template to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/ag-env-templates.html

        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6e8d551f8b2c9bff21b9d394e36754a6898ed64a862c1bc84da16cd6d9d5f868)
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Proton", jsii.invoke(self, "onEnvironmentTemplate", [name, account, region, partition]))

    @jsii.member(jsii_name="onEnvironmentTemplateMajorVersion")
    def on_environment_template_major_version(
        self,
        template_name: builtins.str,
        major_version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type environment-template-major-version to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/ag-env-templates.html

        :param template_name: - Identifier for the templateName.
        :param major_version_id: - Identifier for the majorVersionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__23fa43f9708b3e612ec1f30219519aebd3ee321715f4631d31b24611266c637c)
            check_type(argname="argument template_name", value=template_name, expected_type=type_hints["template_name"])
            check_type(argname="argument major_version_id", value=major_version_id, expected_type=type_hints["major_version_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Proton", jsii.invoke(self, "onEnvironmentTemplateMajorVersion", [template_name, major_version_id, account, region, partition]))

    @jsii.member(jsii_name="onEnvironmentTemplateMinorVersion")
    def on_environment_template_minor_version(
        self,
        template_name: builtins.str,
        major_version_id: builtins.str,
        minor_version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type environment-template-minor-version to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/ag-env-templates.html

        :param template_name: - Identifier for the templateName.
        :param major_version_id: - Identifier for the majorVersionId.
        :param minor_version_id: - Identifier for the minorVersionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__59ed0642dae84025ce09bfab1cf8669defd3fec2740c76f11bd318d51cfe7b1a)
            check_type(argname="argument template_name", value=template_name, expected_type=type_hints["template_name"])
            check_type(argname="argument major_version_id", value=major_version_id, expected_type=type_hints["major_version_id"])
            check_type(argname="argument minor_version_id", value=minor_version_id, expected_type=type_hints["minor_version_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Proton", jsii.invoke(self, "onEnvironmentTemplateMinorVersion", [template_name, major_version_id, minor_version_id, account, region, partition]))

    @jsii.member(jsii_name="onEnvironmentTemplateVersion")
    def on_environment_template_version(
        self,
        template_name: builtins.str,
        major_version: builtins.str,
        minor_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type environment-template-version to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/ag-env-templates.html

        :param template_name: - Identifier for the templateName.
        :param major_version: - Identifier for the majorVersion.
        :param minor_version: - Identifier for the minorVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1d15bd90109b94b8ddf415397f12086a685ff4845eea4b7d355128dfa510f5cd)
            check_type(argname="argument template_name", value=template_name, expected_type=type_hints["template_name"])
            check_type(argname="argument major_version", value=major_version, expected_type=type_hints["major_version"])
            check_type(argname="argument minor_version", value=minor_version, expected_type=type_hints["minor_version"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Proton", jsii.invoke(self, "onEnvironmentTemplateVersion", [template_name, major_version, minor_version, account, region, partition]))

    @jsii.member(jsii_name="onRepository")
    def on_repository(
        self,
        provider: builtins.str,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type repository to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/ag-repositories.html

        :param provider: - Identifier for the provider.
        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6a01052690b69d7777122b583d9650c9eb73318c833608f3f871d769a5183ae4)
            check_type(argname="argument provider", value=provider, expected_type=type_hints["provider"])
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Proton", jsii.invoke(self, "onRepository", [provider, name, account, region, partition]))

    @jsii.member(jsii_name="onService")
    def on_service(
        self,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type service to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/ag-services.html

        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f540a5856197c1ceb5e96b1b44d34e89510fb2046fe54673f4718d8806af0eff)
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Proton", jsii.invoke(self, "onService", [name, account, region, partition]))

    @jsii.member(jsii_name="onServiceInstance")
    def on_service_instance(
        self,
        service_name: builtins.str,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type service-instance to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/ag-services.html

        :param service_name: - Identifier for the serviceName.
        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__79a3763da14e4bfef0603fd97233cd4cfebc2ef539a026bdf42cb21472605a00)
            check_type(argname="argument service_name", value=service_name, expected_type=type_hints["service_name"])
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Proton", jsii.invoke(self, "onServiceInstance", [service_name, name, account, region, partition]))

    @jsii.member(jsii_name="onServiceTemplate")
    def on_service_template(
        self,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type service-template to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/managing-svc-templates.html

        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__622a876e53d64a2a42e103a62ec303c762bd726ed0d2c788e582eb1708e37171)
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Proton", jsii.invoke(self, "onServiceTemplate", [name, account, region, partition]))

    @jsii.member(jsii_name="onServiceTemplateMajorVersion")
    def on_service_template_major_version(
        self,
        template_name: builtins.str,
        major_version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type service-template-major-version to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/managing-svc-templates.html

        :param template_name: - Identifier for the templateName.
        :param major_version_id: - Identifier for the majorVersionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cff747f8581e3b066f0bd127cdea7af3c22729d5c75422f663a27d6f0ba5d67e)
            check_type(argname="argument template_name", value=template_name, expected_type=type_hints["template_name"])
            check_type(argname="argument major_version_id", value=major_version_id, expected_type=type_hints["major_version_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Proton", jsii.invoke(self, "onServiceTemplateMajorVersion", [template_name, major_version_id, account, region, partition]))

    @jsii.member(jsii_name="onServiceTemplateMinorVersion")
    def on_service_template_minor_version(
        self,
        template_name: builtins.str,
        major_version_id: builtins.str,
        minor_version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type service-template-minor-version to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/managing-svc-templates.html

        :param template_name: - Identifier for the templateName.
        :param major_version_id: - Identifier for the majorVersionId.
        :param minor_version_id: - Identifier for the minorVersionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__681bc8434a298a5aa7662ed6fdcececc138710a293a5b06c0098cf1d93ac2b1a)
            check_type(argname="argument template_name", value=template_name, expected_type=type_hints["template_name"])
            check_type(argname="argument major_version_id", value=major_version_id, expected_type=type_hints["major_version_id"])
            check_type(argname="argument minor_version_id", value=minor_version_id, expected_type=type_hints["minor_version_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Proton", jsii.invoke(self, "onServiceTemplateMinorVersion", [template_name, major_version_id, minor_version_id, account, region, partition]))

    @jsii.member(jsii_name="onServiceTemplateVersion")
    def on_service_template_version(
        self,
        template_name: builtins.str,
        major_version: builtins.str,
        minor_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Proton":
        '''(experimental) Adds a resource of type service-template-version to the statement.

        https://docs.aws.amazon.com/proton/latest/adminguide/managing-svc-templates.html

        :param template_name: - Identifier for the templateName.
        :param major_version: - Identifier for the majorVersion.
        :param minor_version: - Identifier for the minorVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e70a3757f3f0596fde80409352bea07e6c40e5499bd4dc96408e1a5a2ffe102f)
            check_type(argname="argument template_name", value=template_name, expected_type=type_hints["template_name"])
            check_type(argname="argument major_version", value=major_version, expected_type=type_hints["major_version"])
            check_type(argname="argument minor_version", value=minor_version, expected_type=type_hints["minor_version"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Proton", jsii.invoke(self, "onServiceTemplateVersion", [template_name, major_version, minor_version, account, region, partition]))

    @jsii.member(jsii_name="toAcceptEnvironmentAccountConnection")
    def to_accept_environment_account_connection(self) -> "Proton":
        '''(experimental) Grants permission to reject an environment account connection request from another environment account.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_AcceptEnvironmentAccountConnection.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toAcceptEnvironmentAccountConnection", []))

    @jsii.member(jsii_name="toCancelComponentDeployment")
    def to_cancel_component_deployment(self) -> "Proton":
        '''(experimental) Grants permission to cancel component deployment.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CancelComponentDeployment.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCancelComponentDeployment", []))

    @jsii.member(jsii_name="toCancelEnvironmentDeployment")
    def to_cancel_environment_deployment(self) -> "Proton":
        '''(experimental) Grants permission to cancel an environment deployment.

        Access Level: Write

        Possible conditions:

        - .ifEnvironmentTemplate()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CancelEnvironmentDeployment.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCancelEnvironmentDeployment", []))

    @jsii.member(jsii_name="toCancelServiceInstanceDeployment")
    def to_cancel_service_instance_deployment(self) -> "Proton":
        '''(experimental) Grants permission to cancel a service instance deployment.

        Access Level: Write

        Possible conditions:

        - .ifServiceTemplate()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CancelServiceInstanceDeployment.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCancelServiceInstanceDeployment", []))

    @jsii.member(jsii_name="toCancelServicePipelineDeployment")
    def to_cancel_service_pipeline_deployment(self) -> "Proton":
        '''(experimental) Grants permission to cancel a service pipeline deployment.

        Access Level: Write

        Possible conditions:

        - .ifServiceTemplate()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CancelServicePipelineDeployment.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCancelServicePipelineDeployment", []))

    @jsii.member(jsii_name="toCreateComponent")
    def to_create_component(self) -> "Proton":
        '''(experimental) Grants permission to create component.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateComponent.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateComponent", []))

    @jsii.member(jsii_name="toCreateEnvironment")
    def to_create_environment(self) -> "Proton":
        '''(experimental) Grants permission to create an environment.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifEnvironmentTemplate()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateEnvironment", []))

    @jsii.member(jsii_name="toCreateEnvironmentAccountConnection")
    def to_create_environment_account_connection(self) -> "Proton":
        '''(experimental) Grants permission to create an environment account connection.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateEnvironmentAccountConnection.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateEnvironmentAccountConnection", []))

    @jsii.member(jsii_name="toCreateEnvironmentTemplate")
    def to_create_environment_template(self) -> "Proton":
        '''(experimental) Grants permission to create an environment template.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateEnvironmentTemplate.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateEnvironmentTemplate", []))

    @jsii.member(jsii_name="toCreateEnvironmentTemplateMajorVersion")
    def to_create_environment_template_major_version(self) -> "Proton":
        '''(experimental) Grants permission to create an environment template major version. DEPRECATED - use CreateEnvironmentTemplateVersion instead.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateEnvironmentTemplateMajorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateEnvironmentTemplateMajorVersion", []))

    @jsii.member(jsii_name="toCreateEnvironmentTemplateMinorVersion")
    def to_create_environment_template_minor_version(self) -> "Proton":
        '''(experimental) Grants permission to create an environment template minor version. DEPRECATED - use CreateEnvironmentTemplateVersion instead.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateEnvironmentTemplateMinorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateEnvironmentTemplateMinorVersion", []))

    @jsii.member(jsii_name="toCreateEnvironmentTemplateVersion")
    def to_create_environment_template_version(self) -> "Proton":
        '''(experimental) Grants permission to create an environment template version.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateEnvironmentTemplateVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateEnvironmentTemplateVersion", []))

    @jsii.member(jsii_name="toCreateRepository")
    def to_create_repository(self) -> "Proton":
        '''(experimental) Grants permission to create a repository.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateRepository.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateRepository", []))

    @jsii.member(jsii_name="toCreateService")
    def to_create_service(self) -> "Proton":
        '''(experimental) Grants permission to create a service.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifServiceTemplate()

        Dependent actions:

        - codestar-connections:PassConnection

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateService.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateService", []))

    @jsii.member(jsii_name="toCreateServiceTemplate")
    def to_create_service_template(self) -> "Proton":
        '''(experimental) Grants permission to create a service template.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateServiceTemplate.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateServiceTemplate", []))

    @jsii.member(jsii_name="toCreateServiceTemplateMajorVersion")
    def to_create_service_template_major_version(self) -> "Proton":
        '''(experimental) Grants permission to create a service template major version. DEPRECATED - use CreateServiceTemplateVersion instead.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateServiceTemplateMajorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateServiceTemplateMajorVersion", []))

    @jsii.member(jsii_name="toCreateServiceTemplateMinorVersion")
    def to_create_service_template_minor_version(self) -> "Proton":
        '''(experimental) Grants permission to create a service template minor version. DEPRECATED - use CreateServiceTemplateVersion instead.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateServiceTemplateMinorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateServiceTemplateMinorVersion", []))

    @jsii.member(jsii_name="toCreateServiceTemplateVersion")
    def to_create_service_template_version(self) -> "Proton":
        '''(experimental) Grants permission to create a service template version.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateServiceTemplateVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateServiceTemplateVersion", []))

    @jsii.member(jsii_name="toCreateTemplateSyncConfig")
    def to_create_template_sync_config(self) -> "Proton":
        '''(experimental) Grants permission to create a template sync config.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_CreateTemplateSyncConfig.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toCreateTemplateSyncConfig", []))

    @jsii.member(jsii_name="toDeleteAccountRoles")
    def to_delete_account_roles(self) -> "Proton":
        '''(experimental) Grants permission to delete account roles. DEPRECATED - use UpdateAccountSettings instead.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteAccountRoles.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteAccountRoles", []))

    @jsii.member(jsii_name="toDeleteComponent")
    def to_delete_component(self) -> "Proton":
        '''(experimental) Grants permission to delete component.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteComponent.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteComponent", []))

    @jsii.member(jsii_name="toDeleteEnvironment")
    def to_delete_environment(self) -> "Proton":
        '''(experimental) Grants permission to delete an environment.

        Access Level: Write

        Possible conditions:

        - .ifEnvironmentTemplate()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteEnvironment", []))

    @jsii.member(jsii_name="toDeleteEnvironmentAccountConnection")
    def to_delete_environment_account_connection(self) -> "Proton":
        '''(experimental) Grants permission to delete an environment account connection.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteEnvironmentAccountConnection.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteEnvironmentAccountConnection", []))

    @jsii.member(jsii_name="toDeleteEnvironmentTemplate")
    def to_delete_environment_template(self) -> "Proton":
        '''(experimental) Grants permission to delete an environment template.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteEnvironmentTemplate.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteEnvironmentTemplate", []))

    @jsii.member(jsii_name="toDeleteEnvironmentTemplateMajorVersion")
    def to_delete_environment_template_major_version(self) -> "Proton":
        '''(experimental) Grants permission to delete an environment template major version. DEPRECATED - use DeleteEnvironmentTemplateVersion instead.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteEnvironmentTemplateMajorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteEnvironmentTemplateMajorVersion", []))

    @jsii.member(jsii_name="toDeleteEnvironmentTemplateMinorVersion")
    def to_delete_environment_template_minor_version(self) -> "Proton":
        '''(experimental) Grants permission to delete an environment template minor version. DEPRECATED - use DeleteEnvironmentTemplateVersion instead.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteEnvironmentTemplateMinorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteEnvironmentTemplateMinorVersion", []))

    @jsii.member(jsii_name="toDeleteEnvironmentTemplateVersion")
    def to_delete_environment_template_version(self) -> "Proton":
        '''(experimental) Grants permission to delete an environment template version.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteEnvironmentTemplateVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteEnvironmentTemplateVersion", []))

    @jsii.member(jsii_name="toDeleteRepository")
    def to_delete_repository(self) -> "Proton":
        '''(experimental) Grants permission to delete a repository.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteRepository.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteRepository", []))

    @jsii.member(jsii_name="toDeleteService")
    def to_delete_service(self) -> "Proton":
        '''(experimental) Grants permission to delete a service.

        Access Level: Write

        Possible conditions:

        - .ifServiceTemplate()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteService.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteService", []))

    @jsii.member(jsii_name="toDeleteServiceTemplate")
    def to_delete_service_template(self) -> "Proton":
        '''(experimental) Grants permission to delete a service template.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteServiceTemplate.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteServiceTemplate", []))

    @jsii.member(jsii_name="toDeleteServiceTemplateMajorVersion")
    def to_delete_service_template_major_version(self) -> "Proton":
        '''(experimental) Grants permission to delete a service template major version. DEPRECATED - use DeleteServiceTemplateVersion instead.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteServiceTemplateMajorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteServiceTemplateMajorVersion", []))

    @jsii.member(jsii_name="toDeleteServiceTemplateMinorVersion")
    def to_delete_service_template_minor_version(self) -> "Proton":
        '''(experimental) Grants permission to delete a service template minor version. DEPRECATED - use DeleteServiceTemplateVersion instead.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteServiceTemplateMinorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteServiceTemplateMinorVersion", []))

    @jsii.member(jsii_name="toDeleteServiceTemplateVersion")
    def to_delete_service_template_version(self) -> "Proton":
        '''(experimental) Grants permission to delete a service template version.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteServiceTemplateVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteServiceTemplateVersion", []))

    @jsii.member(jsii_name="toDeleteTemplateSyncConfig")
    def to_delete_template_sync_config(self) -> "Proton":
        '''(experimental) Grants permission to delete a TemplateSyncConfig.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_DeleteTemplateSyncConfig.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toDeleteTemplateSyncConfig", []))

    @jsii.member(jsii_name="toGetAccountRoles")
    def to_get_account_roles(self) -> "Proton":
        '''(experimental) Grants permission to get account roles. DEPRECATED - use GetAccountSettings instead.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetAccountRoles.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetAccountRoles", []))

    @jsii.member(jsii_name="toGetAccountSettings")
    def to_get_account_settings(self) -> "Proton":
        '''(experimental) Grants permission to describe the account settings.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetAccountSettings.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetAccountSettings", []))

    @jsii.member(jsii_name="toGetComponent")
    def to_get_component(self) -> "Proton":
        '''(experimental) Grants permission to describe a component.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetComponent.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetComponent", []))

    @jsii.member(jsii_name="toGetEnvironment")
    def to_get_environment(self) -> "Proton":
        '''(experimental) Grants permission to describe an environment.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetEnvironment", []))

    @jsii.member(jsii_name="toGetEnvironmentAccountConnection")
    def to_get_environment_account_connection(self) -> "Proton":
        '''(experimental) Grants permission to describe an environment account connection.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetEnvironmentAccountConnection.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetEnvironmentAccountConnection", []))

    @jsii.member(jsii_name="toGetEnvironmentTemplate")
    def to_get_environment_template(self) -> "Proton":
        '''(experimental) Grants permission to describe an environment template.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetEnvironmentTemplate.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetEnvironmentTemplate", []))

    @jsii.member(jsii_name="toGetEnvironmentTemplateMajorVersion")
    def to_get_environment_template_major_version(self) -> "Proton":
        '''(experimental) Grants permission to get an environment template major version. DEPRECATED - use GetEnvironmentTemplateVersion instead.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetEnvironmentTemplateMajorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetEnvironmentTemplateMajorVersion", []))

    @jsii.member(jsii_name="toGetEnvironmentTemplateMinorVersion")
    def to_get_environment_template_minor_version(self) -> "Proton":
        '''(experimental) Grants permission to get an environment template minor version. DEPRECATED - use GetEnvironmentTemplateVersion instead.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetEnvironmentTemplateMinorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetEnvironmentTemplateMinorVersion", []))

    @jsii.member(jsii_name="toGetEnvironmentTemplateVersion")
    def to_get_environment_template_version(self) -> "Proton":
        '''(experimental) Grants permission to describe an environment template version.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetEnvironmentTemplateVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetEnvironmentTemplateVersion", []))

    @jsii.member(jsii_name="toGetRepository")
    def to_get_repository(self) -> "Proton":
        '''(experimental) Grants permission to describe a repository.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetRepository.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetRepository", []))

    @jsii.member(jsii_name="toGetRepositorySyncStatus")
    def to_get_repository_sync_status(self) -> "Proton":
        '''(experimental) Grants permission to get the latest sync status for a repository.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetRepositorySyncStatus.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetRepositorySyncStatus", []))

    @jsii.member(jsii_name="toGetResourcesSummary")
    def to_get_resources_summary(self) -> "Proton":
        '''(experimental) Grants permission to get resources summary.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetResourcesSummary.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetResourcesSummary", []))

    @jsii.member(jsii_name="toGetResourceTemplateVersionStatusCounts")
    def to_get_resource_template_version_status_counts(self) -> "Proton":
        '''(experimental) Grants permission to list resource template version status counts.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetResourceTemplateVersionStatusCounts.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetResourceTemplateVersionStatusCounts", []))

    @jsii.member(jsii_name="toGetService")
    def to_get_service(self) -> "Proton":
        '''(experimental) Grants permission to describe a service.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetService.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetService", []))

    @jsii.member(jsii_name="toGetServiceInstance")
    def to_get_service_instance(self) -> "Proton":
        '''(experimental) Grants permission to describe a service instance.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetServiceInstance.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetServiceInstance", []))

    @jsii.member(jsii_name="toGetServiceTemplate")
    def to_get_service_template(self) -> "Proton":
        '''(experimental) Grants permission to describe a service template.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetServiceTemplate.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetServiceTemplate", []))

    @jsii.member(jsii_name="toGetServiceTemplateMajorVersion")
    def to_get_service_template_major_version(self) -> "Proton":
        '''(experimental) Grants permission to get a service template major version. DEPRECATED - use GetServiceTemplateVersion instead.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetServiceTemplateMajorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetServiceTemplateMajorVersion", []))

    @jsii.member(jsii_name="toGetServiceTemplateMinorVersion")
    def to_get_service_template_minor_version(self) -> "Proton":
        '''(experimental) Grants permission to get a service template minor version. DEPRECATED - use GetServiceTemplateVersion instead.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetServiceTemplateMinorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetServiceTemplateMinorVersion", []))

    @jsii.member(jsii_name="toGetServiceTemplateVersion")
    def to_get_service_template_version(self) -> "Proton":
        '''(experimental) Grants permission to describe a service template version.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetServiceTemplateVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetServiceTemplateVersion", []))

    @jsii.member(jsii_name="toGetTemplateSyncConfig")
    def to_get_template_sync_config(self) -> "Proton":
        '''(experimental) Grants permission to describe a TemplateSyncConfig.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetTemplateSyncConfig.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetTemplateSyncConfig", []))

    @jsii.member(jsii_name="toGetTemplateSyncStatus")
    def to_get_template_sync_status(self) -> "Proton":
        '''(experimental) Grants permission to describe the sync status of a template.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_GetTemplateSyncStatus.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toGetTemplateSyncStatus", []))

    @jsii.member(jsii_name="toListComponentOutputs")
    def to_list_component_outputs(self) -> "Proton":
        '''(experimental) Grants permission to list component outputs.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListComponentOutputs.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListComponentOutputs", []))

    @jsii.member(jsii_name="toListComponentProvisionedResources")
    def to_list_component_provisioned_resources(self) -> "Proton":
        '''(experimental) Grants permission to list component provisioned resources.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListComponentProvisionedResources.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListComponentProvisionedResources", []))

    @jsii.member(jsii_name="toListComponents")
    def to_list_components(self) -> "Proton":
        '''(experimental) Grants permission to list components.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListComponents.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListComponents", []))

    @jsii.member(jsii_name="toListEnvironmentAccountConnections")
    def to_list_environment_account_connections(self) -> "Proton":
        '''(experimental) Grants permission to list environment account connections.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListEnvironmentAccountConnections.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListEnvironmentAccountConnections", []))

    @jsii.member(jsii_name="toListEnvironmentOutputs")
    def to_list_environment_outputs(self) -> "Proton":
        '''(experimental) Grants permission to list environment outputs.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListEnvironmentOutputs.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListEnvironmentOutputs", []))

    @jsii.member(jsii_name="toListEnvironmentProvisionedResources")
    def to_list_environment_provisioned_resources(self) -> "Proton":
        '''(experimental) Grants permission to list environment provisioned resources.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListEnvironmentProvisionedResources.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListEnvironmentProvisionedResources", []))

    @jsii.member(jsii_name="toListEnvironments")
    def to_list_environments(self) -> "Proton":
        '''(experimental) Grants permission to list environments.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListEnvironments.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListEnvironments", []))

    @jsii.member(jsii_name="toListEnvironmentTemplateMajorVersions")
    def to_list_environment_template_major_versions(self) -> "Proton":
        '''(experimental) Grants permission to list environment template major versions. DEPRECATED - use ListEnvironmentTemplateVersions instead.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListEnvironmentTemplateMajorVersions.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListEnvironmentTemplateMajorVersions", []))

    @jsii.member(jsii_name="toListEnvironmentTemplateMinorVersions")
    def to_list_environment_template_minor_versions(self) -> "Proton":
        '''(experimental) Grants permission to list an environment template minor versions. DEPRECATED - use ListEnvironmentTemplateVersions instead.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListEnvironmentTemplateMinorVersions.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListEnvironmentTemplateMinorVersions", []))

    @jsii.member(jsii_name="toListEnvironmentTemplates")
    def to_list_environment_templates(self) -> "Proton":
        '''(experimental) Grants permission to list environment templates.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListEnvironmentTemplates.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListEnvironmentTemplates", []))

    @jsii.member(jsii_name="toListEnvironmentTemplateVersions")
    def to_list_environment_template_versions(self) -> "Proton":
        '''(experimental) Grants permission to list environment template versions.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListEnvironmentTemplateVersions.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListEnvironmentTemplateVersions", []))

    @jsii.member(jsii_name="toListRepositories")
    def to_list_repositories(self) -> "Proton":
        '''(experimental) Grants permission to list repositories.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListRepositories.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListRepositories", []))

    @jsii.member(jsii_name="toListRepositorySyncDefinitions")
    def to_list_repository_sync_definitions(self) -> "Proton":
        '''(experimental) Grants permission to list repository sync definitions.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListRepositorySyncDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListRepositorySyncDefinitions", []))

    @jsii.member(jsii_name="toListServiceInstanceOutputs")
    def to_list_service_instance_outputs(self) -> "Proton":
        '''(experimental) Grants permission to list service instance outputs.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListServiceInstanceOutputs.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListServiceInstanceOutputs", []))

    @jsii.member(jsii_name="toListServiceInstanceProvisionedResources")
    def to_list_service_instance_provisioned_resources(self) -> "Proton":
        '''(experimental) Grants permission to list service instance provisioned resources.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListServiceInstanceProvisionedResources.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListServiceInstanceProvisionedResources", []))

    @jsii.member(jsii_name="toListServiceInstances")
    def to_list_service_instances(self) -> "Proton":
        '''(experimental) Grants permission to list service instances.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListServiceInstances.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListServiceInstances", []))

    @jsii.member(jsii_name="toListServicePipelineOutputs")
    def to_list_service_pipeline_outputs(self) -> "Proton":
        '''(experimental) Grants permission to list service pipeline outputs.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListServicePipelineOutputs.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListServicePipelineOutputs", []))

    @jsii.member(jsii_name="toListServicePipelineProvisionedResources")
    def to_list_service_pipeline_provisioned_resources(self) -> "Proton":
        '''(experimental) Grants permission to list service pipeline provisioned resources.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListServicePipelineProvisionedResources.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListServicePipelineProvisionedResources", []))

    @jsii.member(jsii_name="toListServices")
    def to_list_services(self) -> "Proton":
        '''(experimental) Grants permission to list services.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListServices.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListServices", []))

    @jsii.member(jsii_name="toListServiceTemplateMajorVersions")
    def to_list_service_template_major_versions(self) -> "Proton":
        '''(experimental) Grants permission to list service template major versions. DEPRECATED - use ListServiceTemplateVersions instead.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListServiceTemplateMajorVersions.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListServiceTemplateMajorVersions", []))

    @jsii.member(jsii_name="toListServiceTemplateMinorVersions")
    def to_list_service_template_minor_versions(self) -> "Proton":
        '''(experimental) Grants permission to list service template minor versions. DEPRECATED - use ListServiceTemplateVersions instead.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListServiceTemplateMinorVersions.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListServiceTemplateMinorVersions", []))

    @jsii.member(jsii_name="toListServiceTemplates")
    def to_list_service_templates(self) -> "Proton":
        '''(experimental) Grants permission to list service templates.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListServiceTemplates.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListServiceTemplates", []))

    @jsii.member(jsii_name="toListServiceTemplateVersions")
    def to_list_service_template_versions(self) -> "Proton":
        '''(experimental) Grants permission to list service template versions.

        Access Level: List

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListServiceTemplateVersions.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListServiceTemplateVersions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Proton":
        '''(experimental) Grants permission to list tags of a resource.

        Access Level: Read

        https://docs.aws.amazon.com/proton/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toNotifyResourceDeploymentStatusChange")
    def to_notify_resource_deployment_status_change(self) -> "Proton":
        '''(experimental) Grants permission to notify Proton of resource deployment status changes.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_NotifyResourceDeploymentStatusChange.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toNotifyResourceDeploymentStatusChange", []))

    @jsii.member(jsii_name="toRejectEnvironmentAccountConnection")
    def to_reject_environment_account_connection(self) -> "Proton":
        '''(experimental) Grants permission to reject an environment account connection request from another environment account.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_RejectEnvironmentAccountConnection.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toRejectEnvironmentAccountConnection", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Proton":
        '''(experimental) Grants permission to add tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Proton":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAccountRoles")
    def to_update_account_roles(self) -> "Proton":
        '''(experimental) Grants permission to update account roles. DEPRECATED - use UpdateAccountSettings instead.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateAccountRoles.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateAccountRoles", []))

    @jsii.member(jsii_name="toUpdateAccountSettings")
    def to_update_account_settings(self) -> "Proton":
        '''(experimental) Grants permission to update the account settings.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateAccountSettings.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateAccountSettings", []))

    @jsii.member(jsii_name="toUpdateComponent")
    def to_update_component(self) -> "Proton":
        '''(experimental) Grants permission to update component.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateComponent.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateComponent", []))

    @jsii.member(jsii_name="toUpdateEnvironment")
    def to_update_environment(self) -> "Proton":
        '''(experimental) Grants permission to update an environment.

        Access Level: Write

        Possible conditions:

        - .ifEnvironmentTemplate()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateEnvironment", []))

    @jsii.member(jsii_name="toUpdateEnvironmentAccountConnection")
    def to_update_environment_account_connection(self) -> "Proton":
        '''(experimental) Grants permission to update an environment account connection.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateEnvironmentAccountConnection.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateEnvironmentAccountConnection", []))

    @jsii.member(jsii_name="toUpdateEnvironmentTemplate")
    def to_update_environment_template(self) -> "Proton":
        '''(experimental) Grants permission to update an environment template.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateEnvironmentTemplate.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateEnvironmentTemplate", []))

    @jsii.member(jsii_name="toUpdateEnvironmentTemplateMajorVersion")
    def to_update_environment_template_major_version(self) -> "Proton":
        '''(experimental) Grants permission to update an environment template major version. DEPRECATED - use UpdateEnvironmentTemplateVersion instead.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateEnvironmentTemplateMajorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateEnvironmentTemplateMajorVersion", []))

    @jsii.member(jsii_name="toUpdateEnvironmentTemplateMinorVersion")
    def to_update_environment_template_minor_version(self) -> "Proton":
        '''(experimental) Grants permission to update an environment template minor version. DEPRECATED - use UpdateEnvironmentTemplateVersion instead.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateEnvironmentTemplateMinorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateEnvironmentTemplateMinorVersion", []))

    @jsii.member(jsii_name="toUpdateEnvironmentTemplateVersion")
    def to_update_environment_template_version(self) -> "Proton":
        '''(experimental) Grants permission to update an environment template version.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateEnvironmentTemplateVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateEnvironmentTemplateVersion", []))

    @jsii.member(jsii_name="toUpdateService")
    def to_update_service(self) -> "Proton":
        '''(experimental) Grants permission to update a service.

        Access Level: Write

        Possible conditions:

        - .ifServiceTemplate()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateService.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateService", []))

    @jsii.member(jsii_name="toUpdateServiceInstance")
    def to_update_service_instance(self) -> "Proton":
        '''(experimental) Grants permission to update a service instance.

        Access Level: Write

        Possible conditions:

        - .ifServiceTemplate()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateServiceInstance.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateServiceInstance", []))

    @jsii.member(jsii_name="toUpdateServicePipeline")
    def to_update_service_pipeline(self) -> "Proton":
        '''(experimental) Grants permission to update a service pipeline.

        Access Level: Write

        Possible conditions:

        - .ifServiceTemplate()

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateServicePipeline.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateServicePipeline", []))

    @jsii.member(jsii_name="toUpdateServiceTemplate")
    def to_update_service_template(self) -> "Proton":
        '''(experimental) Grants permission to update a service template.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateServiceTemplate.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateServiceTemplate", []))

    @jsii.member(jsii_name="toUpdateServiceTemplateMajorVersion")
    def to_update_service_template_major_version(self) -> "Proton":
        '''(experimental) Grants permission to update a service template major version. DEPRECATED - use UpdateServiceTemplateVersion instead.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateServiceTemplateMajorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateServiceTemplateMajorVersion", []))

    @jsii.member(jsii_name="toUpdateServiceTemplateMinorVersion")
    def to_update_service_template_minor_version(self) -> "Proton":
        '''(experimental) Grants permission to create a service template minor version. DEPRECATED - use UpdateServiceTemplateVersion instead.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateServiceTemplateMinorVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateServiceTemplateMinorVersion", []))

    @jsii.member(jsii_name="toUpdateServiceTemplateVersion")
    def to_update_service_template_version(self) -> "Proton":
        '''(experimental) Grants permission to update a service template version.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateServiceTemplateVersion.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateServiceTemplateVersion", []))

    @jsii.member(jsii_name="toUpdateTemplateSyncConfig")
    def to_update_template_sync_config(self) -> "Proton":
        '''(experimental) Grants permission to update a TemplateSyncConfig.

        Access Level: Write

        https://docs.aws.amazon.com/proton/latest/APIReference/API_UpdateTemplateSyncConfig.html

        :stability: experimental
        '''
        return typing.cast("Proton", jsii.invoke(self, "toUpdateTemplateSyncConfig", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f640ecdb5a51cacdd64ff56687850fc6fb4a2390a917406f55453b87d395d090)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bcd3df32ca3a946e1603394b45c7ad1d717cbf82473fe01a857965284ade29ce)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class PurchaseOrders(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.PurchaseOrders",
):
    '''(experimental) Statement provider for service `purchase-orders <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awspurchaseordersconsole.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `purchase-orders <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awspurchaseordersconsole.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0be9de5f32d9ffa6b31d1f77ba93ceef5666584191a68a546dc47752ba3fb6c7)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toAddPurchaseOrder")
    def to_add_purchase_order(self) -> "PurchaseOrders":
        '''(experimental) Allow or deny IAM users permission to add a new purchase order.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("PurchaseOrders", jsii.invoke(self, "toAddPurchaseOrder", []))

    @jsii.member(jsii_name="toDeletePurchaseOrder")
    def to_delete_purchase_order(self) -> "PurchaseOrders":
        '''(experimental) Allow or deny IAM users permission to delete a purchase order.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("PurchaseOrders", jsii.invoke(self, "toDeletePurchaseOrder", []))

    @jsii.member(jsii_name="toGetPurchaseOrder")
    def to_get_purchase_order(self) -> "PurchaseOrders":
        '''(experimental) Allow or deny IAM users permission to get a purchase order.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("PurchaseOrders", jsii.invoke(self, "toGetPurchaseOrder", []))

    @jsii.member(jsii_name="toListPurchaseOrderInvoices")
    def to_list_purchase_order_invoices(self) -> "PurchaseOrders":
        '''(experimental) Allow or deny IAM users permission to list purchase order invoices.

        Access Level: List

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("PurchaseOrders", jsii.invoke(self, "toListPurchaseOrderInvoices", []))

    @jsii.member(jsii_name="toListPurchaseOrders")
    def to_list_purchase_orders(self) -> "PurchaseOrders":
        '''(experimental) Allow or deny IAM users permission to get all available purchase orders.

        Access Level: List

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("PurchaseOrders", jsii.invoke(self, "toListPurchaseOrders", []))

    @jsii.member(jsii_name="toModifyPurchaseOrders")
    def to_modify_purchase_orders(self) -> "PurchaseOrders":
        '''(experimental) Grants permission to modify purchase orders and details.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("PurchaseOrders", jsii.invoke(self, "toModifyPurchaseOrders", []))

    @jsii.member(jsii_name="toUpdatePurchaseOrder")
    def to_update_purchase_order(self) -> "PurchaseOrders":
        '''(experimental) Allow or deny IAM users permission to update an existing purchase order.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("PurchaseOrders", jsii.invoke(self, "toUpdatePurchaseOrder", []))

    @jsii.member(jsii_name="toUpdatePurchaseOrderStatus")
    def to_update_purchase_order_status(self) -> "PurchaseOrders":
        '''(experimental) Allow or deny IAM users permission to set purchase order status.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("PurchaseOrders", jsii.invoke(self, "toUpdatePurchaseOrderStatus", []))

    @jsii.member(jsii_name="toViewPurchaseOrders")
    def to_view_purchase_orders(self) -> "PurchaseOrders":
        '''(experimental) Grants permission to view purchase orders and details.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("PurchaseOrders", jsii.invoke(self, "toViewPurchaseOrders", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__820ae5d0e7afedf303efefe6fa87fe4ff1578cc365cb567a547b6ecf2e5bce32)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2ef08f6d6514106f1f4df3b52180fb0751d57b3ab5f00ae3c043006ecf963ed8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Qldb(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Qldb"):
    '''(experimental) Statement provider for service `qldb <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonqldb.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `qldb <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonqldb.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__814f945d7e09888078e8031f9d9ec9fdebef7f7cc351eceeca8611a5cd8d6e2d)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifPurge")
    def if_purge(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Qldb":
        '''(experimental) Filters access by the value of purge that is specified in a PartiQL DROP statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-purge

        Applies to actions:

        - .toPartiQLDropIndex()
        - .toPartiQLDropTable()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e4d6bbc88bcdb9f63fa218d2779e0daae3841f1e693cce053f8c295b00fd0427)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Qldb", jsii.invoke(self, "ifPurge", [value, operator]))

    @jsii.member(jsii_name="onCatalog")
    def on_catalog(
        self,
        ledger_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Qldb":
        '''(experimental) Adds a resource of type catalog to the statement.

        https://docs.aws.amazon.com/qldb/latest/developerguide/working.catalog.html

        :param ledger_name: - Identifier for the ledgerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4d8426a9e7421554baff0b52f4ece371e5b61d013593b1993c5f6a88ed62f090)
            check_type(argname="argument ledger_name", value=ledger_name, expected_type=type_hints["ledger_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Qldb", jsii.invoke(self, "onCatalog", [ledger_name, account, region, partition]))

    @jsii.member(jsii_name="onLedger")
    def on_ledger(
        self,
        ledger_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Qldb":
        '''(experimental) Adds a resource of type ledger to the statement.

        https://docs.aws.amazon.com/qldb/latest/developerguide/ledger-structure.html

        :param ledger_name: - Identifier for the ledgerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__33e79725ffe0458181c113282c1c7506a163d022a78447ca77529ca62d8328b8)
            check_type(argname="argument ledger_name", value=ledger_name, expected_type=type_hints["ledger_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Qldb", jsii.invoke(self, "onLedger", [ledger_name, account, region, partition]))

    @jsii.member(jsii_name="onStream")
    def on_stream(
        self,
        ledger_name: builtins.str,
        stream_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Qldb":
        '''(experimental) Adds a resource of type stream to the statement.

        https://docs.aws.amazon.com/qldb/latest/developerguide/streams.html

        :param ledger_name: - Identifier for the ledgerName.
        :param stream_id: - Identifier for the streamId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__57a800b9336b69e72193b2c799165ace48f65639a98f658c84a7b5246e77c654)
            check_type(argname="argument ledger_name", value=ledger_name, expected_type=type_hints["ledger_name"])
            check_type(argname="argument stream_id", value=stream_id, expected_type=type_hints["stream_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Qldb", jsii.invoke(self, "onStream", [ledger_name, stream_id, account, region, partition]))

    @jsii.member(jsii_name="onTable")
    def on_table(
        self,
        ledger_name: builtins.str,
        table_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Qldb":
        '''(experimental) Adds a resource of type table to the statement.

        https://docs.aws.amazon.com/qldb/latest/developerguide/working.manage-tables.html

        :param ledger_name: - Identifier for the ledgerName.
        :param table_id: - Identifier for the tableId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c0882066580677062a821f19917c77490b17b2470d4e6d6c7e77a838722e68e5)
            check_type(argname="argument ledger_name", value=ledger_name, expected_type=type_hints["ledger_name"])
            check_type(argname="argument table_id", value=table_id, expected_type=type_hints["table_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Qldb", jsii.invoke(self, "onTable", [ledger_name, table_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelJournalKinesisStream")
    def to_cancel_journal_kinesis_stream(self) -> "Qldb":
        '''(experimental) Grants permission to cancel a journal kinesis stream.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_CancelJournalKinesisStream.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toCancelJournalKinesisStream", []))

    @jsii.member(jsii_name="toCreateLedger")
    def to_create_ledger(self) -> "Qldb":
        '''(experimental) Grants permission to create a ledger.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_CreateLedger.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toCreateLedger", []))

    @jsii.member(jsii_name="toDeleteLedger")
    def to_delete_ledger(self) -> "Qldb":
        '''(experimental) Grants permission to delete a ledger.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_DeleteLedger.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toDeleteLedger", []))

    @jsii.member(jsii_name="toDescribeJournalKinesisStream")
    def to_describe_journal_kinesis_stream(self) -> "Qldb":
        '''(experimental) Grants permission to describe information about a journal kinesis stream.

        Access Level: Read

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_DescribeJournalKinesisStream.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toDescribeJournalKinesisStream", []))

    @jsii.member(jsii_name="toDescribeJournalS3Export")
    def to_describe_journal_s3_export(self) -> "Qldb":
        '''(experimental) Grants permission to describe information about a journal export job.

        Access Level: Read

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_DescribeJournalS3Export.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toDescribeJournalS3Export", []))

    @jsii.member(jsii_name="toDescribeLedger")
    def to_describe_ledger(self) -> "Qldb":
        '''(experimental) Grants permission to describe a ledger.

        Access Level: Read

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_DescribeLedger.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toDescribeLedger", []))

    @jsii.member(jsii_name="toExecuteStatement")
    def to_execute_statement(self) -> "Qldb":
        '''(experimental) Grants permission to send commands to a ledger via the console.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/console_QLDB.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toExecuteStatement", []))

    @jsii.member(jsii_name="toExportJournalToS3")
    def to_export_journal_to_s3(self) -> "Qldb":
        '''(experimental) Grants permission to export journal contents to an Amazon S3 bucket.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_ExportJournalToS3.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toExportJournalToS3", []))

    @jsii.member(jsii_name="toGetBlock")
    def to_get_block(self) -> "Qldb":
        '''(experimental) Grants permission to retrieve a block from a ledger for a given BlockAddress.

        Access Level: Read

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_GetBlock.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toGetBlock", []))

    @jsii.member(jsii_name="toGetDigest")
    def to_get_digest(self) -> "Qldb":
        '''(experimental) Grants permission to retrieve a digest from a ledger for a given BlockAddress.

        Access Level: Read

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_GetDigest.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toGetDigest", []))

    @jsii.member(jsii_name="toGetRevision")
    def to_get_revision(self) -> "Qldb":
        '''(experimental) Grants permission to retrieve a revision for a given document ID and a given BlockAddress.

        Access Level: Read

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_GetRevision.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toGetRevision", []))

    @jsii.member(jsii_name="toInsertSampleData")
    def to_insert_sample_data(self) -> "Qldb":
        '''(experimental) Grants permission to insert sample application data via the console.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/console_QLDB.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toInsertSampleData", []))

    @jsii.member(jsii_name="toListJournalKinesisStreamsForLedger")
    def to_list_journal_kinesis_streams_for_ledger(self) -> "Qldb":
        '''(experimental) Grants permission to list journal kinesis streams for a specified ledger.

        Access Level: List

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_ListJournalKinesisStreamsForLedger.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toListJournalKinesisStreamsForLedger", []))

    @jsii.member(jsii_name="toListJournalS3Exports")
    def to_list_journal_s3_exports(self) -> "Qldb":
        '''(experimental) Grants permission to list journal export jobs for all ledgers.

        Access Level: List

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_ListJournalS3Exports.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toListJournalS3Exports", []))

    @jsii.member(jsii_name="toListJournalS3ExportsForLedger")
    def to_list_journal_s3_exports_for_ledger(self) -> "Qldb":
        '''(experimental) Grants permission to list journal export jobs for a specified ledger.

        Access Level: List

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_ListJournalS3ExportsForLedger.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toListJournalS3ExportsForLedger", []))

    @jsii.member(jsii_name="toListLedgers")
    def to_list_ledgers(self) -> "Qldb":
        '''(experimental) Grants permission to list existing ledgers.

        Access Level: List

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_ListLedgers.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toListLedgers", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Qldb":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPartiQLCreateIndex")
    def to_parti_ql_create_index(self) -> "Qldb":
        '''(experimental) Grants permission to create an index on a table.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/ql-reference.create-index.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toPartiQLCreateIndex", []))

    @jsii.member(jsii_name="toPartiQLCreateTable")
    def to_parti_ql_create_table(self) -> "Qldb":
        '''(experimental) Grants permission to create a table.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/qldb/latest/developerguide/ql-reference.create-table.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toPartiQLCreateTable", []))

    @jsii.member(jsii_name="toPartiQLDelete")
    def to_parti_ql_delete(self) -> "Qldb":
        '''(experimental) Grants permission to delete documents from a table.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/ql-reference.delete.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toPartiQLDelete", []))

    @jsii.member(jsii_name="toPartiQLDropIndex")
    def to_parti_ql_drop_index(self) -> "Qldb":
        '''(experimental) Grants permission to drop an index from a table.

        Access Level: Write

        Possible conditions:

        - .ifPurge()

        https://docs.aws.amazon.com/qldb/latest/developerguide/ql-reference.drop-index.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toPartiQLDropIndex", []))

    @jsii.member(jsii_name="toPartiQLDropTable")
    def to_parti_ql_drop_table(self) -> "Qldb":
        '''(experimental) Grants permission to drop a table.

        Access Level: Write

        Possible conditions:

        - .ifPurge()

        https://docs.aws.amazon.com/qldb/latest/developerguide/ql-reference.drop-table.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toPartiQLDropTable", []))

    @jsii.member(jsii_name="toPartiQLHistoryFunction")
    def to_parti_ql_history_function(self) -> "Qldb":
        '''(experimental) Grants permission to use the history function on a table.

        Access Level: Read

        https://docs.aws.amazon.com/qldb/latest/developerguide/working.history.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toPartiQLHistoryFunction", []))

    @jsii.member(jsii_name="toPartiQLInsert")
    def to_parti_ql_insert(self) -> "Qldb":
        '''(experimental) Grants permission to insert documents into a table.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/ql-reference.insert.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toPartiQLInsert", []))

    @jsii.member(jsii_name="toPartiQLRedact")
    def to_parti_ql_redact(self) -> "Qldb":
        '''(experimental) Grants permission to redact historic revisions.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/ql-stored-procedures.redact_revision.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toPartiQLRedact", []))

    @jsii.member(jsii_name="toPartiQLSelect")
    def to_parti_ql_select(self) -> "Qldb":
        '''(experimental) Grants permission to select documents from a table.

        Access Level: Read

        https://docs.aws.amazon.com/qldb/latest/developerguide/ql-reference.select.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toPartiQLSelect", []))

    @jsii.member(jsii_name="toPartiQLUndropTable")
    def to_parti_ql_undrop_table(self) -> "Qldb":
        '''(experimental) Grants permission to undrop a table.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/ql-reference.undrop-table.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toPartiQLUndropTable", []))

    @jsii.member(jsii_name="toPartiQLUpdate")
    def to_parti_ql_update(self) -> "Qldb":
        '''(experimental) Grants permission to update existing documents in a table.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/ql-reference.update.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toPartiQLUpdate", []))

    @jsii.member(jsii_name="toSendCommand")
    def to_send_command(self) -> "Qldb":
        '''(experimental) Grants permission to send commands to a ledger.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_QLDB-Session_SendCommand.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toSendCommand", []))

    @jsii.member(jsii_name="toShowCatalog")
    def to_show_catalog(self) -> "Qldb":
        '''(experimental) Grants permission to view a ledger's catalog via the console.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/console_QLDB.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toShowCatalog", []))

    @jsii.member(jsii_name="toStreamJournalToKinesis")
    def to_stream_journal_to_kinesis(self) -> "Qldb":
        '''(experimental) Grants permission to stream journal contents to a Kinesis Data Stream.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_StreamJournalToKinesis.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toStreamJournalToKinesis", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Qldb":
        '''(experimental) Grants permission to add one or more tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Qldb":
        '''(experimental) Grants permission to remove one or more tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateLedger")
    def to_update_ledger(self) -> "Qldb":
        '''(experimental) Grants permission to update properties on a ledger.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_UpdateLedger.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toUpdateLedger", []))

    @jsii.member(jsii_name="toUpdateLedgerPermissionsMode")
    def to_update_ledger_permissions_mode(self) -> "Qldb":
        '''(experimental) Grants permission to update the permissions mode on a ledger.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/API_UpdateLedgerPermissionsMode.html

        :stability: experimental
        '''
        return typing.cast("Qldb", jsii.invoke(self, "toUpdateLedgerPermissionsMode", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2542c05856d7cab183f67aaa4cdba31400df231c40113801ff8f1a8c8fa81d61)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1648f958f666f37705c42f7516d337838532216c59187bf22c4f3e65e5d062c0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Quicksight(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Quicksight",
):
    '''(experimental) Statement provider for service `quicksight <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonquicksight.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `quicksight <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonquicksight.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f5b650ee63a5a86471675c8c85811a9081ed1f8d431fc90dbb6ea5a37a2ba19d)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAllowedEmbeddingDomains")
    def if_allowed_embedding_domains(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Quicksight":
        '''(experimental) Filters access by the allowed embedding domains.

        https://docs.aws.amazon.com/quicksight/latest/user/embedded-dashboards-for-authenticated-users-step-1.html

        Applies to actions:

        - .toGenerateEmbedUrlForAnonymousUser()
        - .toGenerateEmbedUrlForRegisteredUser()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e15105889e506399c9bbe41b803f9cbef3a84046090a7feb6250b966c7ea92b3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Quicksight", jsii.invoke(self, "ifAllowedEmbeddingDomains", [value, operator]))

    @jsii.member(jsii_name="ifDirectoryType")
    def if_directory_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Quicksight":
        '''(experimental) Filters access by the user management options.

        https://docs.aws.amazon.com/quicksight/latest/user/security-scp.html

        Applies to actions:

        - .toSubscribe()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__df6e6f7e00e6c782d9c80586e2aada3759860d7bd9efd24ec1ff5e0722f71ce3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Quicksight", jsii.invoke(self, "ifDirectoryType", [value, operator]))

    @jsii.member(jsii_name="ifEdition")
    def if_edition(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Quicksight":
        '''(experimental) Filters access by the edition of QuickSight.

        https://docs.aws.amazon.com/quicksight/latest/user/security-scp.html

        Applies to actions:

        - .toSubscribe()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3d845619e5eda7075dfa0d6180e3d0a262030973594315dbe2d5586bf71a5a09)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Quicksight", jsii.invoke(self, "ifEdition", [value, operator]))

    @jsii.member(jsii_name="ifIamArn")
    def if_iam_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Quicksight":
        '''(experimental) Filters access by IAM user or role ARN.

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        Applies to actions:

        - .toRegisterUser()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bd83b0771cfc687fd08724f78bfc7fce98802655ac3e8366cce9a9bb6dbc2ac3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Quicksight", jsii.invoke(self, "ifIamArn", [value, operator]))

    @jsii.member(jsii_name="ifSessionName")
    def if_session_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Quicksight":
        '''(experimental) Filters access by session name.

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        Applies to actions:

        - .toRegisterUser()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9b2d28e4b1f23675081bf1c15d8d4dee5f7881a8351525a7e15d7b9632fd9867)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Quicksight", jsii.invoke(self, "ifSessionName", [value, operator]))

    @jsii.member(jsii_name="ifUserName")
    def if_user_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Quicksight":
        '''(experimental) Filters access by user name.

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        Applies to actions:

        - .toCreateGroupMembership()
        - .toDeleteGroupMembership()
        - .toDescribeGroupMembership()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__36fa1b7d2b6d2e4f0eb3c5a3b41032f07e464577e43fd9de36de4782f94cbf7a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Quicksight", jsii.invoke(self, "ifUserName", [value, operator]))

    @jsii.member(jsii_name="onAccount")
    def on_account(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type account to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_AccountInfo.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2ed20da5bd6f5048349cdeba0ee2a805fe4f0b7b0bae587c99163ece17aec1fd)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Quicksight", jsii.invoke(self, "onAccount", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onAnalysis")
    def on_analysis(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type analysis to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Analysis.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__99f18bd5a0a6b5644fc86ff73898cb2e1893f3659b4030f911cdb25c26ab5e64)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Quicksight", jsii.invoke(self, "onAnalysis", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onAssignment")
    def on_assignment(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type assignment to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_IAMPolicyAssignment.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__49f52a58b130f567653510c488ecd96a3aa745753ad7dc4bea011ad17277bf5c)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Quicksight", jsii.invoke(self, "onAssignment", [resource_id, account, partition]))

    @jsii.member(jsii_name="onCustomization")
    def on_customization(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type customization to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_AccountCustomization.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f4cea98dbac9c8bf0ae15b4737838378b4205707b055adc10306a63a784f4a69)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Quicksight", jsii.invoke(self, "onCustomization", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onDashboard")
    def on_dashboard(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type dashboard to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Dashboard.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__45a4e615ba763e8a5455f534204870042cbaf63a33d5ea561b41f83bcf4bf55b)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Quicksight", jsii.invoke(self, "onDashboard", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onDataset")
    def on_dataset(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type dataset to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DataSet.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ae931c1971aae55fe2fae041e61e99df03771921e3caab81837bd94ce887b5f6)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Quicksight", jsii.invoke(self, "onDataset", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onDatasource")
    def on_datasource(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type datasource to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DataSource.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d815bffbc64a29c3f2939ef4b083faf8ed3377aad9d1e5e904c4247102f5eead)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Quicksight", jsii.invoke(self, "onDatasource", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onEmailCustomizationTemplate")
    def on_email_customization_template(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type emailCustomizationTemplate to the statement.

        https://docs.aws.amazon.com/quicksight/latest/user/customizing-quicksight-email-templates.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__56efff9ad5c3f6968b62b86b6649ae93fe0beae022e0e03c54b08fcb942bb05a)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Quicksight", jsii.invoke(self, "onEmailCustomizationTemplate", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onFolder")
    def on_folder(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type folder to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Folder.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__21c800e5a0e79a750edc3389e68a2d0eac0161fd6758eb56dba737ac271b06ef)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Quicksight", jsii.invoke(self, "onFolder", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onGroup")
    def on_group(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type group to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Group.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8c72ea51c73a16409c0d85e2ac2ed686786f6705b78070222d45e87d36188bbf)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Quicksight", jsii.invoke(self, "onGroup", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onIngestion")
    def on_ingestion(
        self,
        dataset_id: builtins.str,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type ingestion to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Ingestion.html

        :param dataset_id: - Identifier for the datasetId.
        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__43507e3343149fcf266bd3b3de5ad21d61627af515abc1284352bdfde46c83ad)
            check_type(argname="argument dataset_id", value=dataset_id, expected_type=type_hints["dataset_id"])
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Quicksight", jsii.invoke(self, "onIngestion", [dataset_id, resource_id, account, region, partition]))

    @jsii.member(jsii_name="onNamespace")
    def on_namespace(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type namespace to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_NamespaceInfoV2.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c713d95abbd94adafc30660c77bdeaa49cfbb588b9d5d03bcbac0540726d136a)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Quicksight", jsii.invoke(self, "onNamespace", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onTemplate")
    def on_template(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type template to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Template.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__422c86e0ed9c63ba4ee8a0dbad096f76d468838e5f3adcc524f9983647cee91f)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Quicksight", jsii.invoke(self, "onTemplate", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onTheme")
    def on_theme(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type theme to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Theme.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d782750e2b0cce99f646a9d623bb35d11a88b7a5826c1fc3e8c5d007626001a8)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Quicksight", jsii.invoke(self, "onTheme", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onTopic")
    def on_topic(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type topic to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_Topic.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eea4b4d48d8d4685deeca3d13ccbf5573b6ff8b6c2ab9f8cf3fa752e1654ea70)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Quicksight", jsii.invoke(self, "onTopic", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onUser")
    def on_user(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Quicksight":
        '''(experimental) Adds a resource of type user to the statement.

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_User.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f07f23e73ff9250c5ccc08fbb302b1145d0cfbab439a3f621bbc0c07cdd53db9)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Quicksight", jsii.invoke(self, "onUser", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toAccountConfigurations")
    def to_account_configurations(self) -> "Quicksight":
        '''(experimental) Grants permission to enable setting default access to AWS resources.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/accessing-data-sources.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toAccountConfigurations", []))

    @jsii.member(jsii_name="toCancelIngestion")
    def to_cancel_ingestion(self) -> "Quicksight":
        '''(experimental) Grants permission to cancel a SPICE ingestions on a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CancelIngestion.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCancelIngestion", []))

    @jsii.member(jsii_name="toCreateAccountCustomization")
    def to_create_account_customization(self) -> "Quicksight":
        '''(experimental) Grants permission to create an account customization for QuickSight account or namespace.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateAccountCustomization.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateAccountCustomization", []))

    @jsii.member(jsii_name="toCreateAccountSubscription")
    def to_create_account_subscription(self) -> "Quicksight":
        '''(experimental) Grants permission to subscribe to QuickSight.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateAccountSubscription.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateAccountSubscription", []))

    @jsii.member(jsii_name="toCreateAdmin")
    def to_create_admin(self) -> "Quicksight":
        '''(experimental) Grants permission to provision Amazon QuickSight administrators, authors, and readers.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateAdmin", []))

    @jsii.member(jsii_name="toCreateAnalysis")
    def to_create_analysis(self) -> "Quicksight":
        '''(experimental) Grants permission to create an analysis from a template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateAnalysis", []))

    @jsii.member(jsii_name="toCreateCustomPermissions")
    def to_create_custom_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to create a custom permissions resource for restricting user access.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateCustomPermissions", []))

    @jsii.member(jsii_name="toCreateDashboard")
    def to_create_dashboard(self) -> "Quicksight":
        '''(experimental) Grants permission to create a QuickSight Dashboard.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateDashboard.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateDashboard", []))

    @jsii.member(jsii_name="toCreateDataSet")
    def to_create_data_set(self) -> "Quicksight":
        '''(experimental) Grants permission to create a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - quicksight:PassDataSource

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateDataSet.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateDataSet", []))

    @jsii.member(jsii_name="toCreateDataSource")
    def to_create_data_source(self) -> "Quicksight":
        '''(experimental) Grants permission to create a data source.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateDataSource.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateDataSource", []))

    @jsii.member(jsii_name="toCreateEmailCustomizationTemplate")
    def to_create_email_customization_template(self) -> "Quicksight":
        '''(experimental) Grants permission to create a QuickSight email customization template.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/customizing-quicksight-email-templates.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateEmailCustomizationTemplate", []))

    @jsii.member(jsii_name="toCreateFolder")
    def to_create_folder(self) -> "Quicksight":
        '''(experimental) Grants permission to create a QuickSight folder.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateFolder.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateFolder", []))

    @jsii.member(jsii_name="toCreateFolderMembership")
    def to_create_folder_membership(self) -> "Quicksight":
        '''(experimental) Grants permission to add a QuickSight Dashboard, Analysis or Dataset to a QuickSight Folder.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateFolderMembership.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateFolderMembership", []))

    @jsii.member(jsii_name="toCreateGroup")
    def to_create_group(self) -> "Quicksight":
        '''(experimental) Grants permission to create a QuickSight group.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateGroup.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateGroup", []))

    @jsii.member(jsii_name="toCreateGroupMembership")
    def to_create_group_membership(self) -> "Quicksight":
        '''(experimental) Grants permission to add a QuickSight user to a QuickSight group.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateGroupMembership.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateGroupMembership", []))

    @jsii.member(jsii_name="toCreateIAMPolicyAssignment")
    def to_create_iam_policy_assignment(self) -> "Quicksight":
        '''(experimental) Grants permission to create an assignment with one specified IAM Policy ARN that will be assigned to specified groups or users of QuickSight.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateIAMPolicyAssignment.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateIAMPolicyAssignment", []))

    @jsii.member(jsii_name="toCreateIngestion")
    def to_create_ingestion(self) -> "Quicksight":
        '''(experimental) Grants permission to start a SPICE ingestion on a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateIngestion.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateIngestion", []))

    @jsii.member(jsii_name="toCreateNamespace")
    def to_create_namespace(self) -> "Quicksight":
        '''(experimental) Grants permission to create an QuickSight namespace.

        Access Level: Write

        Dependent actions:

        - ds:CreateIdentityPoolDirectory

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateNamespace.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateNamespace", []))

    @jsii.member(jsii_name="toCreateReader")
    def to_create_reader(self) -> "Quicksight":
        '''(experimental) Grants permission to provision Amazon QuickSight readers.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateReader", []))

    @jsii.member(jsii_name="toCreateTemplate")
    def to_create_template(self) -> "Quicksight":
        '''(experimental) Grants permission to create a template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateTemplate.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateTemplate", []))

    @jsii.member(jsii_name="toCreateTemplateAlias")
    def to_create_template_alias(self) -> "Quicksight":
        '''(experimental) Grants permission to create a template alias.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateTemplateAlias.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateTemplateAlias", []))

    @jsii.member(jsii_name="toCreateTheme")
    def to_create_theme(self) -> "Quicksight":
        '''(experimental) Grants permission to create a theme.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateTheme.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateTheme", []))

    @jsii.member(jsii_name="toCreateThemeAlias")
    def to_create_theme_alias(self) -> "Quicksight":
        '''(experimental) Grants permission to create an alias for a theme version.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateThemeAlias.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateThemeAlias", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Quicksight":
        '''(experimental) Grants permission to provision Amazon QuickSight authors and readers.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toCreateVPCConnection")
    def to_create_vpc_connection(self) -> "Quicksight":
        '''(experimental) Grants permission to create a VPC connection.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/vpc-creating-a-connection-in-quicksight.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toCreateVPCConnection", []))

    @jsii.member(jsii_name="toDeleteAccountCustomization")
    def to_delete_account_customization(self) -> "Quicksight":
        '''(experimental) Grants permission to delete an account customization for QuickSight account or namespace.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteAccountCustomization.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteAccountCustomization", []))

    @jsii.member(jsii_name="toDeleteAccountSubscription")
    def to_delete_account_subscription(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a QuickSight account.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteAccountSubscription.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteAccountSubscription", []))

    @jsii.member(jsii_name="toDeleteAnalysis")
    def to_delete_analysis(self) -> "Quicksight":
        '''(experimental) Grants permission to delete an analysis.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteAnalysis", []))

    @jsii.member(jsii_name="toDeleteCustomPermissions")
    def to_delete_custom_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a custom permissions resource.

        Access Level: Permissions management

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteCustomPermissions", []))

    @jsii.member(jsii_name="toDeleteDashboard")
    def to_delete_dashboard(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a QuickSight Dashboard.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteDashboard.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteDashboard", []))

    @jsii.member(jsii_name="toDeleteDataSet")
    def to_delete_data_set(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteDataSet.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteDataSet", []))

    @jsii.member(jsii_name="toDeleteDataSource")
    def to_delete_data_source(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a data source.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteDataSource.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteDataSource", []))

    @jsii.member(jsii_name="toDeleteEmailCustomizationTemplate")
    def to_delete_email_customization_template(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a QuickSight email customization template.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/customizing-quicksight-email-templates.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteEmailCustomizationTemplate", []))

    @jsii.member(jsii_name="toDeleteFolder")
    def to_delete_folder(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a QuickSight Folder.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteFolder.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteFolder", []))

    @jsii.member(jsii_name="toDeleteFolderMembership")
    def to_delete_folder_membership(self) -> "Quicksight":
        '''(experimental) Grants permission to remove a QuickSight Dashboard, Analysis or Dataset from a QuickSight Folder.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteFolderMembership.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteFolderMembership", []))

    @jsii.member(jsii_name="toDeleteGroup")
    def to_delete_group(self) -> "Quicksight":
        '''(experimental) Grants permission to remove a user group from QuickSight.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteGroup.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteGroup", []))

    @jsii.member(jsii_name="toDeleteGroupMembership")
    def to_delete_group_membership(self) -> "Quicksight":
        '''(experimental) Grants permission to remove a user from a group so that he/she is no longer a member of the group.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteGroupMembership.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteGroupMembership", []))

    @jsii.member(jsii_name="toDeleteIAMPolicyAssignment")
    def to_delete_iam_policy_assignment(self) -> "Quicksight":
        '''(experimental) Grants permission to update an existing assignment.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteIAMPolicyAssignment.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteIAMPolicyAssignment", []))

    @jsii.member(jsii_name="toDeleteNamespace")
    def to_delete_namespace(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a QuickSight namespace.

        Access Level: Write

        Dependent actions:

        - ds:DeleteDirectory

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteNamespace.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteNamespace", []))

    @jsii.member(jsii_name="toDeleteTemplate")
    def to_delete_template(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a template.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteTemplate.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteTemplate", []))

    @jsii.member(jsii_name="toDeleteTemplateAlias")
    def to_delete_template_alias(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a template alias.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteTemplateAlias.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteTemplateAlias", []))

    @jsii.member(jsii_name="toDeleteTheme")
    def to_delete_theme(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a theme.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteTheme.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteTheme", []))

    @jsii.member(jsii_name="toDeleteThemeAlias")
    def to_delete_theme_alias(self) -> "Quicksight":
        '''(experimental) Grants permission to delete the alias of a theme.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteThemeAlias.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteThemeAlias", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a QuickSight user, given the user name.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDeleteUserByPrincipalId")
    def to_delete_user_by_principal_id(self) -> "Quicksight":
        '''(experimental) Grants permission to deletes a user identified by its principal ID.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteUserByPrincipalId.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteUserByPrincipalId", []))

    @jsii.member(jsii_name="toDeleteVPCConnection")
    def to_delete_vpc_connection(self) -> "Quicksight":
        '''(experimental) Grants permission to delete a VPC connection.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/vpc-creating-a-connection-in-quicksight.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDeleteVPCConnection", []))

    @jsii.member(jsii_name="toDescribeAccountCustomization")
    def to_describe_account_customization(self) -> "Quicksight":
        '''(experimental) Grants permission to describe an account customization for QuickSight account or namespace.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeAccountCustomization.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeAccountCustomization", []))

    @jsii.member(jsii_name="toDescribeAccountSettings")
    def to_describe_account_settings(self) -> "Quicksight":
        '''(experimental) Grants permission to describe the administrative account settings for QuickSight account.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeAccountSettings.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeAccountSettings", []))

    @jsii.member(jsii_name="toDescribeAccountSubscription")
    def to_describe_account_subscription(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a QuickSight account.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeAccountSubscription.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeAccountSubscription", []))

    @jsii.member(jsii_name="toDescribeAnalysis")
    def to_describe_analysis(self) -> "Quicksight":
        '''(experimental) Grants permission to describe an analysis.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeAnalysis", []))

    @jsii.member(jsii_name="toDescribeAnalysisPermissions")
    def to_describe_analysis_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to describe permissions for an analysis.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeAnalysisPermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeAnalysisPermissions", []))

    @jsii.member(jsii_name="toDescribeCustomPermissions")
    def to_describe_custom_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a custom permissions resource in a QuickSight account.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeCustomPermissions", []))

    @jsii.member(jsii_name="toDescribeDashboard")
    def to_describe_dashboard(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a QuickSight Dashboard.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeDashboard.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeDashboard", []))

    @jsii.member(jsii_name="toDescribeDashboardPermissions")
    def to_describe_dashboard_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to describe permissions for a QuickSight Dashboard.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeDashboardPermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeDashboardPermissions", []))

    @jsii.member(jsii_name="toDescribeDataSet")
    def to_describe_data_set(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a dataset.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeDataSet.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeDataSet", []))

    @jsii.member(jsii_name="toDescribeDataSetPermissions")
    def to_describe_data_set_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to describe the resource policy of a dataset.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeDataSetPermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeDataSetPermissions", []))

    @jsii.member(jsii_name="toDescribeDataSource")
    def to_describe_data_source(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a data source.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeDataSource.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeDataSource", []))

    @jsii.member(jsii_name="toDescribeDataSourcePermissions")
    def to_describe_data_source_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to describe the resource policy of a data source.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeDataSourcePermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeDataSourcePermissions", []))

    @jsii.member(jsii_name="toDescribeEmailCustomizationTemplate")
    def to_describe_email_customization_template(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a QuickSight email customization template.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/user/customizing-quicksight-email-templates.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeEmailCustomizationTemplate", []))

    @jsii.member(jsii_name="toDescribeFolder")
    def to_describe_folder(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a QuickSight Folder.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeFolder.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeFolder", []))

    @jsii.member(jsii_name="toDescribeFolderPermissions")
    def to_describe_folder_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to describe permissions for a QuickSight Folder.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeFolderPermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeFolderPermissions", []))

    @jsii.member(jsii_name="toDescribeFolderResolvedPermissions")
    def to_describe_folder_resolved_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to describe resolved permissions for a QuickSight Folder.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeFolderResolvedPermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeFolderResolvedPermissions", []))

    @jsii.member(jsii_name="toDescribeGroup")
    def to_describe_group(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a QuickSight group.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeGroup.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeGroup", []))

    @jsii.member(jsii_name="toDescribeGroupMembership")
    def to_describe_group_membership(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a QuickSight group member.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeGroupMembership.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeGroupMembership", []))

    @jsii.member(jsii_name="toDescribeIAMPolicyAssignment")
    def to_describe_iam_policy_assignment(self) -> "Quicksight":
        '''(experimental) Grants permission to describe an existing assignment.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeIAMPolicyAssignment.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeIAMPolicyAssignment", []))

    @jsii.member(jsii_name="toDescribeIngestion")
    def to_describe_ingestion(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a SPICE ingestion on a dataset.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeIngestion.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeIngestion", []))

    @jsii.member(jsii_name="toDescribeIpRestriction")
    def to_describe_ip_restriction(self) -> "Quicksight":
        '''(experimental) Grants permission to describe the IP restrictions for QuickSight account.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeIpRestriction.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeIpRestriction", []))

    @jsii.member(jsii_name="toDescribeNamespace")
    def to_describe_namespace(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a QuickSight namespace.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeNamespace.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeNamespace", []))

    @jsii.member(jsii_name="toDescribeTemplate")
    def to_describe_template(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a template.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeTemplate.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeTemplate", []))

    @jsii.member(jsii_name="toDescribeTemplateAlias")
    def to_describe_template_alias(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a template alias.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeTemplateAlias.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeTemplateAlias", []))

    @jsii.member(jsii_name="toDescribeTemplatePermissions")
    def to_describe_template_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to describe permissions for a template.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeTemplatePermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeTemplatePermissions", []))

    @jsii.member(jsii_name="toDescribeTheme")
    def to_describe_theme(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a theme.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeTheme.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeTheme", []))

    @jsii.member(jsii_name="toDescribeThemeAlias")
    def to_describe_theme_alias(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a theme alias.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeThemeAlias.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeThemeAlias", []))

    @jsii.member(jsii_name="toDescribeThemePermissions")
    def to_describe_theme_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to describe permissions for a theme.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeThemePermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeThemePermissions", []))

    @jsii.member(jsii_name="toDescribeUser")
    def to_describe_user(self) -> "Quicksight":
        '''(experimental) Grants permission to describe a QuickSight user given the user name.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeUser.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toDescribeUser", []))

    @jsii.member(jsii_name="toGenerateEmbedUrlForAnonymousUser")
    def to_generate_embed_url_for_anonymous_user(self) -> "Quicksight":
        '''(experimental) Grants permission to generate a URL used to embed a QuickSight Dashboard or Q Topic for a user not registered with QuickSight.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAllowedEmbeddingDomains()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_GenerateEmbedUrlForAnonymousUser.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toGenerateEmbedUrlForAnonymousUser", []))

    @jsii.member(jsii_name="toGenerateEmbedUrlForRegisteredUser")
    def to_generate_embed_url_for_registered_user(self) -> "Quicksight":
        '''(experimental) Grants permission to generate a URL used to embed a QuickSight Dashboard for a user registered with QuickSight.

        Access Level: Write

        Possible conditions:

        - .ifAllowedEmbeddingDomains()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_GenerateEmbedUrlForRegisteredUser.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toGenerateEmbedUrlForRegisteredUser", []))

    @jsii.member(jsii_name="toGetAnonymousUserEmbedUrl")
    def to_get_anonymous_user_embed_url(self) -> "Quicksight":
        '''(experimental) Grants permission to get a URL used to embed a QuickSight Dashboard for a user not registered with QuickSight.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toGetAnonymousUserEmbedUrl", []))

    @jsii.member(jsii_name="toGetAuthCode")
    def to_get_auth_code(self) -> "Quicksight":
        '''(experimental) Grants permission to get an auth code representing a QuickSight user.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toGetAuthCode", []))

    @jsii.member(jsii_name="toGetDashboardEmbedUrl")
    def to_get_dashboard_embed_url(self) -> "Quicksight":
        '''(experimental) Grants permission to get a URL used to embed a QuickSight Dashboard.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_GetDashboardEmbedUrl.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toGetDashboardEmbedUrl", []))

    @jsii.member(jsii_name="toGetGroupMapping")
    def to_get_group_mapping(self) -> "Quicksight":
        '''(experimental) Grants permission to use Amazon QuickSight, in Enterprise edition, to identify and display the Microsoft Active Directory (Microsoft Active Directory) directory groups that are mapped to roles in Amazon QuickSight.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toGetGroupMapping", []))

    @jsii.member(jsii_name="toGetSessionEmbedUrl")
    def to_get_session_embed_url(self) -> "Quicksight":
        '''(experimental) Grants permission to get a URL to embed QuickSight console experience.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_GetSessionEmbedUrl.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toGetSessionEmbedUrl", []))

    @jsii.member(jsii_name="toListAnalyses")
    def to_list_analyses(self) -> "Quicksight":
        '''(experimental) Grants permission to list all analyses in an account.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListAnalyses.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListAnalyses", []))

    @jsii.member(jsii_name="toListCustomPermissions")
    def to_list_custom_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to list custom permissions resources in QuickSight account.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListCustomPermissions", []))

    @jsii.member(jsii_name="toListDashboards")
    def to_list_dashboards(self) -> "Quicksight":
        '''(experimental) Grants permission to list all Dashboards in a QuickSight Account.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListDashboards.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListDashboards", []))

    @jsii.member(jsii_name="toListDashboardVersions")
    def to_list_dashboard_versions(self) -> "Quicksight":
        '''(experimental) Grants permission to list all versions of a QuickSight Dashboard.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListDashboardVersions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListDashboardVersions", []))

    @jsii.member(jsii_name="toListDataSets")
    def to_list_data_sets(self) -> "Quicksight":
        '''(experimental) Grants permission to list all datasets.

        Access Level: List

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListDataSets.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListDataSets", []))

    @jsii.member(jsii_name="toListDataSources")
    def to_list_data_sources(self) -> "Quicksight":
        '''(experimental) Grants permission to list all data sources.

        Access Level: List

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListDataSources.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListDataSources", []))

    @jsii.member(jsii_name="toListFolderMembers")
    def to_list_folder_members(self) -> "Quicksight":
        '''(experimental) Grants permission to list all members in a folder.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListFolderMembers.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListFolderMembers", []))

    @jsii.member(jsii_name="toListFolders")
    def to_list_folders(self) -> "Quicksight":
        '''(experimental) Grants permission to list all Folders in a QuickSight Account.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListFolders.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListFolders", []))

    @jsii.member(jsii_name="toListGroupMemberships")
    def to_list_group_memberships(self) -> "Quicksight":
        '''(experimental) Grants permission to list member users in a group.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListGroupMemberships.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListGroupMemberships", []))

    @jsii.member(jsii_name="toListGroups")
    def to_list_groups(self) -> "Quicksight":
        '''(experimental) Grants permission to list all user groups in QuickSight.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListGroups.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListGroups", []))

    @jsii.member(jsii_name="toListIAMPolicyAssignments")
    def to_list_iam_policy_assignments(self) -> "Quicksight":
        '''(experimental) Grants permission to list all assignments in the current Amazon QuickSight account.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListIAMPolicyAssignments.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListIAMPolicyAssignments", []))

    @jsii.member(jsii_name="toListIAMPolicyAssignmentsForUser")
    def to_list_iam_policy_assignments_for_user(self) -> "Quicksight":
        '''(experimental) Grants permission to list all assignments assigned to a user and the groups it belongs.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListIAMPolicyAssignmentsForUser.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListIAMPolicyAssignmentsForUser", []))

    @jsii.member(jsii_name="toListIngestions")
    def to_list_ingestions(self) -> "Quicksight":
        '''(experimental) Grants permission to list all SPICE ingestions on a dataset.

        Access Level: List

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListIngestions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListIngestions", []))

    @jsii.member(jsii_name="toListNamespaces")
    def to_list_namespaces(self) -> "Quicksight":
        '''(experimental) Grants permission to lists all namespaces in a QuickSight account.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListNamespaces.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListNamespaces", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Quicksight":
        '''(experimental) Grants permission to list tags of a QuickSight resource.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTemplateAliases")
    def to_list_template_aliases(self) -> "Quicksight":
        '''(experimental) Grants permission to list all aliases for a template.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListTemplateAliases.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListTemplateAliases", []))

    @jsii.member(jsii_name="toListTemplates")
    def to_list_templates(self) -> "Quicksight":
        '''(experimental) Grants permission to list all templates in a QuickSight account.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListTemplates.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListTemplates", []))

    @jsii.member(jsii_name="toListTemplateVersions")
    def to_list_template_versions(self) -> "Quicksight":
        '''(experimental) Grants permission to list all versions of a template.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListTemplateVersions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListTemplateVersions", []))

    @jsii.member(jsii_name="toListThemeAliases")
    def to_list_theme_aliases(self) -> "Quicksight":
        '''(experimental) Grants permission to list all aliases of a theme.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListThemeAliases.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListThemeAliases", []))

    @jsii.member(jsii_name="toListThemes")
    def to_list_themes(self) -> "Quicksight":
        '''(experimental) Grants permission to list all themes in an account.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListThemes.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListThemes", []))

    @jsii.member(jsii_name="toListThemeVersions")
    def to_list_theme_versions(self) -> "Quicksight":
        '''(experimental) Grants permission to list all versions of a theme.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListThemeVersions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListThemeVersions", []))

    @jsii.member(jsii_name="toListUserGroups")
    def to_list_user_groups(self) -> "Quicksight":
        '''(experimental) Grants permission to list groups that a given user is a member of.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListUserGroups.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListUserGroups", []))

    @jsii.member(jsii_name="toListUsers")
    def to_list_users(self) -> "Quicksight":
        '''(experimental) Grants permission to list all of the QuickSight users belonging to this account.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListUsers.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toListUsers", []))

    @jsii.member(jsii_name="toPassDataSet")
    def to_pass_data_set(self) -> "Quicksight":
        '''(experimental) Grants permission to use a dataset for a template.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/qs-api-overview.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toPassDataSet", []))

    @jsii.member(jsii_name="toPassDataSource")
    def to_pass_data_source(self) -> "Quicksight":
        '''(experimental) Grants permission to use a data source for a data set.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/qs-api-overview.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toPassDataSource", []))

    @jsii.member(jsii_name="toRegisterUser")
    def to_register_user(self) -> "Quicksight":
        '''(experimental) Grants permission to create a QuickSight user, whose identity is associated with the IAM identity/role specified in the request.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_RegisterUser.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toRegisterUser", []))

    @jsii.member(jsii_name="toRestoreAnalysis")
    def to_restore_analysis(self) -> "Quicksight":
        '''(experimental) Grants permission to restore a deleted analysis.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_RestoreAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toRestoreAnalysis", []))

    @jsii.member(jsii_name="toScopeDownPolicy")
    def to_scope_down_policy(self) -> "Quicksight":
        '''(experimental) Grants permission to manage scoping policies for permissions to AWS resources.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/accessing-data-sources.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toScopeDownPolicy", []))

    @jsii.member(jsii_name="toSearchAnalyses")
    def to_search_analyses(self) -> "Quicksight":
        '''(experimental) Grants permission to search for a sub-set of analyses.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SearchAnalyses.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toSearchAnalyses", []))

    @jsii.member(jsii_name="toSearchDashboards")
    def to_search_dashboards(self) -> "Quicksight":
        '''(experimental) Grants permission to search for a sub-set of QuickSight Dashboards.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SearchDashboards.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toSearchDashboards", []))

    @jsii.member(jsii_name="toSearchDataSets")
    def to_search_data_sets(self) -> "Quicksight":
        '''(experimental) Grants permission to search for a sub-set of QuickSight DatSets.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SearchDataSets.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toSearchDataSets", []))

    @jsii.member(jsii_name="toSearchDataSources")
    def to_search_data_sources(self) -> "Quicksight":
        '''(experimental) Grants permission to search for a sub-set of QuickSight Data Sources.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SearchDataSources.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toSearchDataSources", []))

    @jsii.member(jsii_name="toSearchDirectoryGroups")
    def to_search_directory_groups(self) -> "Quicksight":
        '''(experimental) Grants permission to use Amazon QuickSight, in Enterprise edition, to display your Microsoft Active Directory directory groups so that you can choose which ones to map to roles in Amazon QuickSight.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toSearchDirectoryGroups", []))

    @jsii.member(jsii_name="toSearchFolders")
    def to_search_folders(self) -> "Quicksight":
        '''(experimental) Grants permission to search for a sub-set of QuickSight Folders.

        Access Level: Read

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SearchFolders.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toSearchFolders", []))

    @jsii.member(jsii_name="toSearchGroups")
    def to_search_groups(self) -> "Quicksight":
        '''(experimental) Grants permission to search for a sub-set of QuickSight groups.

        Access Level: List

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_SearchGroups.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toSearchGroups", []))

    @jsii.member(jsii_name="toSetGroupMapping")
    def to_set_group_mapping(self) -> "Quicksight":
        '''(experimental) Grants permission to use Amazon QuickSight, in Enterprise edition, to display your Microsoft Active Directory directory groups so that you can choose which ones to map to roles in Amazon QuickSight.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toSetGroupMapping", []))

    @jsii.member(jsii_name="toSubscribe")
    def to_subscribe(self) -> "Quicksight":
        '''(experimental) Grants permission to subscribe to Amazon QuickSight, and also to allow the user to upgrade the subscription to Enterprise edition.

        Access Level: Write

        Possible conditions:

        - .ifEdition()
        - .ifDirectoryType()

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toSubscribe", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Quicksight":
        '''(experimental) Grants permission to add tags to a QuickSight resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUnsubscribe")
    def to_unsubscribe(self) -> "Quicksight":
        '''(experimental) Grants permission to unsubscribe from Amazon QuickSight, which permanently deletes all users and their resources from Amazon QuickSight.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUnsubscribe", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Quicksight":
        '''(experimental) Grants permission to remove tags from a QuickSight resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAccountCustomization")
    def to_update_account_customization(self) -> "Quicksight":
        '''(experimental) Grants permission to update an account customization for QuickSight account or namespace.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateAccountCustomization.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateAccountCustomization", []))

    @jsii.member(jsii_name="toUpdateAccountSettings")
    def to_update_account_settings(self) -> "Quicksight":
        '''(experimental) Grants permission to update the administrative account settings for QuickSight account.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateAccountSettings.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateAccountSettings", []))

    @jsii.member(jsii_name="toUpdateAnalysis")
    def to_update_analysis(self) -> "Quicksight":
        '''(experimental) Grants permission to update an analysis.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateAnalysis", []))

    @jsii.member(jsii_name="toUpdateAnalysisPermissions")
    def to_update_analysis_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to update permissions for an analysis.

        Access Level: Permissions management

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateAnalysisPermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateAnalysisPermissions", []))

    @jsii.member(jsii_name="toUpdateCustomPermissions")
    def to_update_custom_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to update a custom permissions resource.

        Access Level: Permissions management

        https://docs.aws.amazon.com/quicksight/latest/user/iam-actions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateCustomPermissions", []))

    @jsii.member(jsii_name="toUpdateDashboard")
    def to_update_dashboard(self) -> "Quicksight":
        '''(experimental) Grants permission to update a QuickSight Dashboard.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateDashboard.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateDashboard", []))

    @jsii.member(jsii_name="toUpdateDashboardPermissions")
    def to_update_dashboard_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to update permissions for a QuickSight Dashboard.

        Access Level: Permissions management

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateDashboardPermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateDashboardPermissions", []))

    @jsii.member(jsii_name="toUpdateDashboardPublishedVersion")
    def to_update_dashboard_published_version(self) -> "Quicksight":
        '''(experimental) Grants permission to update a QuickSight Dashboard’s Published Version.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateDashboardPublishedVersion.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateDashboardPublishedVersion", []))

    @jsii.member(jsii_name="toUpdateDataSet")
    def to_update_data_set(self) -> "Quicksight":
        '''(experimental) Grants permission to update a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - quicksight:PassDataSource

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateDataSet.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateDataSet", []))

    @jsii.member(jsii_name="toUpdateDataSetPermissions")
    def to_update_data_set_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to update the resource policy of a dataset.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateDataSetPermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateDataSetPermissions", []))

    @jsii.member(jsii_name="toUpdateDataSource")
    def to_update_data_source(self) -> "Quicksight":
        '''(experimental) Grants permission to update a data source.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateDataSource.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateDataSource", []))

    @jsii.member(jsii_name="toUpdateDataSourcePermissions")
    def to_update_data_source_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to update the resource policy of a data source.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateDataSourcePermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateDataSourcePermissions", []))

    @jsii.member(jsii_name="toUpdateEmailCustomizationTemplate")
    def to_update_email_customization_template(self) -> "Quicksight":
        '''(experimental) Grants permission to update a QuickSight email customization template.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/customizing-quicksight-email-templates.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateEmailCustomizationTemplate", []))

    @jsii.member(jsii_name="toUpdateFolder")
    def to_update_folder(self) -> "Quicksight":
        '''(experimental) Grants permission to update a QuickSight Folder.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateFolder.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateFolder", []))

    @jsii.member(jsii_name="toUpdateFolderPermissions")
    def to_update_folder_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to update permissions for a QuickSight Folder.

        Access Level: Permissions management

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateFolderPermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateFolderPermissions", []))

    @jsii.member(jsii_name="toUpdateGroup")
    def to_update_group(self) -> "Quicksight":
        '''(experimental) Grants permission to change group description.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateGroup.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateGroup", []))

    @jsii.member(jsii_name="toUpdateIAMPolicyAssignment")
    def to_update_iam_policy_assignment(self) -> "Quicksight":
        '''(experimental) Grants permission to update an existing assignment.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateIAMPolicyAssignment.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateIAMPolicyAssignment", []))

    @jsii.member(jsii_name="toUpdateIpRestriction")
    def to_update_ip_restriction(self) -> "Quicksight":
        '''(experimental) Grants permission to update the IP restrictions for QuickSight account.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateIpRestriction.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateIpRestriction", []))

    @jsii.member(jsii_name="toUpdatePublicSharingSettings")
    def to_update_public_sharing_settings(self) -> "Quicksight":
        '''(experimental) Grants permission to enable or disable public sharing on an account.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdatePublicSharingSettings.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdatePublicSharingSettings", []))

    @jsii.member(jsii_name="toUpdateResourcePermissions")
    def to_update_resource_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to update resource-level permissions in QuickSight.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/user/security_iam_service-with-iam.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateResourcePermissions", []))

    @jsii.member(jsii_name="toUpdateTemplate")
    def to_update_template(self) -> "Quicksight":
        '''(experimental) Grants permission to update a template.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateTemplate.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateTemplate", []))

    @jsii.member(jsii_name="toUpdateTemplateAlias")
    def to_update_template_alias(self) -> "Quicksight":
        '''(experimental) Grants permission to update a template alias.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateTemplateAlias.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateTemplateAlias", []))

    @jsii.member(jsii_name="toUpdateTemplatePermissions")
    def to_update_template_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to update permissions for a template.

        Access Level: Permissions management

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateTemplatePermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateTemplatePermissions", []))

    @jsii.member(jsii_name="toUpdateTheme")
    def to_update_theme(self) -> "Quicksight":
        '''(experimental) Grants permission to update a theme.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateTheme.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateTheme", []))

    @jsii.member(jsii_name="toUpdateThemeAlias")
    def to_update_theme_alias(self) -> "Quicksight":
        '''(experimental) Grants permission to update the alias of a theme.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateThemeAlias.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateThemeAlias", []))

    @jsii.member(jsii_name="toUpdateThemePermissions")
    def to_update_theme_permissions(self) -> "Quicksight":
        '''(experimental) Grants permission to update permissions for a theme.

        Access Level: Permissions management

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateThemePermissions.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateThemePermissions", []))

    @jsii.member(jsii_name="toUpdateUser")
    def to_update_user(self) -> "Quicksight":
        '''(experimental) Grants permission to update an Amazon QuickSight user.

        Access Level: Write

        https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateUser.html

        :stability: experimental
        '''
        return typing.cast("Quicksight", jsii.invoke(self, "toUpdateUser", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5c9b76a2f9c030a872af251f3975fa13d7a54e3775d1103db2f8fac2dc687f62)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__98cbb69d70a258c1ec4720497c6f44b6b547d0a9611ddd416e8171da124f3633)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Ram(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ram"):
    '''(experimental) Statement provider for service `ram <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsresourceaccessmanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ram <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsresourceaccessmanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3822d1b4cc4a9f83f686273ef60a69c1983dc0422ac7028bb074e4b327ea5f4b)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAllowsExternalPrincipals")
    def if_allows_external_principals(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Ram":
        '''(experimental) Filters access based on resource shares that allow or deny sharing with external principals.

        For example, specify true if the action can only be performed on resource shares that allow sharing with external principals. External principals are AWS accounts that are outside of its AWS organization

        https://docs.aws.amazon.com/ram/latest/userguide/iam-policies.html#iam-policies-condition

        Applies to actions:

        - .toAssociateResourceShare()
        - .toDeleteResourceShare()
        - .toDisassociateResourceShare()
        - .toListResourceSharePermissions()
        - .toUpdateResourceShare()

        Applies to resource types:

        - resource-share

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__edc29dc6472e888320b0f91ea51686478fd8c997393e73e2bc0c0f049bf5f8c2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Ram", jsii.invoke(self, "ifAllowsExternalPrincipals", [value]))

    @jsii.member(jsii_name="ifPermissionArn")
    def if_permission_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ram":
        '''(experimental) Filters access based on the specified Permission ARN.

        https://docs.aws.amazon.com/ram/latest/userguide/iam-policies.html#iam-policies-condition

        Applies to actions:

        - .toGetPermission()

        Applies to resource types:

        - permission

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d4b5740df16a20cce153a878124a1effc6abfc10ed78b3f9070e3ba63c655aa6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ram", jsii.invoke(self, "ifPermissionArn", [value, operator]))

    @jsii.member(jsii_name="ifPermissionResourceType")
    def if_permission_resource_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ram":
        '''(experimental) Filters access based on permissions of specified resource type.

        https://docs.aws.amazon.com/ram/latest/userguide/iam-policies.html#iam-policies-condition

        Applies to resource types:

        - permission

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__08beefe5aeaf1a60b6b87b30aae9fa69bde0e974fa06710ce7afd1376846e5d7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ram", jsii.invoke(self, "ifPermissionResourceType", [value, operator]))

    @jsii.member(jsii_name="ifPrincipal")
    def if_principal(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ram":
        '''(experimental) Filters access based on the format of the specified principal.

        https://docs.aws.amazon.com/ram/latest/userguide/iam-policies.html#iam-policies-condition

        Applies to actions:

        - .toAssociateResourceShare()
        - .toCreateResourceShare()
        - .toDisassociateResourceShare()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c55db46eb4ef21c0d822f1502de918da1c09d752828c2ac48d53d9b3ebeb44d9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ram", jsii.invoke(self, "ifPrincipal", [value, operator]))

    @jsii.member(jsii_name="ifRequestedAllowsExternalPrincipals")
    def if_requested_allows_external_principals(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Ram":
        '''(experimental) Filters access based on the specified value for 'allowExternalPrincipals'.

        External principals are AWS accounts that are outside of its AWS Organization

        https://docs.aws.amazon.com/ram/latest/userguide/iam-policies.html#iam-policies-condition

        Applies to actions:

        - .toCreateResourceShare()
        - .toUpdateResourceShare()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3e1394f3939b98d541ae36ba308ecfbfd65a8c6ef02611f321b89d27b6dfc6bf)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Ram", jsii.invoke(self, "ifRequestedAllowsExternalPrincipals", [value]))

    @jsii.member(jsii_name="ifRequestedResourceType")
    def if_requested_resource_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ram":
        '''(experimental) Filters access based on the specified resource type.

        https://docs.aws.amazon.com/ram/latest/userguide/iam-policies.html#iam-policies-condition

        Applies to actions:

        - .toAssociateResourceShare()
        - .toCreateResourceShare()
        - .toDisassociateResourceShare()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__30a9f30e15645205eb4130141d3304d032a65faa7d2f975853b16a8f67f8f3c4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ram", jsii.invoke(self, "ifRequestedResourceType", [value, operator]))

    @jsii.member(jsii_name="ifResourceArn")
    def if_resource_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ram":
        '''(experimental) Filters access based on a resource with the specified ARN.

        https://docs.aws.amazon.com/ram/latest/userguide/iam-policies.html#iam-policies-condition

        Applies to actions:

        - .toAssociateResourceShare()
        - .toCreateResourceShare()
        - .toDisassociateResourceShare()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__19ef0498863dae5ce81fa07a03dc63f4ce88383f2b8477e6b60b2540f899ec08)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ram", jsii.invoke(self, "ifResourceArn", [value, operator]))

    @jsii.member(jsii_name="ifResourceShareName")
    def if_resource_share_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ram":
        '''(experimental) Filters access based on a resource share with the specified name.

        https://docs.aws.amazon.com/ram/latest/userguide/iam-policies.html#iam-policies-condition

        Applies to actions:

        - .toAssociateResourceShare()
        - .toDeleteResourceShare()
        - .toDisassociateResourceShare()
        - .toListResourceSharePermissions()
        - .toUpdateResourceShare()

        Applies to resource types:

        - resource-share

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__29de824846fd33a5fcbb51fa4fa317df22e60bbd07c8c276e6667b237f708c8b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ram", jsii.invoke(self, "ifResourceShareName", [value, operator]))

    @jsii.member(jsii_name="ifShareOwnerAccountId")
    def if_share_owner_account_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ram":
        '''(experimental) Filters access based on resource shares owned by a specific account.

        For example, you can use this condition key to specify which resource share invitations can be accepted or rejected based on the resource share owner's account ID

        https://docs.aws.amazon.com/ram/latest/userguide/iam-policies.html#iam-policies-condition

        Applies to actions:

        - .toAcceptResourceShareInvitation()
        - .toRejectResourceShareInvitation()

        Applies to resource types:

        - resource-share-invitation

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5e66a5957ef77079a9549af022fa1a1721146af39fbe75fd03da9f252cd8dfe1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ram", jsii.invoke(self, "ifShareOwnerAccountId", [value, operator]))

    @jsii.member(jsii_name="onPermission")
    def on_permission(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ram":
        '''(experimental) Adds a resource of type permission to the statement.

        https://docs.aws.amazon.com/ram/latest/APIReference/API_ResourceSharePermissionDetail.html

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifPermissionArn() - .ifPermissionResourceType()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ae8f56f25edb2679a6332dd9d802fb0a889002377848344754308333e80e8f63)
            check_type(argname="argument resource_path", value=resource_path, expected_type=type_hints["resource_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ram", jsii.invoke(self, "onPermission", [resource_path, account, partition]))

    @jsii.member(jsii_name="onResourceShare")
    def on_resource_share(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ram":
        '''(experimental) Adds a resource of type resource-share to the statement.

        https://docs.aws.amazon.com/ram/latest/APIReference/API_ResourceShare.html

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifAllowsExternalPrincipals() - .ifResourceShareName()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eab14802bb8bb4a68566c7a4f08f47e6518e5e3bb4ce0559c9be70a422a45747)
            check_type(argname="argument resource_path", value=resource_path, expected_type=type_hints["resource_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ram", jsii.invoke(self, "onResourceShare", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onResourceShareInvitation")
    def on_resource_share_invitation(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ram":
        '''(experimental) Adds a resource of type resource-share-invitation to the statement.

        https://docs.aws.amazon.com/ram/latest/APIReference/API_ResourceShareInvitation.html

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifShareOwnerAccountId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ff49915dd987b331ad3209995f07e5fba49eba6e7cc1523a27ef44f2b545799e)
            check_type(argname="argument resource_path", value=resource_path, expected_type=type_hints["resource_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ram", jsii.invoke(self, "onResourceShareInvitation", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="toAcceptResourceShareInvitation")
    def to_accept_resource_share_invitation(self) -> "Ram":
        '''(experimental) Grants permission to accept the specified resource share invitation.

        Access Level: Write

        Possible conditions:

        - .ifShareOwnerAccountId()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_AcceptResourceShareInvitation.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toAcceptResourceShareInvitation", []))

    @jsii.member(jsii_name="toAssociateResourceShare")
    def to_associate_resource_share(self) -> "Ram":
        '''(experimental) Grants permission to associate resource(s) and/or principal(s) to a resource share.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifResourceShareName()
        - .ifAllowsExternalPrincipals()
        - .ifPrincipal()
        - .ifRequestedResourceType()
        - .ifResourceArn()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_AssociateResourceShare.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toAssociateResourceShare", []))

    @jsii.member(jsii_name="toAssociateResourceSharePermission")
    def to_associate_resource_share_permission(self) -> "Ram":
        '''(experimental) Grants permission to associate a Permission with a Resource Share.

        Access Level: Write

        https://docs.aws.amazon.com/ram/latest/APIReference/API_AssociateResourceSharePermission.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toAssociateResourceSharePermission", []))

    @jsii.member(jsii_name="toCreateResourceShare")
    def to_create_resource_share(self) -> "Ram":
        '''(experimental) Grants permission to create a resource share with provided resource(s) and/or principal(s).

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRequestedResourceType()
        - .ifResourceArn()
        - .ifRequestedAllowsExternalPrincipals()
        - .ifPrincipal()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/ram/latest/APIReference/API_CreateResourceShare.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toCreateResourceShare", []))

    @jsii.member(jsii_name="toDeleteResourceShare")
    def to_delete_resource_share(self) -> "Ram":
        '''(experimental) Grants permission to delete resource share.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifResourceShareName()
        - .ifAllowsExternalPrincipals()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_DeleteResourceShare.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toDeleteResourceShare", []))

    @jsii.member(jsii_name="toDisassociateResourceShare")
    def to_disassociate_resource_share(self) -> "Ram":
        '''(experimental) Grants permission to disassociate resource(s) and/or principal(s) from a resource share.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifResourceShareName()
        - .ifAllowsExternalPrincipals()
        - .ifPrincipal()
        - .ifRequestedResourceType()
        - .ifResourceArn()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_DisassociateResourceShare.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toDisassociateResourceShare", []))

    @jsii.member(jsii_name="toDisassociateResourceSharePermission")
    def to_disassociate_resource_share_permission(self) -> "Ram":
        '''(experimental) Grants permission to disassociate a Permission from a Resource Share.

        Access Level: Write

        https://docs.aws.amazon.com/ram/latest/APIReference/API_DisassociateResourceSharePermission.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toDisassociateResourceSharePermission", []))

    @jsii.member(jsii_name="toEnableSharingWithAwsOrganization")
    def to_enable_sharing_with_aws_organization(self) -> "Ram":
        '''(experimental) Grants permission to access customer's organization and create a SLR in the customer's account.

        Access Level: Permissions management

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - organizations:DescribeOrganization
        - organizations:EnableAWSServiceAccess

        https://docs.aws.amazon.com/ram/latest/APIReference/API_EnableSharingWithAwsOrganization.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toEnableSharingWithAwsOrganization", []))

    @jsii.member(jsii_name="toGetPermission")
    def to_get_permission(self) -> "Ram":
        '''(experimental) Grants permission to get the contents of an AWS RAM permission.

        Access Level: Read

        Possible conditions:

        - .ifPermissionArn()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_GetPermission.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toGetPermission", []))

    @jsii.member(jsii_name="toGetResourcePolicies")
    def to_get_resource_policies(self) -> "Ram":
        '''(experimental) Grants permission to get the policies for the specified resources that you own and have shared.

        Access Level: Read

        https://docs.aws.amazon.com/ram/latest/APIReference/API_GetResourcePolicies.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toGetResourcePolicies", []))

    @jsii.member(jsii_name="toGetResourceShareAssociations")
    def to_get_resource_share_associations(self) -> "Ram":
        '''(experimental) Grants permission to get a set of resource share associations from a provided list or with a specified status of the specified type.

        Access Level: Read

        https://docs.aws.amazon.com/ram/latest/APIReference/API_GetResourceShareAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toGetResourceShareAssociations", []))

    @jsii.member(jsii_name="toGetResourceShareInvitations")
    def to_get_resource_share_invitations(self) -> "Ram":
        '''(experimental) Grants permission to get resource share invitations by the specified invitation arn or those for the resource share.

        Access Level: Read

        https://docs.aws.amazon.com/ram/latest/APIReference/API_GetResourceShareInvitations.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toGetResourceShareInvitations", []))

    @jsii.member(jsii_name="toGetResourceShares")
    def to_get_resource_shares(self) -> "Ram":
        '''(experimental) Grants permission to get a set of resource shares from a provided list or with a specified status.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_GetResourceShares.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toGetResourceShares", []))

    @jsii.member(jsii_name="toListPendingInvitationResources")
    def to_list_pending_invitation_resources(self) -> "Ram":
        '''(experimental) Grants permission to list the resources in a resource share that is shared with you but that the invitation is still pending for.

        Access Level: Read

        https://docs.aws.amazon.com/ram/latest/APIReference/API_ListPendingInvitationResources.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toListPendingInvitationResources", []))

    @jsii.member(jsii_name="toListPermissions")
    def to_list_permissions(self) -> "Ram":
        '''(experimental) Grants permission to list the AWS RAM permissions.

        Access Level: List

        https://docs.aws.amazon.com/ram/latest/APIReference/API_ListPermissions.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toListPermissions", []))

    @jsii.member(jsii_name="toListPermissionVersions")
    def to_list_permission_versions(self) -> "Ram":
        '''(experimental) Grants permission to list the versions of an AWS RAM permission.

        Access Level: List

        https://docs.aws.amazon.com/ram/latest/APIReference/API_ListPermissionVersions.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toListPermissionVersions", []))

    @jsii.member(jsii_name="toListPrincipals")
    def to_list_principals(self) -> "Ram":
        '''(experimental) Grants permission to list the principals that you have shared resources with or that have shared resources with you.

        Access Level: List

        https://docs.aws.amazon.com/ram/latest/APIReference/API_ListPrincipals.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toListPrincipals", []))

    @jsii.member(jsii_name="toListResources")
    def to_list_resources(self) -> "Ram":
        '''(experimental) Grants permission to list the resources that you added to resource shares or the resources that are shared with you.

        Access Level: List

        https://docs.aws.amazon.com/ram/latest/APIReference/API_ListResources.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toListResources", []))

    @jsii.member(jsii_name="toListResourceSharePermissions")
    def to_list_resource_share_permissions(self) -> "Ram":
        '''(experimental) Grants permission to list the Permissions associated with a Resource Share.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifResourceShareName()
        - .ifAllowsExternalPrincipals()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_ListResourceSharePermissions.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toListResourceSharePermissions", []))

    @jsii.member(jsii_name="toListResourceTypes")
    def to_list_resource_types(self) -> "Ram":
        '''(experimental) Grants permission to list the shareable resource types supported by AWS RAM.

        Access Level: List

        https://docs.aws.amazon.com/ram/latest/APIReference/API_ListResourceTypes.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toListResourceTypes", []))

    @jsii.member(jsii_name="toPromoteResourceShareCreatedFromPolicy")
    def to_promote_resource_share_created_from_policy(self) -> "Ram":
        '''(experimental) Grants permission to promote the specified resource share.

        Access Level: Write

        https://docs.aws.amazon.com/ram/latest/APIReference/API_PromoteResourceShareCreatedFromPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toPromoteResourceShareCreatedFromPolicy", []))

    @jsii.member(jsii_name="toRejectResourceShareInvitation")
    def to_reject_resource_share_invitation(self) -> "Ram":
        '''(experimental) Grants permission to reject the specified resource share invitation.

        Access Level: Write

        Possible conditions:

        - .ifShareOwnerAccountId()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_RejectResourceShareInvitation.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toRejectResourceShareInvitation", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Ram":
        '''(experimental) Grants permission to tag the specified resource share.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Ram":
        '''(experimental) Grants permission to untag the specified resource share.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateResourceShare")
    def to_update_resource_share(self) -> "Ram":
        '''(experimental) Grants permission to update attributes of the resource share.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifResourceShareName()
        - .ifAllowsExternalPrincipals()
        - .ifRequestedAllowsExternalPrincipals()

        https://docs.aws.amazon.com/ram/latest/APIReference/API_UpdateResourceShare.html

        :stability: experimental
        '''
        return typing.cast("Ram", jsii.invoke(self, "toUpdateResourceShare", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b06a45f23f47775400812762f9a90aa7813270ebf83cea2fa4df4448b1919493)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eaf46aa0b566aac65efa2222d41af08a2888aaa9c384ac7f491926180d02314f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Rbin(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Rbin"):
    '''(experimental) Statement provider for service `rbin <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsrecyclebin.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `rbin <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsrecyclebin.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1486f9cc41f1f5bff928a4d3df8168339ac3ca60bc62b962d034e27ab9fcbf35)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAttributeResourceType")
    def if_attribute_resource_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rbin":
        '''(experimental) Filters access by the resource type of the existing rule.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/recycle-bin-perms.html#rbin-condition-keys

        Applies to actions:

        - .toDeleteRule()
        - .toGetRule()
        - .toListTagsForResource()
        - .toLockRule()
        - .toTagResource()
        - .toUnlockRule()
        - .toUntagResource()
        - .toUpdateRule()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5d42b9dc9e2b4471c2e3c2f3bbd6aa9d38fbd975bbeae0669800fe7005ddd1ba)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rbin", jsii.invoke(self, "ifAttributeResourceType", [value, operator]))

    @jsii.member(jsii_name="ifRequestResourceType")
    def if_request_resource_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rbin":
        '''(experimental) Filters access by the resource type in a request.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/recycle-bin-perms.html#rbin-condition-keys

        Applies to actions:

        - .toCreateRule()
        - .toListRules()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3dc90fde4b73e7da33177c3f72d7ccf8240f226c31750ab626b76607a585dc57)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rbin", jsii.invoke(self, "ifRequestResourceType", [value, operator]))

    @jsii.member(jsii_name="onRule")
    def on_rule(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rbin":
        '''(experimental) Adds a resource of type rule to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-recycle-bin.html#recycle-bin-concepts

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ee598b2dd198e3f75f23fe52aa36876c48aef8bb26ef018047a30c117ffd1e90)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rbin", jsii.invoke(self, "onRule", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateRule")
    def to_create_rule(self) -> "Rbin":
        '''(experimental) Grants permission to create a Recycle Bin retention rule.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRequestResourceType()

        https://docs.aws.amazon.com/recyclebin/latest/APIReference/API_CreateRule.html

        :stability: experimental
        '''
        return typing.cast("Rbin", jsii.invoke(self, "toCreateRule", []))

    @jsii.member(jsii_name="toDeleteRule")
    def to_delete_rule(self) -> "Rbin":
        '''(experimental) Grants permission to delete a Recycle Bin retention rule.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAttributeResourceType()

        https://docs.aws.amazon.com/recyclebin/latest/APIReference/API_DeleteRule.html

        :stability: experimental
        '''
        return typing.cast("Rbin", jsii.invoke(self, "toDeleteRule", []))

    @jsii.member(jsii_name="toGetRule")
    def to_get_rule(self) -> "Rbin":
        '''(experimental) Grants permission to get detailed information about a Recycle Bin retention rule.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAttributeResourceType()

        https://docs.aws.amazon.com/recyclebin/latest/APIReference/API_GetRule.html

        :stability: experimental
        '''
        return typing.cast("Rbin", jsii.invoke(self, "toGetRule", []))

    @jsii.member(jsii_name="toListRules")
    def to_list_rules(self) -> "Rbin":
        '''(experimental) Grants permission to list the Recycle Bin retention rules in the Region.

        Access Level: Read

        Possible conditions:

        - .ifRequestResourceType()

        https://docs.aws.amazon.com/recyclebin/latest/APIReference/API_ListRules.html

        :stability: experimental
        '''
        return typing.cast("Rbin", jsii.invoke(self, "toListRules", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Rbin":
        '''(experimental) Grants permission to list the tags associated with a resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAttributeResourceType()

        https://docs.aws.amazon.com/recyclebin/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Rbin", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toLockRule")
    def to_lock_rule(self) -> "Rbin":
        '''(experimental) Grants permission to lock an existing Recycle Bin retention rule.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAttributeResourceType()

        https://docs.aws.amazon.com/recyclebin/latest/APIReference/API_LockRule.html

        :stability: experimental
        '''
        return typing.cast("Rbin", jsii.invoke(self, "toLockRule", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Rbin":
        '''(experimental) Grants permission to add or update tags of a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsResourceTag()
        - .ifAwsTagKeys()
        - .ifAttributeResourceType()

        https://docs.aws.amazon.com/recyclebin/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Rbin", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUnlockRule")
    def to_unlock_rule(self) -> "Rbin":
        '''(experimental) Grants permission to unlock an existing Recycle Bin retention rule.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAttributeResourceType()

        https://docs.aws.amazon.com/recyclebin/latest/APIReference/API_UnlockRule.html

        :stability: experimental
        '''
        return typing.cast("Rbin", jsii.invoke(self, "toUnlockRule", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Rbin":
        '''(experimental) Grants permission to remove tags associated with a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()
        - .ifAttributeResourceType()

        https://docs.aws.amazon.com/recyclebin/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Rbin", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateRule")
    def to_update_rule(self) -> "Rbin":
        '''(experimental) Grants permission to update an existing Recycle Bin retention rule.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAttributeResourceType()

        https://docs.aws.amazon.com/recyclebin/latest/APIReference/API_UpdateRule.html

        :stability: experimental
        '''
        return typing.cast("Rbin", jsii.invoke(self, "toUpdateRule", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8086a2dc6ceb80228d6e78481fa70541388de317a80d3cf8552f0d0f029b8f54)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4b1c354f50488609029035641f684c68550703113af13465c3999d2eb5642fb0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Rds(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Rds"):
    '''(experimental) Statement provider for service `rds <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonrds.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `rds <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonrds.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7636c7610b67a46cc205ee185ac20840292e31ea7e1f6ae1438a1302d18cb8d3)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifBackupTarget")
    def if_backup_target(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the type of backup target. One of: REGION, OUTPOSTS.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toCreateDBInstance()
        - .toCreateDBSnapshot()
        - .toRestoreDBInstanceFromDBSnapshot()
        - .toRestoreDBInstanceToPointInTime()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3ab3000f6eeae99280359a85ca8bd42b1ad99f906b46c6bf65c163fda195b311)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rds", jsii.invoke(self, "ifBackupTarget", [value, operator]))

    @jsii.member(jsii_name="ifClusterPgTag")
    def if_cluster_pg_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to a DB cluster parameter group.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toCreateBlueGreenDeployment()

        Applies to resource types:

        - cluster-pg

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a253608cf4e7826cd7af909fbf9334f347e3bd2a27fba6408e058d46395a7a4a)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rds", jsii.invoke(self, "ifClusterPgTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifClusterSnapshotTag")
    def if_cluster_snapshot_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to a DB cluster snapshot.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - cluster-snapshot

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__937e42469632c2901d47608bd47a36b34debef19c6936aff4d95b44fc0c6b5da)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rds", jsii.invoke(self, "ifClusterSnapshotTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifClusterTag")
    def if_cluster_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to a DB cluster.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toCreateBlueGreenDeployment()

        Applies to resource types:

        - cluster

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__425e6e8696b48a751150a3b1781d9a56909cc9cc11c816c6ff802846b3f6bbb4)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rds", jsii.invoke(self, "ifClusterTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifCopyOptionGroup")
    def if_copy_option_group(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the value that specifies whether the CopyDBSnapshot action requires copying the DB option group.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toCopyDBSnapshot()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0b41bb04381e5c500622c998047ed3581ed1fbea242f242ed630ae0f47de3e0e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Rds", jsii.invoke(self, "ifCopyOptionGroup", [value]))

    @jsii.member(jsii_name="ifDatabaseClass")
    def if_database_class(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the type of DB instance class.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toCreateBlueGreenDeployment()
        - .toCreateDBCluster()
        - .toModifyDBCluster()
        - .toRestoreDBClusterFromSnapshot()
        - .toRestoreDBClusterToPointInTime()

        Applies to resource types:

        - db

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__904e44a881682bf5233765b57dc3bd91ccc72318dbb3d9899f14abb79da2098d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rds", jsii.invoke(self, "ifDatabaseClass", [value, operator]))

    @jsii.member(jsii_name="ifDatabaseEngine")
    def if_database_engine(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the database engine. For possible values refer to the engine parameter in CreateDBInstance API.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toCreateBlueGreenDeployment()
        - .toCreateDBCluster()
        - .toRestoreDBClusterFromS3()

        Applies to resource types:

        - db

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b37d8177ecc1aee46e9c20a608d7256d803a462d9d7cf48e6fa268438a70acda)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rds", jsii.invoke(self, "ifDatabaseEngine", [value, operator]))

    @jsii.member(jsii_name="ifDatabaseName")
    def if_database_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the user-defined name of the database on the DB instance.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toCreateBlueGreenDeployment()
        - .toCreateDBCluster()
        - .toRestoreDBClusterFromS3()

        Applies to resource types:

        - db

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0b5db3d253745c3e30570a1cf00b3aab26c70a7f9cb500ffbb655072c4c00f28)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rds", jsii.invoke(self, "ifDatabaseName", [value, operator]))

    @jsii.member(jsii_name="ifDbTag")
    def if_db_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to a DB instance.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toCreateBlueGreenDeployment()

        Applies to resource types:

        - db

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8a8e31a6f7b197aff8ff896883985b2832087b1fce226fa794e77d3a0fea2d65)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rds", jsii.invoke(self, "ifDbTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifEndpointType")
    def if_endpoint_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the type of the endpoint. One of: READER, WRITER, CUSTOM.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toCreateDBClusterEndpoint()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9df5f72cb1251a39e75f0b838a038bd4ef9569c090b5f31612ebc3e20d5f1cd2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rds", jsii.invoke(self, "ifEndpointType", [value, operator]))

    @jsii.member(jsii_name="ifEsTag")
    def if_es_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to an event subscription.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - es

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__834b80e9fd553b9c58ea4a872e2bfe4f0736a2af8cdfb672d00c248b13f00700)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rds", jsii.invoke(self, "ifEsTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifManageMasterUserPassword")
    def if_manage_master_user_password(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the value that specifies whether RDS manages master user password in AWS Secrets Manager for the DB instance or cluster.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toCreateDBCluster()
        - .toCreateDBInstance()
        - .toModifyDBCluster()
        - .toModifyDBInstance()
        - .toRestoreDBClusterFromS3()
        - .toRestoreDBInstanceFromS3()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cbc12ce971413a37a4d8a3345d7c73181168073c6c86c261b5ce4f508443faf1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Rds", jsii.invoke(self, "ifManageMasterUserPassword", [value]))

    @jsii.member(jsii_name="ifMultiAz")
    def if_multi_az(self, value: typing.Optional[builtins.bool] = None) -> "Rds":
        '''(experimental) Filters access by the value that specifies whether the DB instance runs in multiple Availability Zones.

        To indicate that the DB instance is using Multi-AZ, specify true

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toCreateBlueGreenDeployment()

        Applies to resource types:

        - db

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b6cc6588260d4ca9cb732759e1f68c4410431abfa06651c0972ba93ab6a3e7f7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Rds", jsii.invoke(self, "ifMultiAz", [value]))

    @jsii.member(jsii_name="ifOgTag")
    def if_og_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to a DB option group.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - og

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__57fe25efc8106d3ea75bc7ddb7f9de9c4804a87c3c19ae247bd4f633a327beef)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rds", jsii.invoke(self, "ifOgTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifPgTag")
    def if_pg_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to a DB parameter group.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toCreateBlueGreenDeployment()

        Applies to resource types:

        - pg

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5986517914b9b386eca46770322bea7d5dc3e42e74a965138d6a43c91be2946a)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rds", jsii.invoke(self, "ifPgTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifPiops")
    def if_piops(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the value that contains the number of Provisioned IOPS (PIOPS) that the instance supports.

        To indicate a DB instance that does not have PIOPS enabled, specify 0

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toCreateBlueGreenDeployment()
        - .toCreateDBCluster()
        - .toModifyDBCluster()
        - .toRestoreDBClusterFromSnapshot()
        - .toRestoreDBClusterToPointInTime()

        Applies to resource types:

        - db

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e58c252f84180070489f38e64dddb5a20b90dbe392bd768dfeb3a7707e48f4b6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rds", jsii.invoke(self, "ifPiops", [value, operator]))

    @jsii.member(jsii_name="ifReqTag")
    def if_req_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the set of tag keys and values that can be used to tag a resource.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toAddTagsToResource()
        - .toCreateBlueGreenDeployment()
        - .toCreateDBCluster()
        - .toCreateDBClusterParameterGroup()
        - .toCreateDBClusterSnapshot()
        - .toCreateDBInstance()
        - .toCreateDBInstanceReadReplica()
        - .toCreateDBParameterGroup()
        - .toCreateDBSecurityGroup()
        - .toCreateDBSnapshot()
        - .toCreateDBSubnetGroup()
        - .toCreateEventSubscription()
        - .toCreateOptionGroup()
        - .toDeleteBlueGreenDeployment()
        - .toRemoveTagsFromResource()
        - .toRestoreDBClusterFromS3()
        - .toRestoreDBClusterFromSnapshot()
        - .toRestoreDBClusterToPointInTime()
        - .toRestoreDBInstanceFromDBSnapshot()
        - .toRestoreDBInstanceFromS3()
        - .toRestoreDBInstanceToPointInTime()
        - .toSwitchoverBlueGreenDeployment()

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a2012c53b46afa2e72f7e694b30d7bdece323525e0d3c8b218786c0917954cb2)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rds", jsii.invoke(self, "ifReqTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifRiTag")
    def if_ri_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to a reserved DB instance.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - ri

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__71890cb61a5e334ed6bf74806e7ddcb37e2f5f7e37ad8d08c5747dd4d624c98c)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rds", jsii.invoke(self, "ifRiTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifSecgrpTag")
    def if_secgrp_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to a DB security group.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - secgrp

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e17ebdc6f35db16ebfc7eed058d426dbc7de6a8f9d27b9c4bba63c57ce0d8d3e)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rds", jsii.invoke(self, "ifSecgrpTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifSnapshotTag")
    def if_snapshot_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to a DB snapshot.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - snapshot

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e27a364cfd3d6812b5b06b70776d8309c1996eac904fd26f8bf094bbf247094c)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rds", jsii.invoke(self, "ifSnapshotTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifStorageEncrypted")
    def if_storage_encrypted(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the value that specifies whether the DB instance storage should be encrypted.

        To enforce storage encryption, specify true

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toCreateBlueGreenDeployment()
        - .toCreateDBCluster()
        - .toRestoreDBClusterFromS3()

        Applies to resource types:

        - db

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9726eab763c238f6cacc47eb2c4a1a46406e2a14ae3c9368dc62209237996acc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Rds", jsii.invoke(self, "ifStorageEncrypted", [value]))

    @jsii.member(jsii_name="ifStorageSize")
    def if_storage_size(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the storage volume size (in GB).

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toCreateBlueGreenDeployment()
        - .toCreateDBCluster()
        - .toModifyDBCluster()
        - .toRestoreDBClusterFromSnapshot()
        - .toRestoreDBClusterToPointInTime()

        Applies to resource types:

        - db

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__63fa097f46dfa3accfdff9650adc3bb2d1b49070682a837a1cb0e12751835db4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rds", jsii.invoke(self, "ifStorageSize", [value, operator]))

    @jsii.member(jsii_name="ifSubgrpTag")
    def if_subgrp_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Rds":
        '''(experimental) Filters access by the tag attached to a DB subnet group.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to resource types:

        - subgrp

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__59401e703abd303033d7148588e2719653eb05d0a46c7afcfc488455ae17e8cb)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Rds", jsii.invoke(self, "ifSubgrpTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifVpc")
    def if_vpc(self, value: typing.Optional[builtins.bool] = None) -> "Rds":
        '''(experimental) Filters access by the value that specifies whether the DB instance runs in an Amazon Virtual Private Cloud (Amazon VPC).

        To indicate that the DB instance runs in an Amazon VPC, specify true

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        Applies to actions:

        - .toCreateBlueGreenDeployment()

        Applies to resource types:

        - db

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__47aaceaf6b257109bb64b9730a4f7f17f898b59ff7509356ee20291725502e31)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Rds", jsii.invoke(self, "ifVpc", [value]))

    @jsii.member(jsii_name="onCev")
    def on_cev(
        self,
        engine: builtins.str,
        engine_version: builtins.str,
        custom_db_engine_version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type cev to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/custom-cev.html

        :param engine: - Identifier for the engine.
        :param engine_version: - Identifier for the engineVersion.
        :param custom_db_engine_version_id: - Identifier for the customDbEngineVersionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b447f32cb32f12a93e6ebde89bb22b0a66aa2c660135d307398b237e38d50f00)
            check_type(argname="argument engine", value=engine, expected_type=type_hints["engine"])
            check_type(argname="argument engine_version", value=engine_version, expected_type=type_hints["engine_version"])
            check_type(argname="argument custom_db_engine_version_id", value=custom_db_engine_version_id, expected_type=type_hints["custom_db_engine_version_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rds", jsii.invoke(self, "onCev", [engine, engine_version, custom_db_engine_version_id, account, region, partition]))

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        db_cluster_instance_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/CHAP_Aurora.html

        :param db_cluster_instance_name: - Identifier for the dbClusterInstanceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifClusterTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2c753bc15111843fb9b839d1bd2fbf23d7a123dcb3bdca2b6f4e279afa3413bb)
            check_type(argname="argument db_cluster_instance_name", value=db_cluster_instance_name, expected_type=type_hints["db_cluster_instance_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rds", jsii.invoke(self, "onCluster", [db_cluster_instance_name, account, region, partition]))

    @jsii.member(jsii_name="onClusterEndpoint")
    def on_cluster_endpoint(
        self,
        db_cluster_endpoint: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type cluster-endpoint to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Overview.Endpoints.html

        :param db_cluster_endpoint: - Identifier for the dbClusterEndpoint.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c7eb63d7b4f879cce6ccfd80f14c782c5b4e34b6ed6bf1302d0cbc5201c0a576)
            check_type(argname="argument db_cluster_endpoint", value=db_cluster_endpoint, expected_type=type_hints["db_cluster_endpoint"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rds", jsii.invoke(self, "onClusterEndpoint", [db_cluster_endpoint, account, region, partition]))

    @jsii.member(jsii_name="onClusterPg")
    def on_cluster_pg(
        self,
        cluster_parameter_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type cluster-pg to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_WorkingWithParamGroups.html

        :param cluster_parameter_group_name: - Identifier for the clusterParameterGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifClusterPgTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6c490c31dbd2447d92402c8cc914e72d00c424f4dff8901e6deaa949ac8b7619)
            check_type(argname="argument cluster_parameter_group_name", value=cluster_parameter_group_name, expected_type=type_hints["cluster_parameter_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rds", jsii.invoke(self, "onClusterPg", [cluster_parameter_group_name, account, region, partition]))

    @jsii.member(jsii_name="onClusterSnapshot")
    def on_cluster_snapshot(
        self,
        cluster_snapshot_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type cluster-snapshot to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Managing.Backups.html

        :param cluster_snapshot_name: - Identifier for the clusterSnapshotName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifClusterSnapshotTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3bdbfdebf219e9af1a9e85e694a0978c89567ec24afe5ef4da8a11204f0cb67b)
            check_type(argname="argument cluster_snapshot_name", value=cluster_snapshot_name, expected_type=type_hints["cluster_snapshot_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rds", jsii.invoke(self, "onClusterSnapshot", [cluster_snapshot_name, account, region, partition]))

    @jsii.member(jsii_name="onDb")
    def on_db(
        self,
        db_instance_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type db to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.html

        :param db_instance_name: - Identifier for the dbInstanceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifDatabaseClass() - .ifDatabaseEngine() - .ifDatabaseName() - .ifMultiAz() - .ifPiops() - .ifStorageEncrypted() - .ifStorageSize() - .ifVpc() - .ifDbTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__213e2c6d9767fc433dc45f567123efa6604cf2d4f3ddf0f68f79ab67c81831ec)
            check_type(argname="argument db_instance_name", value=db_instance_name, expected_type=type_hints["db_instance_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rds", jsii.invoke(self, "onDb", [db_instance_name, account, region, partition]))

    @jsii.member(jsii_name="onDeployment")
    def on_deployment(
        self,
        blue_green_deployment_identifier: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type deployment to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/blue-green-deployments.html

        :param blue_green_deployment_identifier: - Identifier for the blueGreenDeploymentIdentifier.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b4f600006871a45c1710df72018aa2a7ce6de4236038ed5a0aad56dc5dae66d1)
            check_type(argname="argument blue_green_deployment_identifier", value=blue_green_deployment_identifier, expected_type=type_hints["blue_green_deployment_identifier"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rds", jsii.invoke(self, "onDeployment", [blue_green_deployment_identifier, account, region, partition]))

    @jsii.member(jsii_name="onEs")
    def on_es(
        self,
        subscription_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type es to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html

        :param subscription_name: - Identifier for the subscriptionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifEsTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__928e08473a4dfef632b767dba0b0a082d709f04be264ffba9fedbdd8ccf25c6e)
            check_type(argname="argument subscription_name", value=subscription_name, expected_type=type_hints["subscription_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rds", jsii.invoke(self, "onEs", [subscription_name, account, region, partition]))

    @jsii.member(jsii_name="onGlobalCluster")
    def on_global_cluster(
        self,
        global_cluster: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type global-cluster to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-global-database.html

        :param global_cluster: - Identifier for the globalCluster.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2ec5c5704d4354b0589c96caa43a9d47d06cfccf9f761bca5e020349f566b242)
            check_type(argname="argument global_cluster", value=global_cluster, expected_type=type_hints["global_cluster"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rds", jsii.invoke(self, "onGlobalCluster", [global_cluster, account, partition]))

    @jsii.member(jsii_name="onOg")
    def on_og(
        self,
        option_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type og to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithOptionGroups.html

        :param option_group_name: - Identifier for the optionGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifOgTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ed21f825311c0a8ce6bf6268b65a9446b2776c0f3fb31b168795a39b84819c2e)
            check_type(argname="argument option_group_name", value=option_group_name, expected_type=type_hints["option_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rds", jsii.invoke(self, "onOg", [option_group_name, account, region, partition]))

    @jsii.member(jsii_name="onPg")
    def on_pg(
        self,
        parameter_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type pg to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithParamGroups.html

        :param parameter_group_name: - Identifier for the parameterGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifPgTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a66cb7ea4b02f26afedf51b2b874f87124a738f9bb7f37b30a9dc16350dd55a4)
            check_type(argname="argument parameter_group_name", value=parameter_group_name, expected_type=type_hints["parameter_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rds", jsii.invoke(self, "onPg", [parameter_group_name, account, region, partition]))

    @jsii.member(jsii_name="onProxy")
    def on_proxy(
        self,
        db_proxy_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type proxy to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy.html

        :param db_proxy_id: - Identifier for the dbProxyId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a1850b338bc995d7428d75bb87174606e3c8c21b93a2f9ed44e835d9b052b13d)
            check_type(argname="argument db_proxy_id", value=db_proxy_id, expected_type=type_hints["db_proxy_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rds", jsii.invoke(self, "onProxy", [db_proxy_id, account, region, partition]))

    @jsii.member(jsii_name="onProxyEndpoint")
    def on_proxy_endpoint(
        self,
        db_proxy_endpoint_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type proxy-endpoint to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy.html

        :param db_proxy_endpoint_id: - Identifier for the dbProxyEndpointId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cbf4dc2b6c68613fbe9ce82be99733ec0f5d942bd17598481feac10a5e381682)
            check_type(argname="argument db_proxy_endpoint_id", value=db_proxy_endpoint_id, expected_type=type_hints["db_proxy_endpoint_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rds", jsii.invoke(self, "onProxyEndpoint", [db_proxy_endpoint_id, account, region, partition]))

    @jsii.member(jsii_name="onRi")
    def on_ri(
        self,
        reserved_db_instance_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type ri to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithReservedDBInstances.html

        :param reserved_db_instance_name: - Identifier for the reservedDbInstanceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifRiTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__83095a235a94abc5648818ab6be50465e4c217ea25341e144abbf3f26c083b24)
            check_type(argname="argument reserved_db_instance_name", value=reserved_db_instance_name, expected_type=type_hints["reserved_db_instance_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rds", jsii.invoke(self, "onRi", [reserved_db_instance_name, account, region, partition]))

    @jsii.member(jsii_name="onSecgrp")
    def on_secgrp(
        self,
        security_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type secgrp to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.RDSSecurityGroups.html

        :param security_group_name: - Identifier for the securityGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifSecgrpTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4028da83b0fdae72dddcefdbfc7359ec51a10ab4acee564644d9bff225f556d1)
            check_type(argname="argument security_group_name", value=security_group_name, expected_type=type_hints["security_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rds", jsii.invoke(self, "onSecgrp", [security_group_name, account, region, partition]))

    @jsii.member(jsii_name="onSnapshot")
    def on_snapshot(
        self,
        snapshot_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type snapshot to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html

        :param snapshot_name: - Identifier for the snapshotName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifSnapshotTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dcd3e75bf0e014b5cc6a5205895bcdac55582d929429f8b124c82c76fa78f1fc)
            check_type(argname="argument snapshot_name", value=snapshot_name, expected_type=type_hints["snapshot_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rds", jsii.invoke(self, "onSnapshot", [snapshot_name, account, region, partition]))

    @jsii.member(jsii_name="onSubgrp")
    def on_subgrp(
        self,
        subnet_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type subgrp to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.Scenarios.html#USER_VPC.Scenario1

        :param subnet_group_name: - Identifier for the subnetGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifSubgrpTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__012c3416c0096070e9f64b29a9a8eb3e144ae9ea20ffda6c73de184c603eeab3)
            check_type(argname="argument subnet_group_name", value=subnet_group_name, expected_type=type_hints["subnet_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rds", jsii.invoke(self, "onSubgrp", [subnet_group_name, account, region, partition]))

    @jsii.member(jsii_name="onTarget")
    def on_target(
        self,
        target_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type target to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy.html

        :param target_id: - Identifier for the targetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__18861f76cbeaed7bb9265ca79387e115937170477acea58a1d312387ee4c25a2)
            check_type(argname="argument target_id", value=target_id, expected_type=type_hints["target_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rds", jsii.invoke(self, "onTarget", [target_id, account, region, partition]))

    @jsii.member(jsii_name="onTargetGroup")
    def on_target_group(
        self,
        target_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rds":
        '''(experimental) Adds a resource of type target-group to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-proxy.html

        :param target_group_id: - Identifier for the targetGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c312ff6b8109c43614d52baeaffa0d7152ddb1fea80a9860a6414d07b2c0791a)
            check_type(argname="argument target_group_id", value=target_group_id, expected_type=type_hints["target_group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rds", jsii.invoke(self, "onTargetGroup", [target_group_id, account, region, partition]))

    @jsii.member(jsii_name="toAddRoleToDBCluster")
    def to_add_role_to_db_cluster(self) -> "Rds":
        '''(experimental) Grants permission to associate an Identity and Access Management (IAM) role from an Aurora DB cluster.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_AddRoleToDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toAddRoleToDBCluster", []))

    @jsii.member(jsii_name="toAddRoleToDBInstance")
    def to_add_role_to_db_instance(self) -> "Rds":
        '''(experimental) Grants permission to associate an AWS Identity and Access Management (IAM) role with a DB instance.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_AddRoleToDBInstance.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toAddRoleToDBInstance", []))

    @jsii.member(jsii_name="toAddSourceIdentifierToSubscription")
    def to_add_source_identifier_to_subscription(self) -> "Rds":
        '''(experimental) Grants permission to add a source identifier to an existing RDS event notification subscription.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_AddSourceIdentifierToSubscription.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toAddSourceIdentifierToSubscription", []))

    @jsii.member(jsii_name="toAddTagsToResource")
    def to_add_tags_to_resource(self) -> "Rds":
        '''(experimental) Grants permission to add metadata tags to an Amazon RDS resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_AddTagsToResource.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toAddTagsToResource", []))

    @jsii.member(jsii_name="toApplyPendingMaintenanceAction")
    def to_apply_pending_maintenance_action(self) -> "Rds":
        '''(experimental) Grants permission to apply a pending maintenance action to a resource.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ApplyPendingMaintenanceAction.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toApplyPendingMaintenanceAction", []))

    @jsii.member(jsii_name="toAuthorizeDBSecurityGroupIngress")
    def to_authorize_db_security_group_ingress(self) -> "Rds":
        '''(experimental) Grants permission to enable ingress to a DBSecurityGroup using one of two forms of authorization.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_AuthorizeDBSecurityGroupIngress.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toAuthorizeDBSecurityGroupIngress", []))

    @jsii.member(jsii_name="toBacktrackDBCluster")
    def to_backtrack_db_cluster(self) -> "Rds":
        '''(experimental) Grants permission to backtrack a DB cluster to a specific time, without creating a new DB cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_BacktrackDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toBacktrackDBCluster", []))

    @jsii.member(jsii_name="toCancelExportTask")
    def to_cancel_export_task(self) -> "Rds":
        '''(experimental) Grants permission to cancel an export task in progress.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CancelExportTask.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCancelExportTask", []))

    @jsii.member(jsii_name="toCopyDBClusterParameterGroup")
    def to_copy_db_cluster_parameter_group(self) -> "Rds":
        '''(experimental) Grants permission to copy the specified DB cluster parameter group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CopyDBClusterParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCopyDBClusterParameterGroup", []))

    @jsii.member(jsii_name="toCopyDBClusterSnapshot")
    def to_copy_db_cluster_snapshot(self) -> "Rds":
        '''(experimental) Grants permission to create a snapshot of a DB cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CopyDBClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCopyDBClusterSnapshot", []))

    @jsii.member(jsii_name="toCopyDBParameterGroup")
    def to_copy_db_parameter_group(self) -> "Rds":
        '''(experimental) Grants permission to copy the specified DB parameter group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CopyDBParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCopyDBParameterGroup", []))

    @jsii.member(jsii_name="toCopyDBSnapshot")
    def to_copy_db_snapshot(self) -> "Rds":
        '''(experimental) Grants permission to copy the specified DB snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifCopyOptionGroup()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CopyDBSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCopyDBSnapshot", []))

    @jsii.member(jsii_name="toCopyOptionGroup")
    def to_copy_option_group(self) -> "Rds":
        '''(experimental) Grants permission to copy the specified option group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CopyOptionGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCopyOptionGroup", []))

    @jsii.member(jsii_name="toCreateBlueGreenDeployment")
    def to_create_blue_green_deployment(self) -> "Rds":
        '''(experimental) Grants permission to create a blue-green deployment for a given source cluster or instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsResourceTag()
        - .ifAwsTagKeys()
        - .ifClusterTag()
        - .ifClusterPgTag()
        - .ifDbTag()
        - .ifPgTag()
        - .ifReqTag()
        - .ifDatabaseEngine()
        - .ifDatabaseName()
        - .ifStorageEncrypted()
        - .ifDatabaseClass()
        - .ifStorageSize()
        - .ifMultiAz()
        - .ifPiops()
        - .ifVpc()

        Dependent actions:

        - rds:AddTagsToResource
        - rds:CreateDBCluster
        - rds:CreateDBClusterEndpoint
        - rds:CreateDBInstance
        - rds:CreateDBInstanceReadReplica

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateBlueGreenDeployment.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateBlueGreenDeployment", []))

    @jsii.member(jsii_name="toCreateCustomDBEngineVersion")
    def to_create_custom_db_engine_version(self) -> "Rds":
        '''(experimental) Grants permission to create a custom engine version.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - mediaimport:CreateDatabaseBinarySnapshot
        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateCustomDBEngineVersion.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateCustomDBEngineVersion", []))

    @jsii.member(jsii_name="toCreateDBCluster")
    def to_create_db_cluster(self) -> "Rds":
        '''(experimental) Grants permission to create a new Amazon Aurora DB cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()
        - .ifDatabaseEngine()
        - .ifDatabaseName()
        - .ifStorageEncrypted()
        - .ifDatabaseClass()
        - .ifStorageSize()
        - .ifPiops()
        - .ifManageMasterUserPassword()

        Dependent actions:

        - iam:PassRole
        - kms:CreateGrant
        - kms:Decrypt
        - kms:DescribeKey
        - kms:GenerateDataKey
        - rds:AddTagsToResource
        - rds:CreateDBInstance
        - secretsmanager:CreateSecret
        - secretsmanager:TagResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBCluster", []))

    @jsii.member(jsii_name="toCreateDBClusterEndpoint")
    def to_create_db_cluster_endpoint(self) -> "Rds":
        '''(experimental) Grants permission to create a new custom endpoint and associates it with an Amazon Aurora DB cluster.

        Access Level: Write

        Possible conditions:

        - .ifEndpointType()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBClusterEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBClusterEndpoint", []))

    @jsii.member(jsii_name="toCreateDBClusterParameterGroup")
    def to_create_db_cluster_parameter_group(self) -> "Rds":
        '''(experimental) Grants permission to create a new DB cluster parameter group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBClusterParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBClusterParameterGroup", []))

    @jsii.member(jsii_name="toCreateDBClusterSnapshot")
    def to_create_db_cluster_snapshot(self) -> "Rds":
        '''(experimental) Grants permission to create a snapshot of a DB cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBClusterSnapshot", []))

    @jsii.member(jsii_name="toCreateDBInstance")
    def to_create_db_instance(self) -> "Rds":
        '''(experimental) Grants permission to create a new DB instance.

        Access Level: Write

        Possible conditions:

        - .ifBackupTarget()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()
        - .ifManageMasterUserPassword()

        Dependent actions:

        - iam:PassRole
        - kms:CreateGrant
        - kms:Decrypt
        - kms:DescribeKey
        - kms:GenerateDataKey
        - rds:AddTagsToResource
        - secretsmanager:CreateSecret
        - secretsmanager:TagResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBInstance", []))

    @jsii.member(jsii_name="toCreateDBInstanceReadReplica")
    def to_create_db_instance_read_replica(self) -> "Rds":
        '''(experimental) Grants permission to create a DB instance that acts as a Read Replica of a source DB instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - iam:PassRole
        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstanceReadReplica.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBInstanceReadReplica", []))

    @jsii.member(jsii_name="toCreateDBParameterGroup")
    def to_create_db_parameter_group(self) -> "Rds":
        '''(experimental) Grants permission to create a new DB parameter group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBParameterGroup", []))

    @jsii.member(jsii_name="toCreateDBProxy")
    def to_create_db_proxy(self) -> "Rds":
        '''(experimental) Grants permission to create a database proxy.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBProxy.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBProxy", []))

    @jsii.member(jsii_name="toCreateDBProxyEndpoint")
    def to_create_db_proxy_endpoint(self) -> "Rds":
        '''(experimental) Grants permission to create a database proxy endpoint.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBProxyEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBProxyEndpoint", []))

    @jsii.member(jsii_name="toCreateDBSecurityGroup")
    def to_create_db_security_group(self) -> "Rds":
        '''(experimental) Grants permission to create a new DB security group. DB security groups control access to a DB instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBSecurityGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBSecurityGroup", []))

    @jsii.member(jsii_name="toCreateDBSnapshot")
    def to_create_db_snapshot(self) -> "Rds":
        '''(experimental) Grants permission to create a DBSnapshot.

        Access Level: Write

        Possible conditions:

        - .ifBackupTarget()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBSnapshot", []))

    @jsii.member(jsii_name="toCreateDBSubnetGroup")
    def to_create_db_subnet_group(self) -> "Rds":
        '''(experimental) Grants permission to create a new DB subnet group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateDBSubnetGroup", []))

    @jsii.member(jsii_name="toCreateEventSubscription")
    def to_create_event_subscription(self) -> "Rds":
        '''(experimental) Grants permission to create an RDS event notification subscription.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateEventSubscription.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateEventSubscription", []))

    @jsii.member(jsii_name="toCreateGlobalCluster")
    def to_create_global_cluster(self) -> "Rds":
        '''(experimental) Grants permission to create an Aurora global database spread across multiple regions.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateGlobalCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateGlobalCluster", []))

    @jsii.member(jsii_name="toCreateOptionGroup")
    def to_create_option_group(self) -> "Rds":
        '''(experimental) Grants permission to create a new option group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateOptionGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCreateOptionGroup", []))

    @jsii.member(jsii_name="toCrossRegionCommunication")
    def to_cross_region_communication(self) -> "Rds":
        '''(experimental) Grants permission to access a resource in the remote Region when executing cross-Region operations, such as cross-Region snapshot copy or cross-Region read replica creation.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/security_iam_service-with-iam.html#UsingWithRDS.IAM.Conditions

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toCrossRegionCommunication", []))

    @jsii.member(jsii_name="toDeleteBlueGreenDeployment")
    def to_delete_blue_green_deployment(self) -> "Rds":
        '''(experimental) Grants permission to delete blue green deployments.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsResourceTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - rds:DeleteDBCluster
        - rds:DeleteDBClusterEndpoint
        - rds:DeleteDBInstance

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteBlueGreenDeployment.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteBlueGreenDeployment", []))

    @jsii.member(jsii_name="toDeleteCustomDBEngineVersion")
    def to_delete_custom_db_engine_version(self) -> "Rds":
        '''(experimental) Grants permission to delete an existing custom engine version.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteCustomDBEngineVersion.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteCustomDBEngineVersion", []))

    @jsii.member(jsii_name="toDeleteDBCluster")
    def to_delete_db_cluster(self) -> "Rds":
        '''(experimental) Grants permission to delete a previously provisioned DB cluster.

        Access Level: Write

        Dependent actions:

        - rds:DeleteDBInstance

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBCluster", []))

    @jsii.member(jsii_name="toDeleteDBClusterEndpoint")
    def to_delete_db_cluster_endpoint(self) -> "Rds":
        '''(experimental) Grants permission to delete a custom endpoint and removes it from an Amazon Aurora DB cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBClusterEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBClusterEndpoint", []))

    @jsii.member(jsii_name="toDeleteDBClusterParameterGroup")
    def to_delete_db_cluster_parameter_group(self) -> "Rds":
        '''(experimental) Grants permission to delete a specified DB cluster parameter group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBClusterParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBClusterParameterGroup", []))

    @jsii.member(jsii_name="toDeleteDBClusterSnapshot")
    def to_delete_db_cluster_snapshot(self) -> "Rds":
        '''(experimental) Grants permission to delete a DB cluster snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBClusterSnapshot", []))

    @jsii.member(jsii_name="toDeleteDBInstance")
    def to_delete_db_instance(self) -> "Rds":
        '''(experimental) Grants permission to delete a previously provisioned DB instance.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBInstance.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBInstance", []))

    @jsii.member(jsii_name="toDeleteDBInstanceAutomatedBackup")
    def to_delete_db_instance_automated_backup(self) -> "Rds":
        '''(experimental) Grants permission to deletes automated backups based on the source instance's DbiResourceId value or the restorable instance's resource ID.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBInstanceAutomatedBackup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBInstanceAutomatedBackup", []))

    @jsii.member(jsii_name="toDeleteDBParameterGroup")
    def to_delete_db_parameter_group(self) -> "Rds":
        '''(experimental) Grants permission to delete a specified DBParameterGroup.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBParameterGroup", []))

    @jsii.member(jsii_name="toDeleteDBProxy")
    def to_delete_db_proxy(self) -> "Rds":
        '''(experimental) Grants permission to delete a database proxy.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBProxy.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBProxy", []))

    @jsii.member(jsii_name="toDeleteDBProxyEndpoint")
    def to_delete_db_proxy_endpoint(self) -> "Rds":
        '''(experimental) Grants permission to delete a database proxy endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBProxyEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBProxyEndpoint", []))

    @jsii.member(jsii_name="toDeleteDBSecurityGroup")
    def to_delete_db_security_group(self) -> "Rds":
        '''(experimental) Grants permission to delete a DB security group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBSecurityGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBSecurityGroup", []))

    @jsii.member(jsii_name="toDeleteDBSnapshot")
    def to_delete_db_snapshot(self) -> "Rds":
        '''(experimental) Grants permission to delete a DBSnapshot.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBSnapshot", []))

    @jsii.member(jsii_name="toDeleteDBSubnetGroup")
    def to_delete_db_subnet_group(self) -> "Rds":
        '''(experimental) Grants permission to delete a DB subnet group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteDBSubnetGroup", []))

    @jsii.member(jsii_name="toDeleteEventSubscription")
    def to_delete_event_subscription(self) -> "Rds":
        '''(experimental) Grants permission to delete an RDS event notification subscription.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteEventSubscription.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteEventSubscription", []))

    @jsii.member(jsii_name="toDeleteGlobalCluster")
    def to_delete_global_cluster(self) -> "Rds":
        '''(experimental) Grants permission to delete a global database cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteGlobalCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteGlobalCluster", []))

    @jsii.member(jsii_name="toDeleteOptionGroup")
    def to_delete_option_group(self) -> "Rds":
        '''(experimental) Grants permission to delete an existing option group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteOptionGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeleteOptionGroup", []))

    @jsii.member(jsii_name="toDeregisterDBProxyTargets")
    def to_deregister_db_proxy_targets(self) -> "Rds":
        '''(experimental) Grants permission to remove targets from a database proxy target group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeregisterDBProxyTargets.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDeregisterDBProxyTargets", []))

    @jsii.member(jsii_name="toDescribeAccountAttributes")
    def to_describe_account_attributes(self) -> "Rds":
        '''(experimental) Grants permission to list all of the attributes for a customer account.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeAccountAttributes.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeAccountAttributes", []))

    @jsii.member(jsii_name="toDescribeBlueGreenDeployments")
    def to_describe_blue_green_deployments(self) -> "Rds":
        '''(experimental) Grants permission to describe blue green deployments.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeBlueGreenDeployments.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeBlueGreenDeployments", []))

    @jsii.member(jsii_name="toDescribeCertificates")
    def to_describe_certificates(self) -> "Rds":
        '''(experimental) Grants permission to list the set of CA certificates provided by Amazon RDS for this AWS account.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeCertificates.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeCertificates", []))

    @jsii.member(jsii_name="toDescribeDBClusterBacktracks")
    def to_describe_db_cluster_backtracks(self) -> "Rds":
        '''(experimental) Grants permission to return information about backtracks for a DB cluster.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusterBacktracks.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBClusterBacktracks", []))

    @jsii.member(jsii_name="toDescribeDBClusterEndpoints")
    def to_describe_db_cluster_endpoints(self) -> "Rds":
        '''(experimental) Grants permission to return information about endpoints for an Amazon Aurora DB cluster.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusterEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBClusterEndpoints", []))

    @jsii.member(jsii_name="toDescribeDBClusterParameterGroups")
    def to_describe_db_cluster_parameter_groups(self) -> "Rds":
        '''(experimental) Grants permission to return a list of DBClusterParameterGroup descriptions.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusterParameterGroups.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBClusterParameterGroups", []))

    @jsii.member(jsii_name="toDescribeDBClusterParameters")
    def to_describe_db_cluster_parameters(self) -> "Rds":
        '''(experimental) Grants permission to return the detailed parameter list for a particular DB cluster parameter group.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusterParameters.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBClusterParameters", []))

    @jsii.member(jsii_name="toDescribeDBClusters")
    def to_describe_db_clusters(self) -> "Rds":
        '''(experimental) Grants permission to return information about provisioned Aurora DB clusters.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusters.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBClusters", []))

    @jsii.member(jsii_name="toDescribeDBClusterSnapshotAttributes")
    def to_describe_db_cluster_snapshot_attributes(self) -> "Rds":
        '''(experimental) Grants permission to return a list of DB cluster snapshot attribute names and values for a manual DB cluster snapshot.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusterSnapshotAttributes.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBClusterSnapshotAttributes", []))

    @jsii.member(jsii_name="toDescribeDBClusterSnapshots")
    def to_describe_db_cluster_snapshots(self) -> "Rds":
        '''(experimental) Grants permission to return information about DB cluster snapshots.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusterSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBClusterSnapshots", []))

    @jsii.member(jsii_name="toDescribeDBEngineVersions")
    def to_describe_db_engine_versions(self) -> "Rds":
        '''(experimental) Grants permission to return a list of the available DB engines.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBEngineVersions.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBEngineVersions", []))

    @jsii.member(jsii_name="toDescribeDBInstanceAutomatedBackups")
    def to_describe_db_instance_automated_backups(self) -> "Rds":
        '''(experimental) Grants permission to return a list of automated backups for both current and deleted instances.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBInstanceAutomatedBackups.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBInstanceAutomatedBackups", []))

    @jsii.member(jsii_name="toDescribeDBInstances")
    def to_describe_db_instances(self) -> "Rds":
        '''(experimental) Grants permission to return information about provisioned RDS instances.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBInstances.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBInstances", []))

    @jsii.member(jsii_name="toDescribeDBLogFiles")
    def to_describe_db_log_files(self) -> "Rds":
        '''(experimental) Grants permission to return a list of DB log files for the DB instance.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBLogFiles.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBLogFiles", []))

    @jsii.member(jsii_name="toDescribeDBParameterGroups")
    def to_describe_db_parameter_groups(self) -> "Rds":
        '''(experimental) Grants permission to return a list of DBParameterGroup descriptions.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBParameterGroups.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBParameterGroups", []))

    @jsii.member(jsii_name="toDescribeDBParameters")
    def to_describe_db_parameters(self) -> "Rds":
        '''(experimental) Grants permission to return the detailed parameter list for a particular DB parameter group.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBParameters.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBParameters", []))

    @jsii.member(jsii_name="toDescribeDBProxies")
    def to_describe_db_proxies(self) -> "Rds":
        '''(experimental) Grants permission to view proxies.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBProxies.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBProxies", []))

    @jsii.member(jsii_name="toDescribeDBProxyEndpoints")
    def to_describe_db_proxy_endpoints(self) -> "Rds":
        '''(experimental) Grants permission to view proxy endpoints.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBProxyEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBProxyEndpoints", []))

    @jsii.member(jsii_name="toDescribeDBProxyTargetGroups")
    def to_describe_db_proxy_target_groups(self) -> "Rds":
        '''(experimental) Grants permission to view database proxy target group details.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBProxyTargetGroups.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBProxyTargetGroups", []))

    @jsii.member(jsii_name="toDescribeDBProxyTargets")
    def to_describe_db_proxy_targets(self) -> "Rds":
        '''(experimental) Grants permission to view database proxy target details.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBProxyTargets.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBProxyTargets", []))

    @jsii.member(jsii_name="toDescribeDBSecurityGroups")
    def to_describe_db_security_groups(self) -> "Rds":
        '''(experimental) Grants permission to return a list of DBSecurityGroup descriptions.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBSecurityGroups.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBSecurityGroups", []))

    @jsii.member(jsii_name="toDescribeDBSnapshotAttributes")
    def to_describe_db_snapshot_attributes(self) -> "Rds":
        '''(experimental) Grants permission to return a list of DB snapshot attribute names and values for a manual DB snapshot.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBSnapshotAttributes.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBSnapshotAttributes", []))

    @jsii.member(jsii_name="toDescribeDBSnapshots")
    def to_describe_db_snapshots(self) -> "Rds":
        '''(experimental) Grants permission to return information about DB snapshots.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBSnapshots", []))

    @jsii.member(jsii_name="toDescribeDBSubnetGroups")
    def to_describe_db_subnet_groups(self) -> "Rds":
        '''(experimental) Grants permission to return a list of DBSubnetGroup descriptions.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBSubnetGroups.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeDBSubnetGroups", []))

    @jsii.member(jsii_name="toDescribeEngineDefaultClusterParameters")
    def to_describe_engine_default_cluster_parameters(self) -> "Rds":
        '''(experimental) Grants permission to return the default engine and system parameter information for the cluster database engine.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeEngineDefaultClusterParameters.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeEngineDefaultClusterParameters", []))

    @jsii.member(jsii_name="toDescribeEngineDefaultParameters")
    def to_describe_engine_default_parameters(self) -> "Rds":
        '''(experimental) Grants permission to return the default engine and system parameter information for the specified database engine.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeEngineDefaultParameters.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeEngineDefaultParameters", []))

    @jsii.member(jsii_name="toDescribeEventCategories")
    def to_describe_event_categories(self) -> "Rds":
        '''(experimental) Grants permission to display a list of categories for all event source types, or, if specified, for a specified source type.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeEventCategories.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeEventCategories", []))

    @jsii.member(jsii_name="toDescribeEvents")
    def to_describe_events(self) -> "Rds":
        '''(experimental) Grants permission to return events related to DB instances, DB security groups, DB snapshots, and DB parameter groups for the past 14 days.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeEvents.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeEvents", []))

    @jsii.member(jsii_name="toDescribeEventSubscriptions")
    def to_describe_event_subscriptions(self) -> "Rds":
        '''(experimental) Grants permission to list all the subscription descriptions for a customer account.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeEventSubscriptions.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeEventSubscriptions", []))

    @jsii.member(jsii_name="toDescribeExportTasks")
    def to_describe_export_tasks(self) -> "Rds":
        '''(experimental) Grants permission to return information about the export tasks.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeExportTasks.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeExportTasks", []))

    @jsii.member(jsii_name="toDescribeGlobalClusters")
    def to_describe_global_clusters(self) -> "Rds":
        '''(experimental) Grants permission to return information about Aurora global database clusters.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeGlobalClusters.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeGlobalClusters", []))

    @jsii.member(jsii_name="toDescribeOptionGroupOptions")
    def to_describe_option_group_options(self) -> "Rds":
        '''(experimental) Grants permission to describe all available options.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeOptionGroupOptions.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeOptionGroupOptions", []))

    @jsii.member(jsii_name="toDescribeOptionGroups")
    def to_describe_option_groups(self) -> "Rds":
        '''(experimental) Grants permission to describe the available option groups.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeOptionGroups.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeOptionGroups", []))

    @jsii.member(jsii_name="toDescribeOrderableDBInstanceOptions")
    def to_describe_orderable_db_instance_options(self) -> "Rds":
        '''(experimental) Grants permission to return a list of orderable DB instance options for the specified engine.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeOrderableDBInstanceOptions.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeOrderableDBInstanceOptions", []))

    @jsii.member(jsii_name="toDescribePendingMaintenanceActions")
    def to_describe_pending_maintenance_actions(self) -> "Rds":
        '''(experimental) Grants permission to return a list of resources (for example, DB instances) that have at least one pending maintenance action.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribePendingMaintenanceActions.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribePendingMaintenanceActions", []))

    @jsii.member(jsii_name="toDescribeRecommendationGroups")
    def to_describe_recommendation_groups(self) -> "Rds":
        '''(experimental) Grants permission to return information about recommendation groups.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonRDS/latest/USER_Recommendations.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeRecommendationGroups", []))

    @jsii.member(jsii_name="toDescribeRecommendations")
    def to_describe_recommendations(self) -> "Rds":
        '''(experimental) Grants permission to return information about recommendations.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonRDS/latest/USER_Recommendations.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeRecommendations", []))

    @jsii.member(jsii_name="toDescribeReservedDBInstances")
    def to_describe_reserved_db_instances(self) -> "Rds":
        '''(experimental) Grants permission to return information about reserved DB instances for this account, or about a specified reserved DB instance.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeReservedDBInstances.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeReservedDBInstances", []))

    @jsii.member(jsii_name="toDescribeReservedDBInstancesOfferings")
    def to_describe_reserved_db_instances_offerings(self) -> "Rds":
        '''(experimental) Grants permission to list available reserved DB instance offerings.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeReservedDBInstancesOfferings.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeReservedDBInstancesOfferings", []))

    @jsii.member(jsii_name="toDescribeSourceRegions")
    def to_describe_source_regions(self) -> "Rds":
        '''(experimental) Grants permission to return a list of the source AWS Regions where the current AWS Region can create a Read Replica or copy a DB snapshot from.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeSourceRegions.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeSourceRegions", []))

    @jsii.member(jsii_name="toDescribeValidDBInstanceModifications")
    def to_describe_valid_db_instance_modifications(self) -> "Rds":
        '''(experimental) Grants permission to list available modifications you can make to your DB instance.

        Access Level: List

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeValidDBInstanceModifications.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDescribeValidDBInstanceModifications", []))

    @jsii.member(jsii_name="toDownloadCompleteDBLogFile")
    def to_download_complete_db_log_file(self) -> "Rds":
        '''(experimental) Grants permission to download specified log file.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonRDS/latest/USER_LogAccess.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDownloadCompleteDBLogFile", []))

    @jsii.member(jsii_name="toDownloadDBLogFilePortion")
    def to_download_db_log_file_portion(self) -> "Rds":
        '''(experimental) Grants permission to download all or a portion of the specified log file, up to 1 MB in size.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DownloadDBLogFilePortion.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toDownloadDBLogFilePortion", []))

    @jsii.member(jsii_name="toFailoverDBCluster")
    def to_failover_db_cluster(self) -> "Rds":
        '''(experimental) Grants permission to force a failover for a DB cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_FailoverDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toFailoverDBCluster", []))

    @jsii.member(jsii_name="toFailoverGlobalCluster")
    def to_failover_global_cluster(self) -> "Rds":
        '''(experimental) Grants permission to failover a global cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_FailoverGlobalCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toFailoverGlobalCluster", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Rds":
        '''(experimental) Grants permission to list all tags on an Amazon RDS resource.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toModifyActivityStream")
    def to_modify_activity_stream(self) -> "Rds":
        '''(experimental) Grants permission to modify a database activity stream.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyActivityStream.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyActivityStream", []))

    @jsii.member(jsii_name="toModifyCertificates")
    def to_modify_certificates(self) -> "Rds":
        '''(experimental) Grants permission to modify the system-default Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate for Amazon RDS for new DB instances.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyCertificates.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyCertificates", []))

    @jsii.member(jsii_name="toModifyCurrentDBClusterCapacity")
    def to_modify_current_db_cluster_capacity(self) -> "Rds":
        '''(experimental) Grants permission to modify current cluster capacity for an Amazon Aurora Severless DB cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyCurrentDBClusterCapacity.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyCurrentDBClusterCapacity", []))

    @jsii.member(jsii_name="toModifyCustomDBEngineVersion")
    def to_modify_custom_db_engine_version(self) -> "Rds":
        '''(experimental) Grants permission to modify an existing custom engine version.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyCustomDBEngineVersion.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyCustomDBEngineVersion", []))

    @jsii.member(jsii_name="toModifyDBCluster")
    def to_modify_db_cluster(self) -> "Rds":
        '''(experimental) Grants permission to modify a setting for an Amazon Aurora DB cluster.

        Access Level: Write

        Possible conditions:

        - .ifDatabaseClass()
        - .ifStorageSize()
        - .ifPiops()
        - .ifManageMasterUserPassword()

        Dependent actions:

        - iam:PassRole
        - kms:CreateGrant
        - kms:Decrypt
        - kms:DescribeKey
        - kms:GenerateDataKey
        - rds:ModifyDBInstance
        - secretsmanager:CreateSecret
        - secretsmanager:RotateSecret
        - secretsmanager:TagResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBCluster", []))

    @jsii.member(jsii_name="toModifyDBClusterEndpoint")
    def to_modify_db_cluster_endpoint(self) -> "Rds":
        '''(experimental) Grants permission to modify the properties of an endpoint in an Amazon Aurora DB cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBClusterEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBClusterEndpoint", []))

    @jsii.member(jsii_name="toModifyDBClusterParameterGroup")
    def to_modify_db_cluster_parameter_group(self) -> "Rds":
        '''(experimental) Grants permission to modify the parameters of a DB cluster parameter group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBClusterParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBClusterParameterGroup", []))

    @jsii.member(jsii_name="toModifyDBClusterSnapshotAttribute")
    def to_modify_db_cluster_snapshot_attribute(self) -> "Rds":
        '''(experimental) Grants permission to add an attribute and values to, or removes an attribute and values from, a manual DB cluster snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBClusterSnapshotAttribute.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBClusterSnapshotAttribute", []))

    @jsii.member(jsii_name="toModifyDBInstance")
    def to_modify_db_instance(self) -> "Rds":
        '''(experimental) Grants permission to modify settings for a DB instance.

        Access Level: Write

        Possible conditions:

        - .ifManageMasterUserPassword()

        Dependent actions:

        - iam:PassRole
        - kms:CreateGrant
        - kms:Decrypt
        - kms:DescribeKey
        - kms:GenerateDataKey
        - secretsmanager:CreateSecret
        - secretsmanager:RotateSecret
        - secretsmanager:TagResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBInstance.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBInstance", []))

    @jsii.member(jsii_name="toModifyDBParameterGroup")
    def to_modify_db_parameter_group(self) -> "Rds":
        '''(experimental) Grants permission to modify the parameters of a DB parameter group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBParameterGroup", []))

    @jsii.member(jsii_name="toModifyDBProxy")
    def to_modify_db_proxy(self) -> "Rds":
        '''(experimental) Grants permission to modify database proxy.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBProxy.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBProxy", []))

    @jsii.member(jsii_name="toModifyDBProxyEndpoint")
    def to_modify_db_proxy_endpoint(self) -> "Rds":
        '''(experimental) Grants permission to modify database proxy endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBProxyEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBProxyEndpoint", []))

    @jsii.member(jsii_name="toModifyDBProxyTargetGroup")
    def to_modify_db_proxy_target_group(self) -> "Rds":
        '''(experimental) Grants permission to modify target group for a database proxy.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBProxyTargetGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBProxyTargetGroup", []))

    @jsii.member(jsii_name="toModifyDBSnapshot")
    def to_modify_db_snapshot(self) -> "Rds":
        '''(experimental) Grants permission to update a manual DB snapshot, which can be encrypted or not encrypted, with a new engine version.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBSnapshot", []))

    @jsii.member(jsii_name="toModifyDBSnapshotAttribute")
    def to_modify_db_snapshot_attribute(self) -> "Rds":
        '''(experimental) Grants permission to add an attribute and values to, or removes an attribute and values from, a manual DB snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBSnapshotAttribute.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBSnapshotAttribute", []))

    @jsii.member(jsii_name="toModifyDBSubnetGroup")
    def to_modify_db_subnet_group(self) -> "Rds":
        '''(experimental) Grants permission to modify an existing DB subnet group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyDBSubnetGroup", []))

    @jsii.member(jsii_name="toModifyEventSubscription")
    def to_modify_event_subscription(self) -> "Rds":
        '''(experimental) Grants permission to modify an existing RDS event notification subscription.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyEventSubscription.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyEventSubscription", []))

    @jsii.member(jsii_name="toModifyGlobalCluster")
    def to_modify_global_cluster(self) -> "Rds":
        '''(experimental) Grants permission to modify a setting for an Amazon Aurora global cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyGlobalCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyGlobalCluster", []))

    @jsii.member(jsii_name="toModifyOptionGroup")
    def to_modify_option_group(self) -> "Rds":
        '''(experimental) Grants permission to modify an existing option group.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyOptionGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyOptionGroup", []))

    @jsii.member(jsii_name="toModifyRecommendation")
    def to_modify_recommendation(self) -> "Rds":
        '''(experimental) Grants permission to modify recommendation.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/USER_Recommendations.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toModifyRecommendation", []))

    @jsii.member(jsii_name="toPromoteReadReplica")
    def to_promote_read_replica(self) -> "Rds":
        '''(experimental) Grants permission to promote a Read Replica DB instance to a standalone DB instance.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_PromoteReadReplica.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toPromoteReadReplica", []))

    @jsii.member(jsii_name="toPromoteReadReplicaDBCluster")
    def to_promote_read_replica_db_cluster(self) -> "Rds":
        '''(experimental) Grants permission to promote a Read Replica DB cluster to a standalone DB cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_PromoteReadReplicaDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toPromoteReadReplicaDBCluster", []))

    @jsii.member(jsii_name="toPurchaseReservedDBInstancesOffering")
    def to_purchase_reserved_db_instances_offering(self) -> "Rds":
        '''(experimental) Grants permission to purchase a reserved DB instance offering.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_PurchaseReservedDBInstancesOffering.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toPurchaseReservedDBInstancesOffering", []))

    @jsii.member(jsii_name="toRebootDBCluster")
    def to_reboot_db_cluster(self) -> "Rds":
        '''(experimental) Grants permission to reboot a previously provisioned DB cluster.

        Access Level: Write

        Dependent actions:

        - rds:RebootDBInstance

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RebootDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRebootDBCluster", []))

    @jsii.member(jsii_name="toRebootDBInstance")
    def to_reboot_db_instance(self) -> "Rds":
        '''(experimental) Grants permission to restart the database engine service.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RebootDBInstance.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRebootDBInstance", []))

    @jsii.member(jsii_name="toRegisterDBProxyTargets")
    def to_register_db_proxy_targets(self) -> "Rds":
        '''(experimental) Grants permission to add targets to a database proxy target group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RegisterDBProxyTargets.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRegisterDBProxyTargets", []))

    @jsii.member(jsii_name="toRemoveFromGlobalCluster")
    def to_remove_from_global_cluster(self) -> "Rds":
        '''(experimental) Grants permission to detach an Aurora secondary cluster from an Aurora global database cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RemoveFromGlobalCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRemoveFromGlobalCluster", []))

    @jsii.member(jsii_name="toRemoveRoleFromDBCluster")
    def to_remove_role_from_db_cluster(self) -> "Rds":
        '''(experimental) Grants permission to disassociate an AWS Identity and Access Management (IAM) role from an Amazon Aurora DB cluster.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RemoveRoleFromDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRemoveRoleFromDBCluster", []))

    @jsii.member(jsii_name="toRemoveRoleFromDBInstance")
    def to_remove_role_from_db_instance(self) -> "Rds":
        '''(experimental) Grants permission to disassociate an AWS Identity and Access Management (IAM) role from a DB instance.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RemoveRoleFromDBInstance.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRemoveRoleFromDBInstance", []))

    @jsii.member(jsii_name="toRemoveSourceIdentifierFromSubscription")
    def to_remove_source_identifier_from_subscription(self) -> "Rds":
        '''(experimental) Grants permission to remove a source identifier from an existing RDS event notification subscription.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RemoveSourceIdentifierFromSubscription.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRemoveSourceIdentifierFromSubscription", []))

    @jsii.member(jsii_name="toRemoveTagsFromResource")
    def to_remove_tags_from_resource(self) -> "Rds":
        '''(experimental) Grants permission to remove metadata tags from an Amazon RDS resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RemoveTagsFromResource.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRemoveTagsFromResource", []))

    @jsii.member(jsii_name="toResetDBClusterParameterGroup")
    def to_reset_db_cluster_parameter_group(self) -> "Rds":
        '''(experimental) Grants permission to modify the parameters of a DB cluster parameter group to the default value.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ResetDBClusterParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toResetDBClusterParameterGroup", []))

    @jsii.member(jsii_name="toResetDBParameterGroup")
    def to_reset_db_parameter_group(self) -> "Rds":
        '''(experimental) Grants permission to modify the parameters of a DB parameter group to the engine/system default value.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ResetDBParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toResetDBParameterGroup", []))

    @jsii.member(jsii_name="toRestoreDBClusterFromS3")
    def to_restore_db_cluster_from_s3(self) -> "Rds":
        '''(experimental) Grants permission to create an Amazon Aurora DB cluster from data stored in an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()
        - .ifDatabaseEngine()
        - .ifDatabaseName()
        - .ifStorageEncrypted()
        - .ifManageMasterUserPassword()

        Dependent actions:

        - iam:PassRole
        - kms:CreateGrant
        - kms:Decrypt
        - kms:DescribeKey
        - kms:GenerateDataKey
        - rds:AddTagsToResource
        - secretsmanager:CreateSecret
        - secretsmanager:TagResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBClusterFromS3.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRestoreDBClusterFromS3", []))

    @jsii.member(jsii_name="toRestoreDBClusterFromSnapshot")
    def to_restore_db_cluster_from_snapshot(self) -> "Rds":
        '''(experimental) Grants permission to create a new DB cluster from a DB cluster snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()
        - .ifDatabaseClass()
        - .ifStorageSize()
        - .ifPiops()

        Dependent actions:

        - iam:PassRole
        - rds:AddTagsToResource
        - rds:CreateDBInstance

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBClusterFromSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRestoreDBClusterFromSnapshot", []))

    @jsii.member(jsii_name="toRestoreDBClusterToPointInTime")
    def to_restore_db_cluster_to_point_in_time(self) -> "Rds":
        '''(experimental) Grants permission to restore a DB cluster to an arbitrary point in time.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()
        - .ifDatabaseClass()
        - .ifStorageSize()
        - .ifPiops()

        Dependent actions:

        - iam:PassRole
        - rds:AddTagsToResource
        - rds:CreateDBInstance

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBClusterToPointInTime.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRestoreDBClusterToPointInTime", []))

    @jsii.member(jsii_name="toRestoreDBInstanceFromDBSnapshot")
    def to_restore_db_instance_from_db_snapshot(self) -> "Rds":
        '''(experimental) Grants permission to create a new DB instance from a DB snapshot.

        Access Level: Write

        Possible conditions:

        - .ifBackupTarget()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - iam:PassRole
        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBInstanceFromDBSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRestoreDBInstanceFromDBSnapshot", []))

    @jsii.member(jsii_name="toRestoreDBInstanceFromS3")
    def to_restore_db_instance_from_s3(self) -> "Rds":
        '''(experimental) Grants permission to create a new DB instance from an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()
        - .ifManageMasterUserPassword()

        Dependent actions:

        - iam:PassRole
        - kms:CreateGrant
        - kms:Decrypt
        - kms:DescribeKey
        - kms:GenerateDataKey
        - rds:AddTagsToResource
        - secretsmanager:CreateSecret
        - secretsmanager:TagResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBInstanceFromS3.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRestoreDBInstanceFromS3", []))

    @jsii.member(jsii_name="toRestoreDBInstanceToPointInTime")
    def to_restore_db_instance_to_point_in_time(self) -> "Rds":
        '''(experimental) Grants permission to restore a DB instance to an arbitrary point in time.

        Access Level: Write

        Possible conditions:

        - .ifBackupTarget()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - iam:PassRole
        - rds:AddTagsToResource

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBInstanceToPointInTime.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRestoreDBInstanceToPointInTime", []))

    @jsii.member(jsii_name="toRevokeDBSecurityGroupIngress")
    def to_revoke_db_security_group_ingress(self) -> "Rds":
        '''(experimental) Grants permission to revoke ingress from a DBSecurityGroup for previously authorized IP ranges or EC2 or VPC Security Groups.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RevokeDBSecurityGroupIngress.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toRevokeDBSecurityGroupIngress", []))

    @jsii.member(jsii_name="toStartActivityStream")
    def to_start_activity_stream(self) -> "Rds":
        '''(experimental) Grants permission to start Activity Stream.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartActivityStream.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toStartActivityStream", []))

    @jsii.member(jsii_name="toStartDBCluster")
    def to_start_db_cluster(self) -> "Rds":
        '''(experimental) Grants permission to start the DB cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toStartDBCluster", []))

    @jsii.member(jsii_name="toStartDBInstance")
    def to_start_db_instance(self) -> "Rds":
        '''(experimental) Grants permission to start the DB instance.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartDBInstance.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toStartDBInstance", []))

    @jsii.member(jsii_name="toStartDBInstanceAutomatedBackupsReplication")
    def to_start_db_instance_automated_backups_replication(self) -> "Rds":
        '''(experimental) Grants permission to start replication of automated backups to a different AWS Region.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartDBInstanceAutomatedBackupsReplication.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toStartDBInstanceAutomatedBackupsReplication", []))

    @jsii.member(jsii_name="toStartExportTask")
    def to_start_export_task(self) -> "Rds":
        '''(experimental) Grants permission to start a new Export task for a DB snapshot.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartExportTask.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toStartExportTask", []))

    @jsii.member(jsii_name="toStopActivityStream")
    def to_stop_activity_stream(self) -> "Rds":
        '''(experimental) Grants permission to stop Activity Stream.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StopActivityStream.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toStopActivityStream", []))

    @jsii.member(jsii_name="toStopDBCluster")
    def to_stop_db_cluster(self) -> "Rds":
        '''(experimental) Grants permission to stop the DB cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StopDBCluster.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toStopDBCluster", []))

    @jsii.member(jsii_name="toStopDBInstance")
    def to_stop_db_instance(self) -> "Rds":
        '''(experimental) Grants permission to stop the DB instance.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StopDBInstance.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toStopDBInstance", []))

    @jsii.member(jsii_name="toStopDBInstanceAutomatedBackupsReplication")
    def to_stop_db_instance_automated_backups_replication(self) -> "Rds":
        '''(experimental) Grants permission to stop automated backup replication for a DB instance.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StopDBInstanceAutomatedBackupsReplication.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toStopDBInstanceAutomatedBackupsReplication", []))

    @jsii.member(jsii_name="toSwitchoverBlueGreenDeployment")
    def to_switchover_blue_green_deployment(self) -> "Rds":
        '''(experimental) Grants permission to switch a blue-green deployment from source instance or cluster to target.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsResourceTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        Dependent actions:

        - rds:ModifyDBCluster
        - rds:ModifyDBInstance
        - rds:PromoteReadReplica
        - rds:PromoteReadReplicaDBCluster

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_SwitchoverBlueGreenDeployment.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toSwitchoverBlueGreenDeployment", []))

    @jsii.member(jsii_name="toSwitchoverReadReplica")
    def to_switchover_read_replica(self) -> "Rds":
        '''(experimental) Grants permission to switch over a read replica, making it the new primary database.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_SwitchoverReadReplica.html

        :stability: experimental
        '''
        return typing.cast("Rds", jsii.invoke(self, "toSwitchoverReadReplica", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__46400253108e0da2702ceb4549475c5e628f0684a21b5e4a1bb321dc064b099f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__da0da3c0f59be85e2bdbdb75a293978f7792a12a9099e3632c47ec89f3e3d929)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class RdsData(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.RdsData"):
    '''(experimental) Statement provider for service `rds-data <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonrdsdataapi.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `rds-data <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonrdsdataapi.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7adc06ab1947d33dc5128d3c0a38b99b455b354afaee4f044205dd8fdb794ef6)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        db_cluster_instance_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "RdsData":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Aurora.Managing.html

        :param db_cluster_instance_name: - Identifier for the dbClusterInstanceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifAwsTagKeys()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0fc03183d7a01221a12dca10aee0925e8bc5d89f8782608447d74cda602f0473)
            check_type(argname="argument db_cluster_instance_name", value=db_cluster_instance_name, expected_type=type_hints["db_cluster_instance_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("RdsData", jsii.invoke(self, "onCluster", [db_cluster_instance_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchExecuteStatement")
    def to_batch_execute_statement(self) -> "RdsData":
        '''(experimental) Grants permission to run a batch SQL statement over an array of data.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rdsdataservice/latest/APIReference/API_BatchExecuteStatement.html

        :stability: experimental
        '''
        return typing.cast("RdsData", jsii.invoke(self, "toBatchExecuteStatement", []))

    @jsii.member(jsii_name="toBeginTransaction")
    def to_begin_transaction(self) -> "RdsData":
        '''(experimental) Grants permission to start a SQL transaction.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rdsdataservice/latest/APIReference/API_BeginTransaction.html

        :stability: experimental
        '''
        return typing.cast("RdsData", jsii.invoke(self, "toBeginTransaction", []))

    @jsii.member(jsii_name="toCommitTransaction")
    def to_commit_transaction(self) -> "RdsData":
        '''(experimental) Grants permission to end a SQL transaction started with the BeginTransaction operation and commits the changes.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - rds-data:BeginTransaction

        https://docs.aws.amazon.com/rdsdataservice/latest/APIReference/API_CommitTransaction.html

        :stability: experimental
        '''
        return typing.cast("RdsData", jsii.invoke(self, "toCommitTransaction", []))

    @jsii.member(jsii_name="toExecuteSql")
    def to_execute_sql(self) -> "RdsData":
        '''(experimental) Grants permission to run one or more SQL statements. This operation is deprecated. Use the BatchExecuteStatement or ExecuteStatement operation.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rdsdataservice/latest/APIReference/API_ExecuteSql.html

        :stability: experimental
        '''
        return typing.cast("RdsData", jsii.invoke(self, "toExecuteSql", []))

    @jsii.member(jsii_name="toExecuteStatement")
    def to_execute_statement(self) -> "RdsData":
        '''(experimental) Grants permission to run a SQL statement against a database.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rdsdataservice/latest/APIReference/API_ExecuteStatement.html

        :stability: experimental
        '''
        return typing.cast("RdsData", jsii.invoke(self, "toExecuteStatement", []))

    @jsii.member(jsii_name="toRollbackTransaction")
    def to_rollback_transaction(self) -> "RdsData":
        '''(experimental) Grants permission to perform a rollback of a transaction. Rolling back a transaction cancels its changes.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - rds-data:BeginTransaction

        https://docs.aws.amazon.com/rdsdataservice/latest/APIReference/API_RollbackTransaction.html

        :stability: experimental
        '''
        return typing.cast("RdsData", jsii.invoke(self, "toRollbackTransaction", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9661ab517242cb588d73541bf3d54dc9aeeb15df5fb59035ae0d456285c2254a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bdce333773fc1bbcf36a883a074fd7447dd14c1cea8a595de208ac27278e83bf)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class RdsDb(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.RdsDb"):
    '''(experimental) Statement provider for service `rds-db <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonrdsiamauthentication.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `rds-db <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonrdsiamauthentication.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0df314513029c9e2715b49f9200ccdc31543e7a04e6117a1652629eee98f7174)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDbUser")
    def on_db_user(
        self,
        dbi_resource_id: builtins.str,
        db_user_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "RdsDb":
        '''(experimental) Adds a resource of type db-user to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.DBAccounts.html

        :param dbi_resource_id: - Identifier for the dbiResourceId.
        :param db_user_name: - Identifier for the dbUserName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2bdcd98a53068976e2a153493580bbd366d565d95273bb83207d72491fafab95)
            check_type(argname="argument dbi_resource_id", value=dbi_resource_id, expected_type=type_hints["dbi_resource_id"])
            check_type(argname="argument db_user_name", value=db_user_name, expected_type=type_hints["db_user_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("RdsDb", jsii.invoke(self, "onDbUser", [dbi_resource_id, db_user_name, account, region, partition]))

    @jsii.member(jsii_name="toConnect")
    def to_connect(self) -> "RdsDb":
        '''(experimental) Allows IAM role or user to connect to RDS database.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.IAMPolicy.html

        :stability: experimental
        '''
        return typing.cast("RdsDb", jsii.invoke(self, "toConnect", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5d58a25c6aa1e84f256c8f4898207f5435522fa03337731c7833a7c9d7f9cdc9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__88f8483a30f023533dd46da4dd7706d7ffdc930aeafd08703739225c5fc3f2ed)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Redshift(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Redshift",
):
    '''(experimental) Statement provider for service `redshift <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonredshift.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `redshift <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonredshift.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e1cc19c9b003a0b272b79f64842a1f81e627c04b29e6d7a9fc184cfb03b8b10a)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifConsumerArn")
    def if_consumer_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Redshift":
        '''(experimental) Filters access by the datashare consumer arn.

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-overview.html#redshift-policy-resources.conditions

        Applies to actions:

        - .toAssociateDataShareConsumer()
        - .toDisassociateDataShareConsumer()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__41c04dbc164f31012c86f4ee582c1b2e590c7c4e18666120276686c616865701)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Redshift", jsii.invoke(self, "ifConsumerArn", [value, operator]))

    @jsii.member(jsii_name="ifConsumerIdentifier")
    def if_consumer_identifier(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Redshift":
        '''(experimental) Filters access by the datashare consumer.

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-overview.html#redshift-policy-resources.conditions

        Applies to actions:

        - .toAuthorizeDataShare()
        - .toDeauthorizeDataShare()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__476fa7ab9eebe86e6cef1dcbd1461fdfc7b62b28e3ce9352f23d489aaf202848)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Redshift", jsii.invoke(self, "ifConsumerIdentifier", [value, operator]))

    @jsii.member(jsii_name="ifDbName")
    def if_db_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Redshift":
        '''(experimental) Filters access by the database name.

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-overview.html#redshift-policy-resources.conditions

        Applies to actions:

        - .toGetClusterCredentials()
        - .toGetClusterCredentialsWithIAM()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__711b45d0742b8200d43850142f31107832286ba400dd833bba2186c8d5288305)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Redshift", jsii.invoke(self, "ifDbName", [value, operator]))

    @jsii.member(jsii_name="ifDbUser")
    def if_db_user(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Redshift":
        '''(experimental) Filters access by the database user name.

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-overview.html#redshift-policy-resources.conditions

        Applies to actions:

        - .toCreateClusterUser()
        - .toGetClusterCredentials()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__43403c3b5d60689b406e21a5e8bfff89fc114fec1b57041fc89d1d36963d4253)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Redshift", jsii.invoke(self, "ifDbUser", [value, operator]))

    @jsii.member(jsii_name="ifDurationSeconds")
    def if_duration_seconds(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Redshift":
        '''(experimental) Filters access by the number of seconds until a temporary credential set expires.

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-overview.html#redshift-policy-resources.conditions

        Applies to actions:

        - .toGetClusterCredentials()
        - .toGetClusterCredentialsWithIAM()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__94302136f3d371ba25685d0edda7bf08685210a0476a0b02780a5762394b821a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Redshift", jsii.invoke(self, "ifDurationSeconds", [value, operator]))

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        cluster_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-clusters.html

        :param cluster_name: - Identifier for the clusterName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9ceeaadd289f00bbc22c986c40d4531961652e8d45a44ded453551c5ab20526e)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Redshift", jsii.invoke(self, "onCluster", [cluster_name, account, region, partition]))

    @jsii.member(jsii_name="onDatashare")
    def on_datashare(
        self,
        producer_cluster_namespace: builtins.str,
        data_share_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type datashare to the statement.

        https://docs.aws.amazon.com/redshift/latest/dg/datashare-overview.html

        :param producer_cluster_namespace: - Identifier for the producerClusterNamespace.
        :param data_share_name: - Identifier for the dataShareName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d790593b5b3023f1f8c3492136fee821a2b1cd656d596d264b34066c93c1befc)
            check_type(argname="argument producer_cluster_namespace", value=producer_cluster_namespace, expected_type=type_hints["producer_cluster_namespace"])
            check_type(argname="argument data_share_name", value=data_share_name, expected_type=type_hints["data_share_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Redshift", jsii.invoke(self, "onDatashare", [producer_cluster_namespace, data_share_name, account, region, partition]))

    @jsii.member(jsii_name="onDbgroup")
    def on_dbgroup(
        self,
        cluster_name: builtins.str,
        db_group: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type dbgroup to the statement.

        https://docs.aws.amazon.com/redshift/latest/dg/r_CREATE_GROUP.html

        :param cluster_name: - Identifier for the clusterName.
        :param db_group: - Identifier for the dbGroup.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c370d4e128063c9475605cc3141fe7b11524bd1cf50fd9e7c15371b2cec41615)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument db_group", value=db_group, expected_type=type_hints["db_group"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Redshift", jsii.invoke(self, "onDbgroup", [cluster_name, db_group, account, region, partition]))

    @jsii.member(jsii_name="onDbname")
    def on_dbname(
        self,
        cluster_name: builtins.str,
        db_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type dbname to the statement.

        https://docs.aws.amazon.com/redshift/latest/dg/t_creating_database.html

        :param cluster_name: - Identifier for the clusterName.
        :param db_name: - Identifier for the dbName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0b3dbfce38d1e659e6b1cce333d78e105df3c5faf6565daae5cc47a675e4bd2e)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument db_name", value=db_name, expected_type=type_hints["db_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Redshift", jsii.invoke(self, "onDbname", [cluster_name, db_name, account, region, partition]))

    @jsii.member(jsii_name="onDbuser")
    def on_dbuser(
        self,
        cluster_name: builtins.str,
        db_user: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type dbuser to the statement.

        https://docs.aws.amazon.com/redshift/latest/dg/r_Users.html

        :param cluster_name: - Identifier for the clusterName.
        :param db_user: - Identifier for the dbUser.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7b0205a0b47edaa3c331c99d54621ff8a52fe906b63dde393e4078864478527c)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument db_user", value=db_user, expected_type=type_hints["db_user"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Redshift", jsii.invoke(self, "onDbuser", [cluster_name, db_user, account, region, partition]))

    @jsii.member(jsii_name="onEventsubscription")
    def on_eventsubscription(
        self,
        event_subscription_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type eventsubscription to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-events.html

        :param event_subscription_name: - Identifier for the eventSubscriptionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b81035e540eccfd8aee1f87cab5b3bbc2acb8673007063bc20ec822203b28aca)
            check_type(argname="argument event_subscription_name", value=event_subscription_name, expected_type=type_hints["event_subscription_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Redshift", jsii.invoke(self, "onEventsubscription", [event_subscription_name, account, region, partition]))

    @jsii.member(jsii_name="onHsmclientcertificate")
    def on_hsmclientcertificate(
        self,
        h_sm_client_certificate_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type hsmclientcertificate to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-db-encryption.html#working-with-HSM

        :param h_sm_client_certificate_id: - Identifier for the hSMClientCertificateId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ee50a592616498a2ae9a6faa57c4d08aa649e4a4d159009fb4c1af9485b90310)
            check_type(argname="argument h_sm_client_certificate_id", value=h_sm_client_certificate_id, expected_type=type_hints["h_sm_client_certificate_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Redshift", jsii.invoke(self, "onHsmclientcertificate", [h_sm_client_certificate_id, account, region, partition]))

    @jsii.member(jsii_name="onHsmconfiguration")
    def on_hsmconfiguration(
        self,
        h_sm_configuration_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type hsmconfiguration to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-db-encryption.html#working-with-HSM

        :param h_sm_configuration_id: - Identifier for the hSMConfigurationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__78557a6bb0333245df392c4a27b21631f069ab5cfd03e55ad3cd7fe1ac14154e)
            check_type(argname="argument h_sm_configuration_id", value=h_sm_configuration_id, expected_type=type_hints["h_sm_configuration_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Redshift", jsii.invoke(self, "onHsmconfiguration", [h_sm_configuration_id, account, region, partition]))

    @jsii.member(jsii_name="onNamespace")
    def on_namespace(
        self,
        producer_cluster_namespace: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type namespace to the statement.

        https://docs.aws.amazon.com/redshift/latest/dg/concepts.html

        :param producer_cluster_namespace: - Identifier for the producerClusterNamespace.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9d836326f1e8f3665341fcc0ce277e4e0ed5a0b4625cb5f0a0940a74982fd023)
            check_type(argname="argument producer_cluster_namespace", value=producer_cluster_namespace, expected_type=type_hints["producer_cluster_namespace"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Redshift", jsii.invoke(self, "onNamespace", [producer_cluster_namespace, account, region, partition]))

    @jsii.member(jsii_name="onParametergroup")
    def on_parametergroup(
        self,
        parameter_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type parametergroup to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-parameter-groups.html

        :param parameter_group_name: - Identifier for the parameterGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__101ed9c9e36db19cdb50838d12b97d3563696d31da123d7fb159bf898e05ec02)
            check_type(argname="argument parameter_group_name", value=parameter_group_name, expected_type=type_hints["parameter_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Redshift", jsii.invoke(self, "onParametergroup", [parameter_group_name, account, region, partition]))

    @jsii.member(jsii_name="onSecuritygroup")
    def on_securitygroup(
        self,
        security_group_name: builtins.str,
        owner: builtins.str,
        ec2_security_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type securitygroup to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-security-groups.html

        :param security_group_name: - Identifier for the securityGroupName.
        :param owner: - Identifier for the owner.
        :param ec2_security_group_id: - Identifier for the ec2SecurityGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8effb3eaa5357dbfe09cd91c30376108ac9b9e4bcfeeee94fc3163ab21db8d27)
            check_type(argname="argument security_group_name", value=security_group_name, expected_type=type_hints["security_group_name"])
            check_type(argname="argument owner", value=owner, expected_type=type_hints["owner"])
            check_type(argname="argument ec2_security_group_id", value=ec2_security_group_id, expected_type=type_hints["ec2_security_group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Redshift", jsii.invoke(self, "onSecuritygroup", [security_group_name, owner, ec2_security_group_id, account, region, partition]))

    @jsii.member(jsii_name="onSecuritygroupingressCidr")
    def on_securitygroupingress_cidr(
        self,
        security_group_name: builtins.str,
        ip_range: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type securitygroupingress-cidr to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-security-groups.html

        :param security_group_name: - Identifier for the securityGroupName.
        :param ip_range: - Identifier for the ipRange.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__84c8c7bd11b405684f7ad931ef45129c77d20fbf31b8aa5ce3921c09b9c5286e)
            check_type(argname="argument security_group_name", value=security_group_name, expected_type=type_hints["security_group_name"])
            check_type(argname="argument ip_range", value=ip_range, expected_type=type_hints["ip_range"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Redshift", jsii.invoke(self, "onSecuritygroupingressCidr", [security_group_name, ip_range, account, region, partition]))

    @jsii.member(jsii_name="onSecuritygroupingressEc2securitygroup")
    def on_securitygroupingress_ec2securitygroup(
        self,
        security_group_name: builtins.str,
        owner: builtins.str,
        ece2_securitygroup_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type securitygroupingress-ec2securitygroup to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-security-groups.html

        :param security_group_name: - Identifier for the securityGroupName.
        :param owner: - Identifier for the owner.
        :param ece2_securitygroup_id: - Identifier for the ece2SecuritygroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0b618ab42d0d9a88510de49e689b1c202bfdb75db1098c20b2dc789643b8a3d5)
            check_type(argname="argument security_group_name", value=security_group_name, expected_type=type_hints["security_group_name"])
            check_type(argname="argument owner", value=owner, expected_type=type_hints["owner"])
            check_type(argname="argument ece2_securitygroup_id", value=ece2_securitygroup_id, expected_type=type_hints["ece2_securitygroup_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Redshift", jsii.invoke(self, "onSecuritygroupingressEc2securitygroup", [security_group_name, owner, ece2_securitygroup_id, account, region, partition]))

    @jsii.member(jsii_name="onSnapshot")
    def on_snapshot(
        self,
        cluster_name: builtins.str,
        snapshot_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type snapshot to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-snapshots.html

        :param cluster_name: - Identifier for the clusterName.
        :param snapshot_name: - Identifier for the snapshotName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__414e2e19ccebac929c6aa3a1df94e77ee9d6b063ecdf41641f8bb33db71b70f7)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument snapshot_name", value=snapshot_name, expected_type=type_hints["snapshot_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Redshift", jsii.invoke(self, "onSnapshot", [cluster_name, snapshot_name, account, region, partition]))

    @jsii.member(jsii_name="onSnapshotcopygrant")
    def on_snapshotcopygrant(
        self,
        snapshot_copy_grant_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type snapshotcopygrant to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-db-encryption.html#configure-snapshot-copy-grant

        :param snapshot_copy_grant_name: - Identifier for the snapshotCopyGrantName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7a129f339e2b37776d1fda57911e63e9e58c28d0971a0fffa2caf473df3cd664)
            check_type(argname="argument snapshot_copy_grant_name", value=snapshot_copy_grant_name, expected_type=type_hints["snapshot_copy_grant_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Redshift", jsii.invoke(self, "onSnapshotcopygrant", [snapshot_copy_grant_name, account, region, partition]))

    @jsii.member(jsii_name="onSnapshotschedule")
    def on_snapshotschedule(
        self,
        parameter_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type snapshotschedule to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-snapshots.html

        :param parameter_group_name: - Identifier for the parameterGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1c119fad2680520883b0f0ac155d029855b57d09a2f081a44a8a53f78943a1ae)
            check_type(argname="argument parameter_group_name", value=parameter_group_name, expected_type=type_hints["parameter_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Redshift", jsii.invoke(self, "onSnapshotschedule", [parameter_group_name, account, region, partition]))

    @jsii.member(jsii_name="onSubnetgroup")
    def on_subnetgroup(
        self,
        subnet_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type subnetgroup to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-cluster-subnet-groups.html

        :param subnet_group_name: - Identifier for the subnetGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6e3db32d050245bf6b3c90fdd03eb1fba9e10f3d29b6e10146c148eb1007b4e5)
            check_type(argname="argument subnet_group_name", value=subnet_group_name, expected_type=type_hints["subnet_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Redshift", jsii.invoke(self, "onSubnetgroup", [subnet_group_name, account, region, partition]))

    @jsii.member(jsii_name="onUsagelimit")
    def on_usagelimit(
        self,
        usage_limit_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Redshift":
        '''(experimental) Adds a resource of type usagelimit to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/managing-cluster-usage-limits.html

        :param usage_limit_id: - Identifier for the usageLimitId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__de105e3fd0a7848a2368922330ac5e9d41bf787fad6a4007a16534a47c23865b)
            check_type(argname="argument usage_limit_id", value=usage_limit_id, expected_type=type_hints["usage_limit_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Redshift", jsii.invoke(self, "onUsagelimit", [usage_limit_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptReservedNodeExchange")
    def to_accept_reserved_node_exchange(self) -> "Redshift":
        '''(experimental) Grants permission to exchange a DC1 reserved node for a DC2 reserved node with no changes to the configuration.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_AcceptReservedNodeExchange.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toAcceptReservedNodeExchange", []))

    @jsii.member(jsii_name="toAddPartner")
    def to_add_partner(self) -> "Redshift":
        '''(experimental) Grants permission to add a partner integration to a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_AddPartner.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toAddPartner", []))

    @jsii.member(jsii_name="toAssociateDataShareConsumer")
    def to_associate_data_share_consumer(self) -> "Redshift":
        '''(experimental) Grants permission to associate a consumer to a datashare.

        Access Level: Write

        Possible conditions:

        - .ifConsumerArn()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_AssociateDataShareConsumer.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toAssociateDataShareConsumer", []))

    @jsii.member(jsii_name="toAuthorizeClusterSecurityGroupIngress")
    def to_authorize_cluster_security_group_ingress(self) -> "Redshift":
        '''(experimental) Grants permission to add an inbound (ingress) rule to an Amazon Redshift security group.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_AuthorizeClusterSecurityGroupIngress.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toAuthorizeClusterSecurityGroupIngress", []))

    @jsii.member(jsii_name="toAuthorizeDataShare")
    def to_authorize_data_share(self) -> "Redshift":
        '''(experimental) Grants permission to authorize the specified datashare consumer to consume a datashare.

        Access Level: Permissions management

        Possible conditions:

        - .ifConsumerIdentifier()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_AuthorizeDataShare.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toAuthorizeDataShare", []))

    @jsii.member(jsii_name="toAuthorizeEndpointAccess")
    def to_authorize_endpoint_access(self) -> "Redshift":
        '''(experimental) Grants permission to authorize endpoint related activities for redshift-managed vpc endpoint.

        Access Level: Permissions management

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_AuthorizeEndpointAccess.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toAuthorizeEndpointAccess", []))

    @jsii.member(jsii_name="toAuthorizeSnapshotAccess")
    def to_authorize_snapshot_access(self) -> "Redshift":
        '''(experimental) Grants permission to the specified AWS account to restore a snapshot.

        Access Level: Permissions management

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_AuthorizeSnapshotAccess.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toAuthorizeSnapshotAccess", []))

    @jsii.member(jsii_name="toBatchDeleteClusterSnapshots")
    def to_batch_delete_cluster_snapshots(self) -> "Redshift":
        '''(experimental) Grants permission to delete snapshots in a batch of size upto 100.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_BatchDeleteClusterSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toBatchDeleteClusterSnapshots", []))

    @jsii.member(jsii_name="toBatchModifyClusterSnapshots")
    def to_batch_modify_cluster_snapshots(self) -> "Redshift":
        '''(experimental) Grants permission to modify settings for a list of snapshots.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_BatchModifyClusterSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toBatchModifyClusterSnapshots", []))

    @jsii.member(jsii_name="toCancelQuery")
    def to_cancel_query(self) -> "Redshift":
        '''(experimental) Grants permission to cancel a query through the Amazon Redshift console.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCancelQuery", []))

    @jsii.member(jsii_name="toCancelQuerySession")
    def to_cancel_query_session(self) -> "Redshift":
        '''(experimental) Grants permission to see queries in the Amazon Redshift console.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCancelQuerySession", []))

    @jsii.member(jsii_name="toCancelResize")
    def to_cancel_resize(self) -> "Redshift":
        '''(experimental) Grants permission to cancel a resize operation.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CancelResize.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCancelResize", []))

    @jsii.member(jsii_name="toCopyClusterSnapshot")
    def to_copy_cluster_snapshot(self) -> "Redshift":
        '''(experimental) Grants permission to copy a cluster snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CopyClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCopyClusterSnapshot", []))

    @jsii.member(jsii_name="toCreateAuthenticationProfile")
    def to_create_authentication_profile(self) -> "Redshift":
        '''(experimental) Grants permission to create an Amazon Redshift authentication profile.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateAuthenticationProfile.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateAuthenticationProfile", []))

    @jsii.member(jsii_name="toCreateCluster")
    def to_create_cluster(self) -> "Redshift":
        '''(experimental) Grants permission to create a cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateCluster.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateCluster", []))

    @jsii.member(jsii_name="toCreateClusterParameterGroup")
    def to_create_cluster_parameter_group(self) -> "Redshift":
        '''(experimental) Grants permission to create an Amazon Redshift parameter group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateClusterParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateClusterParameterGroup", []))

    @jsii.member(jsii_name="toCreateClusterSecurityGroup")
    def to_create_cluster_security_group(self) -> "Redshift":
        '''(experimental) Grants permission to create an Amazon Redshift security group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateClusterSecurityGroup.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateClusterSecurityGroup", []))

    @jsii.member(jsii_name="toCreateClusterSnapshot")
    def to_create_cluster_snapshot(self) -> "Redshift":
        '''(experimental) Grants permission to create a manual snapshot of the specified cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateClusterSnapshot", []))

    @jsii.member(jsii_name="toCreateClusterSubnetGroup")
    def to_create_cluster_subnet_group(self) -> "Redshift":
        '''(experimental) Grants permission to create an Amazon Redshift subnet group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateClusterSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateClusterSubnetGroup", []))

    @jsii.member(jsii_name="toCreateClusterUser")
    def to_create_cluster_user(self) -> "Redshift":
        '''(experimental) Grants permission to automatically create the specified Amazon Redshift user if it does not exist.

        Access Level: Permissions management

        Possible conditions:

        - .ifDbUser()

        https://docs.aws.amazon.com/redshift/latest/mgmt/generating-iam-credentials-role-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateClusterUser", []))

    @jsii.member(jsii_name="toCreateEndpointAccess")
    def to_create_endpoint_access(self) -> "Redshift":
        '''(experimental) Grants permission to create a redshift-managed vpc endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateEndpointAccess.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateEndpointAccess", []))

    @jsii.member(jsii_name="toCreateEventSubscription")
    def to_create_event_subscription(self) -> "Redshift":
        '''(experimental) Grants permission to create an Amazon Redshift event notification subscription.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateEventSubscription.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateEventSubscription", []))

    @jsii.member(jsii_name="toCreateHsmClientCertificate")
    def to_create_hsm_client_certificate(self) -> "Redshift":
        '''(experimental) Grants permission to create an HSM client certificate that a cluster uses to connect to an HSM.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateHsmClientCertificate.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateHsmClientCertificate", []))

    @jsii.member(jsii_name="toCreateHsmConfiguration")
    def to_create_hsm_configuration(self) -> "Redshift":
        '''(experimental) Grants permission to create an HSM configuration that contains information required by a cluster to store and use database encryption keys in a hardware security module (HSM).

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateHsmConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateHsmConfiguration", []))

    @jsii.member(jsii_name="toCreateSavedQuery")
    def to_create_saved_query(self) -> "Redshift":
        '''(experimental) Grants permission to create saved SQL queries through the Amazon Redshift console.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateSavedQuery", []))

    @jsii.member(jsii_name="toCreateScheduledAction")
    def to_create_scheduled_action(self) -> "Redshift":
        '''(experimental) Grants permission to create an Amazon Redshift scheduled action.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateScheduledAction.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateScheduledAction", []))

    @jsii.member(jsii_name="toCreateSnapshotCopyGrant")
    def to_create_snapshot_copy_grant(self) -> "Redshift":
        '''(experimental) Grants permission to create a snapshot copy grant and encrypt copied snapshots in a destination AWS Region.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateSnapshotCopyGrant.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateSnapshotCopyGrant", []))

    @jsii.member(jsii_name="toCreateSnapshotSchedule")
    def to_create_snapshot_schedule(self) -> "Redshift":
        '''(experimental) Grants permission to create a snapshot schedule.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateSnapshotSchedule.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateSnapshotSchedule", []))

    @jsii.member(jsii_name="toCreateTags")
    def to_create_tags(self) -> "Redshift":
        '''(experimental) Grants permission to add one or more tags to a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateTags.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateTags", []))

    @jsii.member(jsii_name="toCreateUsageLimit")
    def to_create_usage_limit(self) -> "Redshift":
        '''(experimental) Grants permission to create a usage limit.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_CreateUsageLimit.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toCreateUsageLimit", []))

    @jsii.member(jsii_name="toDeauthorizeDataShare")
    def to_deauthorize_data_share(self) -> "Redshift":
        '''(experimental) Grants permission to remove permission from the specified datashare consumer to consume a datashare.

        Access Level: Permissions management

        Possible conditions:

        - .ifConsumerIdentifier()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeauthorizeDataShare.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeauthorizeDataShare", []))

    @jsii.member(jsii_name="toDeleteAuthenticationProfile")
    def to_delete_authentication_profile(self) -> "Redshift":
        '''(experimental) Grants permission to delete an Amazon Redshift authentication profile.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteAuthenticationProfile", []))

    @jsii.member(jsii_name="toDeleteCluster")
    def to_delete_cluster(self) -> "Redshift":
        '''(experimental) Grants permission to delete a previously provisioned cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteCluster.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteCluster", []))

    @jsii.member(jsii_name="toDeleteClusterParameterGroup")
    def to_delete_cluster_parameter_group(self) -> "Redshift":
        '''(experimental) Grants permission to delete an Amazon Redshift parameter group.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteClusterParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteClusterParameterGroup", []))

    @jsii.member(jsii_name="toDeleteClusterSecurityGroup")
    def to_delete_cluster_security_group(self) -> "Redshift":
        '''(experimental) Grants permission to delete an Amazon Redshift security group.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteClusterSecurityGroup.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteClusterSecurityGroup", []))

    @jsii.member(jsii_name="toDeleteClusterSnapshot")
    def to_delete_cluster_snapshot(self) -> "Redshift":
        '''(experimental) Grants permission to delete a manual snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteClusterSnapshot", []))

    @jsii.member(jsii_name="toDeleteClusterSubnetGroup")
    def to_delete_cluster_subnet_group(self) -> "Redshift":
        '''(experimental) Grants permission to delete a cluster subnet group.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteClusterSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteClusterSubnetGroup", []))

    @jsii.member(jsii_name="toDeleteEndpointAccess")
    def to_delete_endpoint_access(self) -> "Redshift":
        '''(experimental) Grants permission to delete a redshift-managed vpc endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteEndpointAccess.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteEndpointAccess", []))

    @jsii.member(jsii_name="toDeleteEventSubscription")
    def to_delete_event_subscription(self) -> "Redshift":
        '''(experimental) Grants permission to delete an Amazon Redshift event notification subscription.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteEventSubscription.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteEventSubscription", []))

    @jsii.member(jsii_name="toDeleteHsmClientCertificate")
    def to_delete_hsm_client_certificate(self) -> "Redshift":
        '''(experimental) Grants permission to delete an HSM client certificate.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteHsmClientCertificate.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteHsmClientCertificate", []))

    @jsii.member(jsii_name="toDeleteHsmConfiguration")
    def to_delete_hsm_configuration(self) -> "Redshift":
        '''(experimental) Grants permission to delete an Amazon Redshift HSM configuration.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteHsmConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteHsmConfiguration", []))

    @jsii.member(jsii_name="toDeletePartner")
    def to_delete_partner(self) -> "Redshift":
        '''(experimental) Grants permission to delete a partner integration from a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeletePartner.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeletePartner", []))

    @jsii.member(jsii_name="toDeleteSavedQueries")
    def to_delete_saved_queries(self) -> "Redshift":
        '''(experimental) Grants permission to delete saved SQL queries through the Amazon Redshift console.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteSavedQueries", []))

    @jsii.member(jsii_name="toDeleteScheduledAction")
    def to_delete_scheduled_action(self) -> "Redshift":
        '''(experimental) Grants permission to delete an Amazon Redshift scheduled action.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteScheduledAction", []))

    @jsii.member(jsii_name="toDeleteSnapshotCopyGrant")
    def to_delete_snapshot_copy_grant(self) -> "Redshift":
        '''(experimental) Grants permission to delete a snapshot copy grant.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteSnapshotCopyGrant.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteSnapshotCopyGrant", []))

    @jsii.member(jsii_name="toDeleteSnapshotSchedule")
    def to_delete_snapshot_schedule(self) -> "Redshift":
        '''(experimental) Grants permission to delete a snapshot schedule.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteSnapshotSchedule.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteSnapshotSchedule", []))

    @jsii.member(jsii_name="toDeleteTags")
    def to_delete_tags(self) -> "Redshift":
        '''(experimental) Grants permission to delete a tag or tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteTags.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteTags", []))

    @jsii.member(jsii_name="toDeleteUsageLimit")
    def to_delete_usage_limit(self) -> "Redshift":
        '''(experimental) Grants permission to delete a usage limit.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DeleteUsageLimit.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDeleteUsageLimit", []))

    @jsii.member(jsii_name="toDescribeAccountAttributes")
    def to_describe_account_attributes(self) -> "Redshift":
        '''(experimental) Grants permission to describe attributes attached to the specified AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeAccountAttributes.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeAccountAttributes", []))

    @jsii.member(jsii_name="toDescribeAuthenticationProfiles")
    def to_describe_authentication_profiles(self) -> "Redshift":
        '''(experimental) Grants permission to describe created Amazon Redshift authentication profiles.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeAuthenticationProfiles", []))

    @jsii.member(jsii_name="toDescribeClusterDbRevisions")
    def to_describe_cluster_db_revisions(self) -> "Redshift":
        '''(experimental) Grants permission to describe database revisions for a cluster.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeClusterDbRevisions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeClusterDbRevisions", []))

    @jsii.member(jsii_name="toDescribeClusterParameterGroups")
    def to_describe_cluster_parameter_groups(self) -> "Redshift":
        '''(experimental) Grants permission to describe Amazon Redshift parameter groups, including parameter groups you created and the default parameter group.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeClusterParameterGroups.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeClusterParameterGroups", []))

    @jsii.member(jsii_name="toDescribeClusterParameters")
    def to_describe_cluster_parameters(self) -> "Redshift":
        '''(experimental) Grants permission to describe parameters contained within an Amazon Redshift parameter group.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeClusterParameters.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeClusterParameters", []))

    @jsii.member(jsii_name="toDescribeClusters")
    def to_describe_clusters(self) -> "Redshift":
        '''(experimental) Grants permission to describe properties of provisioned clusters.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeClusters.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeClusters", []))

    @jsii.member(jsii_name="toDescribeClusterSecurityGroups")
    def to_describe_cluster_security_groups(self) -> "Redshift":
        '''(experimental) Grants permission to describe Amazon Redshift security groups.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeClusterSecurityGroups.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeClusterSecurityGroups", []))

    @jsii.member(jsii_name="toDescribeClusterSnapshots")
    def to_describe_cluster_snapshots(self) -> "Redshift":
        '''(experimental) Grants permission to describe one or more snapshot objects, which contain metadata about your cluster snapshots.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeClusterSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeClusterSnapshots", []))

    @jsii.member(jsii_name="toDescribeClusterSubnetGroups")
    def to_describe_cluster_subnet_groups(self) -> "Redshift":
        '''(experimental) Grants permission to describe one or more cluster subnet group objects, which contain metadata about your cluster subnet groups.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeClusterSubnetGroups.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeClusterSubnetGroups", []))

    @jsii.member(jsii_name="toDescribeClusterTracks")
    def to_describe_cluster_tracks(self) -> "Redshift":
        '''(experimental) Grants permission to describe available maintenance tracks.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeClusterTracks.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeClusterTracks", []))

    @jsii.member(jsii_name="toDescribeClusterVersions")
    def to_describe_cluster_versions(self) -> "Redshift":
        '''(experimental) Grants permission to describe available Amazon Redshift cluster versions.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeClusterVersions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeClusterVersions", []))

    @jsii.member(jsii_name="toDescribeDataShares")
    def to_describe_data_shares(self) -> "Redshift":
        '''(experimental) Grants permission to describe datashares created and consumed by your clusters.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeDataShares.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeDataShares", []))

    @jsii.member(jsii_name="toDescribeDataSharesForConsumer")
    def to_describe_data_shares_for_consumer(self) -> "Redshift":
        '''(experimental) Grants permission to describe only datashares consumed by your clusters.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeDataSharesForConsumer.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeDataSharesForConsumer", []))

    @jsii.member(jsii_name="toDescribeDataSharesForProducer")
    def to_describe_data_shares_for_producer(self) -> "Redshift":
        '''(experimental) Grants permission to describe only datashares created by your clusters.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeDataSharesForProducer.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeDataSharesForProducer", []))

    @jsii.member(jsii_name="toDescribeDefaultClusterParameters")
    def to_describe_default_cluster_parameters(self) -> "Redshift":
        '''(experimental) Grants permission to describe parameter settings for a parameter group family.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeDefaultClusterParameters.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeDefaultClusterParameters", []))

    @jsii.member(jsii_name="toDescribeEndpointAccess")
    def to_describe_endpoint_access(self) -> "Redshift":
        '''(experimental) Grants permission to describe redshift-managed vpc endpoints.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeEndpointAccess.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeEndpointAccess", []))

    @jsii.member(jsii_name="toDescribeEndpointAuthorization")
    def to_describe_endpoint_authorization(self) -> "Redshift":
        '''(experimental) Grants permission to authorize describe activity for redshift-managed vpc endpoint.

        Access Level: Permissions management

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeEndpointAuthorization.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeEndpointAuthorization", []))

    @jsii.member(jsii_name="toDescribeEventCategories")
    def to_describe_event_categories(self) -> "Redshift":
        '''(experimental) Grants permission to describe event categories for all event source types, or for a specified source type.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeEventCategories.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeEventCategories", []))

    @jsii.member(jsii_name="toDescribeEvents")
    def to_describe_events(self) -> "Redshift":
        '''(experimental) Grants permission to describe events related to clusters, security groups, snapshots, and parameter groups for the past 14 days.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeEvents.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeEvents", []))

    @jsii.member(jsii_name="toDescribeEventSubscriptions")
    def to_describe_event_subscriptions(self) -> "Redshift":
        '''(experimental) Grants permission to describe Amazon Redshift event notification subscriptions for the specified AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeEventSubscriptions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeEventSubscriptions", []))

    @jsii.member(jsii_name="toDescribeHsmClientCertificates")
    def to_describe_hsm_client_certificates(self) -> "Redshift":
        '''(experimental) Grants permission to describe HSM client certificates.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeHsmClientCertificates.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeHsmClientCertificates", []))

    @jsii.member(jsii_name="toDescribeHsmConfigurations")
    def to_describe_hsm_configurations(self) -> "Redshift":
        '''(experimental) Grants permission to describe Amazon Redshift HSM configurations.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeHsmConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeHsmConfigurations", []))

    @jsii.member(jsii_name="toDescribeLoggingStatus")
    def to_describe_logging_status(self) -> "Redshift":
        '''(experimental) Grants permission to describe whether information, such as queries and connection attempts, is being logged for a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeLoggingStatus.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeLoggingStatus", []))

    @jsii.member(jsii_name="toDescribeNodeConfigurationOptions")
    def to_describe_node_configuration_options(self) -> "Redshift":
        '''(experimental) Grants permission to describe properties of possible node configurations such as node type, number of nodes, and disk usage for the specified action type.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeNodeConfigurationOptions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeNodeConfigurationOptions", []))

    @jsii.member(jsii_name="toDescribeOrderableClusterOptions")
    def to_describe_orderable_cluster_options(self) -> "Redshift":
        '''(experimental) Grants permission to describe orderable cluster options.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeOrderableClusterOptions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeOrderableClusterOptions", []))

    @jsii.member(jsii_name="toDescribePartners")
    def to_describe_partners(self) -> "Redshift":
        '''(experimental) Grants permission to retrieve information about the partner integrations defined for a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribePartners.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribePartners", []))

    @jsii.member(jsii_name="toDescribeQuery")
    def to_describe_query(self) -> "Redshift":
        '''(experimental) Grants permission to describe a query through the Amazon Redshift console.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeQuery", []))

    @jsii.member(jsii_name="toDescribeReservedNodeExchangeStatus")
    def to_describe_reserved_node_exchange_status(self) -> "Redshift":
        '''(experimental) Grants permission to describe exchange status details and associated metadata for a reserved-node exchange.

        Statuses include such values as in progress and requested

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeReservedNodeExchangeStatus.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeReservedNodeExchangeStatus", []))

    @jsii.member(jsii_name="toDescribeReservedNodeOfferings")
    def to_describe_reserved_node_offerings(self) -> "Redshift":
        '''(experimental) Grants permission to describe available reserved node offerings by Amazon Redshift.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeReservedNodeOfferings.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeReservedNodeOfferings", []))

    @jsii.member(jsii_name="toDescribeReservedNodes")
    def to_describe_reserved_nodes(self) -> "Redshift":
        '''(experimental) Grants permission to describe the reserved nodes.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeReservedNodes.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeReservedNodes", []))

    @jsii.member(jsii_name="toDescribeResize")
    def to_describe_resize(self) -> "Redshift":
        '''(experimental) Grants permission to describe the last resize operation for a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeResize.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeResize", []))

    @jsii.member(jsii_name="toDescribeSavedQueries")
    def to_describe_saved_queries(self) -> "Redshift":
        '''(experimental) Grants permission to describe saved queries through the Amazon Redshift console.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeSavedQueries", []))

    @jsii.member(jsii_name="toDescribeScheduledActions")
    def to_describe_scheduled_actions(self) -> "Redshift":
        '''(experimental) Grants permission to describe created Amazon Redshift scheduled actions.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeScheduledActions", []))

    @jsii.member(jsii_name="toDescribeSnapshotCopyGrants")
    def to_describe_snapshot_copy_grants(self) -> "Redshift":
        '''(experimental) Grants permission to describe snapshot copy grants owned by the specified AWS account in the destination AWS Region.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeSnapshotCopyGrants.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeSnapshotCopyGrants", []))

    @jsii.member(jsii_name="toDescribeSnapshotSchedules")
    def to_describe_snapshot_schedules(self) -> "Redshift":
        '''(experimental) Grants permission to describe snapshot schedules.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeSnapshotSchedules.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeSnapshotSchedules", []))

    @jsii.member(jsii_name="toDescribeStorage")
    def to_describe_storage(self) -> "Redshift":
        '''(experimental) Grants permission to describe account level backups storage size and provisional storage.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeStorage.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeStorage", []))

    @jsii.member(jsii_name="toDescribeTable")
    def to_describe_table(self) -> "Redshift":
        '''(experimental) Grants permission to describe a table through the Amazon Redshift console.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeTable", []))

    @jsii.member(jsii_name="toDescribeTableRestoreStatus")
    def to_describe_table_restore_status(self) -> "Redshift":
        '''(experimental) Grants permission to describe status of one or more table restore requests made using the RestoreTableFromClusterSnapshot API action.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeTableRestoreStatus.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeTableRestoreStatus", []))

    @jsii.member(jsii_name="toDescribeTags")
    def to_describe_tags(self) -> "Redshift":
        '''(experimental) Grants permission to describe tags.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeTags.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeTags", []))

    @jsii.member(jsii_name="toDescribeUsageLimits")
    def to_describe_usage_limits(self) -> "Redshift":
        '''(experimental) Grants permission to describe usage limits.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DescribeUsageLimits.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDescribeUsageLimits", []))

    @jsii.member(jsii_name="toDisableLogging")
    def to_disable_logging(self) -> "Redshift":
        '''(experimental) Grants permission to disable logging information, such as queries and connection attempts, for a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DisableLogging.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDisableLogging", []))

    @jsii.member(jsii_name="toDisableSnapshotCopy")
    def to_disable_snapshot_copy(self) -> "Redshift":
        '''(experimental) Grants permission to disable the automatic copy of snapshots for a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DisableSnapshotCopy.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDisableSnapshotCopy", []))

    @jsii.member(jsii_name="toDisassociateDataShareConsumer")
    def to_disassociate_data_share_consumer(self) -> "Redshift":
        '''(experimental) Grants permission to disassociate a consumer from a datashare.

        Access Level: Write

        Possible conditions:

        - .ifConsumerArn()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_DisassociateDataShareConsumer.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toDisassociateDataShareConsumer", []))

    @jsii.member(jsii_name="toEnableLogging")
    def to_enable_logging(self) -> "Redshift":
        '''(experimental) Grants permission to enable logging information, such as queries and connection attempts, for a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_EnableLogging.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toEnableLogging", []))

    @jsii.member(jsii_name="toEnableSnapshotCopy")
    def to_enable_snapshot_copy(self) -> "Redshift":
        '''(experimental) Grants permission to enable the automatic copy of snapshots for a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_EnableSnapshotCopy.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toEnableSnapshotCopy", []))

    @jsii.member(jsii_name="toExecuteQuery")
    def to_execute_query(self) -> "Redshift":
        '''(experimental) Grants permission to execute a query through the Amazon Redshift console.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toExecuteQuery", []))

    @jsii.member(jsii_name="toFetchResults")
    def to_fetch_results(self) -> "Redshift":
        '''(experimental) Grants permission to fetch query results through the Amazon Redshift console.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toFetchResults", []))

    @jsii.member(jsii_name="toGetClusterCredentials")
    def to_get_cluster_credentials(self) -> "Redshift":
        '''(experimental) Grants permission to get temporary credentials to access an Amazon Redshift database by the specified AWS account.

        Access Level: Write

        Possible conditions:

        - .ifDbName()
        - .ifDbUser()
        - .ifDurationSeconds()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_GetClusterCredentials.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toGetClusterCredentials", []))

    @jsii.member(jsii_name="toGetClusterCredentialsWithIAM")
    def to_get_cluster_credentials_with_iam(self) -> "Redshift":
        '''(experimental) Grants permission to get enhanced temporary credentials to access an Amazon Redshift database by the specified AWS account.

        Access Level: Write

        Possible conditions:

        - .ifDbName()
        - .ifDurationSeconds()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_GetClusterCredentialsWithIAM.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toGetClusterCredentialsWithIAM", []))

    @jsii.member(jsii_name="toGetReservedNodeExchangeConfigurationOptions")
    def to_get_reserved_node_exchange_configuration_options(self) -> "Redshift":
        '''(experimental) Grants permission to get the configuration options for the reserved-node exchange.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_GetReservedNodeExchangeConfigurationOptions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toGetReservedNodeExchangeConfigurationOptions", []))

    @jsii.member(jsii_name="toGetReservedNodeExchangeOfferings")
    def to_get_reserved_node_exchange_offerings(self) -> "Redshift":
        '''(experimental) Grants permission to get an array of DC2 ReservedNodeOfferings that matches the payment type, term, and usage price of the given DC1 reserved node.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_GetReservedNodeExchangeOfferings.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toGetReservedNodeExchangeOfferings", []))

    @jsii.member(jsii_name="toJoinGroup")
    def to_join_group(self) -> "Redshift":
        '''(experimental) Grants permission to join the specified Amazon Redshift group.

        Access Level: Permissions management

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_GetClusterCredentials.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toJoinGroup", []))

    @jsii.member(jsii_name="toListDatabases")
    def to_list_databases(self) -> "Redshift":
        '''(experimental) Grants permission to list databases through the Amazon Redshift console.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toListDatabases", []))

    @jsii.member(jsii_name="toListSavedQueries")
    def to_list_saved_queries(self) -> "Redshift":
        '''(experimental) Grants permission to list saved queries through the Amazon Redshift console.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toListSavedQueries", []))

    @jsii.member(jsii_name="toListSchemas")
    def to_list_schemas(self) -> "Redshift":
        '''(experimental) Grants permission to list schemas through the Amazon Redshift console.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toListSchemas", []))

    @jsii.member(jsii_name="toListTables")
    def to_list_tables(self) -> "Redshift":
        '''(experimental) Grants permission to list tables through the Amazon Redshift console.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toListTables", []))

    @jsii.member(jsii_name="toModifyAquaConfiguration")
    def to_modify_aqua_configuration(self) -> "Redshift":
        '''(experimental) Grants permission to modify the AQUA configuration of a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyAquaConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyAquaConfiguration", []))

    @jsii.member(jsii_name="toModifyAuthenticationProfile")
    def to_modify_authentication_profile(self) -> "Redshift":
        '''(experimental) Grants permission to modify an existing Amazon Redshift authentication profile.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyAuthenticationProfile.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyAuthenticationProfile", []))

    @jsii.member(jsii_name="toModifyCluster")
    def to_modify_cluster(self) -> "Redshift":
        '''(experimental) Grants permission to modify the settings of a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyCluster.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyCluster", []))

    @jsii.member(jsii_name="toModifyClusterDbRevision")
    def to_modify_cluster_db_revision(self) -> "Redshift":
        '''(experimental) Grants permission to modify the database revision of a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyClusterDbRevision.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyClusterDbRevision", []))

    @jsii.member(jsii_name="toModifyClusterIamRoles")
    def to_modify_cluster_iam_roles(self) -> "Redshift":
        '''(experimental) Grants permission to modify the list of AWS Identity and Access Management (IAM) roles that can be used by a cluster to access other AWS services.

        Access Level: Permissions management

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyClusterIamRoles.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyClusterIamRoles", []))

    @jsii.member(jsii_name="toModifyClusterMaintenance")
    def to_modify_cluster_maintenance(self) -> "Redshift":
        '''(experimental) Grants permission to modify the maintenance settings of a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyClusterMaintenance.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyClusterMaintenance", []))

    @jsii.member(jsii_name="toModifyClusterParameterGroup")
    def to_modify_cluster_parameter_group(self) -> "Redshift":
        '''(experimental) Grants permission to modify the parameters of a parameter group.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyClusterParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyClusterParameterGroup", []))

    @jsii.member(jsii_name="toModifyClusterSnapshot")
    def to_modify_cluster_snapshot(self) -> "Redshift":
        '''(experimental) Grants permission to modify the settings of a snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyClusterSnapshot", []))

    @jsii.member(jsii_name="toModifyClusterSnapshotSchedule")
    def to_modify_cluster_snapshot_schedule(self) -> "Redshift":
        '''(experimental) Grants permission to modify a snapshot schedule for a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyClusterSnapshotSchedule.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyClusterSnapshotSchedule", []))

    @jsii.member(jsii_name="toModifyClusterSubnetGroup")
    def to_modify_cluster_subnet_group(self) -> "Redshift":
        '''(experimental) Grants permission to modify a cluster subnet group to include the specified list of VPC subnets.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyClusterSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyClusterSubnetGroup", []))

    @jsii.member(jsii_name="toModifyEndpointAccess")
    def to_modify_endpoint_access(self) -> "Redshift":
        '''(experimental) Grants permission to modify a redshift-managed vpc endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyEndpointAccess.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyEndpointAccess", []))

    @jsii.member(jsii_name="toModifyEventSubscription")
    def to_modify_event_subscription(self) -> "Redshift":
        '''(experimental) Grants permission to modify an existing Amazon Redshift event notification subscription.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyEventSubscription.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyEventSubscription", []))

    @jsii.member(jsii_name="toModifySavedQuery")
    def to_modify_saved_query(self) -> "Redshift":
        '''(experimental) Grants permission to modify an existing saved query through the Amazon Redshift console.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifySavedQuery", []))

    @jsii.member(jsii_name="toModifyScheduledAction")
    def to_modify_scheduled_action(self) -> "Redshift":
        '''(experimental) Grants permission to modify an existing Amazon Redshift scheduled action.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyScheduledAction.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyScheduledAction", []))

    @jsii.member(jsii_name="toModifySnapshotCopyRetentionPeriod")
    def to_modify_snapshot_copy_retention_period(self) -> "Redshift":
        '''(experimental) Grants permission to modify the number of days to retain snapshots in the destination AWS Region after they are copied from the source AWS Region.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifySnapshotCopyRetentionPeriod.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifySnapshotCopyRetentionPeriod", []))

    @jsii.member(jsii_name="toModifySnapshotSchedule")
    def to_modify_snapshot_schedule(self) -> "Redshift":
        '''(experimental) Grants permission to modify a snapshot schedule.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifySnapshotSchedule.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifySnapshotSchedule", []))

    @jsii.member(jsii_name="toModifyUsageLimit")
    def to_modify_usage_limit(self) -> "Redshift":
        '''(experimental) Grants permission to modify a usage limit.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ModifyUsageLimit.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toModifyUsageLimit", []))

    @jsii.member(jsii_name="toPauseCluster")
    def to_pause_cluster(self) -> "Redshift":
        '''(experimental) Grants permission to pause a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_PauseCluster.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toPauseCluster", []))

    @jsii.member(jsii_name="toPurchaseReservedNodeOffering")
    def to_purchase_reserved_node_offering(self) -> "Redshift":
        '''(experimental) Grants permission to purchase a reserved node.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_PurchaseReservedNodeOffering.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toPurchaseReservedNodeOffering", []))

    @jsii.member(jsii_name="toRebootCluster")
    def to_reboot_cluster(self) -> "Redshift":
        '''(experimental) Grants permission to reboot a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_RebootCluster.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toRebootCluster", []))

    @jsii.member(jsii_name="toRejectDataShare")
    def to_reject_data_share(self) -> "Redshift":
        '''(experimental) Grants permission to decline a datashare shared from another account.

        Access Level: Permissions management

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_RejectDataShare.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toRejectDataShare", []))

    @jsii.member(jsii_name="toResetClusterParameterGroup")
    def to_reset_cluster_parameter_group(self) -> "Redshift":
        '''(experimental) Grants permission to set one or more parameters of a parameter group to their default values and set the source values of the parameters to "engine-default".

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ResetClusterParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toResetClusterParameterGroup", []))

    @jsii.member(jsii_name="toResizeCluster")
    def to_resize_cluster(self) -> "Redshift":
        '''(experimental) Grants permission to change the size of a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ResizeCluster.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toResizeCluster", []))

    @jsii.member(jsii_name="toRestoreFromClusterSnapshot")
    def to_restore_from_cluster_snapshot(self) -> "Redshift":
        '''(experimental) Grants permission to create a cluster from a snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_RestoreFromClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toRestoreFromClusterSnapshot", []))

    @jsii.member(jsii_name="toRestoreTableFromClusterSnapshot")
    def to_restore_table_from_cluster_snapshot(self) -> "Redshift":
        '''(experimental) Grants permission to create a table from a table in an Amazon Redshift cluster snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_RestoreTableFromClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toRestoreTableFromClusterSnapshot", []))

    @jsii.member(jsii_name="toResumeCluster")
    def to_resume_cluster(self) -> "Redshift":
        '''(experimental) Grants permission to resume a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_ResumeCluster.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toResumeCluster", []))

    @jsii.member(jsii_name="toRevokeClusterSecurityGroupIngress")
    def to_revoke_cluster_security_group_ingress(self) -> "Redshift":
        '''(experimental) Grants permission to revoke an ingress rule in an Amazon Redshift security group for a previously authorized IP range or Amazon EC2 security group.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_RevokeClusterSecurityGroupIngress.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toRevokeClusterSecurityGroupIngress", []))

    @jsii.member(jsii_name="toRevokeEndpointAccess")
    def to_revoke_endpoint_access(self) -> "Redshift":
        '''(experimental) Grants permission to revoke access for endpoint related activities for redshift-managed vpc endpoint.

        Access Level: Permissions management

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_RevokeEndpointAccess.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toRevokeEndpointAccess", []))

    @jsii.member(jsii_name="toRevokeSnapshotAccess")
    def to_revoke_snapshot_access(self) -> "Redshift":
        '''(experimental) Grants permission to revoke access from the specified AWS account to restore a snapshot.

        Access Level: Permissions management

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_RevokeSnapshotAccess.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toRevokeSnapshotAccess", []))

    @jsii.member(jsii_name="toRotateEncryptionKey")
    def to_rotate_encryption_key(self) -> "Redshift":
        '''(experimental) Grants permission to rotate an encryption key for a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_RotateEncryptionKey.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toRotateEncryptionKey", []))

    @jsii.member(jsii_name="toUpdatePartnerStatus")
    def to_update_partner_status(self) -> "Redshift":
        '''(experimental) Grants permission to update the status of a partner integration.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/APIReference/API_UpdatePartnerStatus.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toUpdatePartnerStatus", []))

    @jsii.member(jsii_name="toViewQueriesFromConsole")
    def to_view_queries_from_console(self) -> "Redshift":
        '''(experimental) Grants permission to view query results through the Amazon Redshift console.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toViewQueriesFromConsole", []))

    @jsii.member(jsii_name="toViewQueriesInConsole")
    def to_view_queries_in_console(self) -> "Redshift":
        '''(experimental) Grants permission to terminate running queries and loads through the Amazon Redshift console.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Redshift", jsii.invoke(self, "toViewQueriesInConsole", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f28f29ae8a037b92bd049cdee3c5cd137092e09fa0230257c152d1dace685ffd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__14bf5f7ce9fe4589eff2d5505245262db2b74d365314703627e896bf9de9425f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class RedshiftData(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.RedshiftData",
):
    '''(experimental) Statement provider for service `redshift-data <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonredshiftdataapi.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `redshift-data <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonredshiftdataapi.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__01b16e1aca1d430dedca398915fdc46c452e5f2df3aee33b8f2a471717e77451)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifStatementOwnerIamUserid")
    def if_statement_owner_iam_userid(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "RedshiftData":
        '''(experimental) Filters access by statement owner iam userid.

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-overview.html#redshift-policy-resources.conditions

        Applies to actions:

        - .toCancelStatement()
        - .toDescribeStatement()
        - .toGetStatementResult()
        - .toListStatements()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7d1679a6c1112c48116e86fa276c3a1db260456ce8edc7159102f2afb09c79e7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("RedshiftData", jsii.invoke(self, "ifStatementOwnerIamUserid", [value, operator]))

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        cluster_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "RedshiftData":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-clusters.html

        :param cluster_name: - Identifier for the clusterName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__be4162736a3b1a9bf2c47ed5dd4368eaa722b36b3db3ea39fb80de60797e73a3)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("RedshiftData", jsii.invoke(self, "onCluster", [cluster_name, account, region, partition]))

    @jsii.member(jsii_name="onWorkgroup")
    def on_workgroup(
        self,
        workgroup_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "RedshiftData":
        '''(experimental) Adds a resource of type workgroup to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/working-with-serverless.html

        :param workgroup_id: - Identifier for the workgroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8f84f4115084e2ae53830236725c2326c31c27cc0974541ed0578e8da318204e)
            check_type(argname="argument workgroup_id", value=workgroup_id, expected_type=type_hints["workgroup_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("RedshiftData", jsii.invoke(self, "onWorkgroup", [workgroup_id, account, region, partition]))

    @jsii.member(jsii_name="toBatchExecuteStatement")
    def to_batch_execute_statement(self) -> "RedshiftData":
        '''(experimental) Grants permission to execute multiple queries under a single connection.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_BatchExecuteStatement.html

        :stability: experimental
        '''
        return typing.cast("RedshiftData", jsii.invoke(self, "toBatchExecuteStatement", []))

    @jsii.member(jsii_name="toCancelStatement")
    def to_cancel_statement(self) -> "RedshiftData":
        '''(experimental) Grants permission to cancel a running query.

        Access Level: Write

        Possible conditions:

        - .ifStatementOwnerIamUserid()

        https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_CancelStatement.html

        :stability: experimental
        '''
        return typing.cast("RedshiftData", jsii.invoke(self, "toCancelStatement", []))

    @jsii.member(jsii_name="toDescribeStatement")
    def to_describe_statement(self) -> "RedshiftData":
        '''(experimental) Grants permission to retrieve detailed information about a statement execution.

        Access Level: Read

        Possible conditions:

        - .ifStatementOwnerIamUserid()

        https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_DescribeStatement.html

        :stability: experimental
        '''
        return typing.cast("RedshiftData", jsii.invoke(self, "toDescribeStatement", []))

    @jsii.member(jsii_name="toDescribeTable")
    def to_describe_table(self) -> "RedshiftData":
        '''(experimental) Grants permission to retrieve metadata about a particular table.

        Access Level: Read

        https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_DescribeTable.html

        :stability: experimental
        '''
        return typing.cast("RedshiftData", jsii.invoke(self, "toDescribeTable", []))

    @jsii.member(jsii_name="toExecuteStatement")
    def to_execute_statement(self) -> "RedshiftData":
        '''(experimental) Grants permission to execute a query.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_ExecuteStatement.html

        :stability: experimental
        '''
        return typing.cast("RedshiftData", jsii.invoke(self, "toExecuteStatement", []))

    @jsii.member(jsii_name="toGetStatementResult")
    def to_get_statement_result(self) -> "RedshiftData":
        '''(experimental) Grants permission to fetch the result of a query.

        Access Level: Read

        Possible conditions:

        - .ifStatementOwnerIamUserid()

        https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_GetStatementResult.html

        :stability: experimental
        '''
        return typing.cast("RedshiftData", jsii.invoke(self, "toGetStatementResult", []))

    @jsii.member(jsii_name="toListDatabases")
    def to_list_databases(self) -> "RedshiftData":
        '''(experimental) Grants permission to list databases for a given cluster.

        Access Level: Read

        https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_ListDatabases.html

        :stability: experimental
        '''
        return typing.cast("RedshiftData", jsii.invoke(self, "toListDatabases", []))

    @jsii.member(jsii_name="toListSchemas")
    def to_list_schemas(self) -> "RedshiftData":
        '''(experimental) Grants permission to list schemas for a given cluster.

        Access Level: Read

        https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_ListSchemas.html

        :stability: experimental
        '''
        return typing.cast("RedshiftData", jsii.invoke(self, "toListSchemas", []))

    @jsii.member(jsii_name="toListStatements")
    def to_list_statements(self) -> "RedshiftData":
        '''(experimental) Grants permission to list queries for a given principal.

        Access Level: List

        Possible conditions:

        - .ifStatementOwnerIamUserid()

        https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_ListStatements.html

        :stability: experimental
        '''
        return typing.cast("RedshiftData", jsii.invoke(self, "toListStatements", []))

    @jsii.member(jsii_name="toListTables")
    def to_list_tables(self) -> "RedshiftData":
        '''(experimental) Grants permission to list tables for a given cluster.

        Access Level: List

        https://docs.aws.amazon.com/redshift-data/latest/APIReference/API_ListTables.html

        :stability: experimental
        '''
        return typing.cast("RedshiftData", jsii.invoke(self, "toListTables", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f9d15f7aade048017622f7527799fb04a5f54aab6e3b7bd139e6143c48dacc77)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__935dd7c7e3a5e47476c5e77af1619cce090bdb8e986d90407cc0a16422d815a3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class RedshiftServerless(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.RedshiftServerless",
):
    '''(experimental) Statement provider for service `redshift-serverless <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonredshiftserverless.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `redshift-serverless <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonredshiftserverless.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__358d961e21363adae8e7ac62c80a5e5dc217d1cdf5ce6de73c56608f9b29e8d4)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifEndpointAccessId")
    def if_endpoint_access_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "RedshiftServerless":
        '''(experimental) Filters access by the endpoint access identifier.

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6e249add0d94f77948c435215528bb54484ae9dddb942ad7a7c7fc26b9ef5d70)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("RedshiftServerless", jsii.invoke(self, "ifEndpointAccessId", [value, operator]))

    @jsii.member(jsii_name="ifNamespaceId")
    def if_namespace_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "RedshiftServerless":
        '''(experimental) Filters access by the namespace identifier.

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c2ecacc5770ad5883f6867cd7b11a0c137ae610ed86cd391bb17cd9140b757a2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("RedshiftServerless", jsii.invoke(self, "ifNamespaceId", [value, operator]))

    @jsii.member(jsii_name="ifRecoveryPointId")
    def if_recovery_point_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "RedshiftServerless":
        '''(experimental) Filters access by the recovery point identifier.

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4dc7132ac640f8b7abd41dffc0f8ee008f54e96ad2541dc9935ba9c6d677eca5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("RedshiftServerless", jsii.invoke(self, "ifRecoveryPointId", [value, operator]))

    @jsii.member(jsii_name="ifSnapshotId")
    def if_snapshot_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "RedshiftServerless":
        '''(experimental) Filters access by the snapshot identifier.

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a35910cdccc6cd2505fade1e6ad491cfcc7d93f4c74ae7e83219905356d5ffa3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("RedshiftServerless", jsii.invoke(self, "ifSnapshotId", [value, operator]))

    @jsii.member(jsii_name="ifTableRestoreRequestId")
    def if_table_restore_request_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "RedshiftServerless":
        '''(experimental) Filters access by the table restore request identifier.

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bef6db18470b302c2135b22fa7cea094358d37abbdc5324f9a8c19804a4c61bb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("RedshiftServerless", jsii.invoke(self, "ifTableRestoreRequestId", [value, operator]))

    @jsii.member(jsii_name="ifWorkgroupId")
    def if_workgroup_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "RedshiftServerless":
        '''(experimental) Filters access by the workgroup identifier.

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__71923bd8aa91daae263c79838ecef22b1748117b16a405ef52d1e98611a535d0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("RedshiftServerless", jsii.invoke(self, "ifWorkgroupId", [value, operator]))

    @jsii.member(jsii_name="onEndpointAccess")
    def on_endpoint_access(
        self,
        endpoint_access_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "RedshiftServerless":
        '''(experimental) Adds a resource of type endpointAccess to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/serverless-connecting.html

        :param endpoint_access_id: - Identifier for the endpointAccessId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b6968ae9337e326b390d442d64826cd6730ab56e167f836afd10d1108559e6d1)
            check_type(argname="argument endpoint_access_id", value=endpoint_access_id, expected_type=type_hints["endpoint_access_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("RedshiftServerless", jsii.invoke(self, "onEndpointAccess", [endpoint_access_id, account, region, partition]))

    @jsii.member(jsii_name="onNamespace")
    def on_namespace(
        self,
        namespace_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "RedshiftServerless":
        '''(experimental) Adds a resource of type namespace to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/serverless-workgroup-namespace.html

        :param namespace_id: - Identifier for the namespaceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7316156c1851a8eef0272cc210af8697e5fafe5d69c24e10c388f2315c9be0c5)
            check_type(argname="argument namespace_id", value=namespace_id, expected_type=type_hints["namespace_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("RedshiftServerless", jsii.invoke(self, "onNamespace", [namespace_id, account, region, partition]))

    @jsii.member(jsii_name="onRecoveryPoint")
    def on_recovery_point(
        self,
        recovery_point_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "RedshiftServerless":
        '''(experimental) Adds a resource of type recoveryPoint to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/serverless-snapshots-recovery.html

        :param recovery_point_id: - Identifier for the recoveryPointId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__df8227b107b02b1c522285372025625294fc13f5d95efc8ed75eeaeca115b3ea)
            check_type(argname="argument recovery_point_id", value=recovery_point_id, expected_type=type_hints["recovery_point_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("RedshiftServerless", jsii.invoke(self, "onRecoveryPoint", [recovery_point_id, account, region, partition]))

    @jsii.member(jsii_name="onSnapshot")
    def on_snapshot(
        self,
        snapshot_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "RedshiftServerless":
        '''(experimental) Adds a resource of type snapshot to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/serverless-snapshots-recovery.html

        :param snapshot_id: - Identifier for the snapshotId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__01e05d2a84e7e3ee734299af05dd2cd93c09b99cb76af5fd6b12881d60f876d2)
            check_type(argname="argument snapshot_id", value=snapshot_id, expected_type=type_hints["snapshot_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("RedshiftServerless", jsii.invoke(self, "onSnapshot", [snapshot_id, account, region, partition]))

    @jsii.member(jsii_name="onWorkgroup")
    def on_workgroup(
        self,
        workgroup_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "RedshiftServerless":
        '''(experimental) Adds a resource of type workgroup to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/serverless-workgroup-namespace.html

        :param workgroup_id: - Identifier for the workgroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c4e5ea105e06d8ac92c73745854dcf1923aafe0381335fcea406493e7fbecdf7)
            check_type(argname="argument workgroup_id", value=workgroup_id, expected_type=type_hints["workgroup_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("RedshiftServerless", jsii.invoke(self, "onWorkgroup", [workgroup_id, account, region, partition]))

    @jsii.member(jsii_name="toConvertRecoveryPointToSnapshot")
    def to_convert_recovery_point_to_snapshot(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to convert a recovery point to a snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_ConvertRecoveryPointToSnapshot.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toConvertRecoveryPointToSnapshot", []))

    @jsii.member(jsii_name="toCreateEndpointAccess")
    def to_create_endpoint_access(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to create an Amazon Redshift Serverless managed VPC endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_CreateEndpointAccess.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toCreateEndpointAccess", []))

    @jsii.member(jsii_name="toCreateNamespace")
    def to_create_namespace(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to create an Amazon Redshift Serverless namespace.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_CreateNamespace.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toCreateNamespace", []))

    @jsii.member(jsii_name="toCreateSnapshot")
    def to_create_snapshot(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to create a snapshot of all databases in a namespace.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_CreateSnapshot.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toCreateSnapshot", []))

    @jsii.member(jsii_name="toCreateUsageLimit")
    def to_create_usage_limit(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to create a usage limit for a specified Amazon Redshift Serverless usage type.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_CreateUsageLimit.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toCreateUsageLimit", []))

    @jsii.member(jsii_name="toCreateWorkgroup")
    def to_create_workgroup(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to create a workgroup in Amazon Redshift Serverless.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_CreateWorkgroup.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toCreateWorkgroup", []))

    @jsii.member(jsii_name="toDeleteEndpointAccess")
    def to_delete_endpoint_access(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to delete an Amazon Redshift Serverless managed VPC endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_DeleteEndpointAccess.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toDeleteEndpointAccess", []))

    @jsii.member(jsii_name="toDeleteNamespace")
    def to_delete_namespace(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to delete a namespace from Amazon Redshift Serverless.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_DeleteNamespace.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toDeleteNamespace", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to delete the specified resource policy.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_DeleteResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteSnapshot")
    def to_delete_snapshot(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to delete a snapshot from Amazon Redshift Serverless.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_DeleteSnapshot.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toDeleteSnapshot", []))

    @jsii.member(jsii_name="toDeleteUsageLimit")
    def to_delete_usage_limit(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to delete a usage limit from Amazon Redshift Serverless.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_DeleteUsageLimit.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toDeleteUsageLimit", []))

    @jsii.member(jsii_name="toDeleteWorkgroup")
    def to_delete_workgroup(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to delete a workgroup.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_DeleteWorkgroup.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toDeleteWorkgroup", []))

    @jsii.member(jsii_name="toGetCredentials")
    def to_get_credentials(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to get a database user name and temporary password with temporary authorization to log on to Amazon Redshift Serverless.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_GetCredentials.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toGetCredentials", []))

    @jsii.member(jsii_name="toGetEndpointAccess")
    def to_get_endpoint_access(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to create an Amazon Redshift Serverless managed VPC endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_GetEndpointAccess.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toGetEndpointAccess", []))

    @jsii.member(jsii_name="toGetNamespace")
    def to_get_namespace(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to get information about a namespace in Amazon Redshift Serverless.

        Access Level: Read

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_GetNamespace.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toGetNamespace", []))

    @jsii.member(jsii_name="toGetRecoveryPoint")
    def to_get_recovery_point(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to get information about a recovery point.

        Access Level: Read

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_GetRecoveryPoint.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toGetRecoveryPoint", []))

    @jsii.member(jsii_name="toGetResourcePolicy")
    def to_get_resource_policy(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to get a resource policy.

        Access Level: Read

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_GetResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toGetResourcePolicy", []))

    @jsii.member(jsii_name="toGetSnapshot")
    def to_get_snapshot(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to get information about a specific snapshot.

        Access Level: Read

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_GetSnapshot.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toGetSnapshot", []))

    @jsii.member(jsii_name="toGetTableRestoreStatus")
    def to_get_table_restore_status(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to get table restore status about a specific snapshot.

        Access Level: Read

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_GetTableRestoreStatus.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toGetTableRestoreStatus", []))

    @jsii.member(jsii_name="toGetUsageLimit")
    def to_get_usage_limit(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to get information about a usage limit in Amazon Redshift Serverless.

        Access Level: Read

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_GetUsageLimit.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toGetUsageLimit", []))

    @jsii.member(jsii_name="toGetWorkgroup")
    def to_get_workgroup(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to get information about a specific workgroup.

        Access Level: Read

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_GetWorkgroup.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toGetWorkgroup", []))

    @jsii.member(jsii_name="toListEndpointAccess")
    def to_list_endpoint_access(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to list EndpointAccess objects and relevant information.

        Access Level: List

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_ListEndpointAccess.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toListEndpointAccess", []))

    @jsii.member(jsii_name="toListNamespaces")
    def to_list_namespaces(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to list namespaces in Amazon Redshift Serverless.

        Access Level: List

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_ListNamespaces.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toListNamespaces", []))

    @jsii.member(jsii_name="toListRecoveryPoints")
    def to_list_recovery_points(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to list an array of recovery points.

        Access Level: List

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_ListRecoveryPoints.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toListRecoveryPoints", []))

    @jsii.member(jsii_name="toListSnapshots")
    def to_list_snapshots(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to list snapshots.

        Access Level: List

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_ListSnapshots.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toListSnapshots", []))

    @jsii.member(jsii_name="toListTableRestoreStatus")
    def to_list_table_restore_status(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to list table restore status.

        Access Level: List

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_ListTableRestoreStatus.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toListTableRestoreStatus", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to list the tags assigned to a resource.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListUsageLimits")
    def to_list_usage_limits(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to list all usage limits within Amazon Redshift Serverless.

        Access Level: List

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_ListUsageLimits.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toListUsageLimits", []))

    @jsii.member(jsii_name="toListWorkgroups")
    def to_list_workgroups(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to list workgroups in Amazon Redshift Serverless.

        Access Level: List

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_ListWorkgroups.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toListWorkgroups", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to create or update a resource policy.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_PutResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toRestoreFromRecoveryPoint")
    def to_restore_from_recovery_point(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to restore the data from a recovery point.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_RestoreFromRecoveryPoint.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toRestoreFromRecoveryPoint", []))

    @jsii.member(jsii_name="toRestoreFromSnapshot")
    def to_restore_from_snapshot(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to restore a namespace from a snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_RestoreFromSnapshot.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toRestoreFromSnapshot", []))

    @jsii.member(jsii_name="toRestoreTableFromSnapshot")
    def to_restore_table_from_snapshot(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to restore a table from a snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_RestoreTableFromSnapshot.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toRestoreTableFromSnapshot", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to assign one or more tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to remove a tag or set of tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateEndpointAccess")
    def to_update_endpoint_access(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to update an Amazon Redshift Serverless managed VPC endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_UpdateEndpointAccess.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toUpdateEndpointAccess", []))

    @jsii.member(jsii_name="toUpdateNamespace")
    def to_update_namespace(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to update a namespace with the specified configuration settings.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_UpdateNamespace.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toUpdateNamespace", []))

    @jsii.member(jsii_name="toUpdateSnapshot")
    def to_update_snapshot(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to update a snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_UpdateSnapshot.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toUpdateSnapshot", []))

    @jsii.member(jsii_name="toUpdateUsageLimit")
    def to_update_usage_limit(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to update a usage limit in Amazon Redshift Serverless.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_UpdateUsageLimit.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toUpdateUsageLimit", []))

    @jsii.member(jsii_name="toUpdateWorkgroup")
    def to_update_workgroup(self) -> "RedshiftServerless":
        '''(experimental) Grants permission to update an Amazon Redshift Serverless workgroup with the specified configuration settings.

        Access Level: Write

        https://docs.aws.amazon.com/redshift-serverless/latest/APIReference/API_UpdateWorkgroup.html

        :stability: experimental
        '''
        return typing.cast("RedshiftServerless", jsii.invoke(self, "toUpdateWorkgroup", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1deb17852c187880950221bdbc2ea522bc5bc2072fc42d3c821251d061deb0b9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__74b8a5e5de499a48ba8d14ac46c69f651cc4dfb17203471407fad252e777c12b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class RefactorSpaces(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.RefactorSpaces",
):
    '''(experimental) Statement provider for service `refactor-spaces <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmigrationhubrefactorspaces.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `refactor-spaces <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmigrationhubrefactorspaces.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__854a934cfdb73247f8e90f506eaf5fb5ec41bfe9f253da0fdd941a3255e2ff1a)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifApplicationCreatedByAccount")
    def if_application_created_by_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "RefactorSpaces":
        '''(experimental) Filters access by restricting the action to only those accounts that created the application within an environment.

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toCreateApplication()
        - .toCreateRoute()
        - .toCreateService()
        - .toDeleteApplication()
        - .toDeleteRoute()
        - .toDeleteService()
        - .toGetApplication()
        - .toGetRoute()
        - .toGetService()
        - .toTagResource()
        - .toUntagResource()
        - .toUpdateRoute()

        Applies to resource types:

        - application
        - service
        - route

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b4532fbacba325b4e9dc78e0638f285e4e40ea0221da61b65e239c13053e277f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("RefactorSpaces", jsii.invoke(self, "ifApplicationCreatedByAccount", [value, operator]))

    @jsii.member(jsii_name="ifCreatedByAccountIds")
    def if_created_by_account_ids(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "RefactorSpaces":
        '''(experimental) Filters access by the accounts that created the resource.

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toCreateApplication()
        - .toCreateRoute()
        - .toCreateService()
        - .toDeleteApplication()
        - .toDeleteRoute()
        - .toDeleteService()
        - .toGetApplication()
        - .toGetRoute()
        - .toGetService()
        - .toTagResource()
        - .toUntagResource()
        - .toUpdateRoute()

        Applies to resource types:

        - application
        - service
        - route

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e03ed697099ac70d72bb4bfd65e17c45f99ae4ad43d1b213d2911a79cc73c3dc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("RefactorSpaces", jsii.invoke(self, "ifCreatedByAccountIds", [value, operator]))

    @jsii.member(jsii_name="ifRouteCreatedByAccount")
    def if_route_created_by_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "RefactorSpaces":
        '''(experimental) Filters access by restricting the action to only those accounts that created the route within an application.

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toCreateRoute()
        - .toDeleteRoute()
        - .toGetRoute()
        - .toTagResource()
        - .toUntagResource()
        - .toUpdateRoute()

        Applies to resource types:

        - route

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__69770b64be2ace592c90b62b2d5c541c2981cb6b387ac59963b596f5539500de)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("RefactorSpaces", jsii.invoke(self, "ifRouteCreatedByAccount", [value, operator]))

    @jsii.member(jsii_name="ifServiceCreatedByAccount")
    def if_service_created_by_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "RefactorSpaces":
        '''(experimental) Filters access by restricting the action to only those accounts that created the service within an application.

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toCreateRoute()
        - .toCreateService()
        - .toDeleteRoute()
        - .toDeleteService()
        - .toGetRoute()
        - .toGetService()
        - .toTagResource()
        - .toUntagResource()
        - .toUpdateRoute()

        Applies to resource types:

        - service
        - route

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__205a974a40572c29a1133ce70f6e3e4c4fe97d0bdaf9fdc58fd1b43f029ddb46)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("RefactorSpaces", jsii.invoke(self, "ifServiceCreatedByAccount", [value, operator]))

    @jsii.member(jsii_name="ifSourcePath")
    def if_source_path(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "RefactorSpaces":
        '''(experimental) Filters access by the path of the route.

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toCreateRoute()
        - .toDeleteRoute()
        - .toGetRoute()
        - .toTagResource()
        - .toUntagResource()
        - .toUpdateRoute()

        Applies to resource types:

        - route

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8f18a143a2b47c0483c36214e269ddd3687ec8c61cb4a0e21aeb77fa05896369)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("RefactorSpaces", jsii.invoke(self, "ifSourcePath", [value, operator]))

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        environment_id: builtins.str,
        application_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "RefactorSpaces":
        '''(experimental) Adds a resource of type application to the statement.

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-resources

        :param environment_id: - Identifier for the environmentId.
        :param application_id: - Identifier for the applicationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifApplicationCreatedByAccount() - .ifCreatedByAccountIds()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__754a7da14fd2f9f19adee64fd048e6d479bb2856da6394ace5200c1e6be98cb4)
            check_type(argname="argument environment_id", value=environment_id, expected_type=type_hints["environment_id"])
            check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("RefactorSpaces", jsii.invoke(self, "onApplication", [environment_id, application_id, account, region, partition]))

    @jsii.member(jsii_name="onEnvironment")
    def on_environment(
        self,
        environment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "RefactorSpaces":
        '''(experimental) Adds a resource of type environment to the statement.

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-resources

        :param environment_id: - Identifier for the environmentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f84d4717d9c36c5615b4334e6edc50c3172fcec55602449f6091acd5f3ff84f8)
            check_type(argname="argument environment_id", value=environment_id, expected_type=type_hints["environment_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("RefactorSpaces", jsii.invoke(self, "onEnvironment", [environment_id, account, region, partition]))

    @jsii.member(jsii_name="onRoute")
    def on_route(
        self,
        environment_id: builtins.str,
        application_id: builtins.str,
        route_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "RefactorSpaces":
        '''(experimental) Adds a resource of type route to the statement.

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-resources

        :param environment_id: - Identifier for the environmentId.
        :param application_id: - Identifier for the applicationId.
        :param route_id: - Identifier for the routeId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifApplicationCreatedByAccount() - .ifCreatedByAccountIds() - .ifRouteCreatedByAccount() - .ifServiceCreatedByAccount() - .ifSourcePath()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__59eaddf66b2beb99457c80e8e438a7e35b27ba269358f23c560a0e55eb555407)
            check_type(argname="argument environment_id", value=environment_id, expected_type=type_hints["environment_id"])
            check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
            check_type(argname="argument route_id", value=route_id, expected_type=type_hints["route_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("RefactorSpaces", jsii.invoke(self, "onRoute", [environment_id, application_id, route_id, account, region, partition]))

    @jsii.member(jsii_name="onService")
    def on_service(
        self,
        environment_id: builtins.str,
        application_id: builtins.str,
        service_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "RefactorSpaces":
        '''(experimental) Adds a resource of type service to the statement.

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-resources

        :param environment_id: - Identifier for the environmentId.
        :param application_id: - Identifier for the applicationId.
        :param service_id: - Identifier for the serviceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifApplicationCreatedByAccount() - .ifCreatedByAccountIds() - .ifServiceCreatedByAccount()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7b2b9c11e7b42d64f38a16dbb2213b91744b4ed859bc32759beef94edd215f9c)
            check_type(argname="argument environment_id", value=environment_id, expected_type=type_hints["environment_id"])
            check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
            check_type(argname="argument service_id", value=service_id, expected_type=type_hints["service_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("RefactorSpaces", jsii.invoke(self, "onService", [environment_id, application_id, service_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to create an application within an environment.

        Access Level: Write

        Possible conditions:

        - .ifApplicationCreatedByAccount()
        - .ifCreatedByAccountIds()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toCreateEnvironment")
    def to_create_environment(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to create an environment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_CreateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toCreateEnvironment", []))

    @jsii.member(jsii_name="toCreateRoute")
    def to_create_route(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to create a route within an application.

        Access Level: Write

        Possible conditions:

        - .ifApplicationCreatedByAccount()
        - .ifServiceCreatedByAccount()
        - .ifRouteCreatedByAccount()
        - .ifCreatedByAccountIds()
        - .ifSourcePath()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_CreateRoute.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toCreateRoute", []))

    @jsii.member(jsii_name="toCreateService")
    def to_create_service(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to create a service within an application.

        Access Level: Write

        Possible conditions:

        - .ifApplicationCreatedByAccount()
        - .ifServiceCreatedByAccount()
        - .ifCreatedByAccountIds()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_CreateService.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toCreateService", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to delete an application from an environment.

        Access Level: Write

        Possible conditions:

        - .ifApplicationCreatedByAccount()
        - .ifCreatedByAccountIds()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toDeleteEnvironment")
    def to_delete_environment(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to delete an environment.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_DeleteEnvironment.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toDeleteEnvironment", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to delete a resource policy.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_DeleteResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteRoute")
    def to_delete_route(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to delete a route from an application.

        Access Level: Write

        Possible conditions:

        - .ifApplicationCreatedByAccount()
        - .ifServiceCreatedByAccount()
        - .ifRouteCreatedByAccount()
        - .ifCreatedByAccountIds()
        - .ifSourcePath()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_DeleteRoute.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toDeleteRoute", []))

    @jsii.member(jsii_name="toDeleteService")
    def to_delete_service(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to delete a service from an application.

        Access Level: Write

        Possible conditions:

        - .ifApplicationCreatedByAccount()
        - .ifServiceCreatedByAccount()
        - .ifCreatedByAccountIds()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_DeleteService.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toDeleteService", []))

    @jsii.member(jsii_name="toGetApplication")
    def to_get_application(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to get more information about an application.

        Access Level: Read

        Possible conditions:

        - .ifApplicationCreatedByAccount()
        - .ifCreatedByAccountIds()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_GetApplication.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toGetApplication", []))

    @jsii.member(jsii_name="toGetEnvironment")
    def to_get_environment(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to get more information for an environment.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_GetEnvironment.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toGetEnvironment", []))

    @jsii.member(jsii_name="toGetResourcePolicy")
    def to_get_resource_policy(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to get the details about a resource policy.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_GetResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toGetResourcePolicy", []))

    @jsii.member(jsii_name="toGetRoute")
    def to_get_route(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to get more information about a route.

        Access Level: Read

        Possible conditions:

        - .ifApplicationCreatedByAccount()
        - .ifServiceCreatedByAccount()
        - .ifRouteCreatedByAccount()
        - .ifCreatedByAccountIds()
        - .ifSourcePath()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_GetRoute.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toGetRoute", []))

    @jsii.member(jsii_name="toGetService")
    def to_get_service(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to get more information about a service.

        Access Level: Read

        Possible conditions:

        - .ifApplicationCreatedByAccount()
        - .ifServiceCreatedByAccount()
        - .ifCreatedByAccountIds()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_GetService.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toGetService", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to list all the applications in an environment.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_ListApplications.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListEnvironments")
    def to_list_environments(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to list all environments.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_ListEnvironments.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toListEnvironments", []))

    @jsii.member(jsii_name="toListEnvironmentVpcs")
    def to_list_environment_vpcs(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to list all the VPCs for the environment.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_ListEnvironmentVpcs.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toListEnvironmentVpcs", []))

    @jsii.member(jsii_name="toListRoutes")
    def to_list_routes(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to list all the routes in an application.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_ListRoutes.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toListRoutes", []))

    @jsii.member(jsii_name="toListServices")
    def to_list_services(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to list all the services in an environment.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_ListServices.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toListServices", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to list all the tags for a given resource.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to add a resource policy.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_PutResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifApplicationCreatedByAccount()
        - .ifServiceCreatedByAccount()
        - .ifRouteCreatedByAccount()
        - .ifCreatedByAccountIds()
        - .ifSourcePath()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to remove a tag from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifApplicationCreatedByAccount()
        - .ifServiceCreatedByAccount()
        - .ifRouteCreatedByAccount()
        - .ifCreatedByAccountIds()
        - .ifSourcePath()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateRoute")
    def to_update_route(self) -> "RefactorSpaces":
        '''(experimental) Grants permission to update a route from an application.

        Access Level: Write

        Possible conditions:

        - .ifApplicationCreatedByAccount()
        - .ifServiceCreatedByAccount()
        - .ifRouteCreatedByAccount()
        - .ifCreatedByAccountIds()
        - .ifSourcePath()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/migrationhub-refactor-spaces/latest/APIReference/API_UpdateRoute.html

        :stability: experimental
        '''
        return typing.cast("RefactorSpaces", jsii.invoke(self, "toUpdateRoute", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5cb3c976e58628525dbadc56cbebd62db90603b9d8af00e659e42408c7e2eeea)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__449746669f9fce40e5d293c9262444795d0bc86d05dcf5f41004009a88f7aeea)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Rekognition(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Rekognition",
):
    '''(experimental) Statement provider for service `rekognition <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonrekognition.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `rekognition <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonrekognition.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1841891799190e920d73bc734030bf5a06299205c248cb3ca6b471c1a00fc54b)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onCollection")
    def on_collection(
        self,
        collection_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rekognition":
        '''(experimental) Adds a resource of type collection to the statement.

        https://docs.aws.amazon.com/rekognition/latest/dg/collections.html

        :param collection_id: - Identifier for the collectionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__74432c007be534094ac5e01b546cd6348d1694fcaf76919e87d2b93d80cf3423)
            check_type(argname="argument collection_id", value=collection_id, expected_type=type_hints["collection_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rekognition", jsii.invoke(self, "onCollection", [collection_id, account, region, partition]))

    @jsii.member(jsii_name="onDataset")
    def on_dataset(
        self,
        project_name: builtins.str,
        dataset_type: builtins.str,
        creation_timestamp: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rekognition":
        '''(experimental) Adds a resource of type dataset to the statement.

        https://docs.aws.amazon.com/rekognition/latest/customlabels-dg/creating-datasets.html

        :param project_name: - Identifier for the projectName.
        :param dataset_type: - Identifier for the datasetType.
        :param creation_timestamp: - Identifier for the creationTimestamp.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c8d5d5b0b99b75f7bc1665613b56ecc8383accbe20585c9a94c8b2b23418b5c3)
            check_type(argname="argument project_name", value=project_name, expected_type=type_hints["project_name"])
            check_type(argname="argument dataset_type", value=dataset_type, expected_type=type_hints["dataset_type"])
            check_type(argname="argument creation_timestamp", value=creation_timestamp, expected_type=type_hints["creation_timestamp"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rekognition", jsii.invoke(self, "onDataset", [project_name, dataset_type, creation_timestamp, account, region, partition]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_name: builtins.str,
        creation_timestamp: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rekognition":
        '''(experimental) Adds a resource of type project to the statement.

        https://docs.aws.amazon.com/rekognition/latest/customlabels-dg/mp-create-project.html

        :param project_name: - Identifier for the projectName.
        :param creation_timestamp: - Identifier for the creationTimestamp.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e371b3130deb575d899292278fe9d2dd5929fd7b5d279b339bf3b7e78fdf457d)
            check_type(argname="argument project_name", value=project_name, expected_type=type_hints["project_name"])
            check_type(argname="argument creation_timestamp", value=creation_timestamp, expected_type=type_hints["creation_timestamp"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rekognition", jsii.invoke(self, "onProject", [project_name, creation_timestamp, account, region, partition]))

    @jsii.member(jsii_name="onProjectversion")
    def on_projectversion(
        self,
        project_name: builtins.str,
        version_name: builtins.str,
        creation_timestamp: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rekognition":
        '''(experimental) Adds a resource of type projectversion to the statement.

        https://docs.aws.amazon.com/rekognition/latest/customlabels-dg/training-model.html

        :param project_name: - Identifier for the projectName.
        :param version_name: - Identifier for the versionName.
        :param creation_timestamp: - Identifier for the creationTimestamp.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1699089d4bd5249a4491fa0eef7fcd437df4db88962642cb330fcb0abff2a634)
            check_type(argname="argument project_name", value=project_name, expected_type=type_hints["project_name"])
            check_type(argname="argument version_name", value=version_name, expected_type=type_hints["version_name"])
            check_type(argname="argument creation_timestamp", value=creation_timestamp, expected_type=type_hints["creation_timestamp"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rekognition", jsii.invoke(self, "onProjectversion", [project_name, version_name, creation_timestamp, account, region, partition]))

    @jsii.member(jsii_name="onStreamprocessor")
    def on_streamprocessor(
        self,
        streamprocessor_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rekognition":
        '''(experimental) Adds a resource of type streamprocessor to the statement.

        https://docs.aws.amazon.com/rekognition/latest/dg/streaming-video.html

        :param streamprocessor_id: - Identifier for the streamprocessorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ecffc1329d65e1918fa85a5b6a91cc8bfc5c91e5b369bc0e493eaaa4c816c017)
            check_type(argname="argument streamprocessor_id", value=streamprocessor_id, expected_type=type_hints["streamprocessor_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rekognition", jsii.invoke(self, "onStreamprocessor", [streamprocessor_id, account, region, partition]))

    @jsii.member(jsii_name="toCompareFaces")
    def to_compare_faces(self) -> "Rekognition":
        '''(experimental) Grants permission to compare faces in the source input image with each face detected in the target input image.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_CompareFaces.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toCompareFaces", []))

    @jsii.member(jsii_name="toCopyProjectVersion")
    def to_copy_project_version(self) -> "Rekognition":
        '''(experimental) Grants permission to copy an existing model version to a new model version.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_CopyProjectVersion.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toCopyProjectVersion", []))

    @jsii.member(jsii_name="toCreateCollection")
    def to_create_collection(self) -> "Rekognition":
        '''(experimental) Grants permission to create a collection in an AWS Region.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_CreateCollection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toCreateCollection", []))

    @jsii.member(jsii_name="toCreateDataset")
    def to_create_dataset(self) -> "Rekognition":
        '''(experimental) Grants permission to create a new Amazon Rekognition Custom Labels dataset.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_CreateDataset.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toCreateDataset", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Rekognition":
        '''(experimental) Grants permission to create an Amazon Rekognition Custom Labels project.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_CreateProject.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toCreateProjectVersion")
    def to_create_project_version(self) -> "Rekognition":
        '''(experimental) Grants permission to begin training a new version of a model.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_CreateProjectVersion.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toCreateProjectVersion", []))

    @jsii.member(jsii_name="toCreateStreamProcessor")
    def to_create_stream_processor(self) -> "Rekognition":
        '''(experimental) Grants permission to create an Amazon Rekognition stream processor.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_CreateStreamProcessor.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toCreateStreamProcessor", []))

    @jsii.member(jsii_name="toDeleteCollection")
    def to_delete_collection(self) -> "Rekognition":
        '''(experimental) Grants permission to delete the specified collection.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_DeleteCollection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDeleteCollection", []))

    @jsii.member(jsii_name="toDeleteDataset")
    def to_delete_dataset(self) -> "Rekognition":
        '''(experimental) Grants permission to delete an existing Amazon Rekognition Custom Labels dataset.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_DeleteDataset.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDeleteDataset", []))

    @jsii.member(jsii_name="toDeleteFaces")
    def to_delete_faces(self) -> "Rekognition":
        '''(experimental) Grants permission to delete faces from a collection.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_DeleteFaces.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDeleteFaces", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Rekognition":
        '''(experimental) Grants permission to delete a project.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_DeleteProject.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDeleteProjectPolicy")
    def to_delete_project_policy(self) -> "Rekognition":
        '''(experimental) Grants permission to delete a resource policy attached to a project.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_DeleteProjectPolicy.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDeleteProjectPolicy", []))

    @jsii.member(jsii_name="toDeleteProjectVersion")
    def to_delete_project_version(self) -> "Rekognition":
        '''(experimental) Grants permission to delete a model.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_DeleteProjectVersion.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDeleteProjectVersion", []))

    @jsii.member(jsii_name="toDeleteStreamProcessor")
    def to_delete_stream_processor(self) -> "Rekognition":
        '''(experimental) Grants permission to delete the specified stream processor.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_DeleteStreamProcessor.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDeleteStreamProcessor", []))

    @jsii.member(jsii_name="toDescribeCollection")
    def to_describe_collection(self) -> "Rekognition":
        '''(experimental) Grants permission to read details about a collection.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_DescribeCollection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDescribeCollection", []))

    @jsii.member(jsii_name="toDescribeDataset")
    def to_describe_dataset(self) -> "Rekognition":
        '''(experimental) Grants permission to describe an Amazon Rekognition Custom Labels dataset.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_DescribeDataset.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDescribeDataset", []))

    @jsii.member(jsii_name="toDescribeProjects")
    def to_describe_projects(self) -> "Rekognition":
        '''(experimental) Grants permission to list Amazon Rekognition Custom Labels projects.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_DescribeProjects.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDescribeProjects", []))

    @jsii.member(jsii_name="toDescribeProjectVersions")
    def to_describe_project_versions(self) -> "Rekognition":
        '''(experimental) Grants permission to list the versions of a model in an Amazon Rekognition Custom Labels project.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_DescribeProjectVersions.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDescribeProjectVersions", []))

    @jsii.member(jsii_name="toDescribeStreamProcessor")
    def to_describe_stream_processor(self) -> "Rekognition":
        '''(experimental) Grants permission to get information about the specified stream processor.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_DescribeStreamProcessor.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDescribeStreamProcessor", []))

    @jsii.member(jsii_name="toDetectCustomLabels")
    def to_detect_custom_labels(self) -> "Rekognition":
        '''(experimental) Grants permission to detect custom labels in a supplied image.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_DetectCustomLabels.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDetectCustomLabels", []))

    @jsii.member(jsii_name="toDetectFaces")
    def to_detect_faces(self) -> "Rekognition":
        '''(experimental) Grants permission to detect human faces within an image provided as input.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_DetectFaces.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDetectFaces", []))

    @jsii.member(jsii_name="toDetectLabels")
    def to_detect_labels(self) -> "Rekognition":
        '''(experimental) Grants permission to detect instances of real-world labels within an image provided as input.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_DetectLabels.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDetectLabels", []))

    @jsii.member(jsii_name="toDetectModerationLabels")
    def to_detect_moderation_labels(self) -> "Rekognition":
        '''(experimental) Grants permission to detect moderation labels within the input image.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_DetectModerationLabels.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDetectModerationLabels", []))

    @jsii.member(jsii_name="toDetectProtectiveEquipment")
    def to_detect_protective_equipment(self) -> "Rekognition":
        '''(experimental) Grants permission to detect Personal Protective Equipment in the input image.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_DetectProtectiveEquipment.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDetectProtectiveEquipment", []))

    @jsii.member(jsii_name="toDetectText")
    def to_detect_text(self) -> "Rekognition":
        '''(experimental) Grants permission to detect text in the input image and convert it into machine-readable text.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_DetectText.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDetectText", []))

    @jsii.member(jsii_name="toDistributeDatasetEntries")
    def to_distribute_dataset_entries(self) -> "Rekognition":
        '''(experimental) Grants permission to distribute the entries in a training dataset across the training dataset and the test dataset for a project.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_DistributeDatasetEntries.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toDistributeDatasetEntries", []))

    @jsii.member(jsii_name="toGetCelebrityInfo")
    def to_get_celebrity_info(self) -> "Rekognition":
        '''(experimental) Grants permission to read the name, and additional information, of a celebrity.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_GetCelebrityInfo.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toGetCelebrityInfo", []))

    @jsii.member(jsii_name="toGetCelebrityRecognition")
    def to_get_celebrity_recognition(self) -> "Rekognition":
        '''(experimental) Grants permission to read the celebrity recognition results found in a stored video by an asynchronous celebrity recognition job.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_GetCelebrityRecognition.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toGetCelebrityRecognition", []))

    @jsii.member(jsii_name="toGetContentModeration")
    def to_get_content_moderation(self) -> "Rekognition":
        '''(experimental) Grants permission to read the content moderation analysis results found in a stored video by an asynchronous content moderation job.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_GetContentModeration.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toGetContentModeration", []))

    @jsii.member(jsii_name="toGetFaceDetection")
    def to_get_face_detection(self) -> "Rekognition":
        '''(experimental) Grants permission to read the faces detection results found in a stored video by an asynchronous face detection job.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_GetFaceDetection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toGetFaceDetection", []))

    @jsii.member(jsii_name="toGetFaceSearch")
    def to_get_face_search(self) -> "Rekognition":
        '''(experimental) Grants permission to read the matching collection faces found in a stored video by an asynchronous face search job.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_GetFaceSearch.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toGetFaceSearch", []))

    @jsii.member(jsii_name="toGetLabelDetection")
    def to_get_label_detection(self) -> "Rekognition":
        '''(experimental) Grants permission to read the label detected resuls found in a stored video by an asynchronous label detection job.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_GetLabelDetection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toGetLabelDetection", []))

    @jsii.member(jsii_name="toGetPersonTracking")
    def to_get_person_tracking(self) -> "Rekognition":
        '''(experimental) Grants permission to read the list of persons detected in a stored video by an asynchronous person tracking job.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_GetPersonTracking.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toGetPersonTracking", []))

    @jsii.member(jsii_name="toGetSegmentDetection")
    def to_get_segment_detection(self) -> "Rekognition":
        '''(experimental) Grants permission to get the vdeo segments found in a stored video by an asynchronous segment detection job.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_GetSegmentDetection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toGetSegmentDetection", []))

    @jsii.member(jsii_name="toGetTextDetection")
    def to_get_text_detection(self) -> "Rekognition":
        '''(experimental) Grants permission to get the text found in a stored video by an asynchronous text detection job.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_GetTextDetection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toGetTextDetection", []))

    @jsii.member(jsii_name="toIndexFaces")
    def to_index_faces(self) -> "Rekognition":
        '''(experimental) Grants permission to update an existing collection with faces detected in the input image.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_IndexFaces.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toIndexFaces", []))

    @jsii.member(jsii_name="toListCollections")
    def to_list_collections(self) -> "Rekognition":
        '''(experimental) Grants permission to read the collection Id's in your account.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_ListCollections.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toListCollections", []))

    @jsii.member(jsii_name="toListDatasetEntries")
    def to_list_dataset_entries(self) -> "Rekognition":
        '''(experimental) Grants permission to list the dataset entries in an existing Amazon Rekognition Custom Labels dataset.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_ListDatasetEntries.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toListDatasetEntries", []))

    @jsii.member(jsii_name="toListDatasetLabels")
    def to_list_dataset_labels(self) -> "Rekognition":
        '''(experimental) Grants permission to list the labels in a dataset.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_ListDatasetLabels.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toListDatasetLabels", []))

    @jsii.member(jsii_name="toListFaces")
    def to_list_faces(self) -> "Rekognition":
        '''(experimental) Grants permission to read metadata for faces in the specificed collection.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_ListFaces.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toListFaces", []))

    @jsii.member(jsii_name="toListProjectPolicies")
    def to_list_project_policies(self) -> "Rekognition":
        '''(experimental) Grants permission to list the resource policies attached to a project.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_ListProjectPolicies.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toListProjectPolicies", []))

    @jsii.member(jsii_name="toListStreamProcessors")
    def to_list_stream_processors(self) -> "Rekognition":
        '''(experimental) Grants permission to get a list of your stream processors.

        Access Level: List

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_ListStreamProcessors.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toListStreamProcessors", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Rekognition":
        '''(experimental) Grants permission to return a list of tags associated with a resource.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutProjectPolicy")
    def to_put_project_policy(self) -> "Rekognition":
        '''(experimental) Grants permission to attach a resource policy to a project.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_PutProjectPolicy.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toPutProjectPolicy", []))

    @jsii.member(jsii_name="toRecognizeCelebrities")
    def to_recognize_celebrities(self) -> "Rekognition":
        '''(experimental) Grants permission to detect celebrities in the input image.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_RecognizeCelebrities.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toRecognizeCelebrities", []))

    @jsii.member(jsii_name="toSearchFaces")
    def to_search_faces(self) -> "Rekognition":
        '''(experimental) Grants permission to search the specificed collection for the supplied face ID.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_SearchFaces.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toSearchFaces", []))

    @jsii.member(jsii_name="toSearchFacesByImage")
    def to_search_faces_by_image(self) -> "Rekognition":
        '''(experimental) Grants permission to search the specificed collection for the largest face in the input image.

        Access Level: Read

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_SearchFacesByImage.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toSearchFacesByImage", []))

    @jsii.member(jsii_name="toStartCelebrityRecognition")
    def to_start_celebrity_recognition(self) -> "Rekognition":
        '''(experimental) Grants permission to start the asynchronous recognition of celebrities in a stored video.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_StartCelebrityRecognition.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStartCelebrityRecognition", []))

    @jsii.member(jsii_name="toStartContentModeration")
    def to_start_content_moderation(self) -> "Rekognition":
        '''(experimental) Grants permission to start asynchronous detection of explicit or suggestive adult content in a stored video.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_StartContentModeration.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStartContentModeration", []))

    @jsii.member(jsii_name="toStartFaceDetection")
    def to_start_face_detection(self) -> "Rekognition":
        '''(experimental) Grants permission to start asynchronous detection of faces in a stored video.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_StartFaceDetection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStartFaceDetection", []))

    @jsii.member(jsii_name="toStartFaceSearch")
    def to_start_face_search(self) -> "Rekognition":
        '''(experimental) Grants permission to start an asynchronous search for faces in a collection that match the faces of persons detected in a stored video.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_StartFaceSearch.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStartFaceSearch", []))

    @jsii.member(jsii_name="toStartLabelDetection")
    def to_start_label_detection(self) -> "Rekognition":
        '''(experimental) Grants permission to start asynchronous detection of labels in a stored video.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_StartLabelDetection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStartLabelDetection", []))

    @jsii.member(jsii_name="toStartPersonTracking")
    def to_start_person_tracking(self) -> "Rekognition":
        '''(experimental) Grants permission to start the asynchronous tracking of persons in a stored video.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_StartPersonTracking.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStartPersonTracking", []))

    @jsii.member(jsii_name="toStartProjectVersion")
    def to_start_project_version(self) -> "Rekognition":
        '''(experimental) Grants permission to start running a model version.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_StartProjectVersion.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStartProjectVersion", []))

    @jsii.member(jsii_name="toStartSegmentDetection")
    def to_start_segment_detection(self) -> "Rekognition":
        '''(experimental) Grants permission to start the asynchronous detection of segments in a stored video.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_StartSegmentDetection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStartSegmentDetection", []))

    @jsii.member(jsii_name="toStartStreamProcessor")
    def to_start_stream_processor(self) -> "Rekognition":
        '''(experimental) Grants permission to start running a stream processor.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_StartStreamProcessor.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStartStreamProcessor", []))

    @jsii.member(jsii_name="toStartTextDetection")
    def to_start_text_detection(self) -> "Rekognition":
        '''(experimental) Grants permission to start the asynchronous detection of text in a stored video.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_StartTextDetection.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStartTextDetection", []))

    @jsii.member(jsii_name="toStopProjectVersion")
    def to_stop_project_version(self) -> "Rekognition":
        '''(experimental) Grants permission to stop a running model version.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_StopProjectVersion.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStopProjectVersion", []))

    @jsii.member(jsii_name="toStopStreamProcessor")
    def to_stop_stream_processor(self) -> "Rekognition":
        '''(experimental) Grants permission to stop a running stream processor.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_StopStreamProcessor.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toStopStreamProcessor", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Rekognition":
        '''(experimental) Grants permission to add one or more tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Rekognition":
        '''(experimental) Grants permission to remove one or more tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDatasetEntries")
    def to_update_dataset_entries(self) -> "Rekognition":
        '''(experimental) Grants permission to add or update one or more JSON Lines (entries) in a dataset.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_UpdateDatasetEntries.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toUpdateDatasetEntries", []))

    @jsii.member(jsii_name="toUpdateStreamProcessor")
    def to_update_stream_processor(self) -> "Rekognition":
        '''(experimental) Grants permission to modify properties for a stream processor.

        Access Level: Write

        https://docs.aws.amazon.com/rekognition/latest/APIReference/API_UpdateStreamProcessor.html

        :stability: experimental
        '''
        return typing.cast("Rekognition", jsii.invoke(self, "toUpdateStreamProcessor", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c9b88152714cf0853b143b864ec1874958a872bb90d95de550cb11614b45d63e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__137b91340982eba80838094e6d5543f92389d5c1df2936cd7dcbc1ea38fe3442)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Resiliencehub(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Resiliencehub",
):
    '''(experimental) Statement provider for service `resiliencehub <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsresiliencehubservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `resiliencehub <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsresiliencehubservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4ccc6564bd955878e893e467943a784b479683f56588c6361c1296cecbc1147a)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAppAssessment")
    def on_app_assessment(
        self,
        app_assessment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Resiliencehub":
        '''(experimental) Adds a resource of type app-assessment to the statement.

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_AppAssessment.html

        :param app_assessment_id: - Identifier for the appAssessmentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__84ad352677a2ceaf551975e74e750ee8e5ebfe303c2613dc2325115a6343003a)
            check_type(argname="argument app_assessment_id", value=app_assessment_id, expected_type=type_hints["app_assessment_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Resiliencehub", jsii.invoke(self, "onAppAssessment", [app_assessment_id, account, region, partition]))

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        app_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Resiliencehub":
        '''(experimental) Adds a resource of type application to the statement.

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_App.html

        :param app_id: - Identifier for the appId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__12bddb5aaf190bbec30fcdd2b9cc2379a605f48175a5d978be17f0b72ebf88b2)
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Resiliencehub", jsii.invoke(self, "onApplication", [app_id, account, region, partition]))

    @jsii.member(jsii_name="onRecommendationTemplate")
    def on_recommendation_template(
        self,
        recommendation_template_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Resiliencehub":
        '''(experimental) Adds a resource of type recommendation-template to the statement.

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_RecommendationTemplate.html

        :param recommendation_template_id: - Identifier for the recommendationTemplateId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7f87d4228c884f3a24dfed7cc0aeb7ebe1f6662256acbba65d824bdf1fd46b35)
            check_type(argname="argument recommendation_template_id", value=recommendation_template_id, expected_type=type_hints["recommendation_template_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Resiliencehub", jsii.invoke(self, "onRecommendationTemplate", [recommendation_template_id, account, region, partition]))

    @jsii.member(jsii_name="onResiliencyPolicy")
    def on_resiliency_policy(
        self,
        resiliency_policy_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Resiliencehub":
        '''(experimental) Adds a resource of type resiliency-policy to the statement.

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_ResiliencyPolicy.html

        :param resiliency_policy_id: - Identifier for the resiliencyPolicyId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8848449db0f4daa8ac39918d199d05d8a5d500ef249db18322b21cd5e29bdd26)
            check_type(argname="argument resiliency_policy_id", value=resiliency_policy_id, expected_type=type_hints["resiliency_policy_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Resiliencehub", jsii.invoke(self, "onResiliencyPolicy", [resiliency_policy_id, account, region, partition]))

    @jsii.member(jsii_name="toAddDraftAppVersionResourceMappings")
    def to_add_draft_app_version_resource_mappings(self) -> "Resiliencehub":
        '''(experimental) Grants permission to add draft application version resource mappings.

        Access Level: Write

        Dependent actions:

        - cloudformation:DescribeStacks
        - cloudformation:ListStackResources
        - resource-groups:GetGroup
        - resource-groups:ListGroupResources
        - servicecatalog:GetApplication
        - servicecatalog:ListAssociatedResources

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_AddDraftAppVersionResourceMappings.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toAddDraftAppVersionResourceMappings", []))

    @jsii.member(jsii_name="toCreateApp")
    def to_create_app(self) -> "Resiliencehub":
        '''(experimental) Grants permission to create application.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_CreateApp.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toCreateApp", []))

    @jsii.member(jsii_name="toCreateAppVersionAppComponent")
    def to_create_app_version_app_component(self) -> "Resiliencehub":
        '''(experimental) Grants permission to create application app component.

        Access Level: Write

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_CreateAppVersionAppComponent.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toCreateAppVersionAppComponent", []))

    @jsii.member(jsii_name="toCreateAppVersionResource")
    def to_create_app_version_resource(self) -> "Resiliencehub":
        '''(experimental) Grants permission to create application resource.

        Access Level: Write

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_CreateAppVersionResource.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toCreateAppVersionResource", []))

    @jsii.member(jsii_name="toCreateRecommendationTemplate")
    def to_create_recommendation_template(self) -> "Resiliencehub":
        '''(experimental) Grants permission to create recommendation template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - s3:CreateBucket
        - s3:ListBucket
        - s3:PutObject

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_CreateRecommendationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toCreateRecommendationTemplate", []))

    @jsii.member(jsii_name="toCreateResiliencyPolicy")
    def to_create_resiliency_policy(self) -> "Resiliencehub":
        '''(experimental) Grants permission to create resiliency policy.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_CreateResiliencyPolicy.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toCreateResiliencyPolicy", []))

    @jsii.member(jsii_name="toDeleteApp")
    def to_delete_app(self) -> "Resiliencehub":
        '''(experimental) Grants permission to batch delete application.

        Access Level: Write

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_DeleteApp.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toDeleteApp", []))

    @jsii.member(jsii_name="toDeleteAppAssessment")
    def to_delete_app_assessment(self) -> "Resiliencehub":
        '''(experimental) Grants permission to batch delete application assessment.

        Access Level: Write

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_DeleteAppAssessment.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toDeleteAppAssessment", []))

    @jsii.member(jsii_name="toDeleteAppInputSource")
    def to_delete_app_input_source(self) -> "Resiliencehub":
        '''(experimental) Grants permission to remove application input source.

        Access Level: Write

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_DeleteAppInputSource.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toDeleteAppInputSource", []))

    @jsii.member(jsii_name="toDeleteAppVersionAppComponent")
    def to_delete_app_version_app_component(self) -> "Resiliencehub":
        '''(experimental) Grants permission to delete application app component.

        Access Level: Write

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_DeleteAppVersionAppComponent.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toDeleteAppVersionAppComponent", []))

    @jsii.member(jsii_name="toDeleteAppVersionResource")
    def to_delete_app_version_resource(self) -> "Resiliencehub":
        '''(experimental) Grants permission to delete application resource.

        Access Level: Write

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_DeleteAppVersionResource.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toDeleteAppVersionResource", []))

    @jsii.member(jsii_name="toDeleteRecommendationTemplate")
    def to_delete_recommendation_template(self) -> "Resiliencehub":
        '''(experimental) Grants permission to batch delete recommendation template.

        Access Level: Write

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_DeleteRecommendationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toDeleteRecommendationTemplate", []))

    @jsii.member(jsii_name="toDeleteResiliencyPolicy")
    def to_delete_resiliency_policy(self) -> "Resiliencehub":
        '''(experimental) Grants permission to batch delete resiliency policy.

        Access Level: Write

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_DeleteResiliencyPolicy.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toDeleteResiliencyPolicy", []))

    @jsii.member(jsii_name="toDescribeApp")
    def to_describe_app(self) -> "Resiliencehub":
        '''(experimental) Grants permission to describe application.

        Access Level: Read

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_DescribeApp.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toDescribeApp", []))

    @jsii.member(jsii_name="toDescribeAppAssessment")
    def to_describe_app_assessment(self) -> "Resiliencehub":
        '''(experimental) Grants permission to describe application assessment.

        Access Level: Read

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_DescribeAppAssessment.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toDescribeAppAssessment", []))

    @jsii.member(jsii_name="toDescribeAppVersion")
    def to_describe_app_version(self) -> "Resiliencehub":
        '''(experimental) Grants permission to describe application version.

        Access Level: Read

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_DescribeAppVersion.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toDescribeAppVersion", []))

    @jsii.member(jsii_name="toDescribeAppVersionAppComponent")
    def to_describe_app_version_app_component(self) -> "Resiliencehub":
        '''(experimental) Grants permission to describe application version app component.

        Access Level: Read

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_DescribeAppVersionAppComponent.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toDescribeAppVersionAppComponent", []))

    @jsii.member(jsii_name="toDescribeAppVersionResource")
    def to_describe_app_version_resource(self) -> "Resiliencehub":
        '''(experimental) Grants permission to describe application version resource.

        Access Level: Read

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_DescribeAppVersionResource.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toDescribeAppVersionResource", []))

    @jsii.member(jsii_name="toDescribeAppVersionResourcesResolutionStatus")
    def to_describe_app_version_resources_resolution_status(self) -> "Resiliencehub":
        '''(experimental) Grants permission to describe application resolution.

        Access Level: Read

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_DescribeAppVersionResourcesResolutionStatus.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toDescribeAppVersionResourcesResolutionStatus", []))

    @jsii.member(jsii_name="toDescribeAppVersionTemplate")
    def to_describe_app_version_template(self) -> "Resiliencehub":
        '''(experimental) Grants permission to describe application version template.

        Access Level: Read

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_DescribeAppVersionTemplate.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toDescribeAppVersionTemplate", []))

    @jsii.member(jsii_name="toDescribeDraftAppVersionResourcesImportStatus")
    def to_describe_draft_app_version_resources_import_status(self) -> "Resiliencehub":
        '''(experimental) Grants permission to describe draft application version resources import status.

        Access Level: Read

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_DescribeDraftAppVersionResourcesImportStatus.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toDescribeDraftAppVersionResourcesImportStatus", []))

    @jsii.member(jsii_name="toDescribeResiliencyPolicy")
    def to_describe_resiliency_policy(self) -> "Resiliencehub":
        '''(experimental) Grants permission to describe resiliency policy.

        Access Level: Read

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_DescribeResiliencyPolicy.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toDescribeResiliencyPolicy", []))

    @jsii.member(jsii_name="toImportResourcesToDraftAppVersion")
    def to_import_resources_to_draft_app_version(self) -> "Resiliencehub":
        '''(experimental) Grants permission to import resources to draft application version.

        Access Level: Write

        Dependent actions:

        - cloudformation:DescribeStacks
        - cloudformation:ListStackResources
        - resource-groups:GetGroup
        - resource-groups:ListGroupResources
        - servicecatalog:GetApplication
        - servicecatalog:ListAssociatedResources

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_ImportResourcesToDraftAppVersion.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toImportResourcesToDraftAppVersion", []))

    @jsii.member(jsii_name="toListAlarmRecommendations")
    def to_list_alarm_recommendations(self) -> "Resiliencehub":
        '''(experimental) Grants permission to list alarm recommendation.

        Access Level: List

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_ListAlarmRecommendations.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toListAlarmRecommendations", []))

    @jsii.member(jsii_name="toListAppAssessments")
    def to_list_app_assessments(self) -> "Resiliencehub":
        '''(experimental) Grants permission to list application assessment.

        Access Level: List

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_ListAppAssessments.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toListAppAssessments", []))

    @jsii.member(jsii_name="toListAppComponentCompliances")
    def to_list_app_component_compliances(self) -> "Resiliencehub":
        '''(experimental) Grants permission to list app component compliances.

        Access Level: List

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_ListAppComponentCompliances.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toListAppComponentCompliances", []))

    @jsii.member(jsii_name="toListAppComponentRecommendations")
    def to_list_app_component_recommendations(self) -> "Resiliencehub":
        '''(experimental) Grants permission to list app component recommendations.

        Access Level: List

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_ListAppComponentRecommendations.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toListAppComponentRecommendations", []))

    @jsii.member(jsii_name="toListAppInputSources")
    def to_list_app_input_sources(self) -> "Resiliencehub":
        '''(experimental) Grants permission to list application input sources.

        Access Level: List

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_ListAppInputSources.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toListAppInputSources", []))

    @jsii.member(jsii_name="toListApps")
    def to_list_apps(self) -> "Resiliencehub":
        '''(experimental) Grants permission to list applications.

        Access Level: List

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_ListApps.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toListApps", []))

    @jsii.member(jsii_name="toListAppVersionAppComponents")
    def to_list_app_version_app_components(self) -> "Resiliencehub":
        '''(experimental) Grants permission to list application version app components.

        Access Level: List

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_ListAppVersionAppComponents.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toListAppVersionAppComponents", []))

    @jsii.member(jsii_name="toListAppVersionResourceMappings")
    def to_list_app_version_resource_mappings(self) -> "Resiliencehub":
        '''(experimental) Grants permission to application version resource mappings.

        Access Level: List

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_ListAppVersionResourceMappings.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toListAppVersionResourceMappings", []))

    @jsii.member(jsii_name="toListAppVersionResources")
    def to_list_app_version_resources(self) -> "Resiliencehub":
        '''(experimental) Grants permission to list application resources.

        Access Level: List

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_ListAppVersionResources.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toListAppVersionResources", []))

    @jsii.member(jsii_name="toListAppVersions")
    def to_list_app_versions(self) -> "Resiliencehub":
        '''(experimental) Grants permission to list application version.

        Access Level: List

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_ListAppVersions.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toListAppVersions", []))

    @jsii.member(jsii_name="toListRecommendationTemplates")
    def to_list_recommendation_templates(self) -> "Resiliencehub":
        '''(experimental) Grants permission to list recommendation templates.

        Access Level: List

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_ListRecommendationTemplates.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toListRecommendationTemplates", []))

    @jsii.member(jsii_name="toListResiliencyPolicies")
    def to_list_resiliency_policies(self) -> "Resiliencehub":
        '''(experimental) Grants permission to list resiliency policies.

        Access Level: List

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_ListResiliencyPolicies.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toListResiliencyPolicies", []))

    @jsii.member(jsii_name="toListSopRecommendations")
    def to_list_sop_recommendations(self) -> "Resiliencehub":
        '''(experimental) Grants permission to list SOP recommendations.

        Access Level: List

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_ListSopRecommendations.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toListSopRecommendations", []))

    @jsii.member(jsii_name="toListSuggestedResiliencyPolicies")
    def to_list_suggested_resiliency_policies(self) -> "Resiliencehub":
        '''(experimental) Grants permission to list suggested resiliency policies.

        Access Level: List

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_ListSuggestedResiliencyPolicies.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toListSuggestedResiliencyPolicies", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Resiliencehub":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTestRecommendations")
    def to_list_test_recommendations(self) -> "Resiliencehub":
        '''(experimental) Grants permission to list test recommendations.

        Access Level: List

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_ListTestRecommendations.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toListTestRecommendations", []))

    @jsii.member(jsii_name="toListUnsupportedAppVersionResources")
    def to_list_unsupported_app_version_resources(self) -> "Resiliencehub":
        '''(experimental) Grants permission to list unsupported application version resources.

        Access Level: List

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_ListUnsupportedAppVersionResources.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toListUnsupportedAppVersionResources", []))

    @jsii.member(jsii_name="toPublishAppVersion")
    def to_publish_app_version(self) -> "Resiliencehub":
        '''(experimental) Grants permission to publish application version.

        Access Level: Write

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_PublishAppVersion.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toPublishAppVersion", []))

    @jsii.member(jsii_name="toPutDraftAppVersionTemplate")
    def to_put_draft_app_version_template(self) -> "Resiliencehub":
        '''(experimental) Grants permission to put draft application version template.

        Access Level: Write

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_PutDraftAppVersionTemplate.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toPutDraftAppVersionTemplate", []))

    @jsii.member(jsii_name="toRemoveDraftAppVersionResourceMappings")
    def to_remove_draft_app_version_resource_mappings(self) -> "Resiliencehub":
        '''(experimental) Grants permission to remove draft application version mappings.

        Access Level: Write

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_RemoveDraftAppVersionResourceMappings.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toRemoveDraftAppVersionResourceMappings", []))

    @jsii.member(jsii_name="toResolveAppVersionResources")
    def to_resolve_app_version_resources(self) -> "Resiliencehub":
        '''(experimental) Grants permission to resolve application version resources.

        Access Level: Write

        Dependent actions:

        - cloudformation:DescribeStacks
        - cloudformation:ListStackResources
        - resource-groups:GetGroup
        - resource-groups:ListGroupResources
        - servicecatalog:GetApplication
        - servicecatalog:ListAssociatedResources

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_ResolveAppVersionResources.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toResolveAppVersionResources", []))

    @jsii.member(jsii_name="toStartAppAssessment")
    def to_start_app_assessment(self) -> "Resiliencehub":
        '''(experimental) Grants permission to create application assessment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - cloudformation:DescribeStacks
        - cloudformation:ListStackResources
        - cloudwatch:DescribeAlarms
        - cloudwatch:GetMetricData
        - cloudwatch:GetMetricStatistics
        - cloudwatch:PutMetricData
        - ec2:DescribeRegions
        - fis:GetExperimentTemplate
        - fis:ListExperimentTemplates
        - fis:ListExperiments
        - resource-groups:GetGroup
        - resource-groups:ListGroupResources
        - servicecatalog:GetApplication
        - servicecatalog:ListAssociatedResources
        - ssm:GetParametersByPath

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_StartAppAssessment.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toStartAppAssessment", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Resiliencehub":
        '''(experimental) Grants permission to assign a resource tag.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Resiliencehub":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApp")
    def to_update_app(self) -> "Resiliencehub":
        '''(experimental) Grants permission to update application.

        Access Level: Write

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_UpdateApp.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toUpdateApp", []))

    @jsii.member(jsii_name="toUpdateAppVersion")
    def to_update_app_version(self) -> "Resiliencehub":
        '''(experimental) Grants permission to update application version.

        Access Level: Write

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_UpdateAppVersion.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toUpdateAppVersion", []))

    @jsii.member(jsii_name="toUpdateAppVersionAppComponent")
    def to_update_app_version_app_component(self) -> "Resiliencehub":
        '''(experimental) Grants permission to update application app component.

        Access Level: Write

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_UpdateAppVersionAppComponent.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toUpdateAppVersionAppComponent", []))

    @jsii.member(jsii_name="toUpdateAppVersionResource")
    def to_update_app_version_resource(self) -> "Resiliencehub":
        '''(experimental) Grants permission to update application resource.

        Access Level: Write

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_UpdateAppVersionResource.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toUpdateAppVersionResource", []))

    @jsii.member(jsii_name="toUpdateResiliencyPolicy")
    def to_update_resiliency_policy(self) -> "Resiliencehub":
        '''(experimental) Grants permission to update resiliency policy.

        Access Level: Write

        https://docs.aws.amazon.com/resilience-hub/latest/APIReference/API_UpdateResiliencyPolicy.html

        :stability: experimental
        '''
        return typing.cast("Resiliencehub", jsii.invoke(self, "toUpdateResiliencyPolicy", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bb5ac232a61d1b0b1c25ec3d5a05e6d24c0f055020ddade66070b62bf01dba34)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__60ca2c759bb71961c52713a4ac62f1e5ce6454f493276239c1f764861dbd9c29)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class ResourceExplorer(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ResourceExplorer",
):
    '''(experimental) Statement provider for service `resource-explorer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awstageditor.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `resource-explorer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awstageditor.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f9555de3612f3e7ca2c63c2633bfe0096280d705d78e69807a3d61169c1765a5)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toListResources")
    def to_list_resources(self) -> "ResourceExplorer":
        '''(experimental) Grants permission to retrieve the identifiers of the resources in the AWS account.

        Access Level: List

        https://docs.aws.amazon.com/ARG/latest/userguide/gettingstarted-prereqs.html#rg-permissions-te

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer", jsii.invoke(self, "toListResources", []))

    @jsii.member(jsii_name="toListResourceTypes")
    def to_list_resource_types(self) -> "ResourceExplorer":
        '''(experimental) Grants permission to retrieve the resource types currently supported by Tag Editor.

        Access Level: List

        https://docs.aws.amazon.com/ARG/latest/userguide/gettingstarted-prereqs.html#rg-permissions-te

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer", jsii.invoke(self, "toListResourceTypes", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "ResourceExplorer":
        '''(experimental) Grants permission to retrieve the tags attached to the specified resource identifiers.

        Access Level: Read

        Dependent actions:

        - tag:GetResources

        https://docs.aws.amazon.com/ARG/latest/userguide/gettingstarted-prereqs.html#rg-permissions-te

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer", jsii.invoke(self, "toListTags", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__609c90c8a71ea25fe7e9f0aea1ef43a27edf440eb8847ae1bd94bea457d61505)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e9f63681845c076d3e9c75d3e3062813c02b914d36f6600de34f97466e88950f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class ResourceExplorer2(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ResourceExplorer2",
):
    '''(experimental) Statement provider for service `resource-explorer-2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsresourceexplorer.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `resource-explorer-2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsresourceexplorer.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__12ba79db4a84211eda9c47c1c159e0bb069d2cbe17426d9864afd1e8299f7877)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onIndex")
    def on_index(
        self,
        index_uuid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ResourceExplorer2":
        '''(experimental) Adds a resource of type index to the statement.

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_Index.html

        :param index_uuid: - Identifier for the indexUuid.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__899d978dec65391999f3157cb8be10136fc6616451070a5602c4a98bc045c5ec)
            check_type(argname="argument index_uuid", value=index_uuid, expected_type=type_hints["index_uuid"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "onIndex", [index_uuid, account, region, partition]))

    @jsii.member(jsii_name="onView")
    def on_view(
        self,
        view_name: builtins.str,
        view_uuid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ResourceExplorer2":
        '''(experimental) Adds a resource of type view to the statement.

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_View.html

        :param view_name: - Identifier for the viewName.
        :param view_uuid: - Identifier for the viewUuid.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6bfc1200edb218e8258a69ae4a1d6a8a895cee091ba00d6fc0856ffc124390e1)
            check_type(argname="argument view_name", value=view_name, expected_type=type_hints["view_name"])
            check_type(argname="argument view_uuid", value=view_uuid, expected_type=type_hints["view_uuid"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "onView", [view_name, view_uuid, account, region, partition]))

    @jsii.member(jsii_name="toAssociateDefaultView")
    def to_associate_default_view(self) -> "ResourceExplorer2":
        '''(experimental) Grants permission to set the specified view as the default for this AWS Region in this AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_AssociateDefaultView.html

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "toAssociateDefaultView", []))

    @jsii.member(jsii_name="toBatchGetView")
    def to_batch_get_view(self) -> "ResourceExplorer2":
        '''(experimental) Grants permission to retrieve details about views that you specify by a list of ARNs.

        Access Level: Read

        Dependent actions:

        - resource-explorer-2:GetView

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_BatchGetView.html

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "toBatchGetView", []))

    @jsii.member(jsii_name="toCreateIndex")
    def to_create_index(self) -> "ResourceExplorer2":
        '''(experimental) Grants permission to turn on Resource Explorer in the AWS Region in which you called this operation by creating an index.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_CreateIndex.html

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "toCreateIndex", []))

    @jsii.member(jsii_name="toCreateView")
    def to_create_view(self) -> "ResourceExplorer2":
        '''(experimental) Grants permission to create a view that users can query.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_CreateView.html

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "toCreateView", []))

    @jsii.member(jsii_name="toDeleteIndex")
    def to_delete_index(self) -> "ResourceExplorer2":
        '''(experimental) Grants permission to turn off Resource Explorer in the specified AWS Region by deleting the index.

        Access Level: Write

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_DeleteIndex.html

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "toDeleteIndex", []))

    @jsii.member(jsii_name="toDeleteView")
    def to_delete_view(self) -> "ResourceExplorer2":
        '''(experimental) Grants permission to delete a view.

        Access Level: Write

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_DeleteView.html

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "toDeleteView", []))

    @jsii.member(jsii_name="toDisassociateDefaultView")
    def to_disassociate_default_view(self) -> "ResourceExplorer2":
        '''(experimental) Grants permission to remove the default view for the AWS Region in which you call this operation.

        Access Level: Write

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_DisassociateDefaultView.html

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "toDisassociateDefaultView", []))

    @jsii.member(jsii_name="toGetDefaultView")
    def to_get_default_view(self) -> "ResourceExplorer2":
        '''(experimental) Grants permission to retrieve the Amazon resource name (ARN) of the view that is the default for the AWS Region in which you call this operation.

        Access Level: Read

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_GetDefaultView.html

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "toGetDefaultView", []))

    @jsii.member(jsii_name="toGetIndex")
    def to_get_index(self) -> "ResourceExplorer2":
        '''(experimental) Grants permission to retrieve information about the index in the AWS Region in which you call this operation.

        Access Level: Read

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_GetIndex.html

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "toGetIndex", []))

    @jsii.member(jsii_name="toGetView")
    def to_get_view(self) -> "ResourceExplorer2":
        '''(experimental) Grants permission to retrieve information about the specified view.

        Access Level: Read

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_GetView.html

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "toGetView", []))

    @jsii.member(jsii_name="toListIndexes")
    def to_list_indexes(self) -> "ResourceExplorer2":
        '''(experimental) Grants permission to list the indexes in all AWS Regions.

        Access Level: List

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_ListIndexes.html

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "toListIndexes", []))

    @jsii.member(jsii_name="toListSupportedResourceTypes")
    def to_list_supported_resource_types(self) -> "ResourceExplorer2":
        '''(experimental) Grants permission to retrieve a list of all resource types currently supported by Resource Explorer.

        Access Level: List

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_ListSupportedResourceTypes.html

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "toListSupportedResourceTypes", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "ResourceExplorer2":
        '''(experimental) Grants permission to list the tags that are attached to the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListViews")
    def to_list_views(self) -> "ResourceExplorer2":
        '''(experimental) Grants permission to list the Amazon resource names (ARNs) of all of the views available in the AWS Region in which you call this operation.

        Access Level: List

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_ListViews.html

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "toListViews", []))

    @jsii.member(jsii_name="toSearch")
    def to_search(self) -> "ResourceExplorer2":
        '''(experimental) Grants permission to search for resources and display details about all resources that match the specified criteria.

        Access Level: Read

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_Search.html

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "toSearch", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "ResourceExplorer2":
        '''(experimental) Grants permission to add one or more tag key and value pairs to the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "ResourceExplorer2":
        '''(experimental) Grants permission to remove one or more tag key and value pairs from the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateIndexType")
    def to_update_index_type(self) -> "ResourceExplorer2":
        '''(experimental) Grants permission to change the type of the index from LOCAL to AGGREGATOR or back.

        Access Level: Write

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_UpdateIndexType.html

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "toUpdateIndexType", []))

    @jsii.member(jsii_name="toUpdateView")
    def to_update_view(self) -> "ResourceExplorer2":
        '''(experimental) Grants permission to modify some of the details of a view.

        Access Level: Write

        https://docs.aws.amazon.com/resource-explorer/latest/apireference/API_UpdateView.html

        :stability: experimental
        '''
        return typing.cast("ResourceExplorer2", jsii.invoke(self, "toUpdateView", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__85ec51b149d06bfe41d58beac6a0bec4039d328b6d2d7119cc9a9ae6d2466698)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b8fb1a7656f6cfbc40ed21b11ae2664dea22463ccbf3154add78635778871a49)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class ResourceGroups(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ResourceGroups",
):
    '''(experimental) Statement provider for service `resource-groups <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsresourcegroups.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `resource-groups <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsresourcegroups.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eb95bd2bc4554839bd13dc5f8c205957caf135452a06648ad1c37b20ea96d52e)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onGroup")
    def on_group(
        self,
        group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ResourceGroups":
        '''(experimental) Adds a resource of type group to the statement.

        https://docs.aws.amazon.com/ARG/latest/userguide/resource-groups.html

        :param group_name: - Identifier for the groupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__143d37c1dcbe5a552a00d407dd532a97845024720015816e443c9f3529e1bb00)
            check_type(argname="argument group_name", value=group_name, expected_type=type_hints["group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ResourceGroups", jsii.invoke(self, "onGroup", [group_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateGroup")
    def to_create_group(self) -> "ResourceGroups":
        '''(experimental) Grants permission to create a resource group with a specified name, description, and resource query.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_CreateGroup.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toCreateGroup", []))

    @jsii.member(jsii_name="toDeleteGroup")
    def to_delete_group(self) -> "ResourceGroups":
        '''(experimental) Grants permission to delete a specified resource group.

        Access Level: Write

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_DeleteGroup.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toDeleteGroup", []))

    @jsii.member(jsii_name="toGetAccountSettings")
    def to_get_account_settings(self) -> "ResourceGroups":
        '''(experimental) Grants permission to get the current status of optional features in Resource Groups.

        Access Level: Read

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_GetAccountSettings.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toGetAccountSettings", []))

    @jsii.member(jsii_name="toGetGroup")
    def to_get_group(self) -> "ResourceGroups":
        '''(experimental) Grants permission to get information of a specified resource group.

        Access Level: Read

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_GetGroup.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toGetGroup", []))

    @jsii.member(jsii_name="toGetGroupConfiguration")
    def to_get_group_configuration(self) -> "ResourceGroups":
        '''(experimental) Grants permission to get the service configuration associated with the specified resource group.

        Access Level: Read

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_GetGroupConfiguration.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toGetGroupConfiguration", []))

    @jsii.member(jsii_name="toGetGroupQuery")
    def to_get_group_query(self) -> "ResourceGroups":
        '''(experimental) Grants permission to get the query associated with a specified resource group.

        Access Level: Read

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_GetGroupQuery.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toGetGroupQuery", []))

    @jsii.member(jsii_name="toGetTags")
    def to_get_tags(self) -> "ResourceGroups":
        '''(experimental) Grants permission to get the tags associated with a specified resource group.

        Access Level: Read

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_GetTags.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toGetTags", []))

    @jsii.member(jsii_name="toGroupResources")
    def to_group_resources(self) -> "ResourceGroups":
        '''(experimental) Grants permission to add the specified resources to the specified group.

        Access Level: Write

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_GroupResources.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toGroupResources", []))

    @jsii.member(jsii_name="toListGroupResources")
    def to_list_group_resources(self) -> "ResourceGroups":
        '''(experimental) Grants permission to list the resources that are members of a specified resource group.

        Access Level: List

        Dependent actions:

        - cloudformation:DescribeStacks
        - cloudformation:ListStackResources
        - tag:GetResources

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_ListGroupResources.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toListGroupResources", []))

    @jsii.member(jsii_name="toListGroups")
    def to_list_groups(self) -> "ResourceGroups":
        '''(experimental) Grants permission to list all resource groups in your account.

        Access Level: List

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_ListGroups.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toListGroups", []))

    @jsii.member(jsii_name="toPutGroupConfiguration")
    def to_put_group_configuration(self) -> "ResourceGroups":
        '''(experimental) Grants permission to put the service configuration associated with the specified resource group.

        Access Level: Write

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_PutGroupConfiguration.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toPutGroupConfiguration", []))

    @jsii.member(jsii_name="toPutGroupPolicy")
    def to_put_group_policy(self) -> "ResourceGroups":
        '''(experimental) Grants permission to add a resource-based policy for the specified group.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/userguide/management-role.html#service-linked-role-permissions-management-role

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toPutGroupPolicy", []))

    @jsii.member(jsii_name="toSearchResources")
    def to_search_resources(self) -> "ResourceGroups":
        '''(experimental) Grants permission to search for AWS resources matching the given query.

        Access Level: List

        Dependent actions:

        - cloudformation:DescribeStacks
        - cloudformation:ListStackResources
        - tag:GetResources

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_SearchResources.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toSearchResources", []))

    @jsii.member(jsii_name="toTag")
    def to_tag(self) -> "ResourceGroups":
        '''(experimental) Grants permission to tag a specified resource group.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_Tag.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toTag", []))

    @jsii.member(jsii_name="toUngroupResources")
    def to_ungroup_resources(self) -> "ResourceGroups":
        '''(experimental) Grants permission to remove the specified resources from the specified group.

        Access Level: Write

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_UngroupResources.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toUngroupResources", []))

    @jsii.member(jsii_name="toUntag")
    def to_untag(self) -> "ResourceGroups":
        '''(experimental) Grants permission to remove tags associated with a specified resource group.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_Untag.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toUntag", []))

    @jsii.member(jsii_name="toUpdateAccountSettings")
    def to_update_account_settings(self) -> "ResourceGroups":
        '''(experimental) Grants permission to update optional features in Resource Groups.

        Access Level: Write

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_UpdateAccountSettings.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toUpdateAccountSettings", []))

    @jsii.member(jsii_name="toUpdateGroup")
    def to_update_group(self) -> "ResourceGroups":
        '''(experimental) Grants permission to update a specified resource group.

        Access Level: Write

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_UpdateGroup.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toUpdateGroup", []))

    @jsii.member(jsii_name="toUpdateGroupQuery")
    def to_update_group_query(self) -> "ResourceGroups":
        '''(experimental) Grants permission to update the query associated with a specified resource group.

        Access Level: Write

        https://docs.aws.amazon.com/ARG/latest/APIReference/API_UpdateGroupQuery.html

        :stability: experimental
        '''
        return typing.cast("ResourceGroups", jsii.invoke(self, "toUpdateGroupQuery", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a38521a1796ad59d2e01361aad1c5da5a47f159cb8af3087d0bb1e5ec7c7f6b3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__af936c72ce1c802281b6483144d22f78336eaf2eef03dd269349aa655a81650b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Rhelkb(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Rhelkb"):
    '''(experimental) Statement provider for service `rhelkb <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonrhelknowledgebaseportal.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `rhelkb <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonrhelknowledgebaseportal.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d599ed12ef977cba5b19170843b2c0fdba8b93d6c9a5f1e60ac4020947bcbd09)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toGetRhelURL")
    def to_get_rhel_url(self) -> "Rhelkb":
        '''(experimental) Grants permission to access the Red Hat Knowledgebase portal.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/userguide/fleet-rhel.html

        :stability: experimental
        '''
        return typing.cast("Rhelkb", jsii.invoke(self, "toGetRhelURL", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b9913f702c2864624aa05b1faf1eda08ccd6c3c915ce35f41ca5563f8a30a45b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6ecdcc4695e39179b9396d9169f67178cbdefc09de4bc90aef77bd33ab0eed3b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Robomaker(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Robomaker",
):
    '''(experimental) Statement provider for service `robomaker <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsrobomaker.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `robomaker <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsrobomaker.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cf1058d56947ac68fc710c2ca40cabff6e03ba8165b9f9c015a863e939dde123)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDeploymentFleet")
    def on_deployment_fleet(
        self,
        fleet_name: builtins.str,
        created_on_epoch: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type deploymentFleet to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/managing-simulation-applications.html

        :param fleet_name: - Identifier for the fleetName.
        :param created_on_epoch: - Identifier for the createdOnEpoch.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8481f45070fbdba79c5e44e02381ec5b195e683c6f82b3ee6bbd996c79b58249)
            check_type(argname="argument fleet_name", value=fleet_name, expected_type=type_hints["fleet_name"])
            check_type(argname="argument created_on_epoch", value=created_on_epoch, expected_type=type_hints["created_on_epoch"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Robomaker", jsii.invoke(self, "onDeploymentFleet", [fleet_name, created_on_epoch, account, region, partition]))

    @jsii.member(jsii_name="onDeploymentJob")
    def on_deployment_job(
        self,
        deployment_job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type deploymentJob to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/deployment.html

        :param deployment_job_id: - Identifier for the deploymentJobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c25ea7be575688f4882a53c7bd1d20f3b9b8cddf834758877ff8de38b11c4613)
            check_type(argname="argument deployment_job_id", value=deployment_job_id, expected_type=type_hints["deployment_job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Robomaker", jsii.invoke(self, "onDeploymentJob", [deployment_job_id, account, region, partition]))

    @jsii.member(jsii_name="onRobot")
    def on_robot(
        self,
        robot_name: builtins.str,
        created_on_epoch: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type robot to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/fleets.html

        :param robot_name: - Identifier for the robotName.
        :param created_on_epoch: - Identifier for the createdOnEpoch.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e51238d4fbd0404910189633a75759645337ccb1d3273899203d2b6ce1591678)
            check_type(argname="argument robot_name", value=robot_name, expected_type=type_hints["robot_name"])
            check_type(argname="argument created_on_epoch", value=created_on_epoch, expected_type=type_hints["created_on_epoch"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Robomaker", jsii.invoke(self, "onRobot", [robot_name, created_on_epoch, account, region, partition]))

    @jsii.member(jsii_name="onRobotApplication")
    def on_robot_application(
        self,
        application_name: builtins.str,
        created_on_epoch: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type robotApplication to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/managing-robot-applications.html

        :param application_name: - Identifier for the applicationName.
        :param created_on_epoch: - Identifier for the createdOnEpoch.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b7397c9824ba7cc60a78786c6257c020393da26718cb030b68688167b53de284)
            check_type(argname="argument application_name", value=application_name, expected_type=type_hints["application_name"])
            check_type(argname="argument created_on_epoch", value=created_on_epoch, expected_type=type_hints["created_on_epoch"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Robomaker", jsii.invoke(self, "onRobotApplication", [application_name, created_on_epoch, account, region, partition]))

    @jsii.member(jsii_name="onSimulationApplication")
    def on_simulation_application(
        self,
        application_name: builtins.str,
        created_on_epoch: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type simulationApplication to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/managing-simulation-applications.html

        :param application_name: - Identifier for the applicationName.
        :param created_on_epoch: - Identifier for the createdOnEpoch.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8f944a56aa75867cafcfad9ad1beb4c7c62e0397055cb437ef3dfa513b4e36fb)
            check_type(argname="argument application_name", value=application_name, expected_type=type_hints["application_name"])
            check_type(argname="argument created_on_epoch", value=created_on_epoch, expected_type=type_hints["created_on_epoch"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Robomaker", jsii.invoke(self, "onSimulationApplication", [application_name, created_on_epoch, account, region, partition]))

    @jsii.member(jsii_name="onSimulationJob")
    def on_simulation_job(
        self,
        simulation_job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type simulationJob to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/simulation.html

        :param simulation_job_id: - Identifier for the simulationJobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ad1081b9de391d348b5ef7df35936b550d00fb4af35f63c772a778a13541762f)
            check_type(argname="argument simulation_job_id", value=simulation_job_id, expected_type=type_hints["simulation_job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Robomaker", jsii.invoke(self, "onSimulationJob", [simulation_job_id, account, region, partition]))

    @jsii.member(jsii_name="onSimulationJobBatch")
    def on_simulation_job_batch(
        self,
        simulation_job_batch_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type simulationJobBatch to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/simulation-job-batch.html

        :param simulation_job_batch_id: - Identifier for the simulationJobBatchId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bfea4910abd64c9df238843d1d530082dc0a1ee8399aa03de7f43a197ea1866e)
            check_type(argname="argument simulation_job_batch_id", value=simulation_job_batch_id, expected_type=type_hints["simulation_job_batch_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Robomaker", jsii.invoke(self, "onSimulationJobBatch", [simulation_job_batch_id, account, region, partition]))

    @jsii.member(jsii_name="onWorld")
    def on_world(
        self,
        world_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type world to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/worlds-managing-generated-worlds.html

        :param world_id: - Identifier for the worldId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f18b9b21d2a2bee4a33e15086beda9357b3d03b8c88f966a4fd36181f804c91f)
            check_type(argname="argument world_id", value=world_id, expected_type=type_hints["world_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Robomaker", jsii.invoke(self, "onWorld", [world_id, account, region, partition]))

    @jsii.member(jsii_name="onWorldExportJob")
    def on_world_export_job(
        self,
        world_export_job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type worldExportJob to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/worlds-managing-export-jobs.html

        :param world_export_job_id: - Identifier for the worldExportJobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__933769643f38a7925204651030688b44902c0043d40a7ed3e02643bdb4ec6ea0)
            check_type(argname="argument world_export_job_id", value=world_export_job_id, expected_type=type_hints["world_export_job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Robomaker", jsii.invoke(self, "onWorldExportJob", [world_export_job_id, account, region, partition]))

    @jsii.member(jsii_name="onWorldGenerationJob")
    def on_world_generation_job(
        self,
        world_generation_job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type worldGenerationJob to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/worlds-managing-generation-jobs.html

        :param world_generation_job_id: - Identifier for the worldGenerationJobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__66a72473fa73ced243aa2aac8512c5301ce7727630314b8a73cda487b75cabb9)
            check_type(argname="argument world_generation_job_id", value=world_generation_job_id, expected_type=type_hints["world_generation_job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Robomaker", jsii.invoke(self, "onWorldGenerationJob", [world_generation_job_id, account, region, partition]))

    @jsii.member(jsii_name="onWorldTemplate")
    def on_world_template(
        self,
        world_template_job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Robomaker":
        '''(experimental) Adds a resource of type worldTemplate to the statement.

        https://docs.aws.amazon.com/robomaker/latest/dg/worlds-managing-simworld-templates.html

        :param world_template_job_id: - Identifier for the worldTemplateJobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f392968549e746a1b2968902af0708f3f6d4114bea510d0b0445ad4a85f86bde)
            check_type(argname="argument world_template_job_id", value=world_template_job_id, expected_type=type_hints["world_template_job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Robomaker", jsii.invoke(self, "onWorldTemplate", [world_template_job_id, account, region, partition]))

    @jsii.member(jsii_name="toBatchDeleteWorlds")
    def to_batch_delete_worlds(self) -> "Robomaker":
        '''(experimental) Delete one or more worlds in a batch operation.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_BatchDeleteWorlds.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toBatchDeleteWorlds", []))

    @jsii.member(jsii_name="toBatchDescribeSimulationJob")
    def to_batch_describe_simulation_job(self) -> "Robomaker":
        '''(experimental) Describe multiple simulation jobs.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_BatchDescribeSimulationJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toBatchDescribeSimulationJob", []))

    @jsii.member(jsii_name="toCancelDeploymentJob")
    def to_cancel_deployment_job(self) -> "Robomaker":
        '''(experimental) Cancel a deployment job.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CancelDeploymentJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCancelDeploymentJob", []))

    @jsii.member(jsii_name="toCancelSimulationJob")
    def to_cancel_simulation_job(self) -> "Robomaker":
        '''(experimental) Cancel a simulation job.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CancelSimulationJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCancelSimulationJob", []))

    @jsii.member(jsii_name="toCancelSimulationJobBatch")
    def to_cancel_simulation_job_batch(self) -> "Robomaker":
        '''(experimental) Cancel a simulation job batch.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CancelSimulationJobBatch.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCancelSimulationJobBatch", []))

    @jsii.member(jsii_name="toCancelWorldExportJob")
    def to_cancel_world_export_job(self) -> "Robomaker":
        '''(experimental) Cancel a world export job.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CancelWorldExportJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCancelWorldExportJob", []))

    @jsii.member(jsii_name="toCancelWorldGenerationJob")
    def to_cancel_world_generation_job(self) -> "Robomaker":
        '''(experimental) Cancel a world generation job.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CancelWorldGenerationJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCancelWorldGenerationJob", []))

    @jsii.member(jsii_name="toCreateDeploymentJob")
    def to_create_deployment_job(self) -> "Robomaker":
        '''(experimental) Create a deployment job.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateDeploymentJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateDeploymentJob", []))

    @jsii.member(jsii_name="toCreateFleet")
    def to_create_fleet(self) -> "Robomaker":
        '''(experimental) Create a deployment fleet that represents a logical group of robots running the same robot application.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateFleet.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateFleet", []))

    @jsii.member(jsii_name="toCreateRobot")
    def to_create_robot(self) -> "Robomaker":
        '''(experimental) Create a robot that can be registered to a fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateRobot.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateRobot", []))

    @jsii.member(jsii_name="toCreateRobotApplication")
    def to_create_robot_application(self) -> "Robomaker":
        '''(experimental) Create a robot application.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateRobotApplication.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateRobotApplication", []))

    @jsii.member(jsii_name="toCreateRobotApplicationVersion")
    def to_create_robot_application_version(self) -> "Robomaker":
        '''(experimental) Create a snapshot of a robot application.

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateRobotApplicationVersion.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateRobotApplicationVersion", []))

    @jsii.member(jsii_name="toCreateSimulationApplication")
    def to_create_simulation_application(self) -> "Robomaker":
        '''(experimental) Create a simulation application.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateSimulationApplication.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateSimulationApplication", []))

    @jsii.member(jsii_name="toCreateSimulationApplicationVersion")
    def to_create_simulation_application_version(self) -> "Robomaker":
        '''(experimental) Create a snapshot of a simulation application.

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateSimulationApplicationVersion.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateSimulationApplicationVersion", []))

    @jsii.member(jsii_name="toCreateSimulationJob")
    def to_create_simulation_job(self) -> "Robomaker":
        '''(experimental) Create a simulation job.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateSimulationJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateSimulationJob", []))

    @jsii.member(jsii_name="toCreateWorldExportJob")
    def to_create_world_export_job(self) -> "Robomaker":
        '''(experimental) Create a world export job.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateWorldExportJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateWorldExportJob", []))

    @jsii.member(jsii_name="toCreateWorldGenerationJob")
    def to_create_world_generation_job(self) -> "Robomaker":
        '''(experimental) Create a world generation job.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateWorldGenerationJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateWorldGenerationJob", []))

    @jsii.member(jsii_name="toCreateWorldTemplate")
    def to_create_world_template(self) -> "Robomaker":
        '''(experimental) Create a world template.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/robomaker/latest/dg/API_CreateWorldTemplate.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toCreateWorldTemplate", []))

    @jsii.member(jsii_name="toDeleteFleet")
    def to_delete_fleet(self) -> "Robomaker":
        '''(experimental) Delete a deployment fleet.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DeleteFleet.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDeleteFleet", []))

    @jsii.member(jsii_name="toDeleteRobot")
    def to_delete_robot(self) -> "Robomaker":
        '''(experimental) Delete a robot.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DeleteRobot.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDeleteRobot", []))

    @jsii.member(jsii_name="toDeleteRobotApplication")
    def to_delete_robot_application(self) -> "Robomaker":
        '''(experimental) Delete a robot application.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DeleteRobotApplication.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDeleteRobotApplication", []))

    @jsii.member(jsii_name="toDeleteSimulationApplication")
    def to_delete_simulation_application(self) -> "Robomaker":
        '''(experimental) Delete a simulation application.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DeleteSimulationApplication.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDeleteSimulationApplication", []))

    @jsii.member(jsii_name="toDeleteWorldTemplate")
    def to_delete_world_template(self) -> "Robomaker":
        '''(experimental) Delete a world template.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DeleteWorldTemplate.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDeleteWorldTemplate", []))

    @jsii.member(jsii_name="toDeregisterRobot")
    def to_deregister_robot(self) -> "Robomaker":
        '''(experimental) Deregister a robot from a fleet.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DeregisterRobot.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDeregisterRobot", []))

    @jsii.member(jsii_name="toDescribeDeploymentJob")
    def to_describe_deployment_job(self) -> "Robomaker":
        '''(experimental) Describe a deployment job.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeDeploymentJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeDeploymentJob", []))

    @jsii.member(jsii_name="toDescribeFleet")
    def to_describe_fleet(self) -> "Robomaker":
        '''(experimental) Describe a deployment fleet.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeFleet.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeFleet", []))

    @jsii.member(jsii_name="toDescribeRobot")
    def to_describe_robot(self) -> "Robomaker":
        '''(experimental) Describe a robot.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeRobot.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeRobot", []))

    @jsii.member(jsii_name="toDescribeRobotApplication")
    def to_describe_robot_application(self) -> "Robomaker":
        '''(experimental) Describe a robot application.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeRobotApplication.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeRobotApplication", []))

    @jsii.member(jsii_name="toDescribeSimulationApplication")
    def to_describe_simulation_application(self) -> "Robomaker":
        '''(experimental) Describe a simulation application.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeSimulationApplication.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeSimulationApplication", []))

    @jsii.member(jsii_name="toDescribeSimulationJob")
    def to_describe_simulation_job(self) -> "Robomaker":
        '''(experimental) Describe a simulation job.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeSimulationJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeSimulationJob", []))

    @jsii.member(jsii_name="toDescribeSimulationJobBatch")
    def to_describe_simulation_job_batch(self) -> "Robomaker":
        '''(experimental) Describe a simulation job batch.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeSimulationJobBatch.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeSimulationJobBatch", []))

    @jsii.member(jsii_name="toDescribeWorld")
    def to_describe_world(self) -> "Robomaker":
        '''(experimental) Describe a world.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeWorld.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeWorld", []))

    @jsii.member(jsii_name="toDescribeWorldExportJob")
    def to_describe_world_export_job(self) -> "Robomaker":
        '''(experimental) Describe a world export job.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeWorldExportJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeWorldExportJob", []))

    @jsii.member(jsii_name="toDescribeWorldGenerationJob")
    def to_describe_world_generation_job(self) -> "Robomaker":
        '''(experimental) Describe a world generation job.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeWorldGenerationJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeWorldGenerationJob", []))

    @jsii.member(jsii_name="toDescribeWorldTemplate")
    def to_describe_world_template(self) -> "Robomaker":
        '''(experimental) Describe a world template.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_DescribeWorldTemplate.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toDescribeWorldTemplate", []))

    @jsii.member(jsii_name="toGetWorldTemplateBody")
    def to_get_world_template_body(self) -> "Robomaker":
        '''(experimental) Get the body of a world template.

        Access Level: Read

        https://docs.aws.amazon.com/robomaker/latest/dg/API_GetWorldTemplateBody.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toGetWorldTemplateBody", []))

    @jsii.member(jsii_name="toListDeploymentJobs")
    def to_list_deployment_jobs(self) -> "Robomaker":
        '''(experimental) List deployment jobs.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListDeploymentJobs.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListDeploymentJobs", []))

    @jsii.member(jsii_name="toListFleets")
    def to_list_fleets(self) -> "Robomaker":
        '''(experimental) List fleets.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListFleets.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListFleets", []))

    @jsii.member(jsii_name="toListRobotApplications")
    def to_list_robot_applications(self) -> "Robomaker":
        '''(experimental) List robot applications.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListRobotApplications.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListRobotApplications", []))

    @jsii.member(jsii_name="toListRobots")
    def to_list_robots(self) -> "Robomaker":
        '''(experimental) List robots.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListRobots.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListRobots", []))

    @jsii.member(jsii_name="toListSimulationApplications")
    def to_list_simulation_applications(self) -> "Robomaker":
        '''(experimental) List simulation applications.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListSimulationApplications.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListSimulationApplications", []))

    @jsii.member(jsii_name="toListSimulationJobBatches")
    def to_list_simulation_job_batches(self) -> "Robomaker":
        '''(experimental) List simulation job batches.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListSimulationJobBatches.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListSimulationJobBatches", []))

    @jsii.member(jsii_name="toListSimulationJobs")
    def to_list_simulation_jobs(self) -> "Robomaker":
        '''(experimental) List simulation jobs.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListSimulationJobs.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListSimulationJobs", []))

    @jsii.member(jsii_name="toListSupportedAvailabilityZones")
    def to_list_supported_availability_zones(self) -> "Robomaker":
        '''(experimental) Lists supported availability zones.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListSupportedAvailabilityZones", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Robomaker":
        '''(experimental) List tags for a RoboMaker resource.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWorldExportJobs")
    def to_list_world_export_jobs(self) -> "Robomaker":
        '''(experimental) List world export jobs.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListWorldExportJobs.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListWorldExportJobs", []))

    @jsii.member(jsii_name="toListWorldGenerationJobs")
    def to_list_world_generation_jobs(self) -> "Robomaker":
        '''(experimental) List world generation jobs.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListWorldGenerationJobs.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListWorldGenerationJobs", []))

    @jsii.member(jsii_name="toListWorlds")
    def to_list_worlds(self) -> "Robomaker":
        '''(experimental) List worlds.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListWorlds.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListWorlds", []))

    @jsii.member(jsii_name="toListWorldTemplates")
    def to_list_world_templates(self) -> "Robomaker":
        '''(experimental) List world templates.

        Access Level: List

        https://docs.aws.amazon.com/robomaker/latest/dg/API_ListWorldTemplates.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toListWorldTemplates", []))

    @jsii.member(jsii_name="toRegisterRobot")
    def to_register_robot(self) -> "Robomaker":
        '''(experimental) Register a robot to a fleet.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_RegisterRobot.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toRegisterRobot", []))

    @jsii.member(jsii_name="toRestartSimulationJob")
    def to_restart_simulation_job(self) -> "Robomaker":
        '''(experimental) Restart a running simulation job.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_RestartSimulationJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toRestartSimulationJob", []))

    @jsii.member(jsii_name="toStartSimulationJobBatch")
    def to_start_simulation_job_batch(self) -> "Robomaker":
        '''(experimental) Create a simulation job batch.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/robomaker/latest/dg/API_StartSimulationJobBatch.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toStartSimulationJobBatch", []))

    @jsii.member(jsii_name="toSyncDeploymentJob")
    def to_sync_deployment_job(self) -> "Robomaker":
        '''(experimental) Ensures the most recently deployed robot application is deployed to all robots in the fleet.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/robomaker/latest/dg/API_SyncDeploymentJob.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toSyncDeploymentJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Robomaker":
        '''(experimental) Add tags to a RoboMaker resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/robomaker/latest/dg/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Robomaker":
        '''(experimental) Remove tags from a RoboMaker resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/robomaker/latest/dg/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateRobotApplication")
    def to_update_robot_application(self) -> "Robomaker":
        '''(experimental) Update a robot application.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_UpdateRobotApplication.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toUpdateRobotApplication", []))

    @jsii.member(jsii_name="toUpdateRobotDeployment")
    def to_update_robot_deployment(self) -> "Robomaker":
        '''(experimental) Report the deployment status for an individual robot.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toUpdateRobotDeployment", []))

    @jsii.member(jsii_name="toUpdateSimulationApplication")
    def to_update_simulation_application(self) -> "Robomaker":
        '''(experimental) Update a simulation application.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_UpdateSimulationApplication.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toUpdateSimulationApplication", []))

    @jsii.member(jsii_name="toUpdateWorldTemplate")
    def to_update_world_template(self) -> "Robomaker":
        '''(experimental) Update a world template.

        Access Level: Write

        https://docs.aws.amazon.com/robomaker/latest/dg/API_UpdateWorldTemplate.html

        :stability: experimental
        '''
        return typing.cast("Robomaker", jsii.invoke(self, "toUpdateWorldTemplate", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0df591d20b902eca9270c35c3e3492cbdcf6cfb886c1afccb7b8bdbf1972c5a4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2b13eaccbfd240f8766527896d141d580d13c848cb92359015c2ea10a9d45b23)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Rolesanywhere(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Rolesanywhere",
):
    '''(experimental) Statement provider for service `rolesanywhere <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsidentityandaccessmanagementrolesanywhere.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `rolesanywhere <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsidentityandaccessmanagementrolesanywhere.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__228b7755abbe8814f0422fa036b81606c8b737cf27d03dc412a30bad5c70ff1e)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onCrl")
    def on_crl(
        self,
        crl_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rolesanywhere":
        '''(experimental) Adds a resource of type crl to the statement.

        https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html#first-time-user

        :param crl_id: - Identifier for the crlId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__10004a5c8a47b49bc6896b25e7267860323a07b57b494ccfc559a29d18b037f0)
            check_type(argname="argument crl_id", value=crl_id, expected_type=type_hints["crl_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rolesanywhere", jsii.invoke(self, "onCrl", [crl_id, account, region, partition]))

    @jsii.member(jsii_name="onProfile")
    def on_profile(
        self,
        profile_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rolesanywhere":
        '''(experimental) Adds a resource of type profile to the statement.

        https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html#first-time-user

        :param profile_id: - Identifier for the profileId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b972d321c1ea6202c4b5b586b49cef339aa26c293f15ac7faca7b99648616e92)
            check_type(argname="argument profile_id", value=profile_id, expected_type=type_hints["profile_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rolesanywhere", jsii.invoke(self, "onProfile", [profile_id, account, region, partition]))

    @jsii.member(jsii_name="onSubject")
    def on_subject(
        self,
        subject_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rolesanywhere":
        '''(experimental) Adds a resource of type subject to the statement.

        https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html#first-time-user

        :param subject_id: - Identifier for the subjectId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f36d64bec08d13a45240e2ff189f374bb021dc4239f0fe4332f2980afda15363)
            check_type(argname="argument subject_id", value=subject_id, expected_type=type_hints["subject_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rolesanywhere", jsii.invoke(self, "onSubject", [subject_id, account, region, partition]))

    @jsii.member(jsii_name="onTrustAnchor")
    def on_trust_anchor(
        self,
        trust_anchor_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rolesanywhere":
        '''(experimental) Adds a resource of type trust-anchor to the statement.

        https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html#first-time-user

        :param trust_anchor_id: - Identifier for the trustAnchorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4fb1cc95f0219f5ef09527efca2bfd32eb831b58efece91ef8dc6efd43e72b12)
            check_type(argname="argument trust_anchor_id", value=trust_anchor_id, expected_type=type_hints["trust_anchor_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rolesanywhere", jsii.invoke(self, "onTrustAnchor", [trust_anchor_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateProfile")
    def to_create_profile(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to create a profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_CreateProfile.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toCreateProfile", []))

    @jsii.member(jsii_name="toCreateTrustAnchor")
    def to_create_trust_anchor(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to create a trust anchor.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_CreateTrustAnchor.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toCreateTrustAnchor", []))

    @jsii.member(jsii_name="toDeleteCrl")
    def to_delete_crl(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to delete a certificate revocation list (crl).

        Access Level: Write

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_DeleteCrl.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toDeleteCrl", []))

    @jsii.member(jsii_name="toDeleteProfile")
    def to_delete_profile(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to delete a profile.

        Access Level: Write

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_DeleteProfile.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toDeleteProfile", []))

    @jsii.member(jsii_name="toDeleteTrustAnchor")
    def to_delete_trust_anchor(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to delete a trust anchor.

        Access Level: Write

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_DeleteTrustAnchor.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toDeleteTrustAnchor", []))

    @jsii.member(jsii_name="toDisableCrl")
    def to_disable_crl(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to disable a certificate revocation list (crl).

        Access Level: Write

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_DisableCrl.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toDisableCrl", []))

    @jsii.member(jsii_name="toDisableProfile")
    def to_disable_profile(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to disable a profile.

        Access Level: Write

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_DisableProfile.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toDisableProfile", []))

    @jsii.member(jsii_name="toDisableTrustAnchor")
    def to_disable_trust_anchor(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to disable a trust anchor.

        Access Level: Write

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_DisableTrustAnchor.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toDisableTrustAnchor", []))

    @jsii.member(jsii_name="toEnableCrl")
    def to_enable_crl(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to enable a certificate revocation list (crl).

        Access Level: Write

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_EnableCrl.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toEnableCrl", []))

    @jsii.member(jsii_name="toEnableProfile")
    def to_enable_profile(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to enable a profile.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_EnableProfile.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toEnableProfile", []))

    @jsii.member(jsii_name="toEnableTrustAnchor")
    def to_enable_trust_anchor(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to enable a trust anchor.

        Access Level: Write

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_EnableTrustAnchor.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toEnableTrustAnchor", []))

    @jsii.member(jsii_name="toGetCrl")
    def to_get_crl(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to get a certificate revocation list (crl).

        Access Level: Read

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_GetCrl.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toGetCrl", []))

    @jsii.member(jsii_name="toGetProfile")
    def to_get_profile(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to get a profile.

        Access Level: Read

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_GetProfile.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toGetProfile", []))

    @jsii.member(jsii_name="toGetSubject")
    def to_get_subject(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to get a subject.

        Access Level: Read

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_GetSubject.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toGetSubject", []))

    @jsii.member(jsii_name="toGetTrustAnchor")
    def to_get_trust_anchor(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to get a trust anchor.

        Access Level: Read

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_GetTrustAnchor.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toGetTrustAnchor", []))

    @jsii.member(jsii_name="toImportCrl")
    def to_import_crl(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to import a certificate revocation list (crl).

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ImportCrl.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toImportCrl", []))

    @jsii.member(jsii_name="toListCrls")
    def to_list_crls(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to list certificate revocation lists (crls).

        Access Level: List

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ListCrls.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toListCrls", []))

    @jsii.member(jsii_name="toListProfiles")
    def to_list_profiles(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to list profiles.

        Access Level: List

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ListProfiles.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toListProfiles", []))

    @jsii.member(jsii_name="toListSubjects")
    def to_list_subjects(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to list subjects.

        Access Level: List

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ListSubjects.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toListSubjects", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: List

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTrustAnchors")
    def to_list_trust_anchors(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to list trust anchors.

        Access Level: List

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_ListTrustAnchors.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toListTrustAnchors", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateCrl")
    def to_update_crl(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to update a certificate revocation list (crl).

        Access Level: Write

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_UpdateCrl.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toUpdateCrl", []))

    @jsii.member(jsii_name="toUpdateProfile")
    def to_update_profile(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to update a profile.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_UpdateProfile.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toUpdateProfile", []))

    @jsii.member(jsii_name="toUpdateTrustAnchor")
    def to_update_trust_anchor(self) -> "Rolesanywhere":
        '''(experimental) Grants permission to update a trust anchor.

        Access Level: Write

        https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_UpdateTrustAnchor.html

        :stability: experimental
        '''
        return typing.cast("Rolesanywhere", jsii.invoke(self, "toUpdateTrustAnchor", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8b95b1d0c6c28a035b1a422f1f622d836210b1cb7edf4b48a49ae810f9d94076)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__29c31406859440f572680e18a253e54ba8e606204aca8d2f4d554c08e72af32c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Route53(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Route53"):
    '''(experimental) Statement provider for service `route53 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `route53 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__41e6eaec234868cb978b61090c21226f41d247110ca70bf78370b3e83a141e15)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifChangeResourceRecordSetsActions")
    def if_change_resource_record_sets_actions(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Route53":
        '''(experimental) Filters access by the change actions, CREATE, UPSERT, or DELETE, in a ChangeResourceRecordSets request.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/specifying-rrset-conditions.html#route53_rrset_ConditionKeys

        Applies to actions:

        - .toChangeResourceRecordSets()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__27af08ae9e757e86910d56cde383673d9f56a445654bd761f51c0cd49a14c57a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Route53", jsii.invoke(self, "ifChangeResourceRecordSetsActions", [value, operator]))

    @jsii.member(jsii_name="ifChangeResourceRecordSetsNormalizedRecordNames")
    def if_change_resource_record_sets_normalized_record_names(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Route53":
        '''(experimental) Filters access by the normalized DNS record names in a ChangeResourceRecordSets request.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/specifying-rrset-conditions.html#route53_rrset_ConditionKeys

        Applies to actions:

        - .toChangeResourceRecordSets()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__44d17d965f5ebef61db2b722b17500c785b47ec2030630fe42f85ddf45bfe080)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Route53", jsii.invoke(self, "ifChangeResourceRecordSetsNormalizedRecordNames", [value, operator]))

    @jsii.member(jsii_name="ifChangeResourceRecordSetsRecordTypes")
    def if_change_resource_record_sets_record_types(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Route53":
        '''(experimental) Filters access by the DNS record types in a ChangeResourceRecordSets request.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/specifying-rrset-conditions.html#route53_rrset_ConditionKeys

        Applies to actions:

        - .toChangeResourceRecordSets()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__193449bd36315bdc5d6c503012ce6cb00eb1f6018e70dadda5d1ec0cf26bc98c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Route53", jsii.invoke(self, "ifChangeResourceRecordSetsRecordTypes", [value, operator]))

    @jsii.member(jsii_name="onChange")
    def on_change(
        self,
        id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53":
        '''(experimental) Adds a resource of type change to the statement.

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_Change.html

        :param id: - Identifier for the id.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3a8b96336092c5a9b7fc4f0ad98803155227c98ab39bb6e8959078c33f99a3e0)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53", jsii.invoke(self, "onChange", [id, partition]))

    @jsii.member(jsii_name="onCidrcollection")
    def on_cidrcollection(
        self,
        id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53":
        '''(experimental) Adds a resource of type cidrcollection to the statement.

        :param id: - Identifier for the id.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__29e3f4306c3f325c0e760cec9e20f551991ec88c0651b4f697321cf89453f27d)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53", jsii.invoke(self, "onCidrcollection", [id, partition]))

    @jsii.member(jsii_name="onDelegationset")
    def on_delegationset(
        self,
        id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53":
        '''(experimental) Adds a resource of type delegationset to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/route-53-concepts.html#route-53-concepts-reusable-delegation-set

        :param id: - Identifier for the id.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e3c9ac2753836dd2a4abaa81684b61551b0fbbdbb473e9fe4ad1c4baee100e77)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53", jsii.invoke(self, "onDelegationset", [id, partition]))

    @jsii.member(jsii_name="onHealthcheck")
    def on_healthcheck(
        self,
        id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53":
        '''(experimental) Adds a resource of type healthcheck to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/route-53-concepts.html#route-53-concepts-health-check

        :param id: - Identifier for the id.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__35a1477d7dc71de9514fa82497c4330f54c4a9651000eb491e52189582a7f22f)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53", jsii.invoke(self, "onHealthcheck", [id, partition]))

    @jsii.member(jsii_name="onHostedzone")
    def on_hostedzone(
        self,
        id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53":
        '''(experimental) Adds a resource of type hostedzone to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/route-53-concepts.html#route-53-concepts-hosted-zone

        :param id: - Identifier for the id.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__61e471217a89a6856a85c7dc1be681ac576d7f0192afa9846bb0c62573afaa99)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53", jsii.invoke(self, "onHostedzone", [id, partition]))

    @jsii.member(jsii_name="onQueryloggingconfig")
    def on_queryloggingconfig(
        self,
        id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53":
        '''(experimental) Adds a resource of type queryloggingconfig to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/query-logs.html

        :param id: - Identifier for the id.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__02358f2e315125c3ca0ade5fbeca7d086b288bbe942f776bb4bf30df13028d6c)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53", jsii.invoke(self, "onQueryloggingconfig", [id, partition]))

    @jsii.member(jsii_name="onTrafficpolicy")
    def on_trafficpolicy(
        self,
        id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53":
        '''(experimental) Adds a resource of type trafficpolicy to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/traffic-policies.html

        :param id: - Identifier for the id.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__50f2ea3f59a9ac579795a894a84a4259981a16a01bcbe3d8af7608d857f68b80)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53", jsii.invoke(self, "onTrafficpolicy", [id, partition]))

    @jsii.member(jsii_name="onTrafficpolicyinstance")
    def on_trafficpolicyinstance(
        self,
        id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53":
        '''(experimental) Adds a resource of type trafficpolicyinstance to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/traffic-policy-records.html

        :param id: - Identifier for the id.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__67700d2b6aeebf3eb09de4542507bb1e54ae158e7ee76e72c5b120ea73818716)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53", jsii.invoke(self, "onTrafficpolicyinstance", [id, partition]))

    @jsii.member(jsii_name="onVpc")
    def on_vpc(
        self,
        vpc_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53":
        '''(experimental) Adds a resource of type vpc to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html

        :param vpc_id: - Identifier for the vpcId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__227106973b768b2e8bf62245c092b455ec5c78c131c4c78ac24bf43027432bf3)
            check_type(argname="argument vpc_id", value=vpc_id, expected_type=type_hints["vpc_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53", jsii.invoke(self, "onVpc", [vpc_id, account, region, partition]))

    @jsii.member(jsii_name="toActivateKeySigningKey")
    def to_activate_key_signing_key(self) -> "Route53":
        '''(experimental) Grants permission to activate a key-signing key so that it can be used for signing by DNSSEC.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ActivateKeySigningKey.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toActivateKeySigningKey", []))

    @jsii.member(jsii_name="toAssociateVPCWithHostedZone")
    def to_associate_vpc_with_hosted_zone(self) -> "Route53":
        '''(experimental) Grants permission to associate an additional Amazon VPC with a private hosted zone.

        Access Level: Write

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_AssociateVPCWithHostedZone.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toAssociateVPCWithHostedZone", []))

    @jsii.member(jsii_name="toChangeCidrCollection")
    def to_change_cidr_collection(self) -> "Route53":
        '''(experimental) Grants permission to create or delete CIDR blocks within a CIDR collection.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ChangeCidrCollection.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toChangeCidrCollection", []))

    @jsii.member(jsii_name="toChangeResourceRecordSets")
    def to_change_resource_record_sets(self) -> "Route53":
        '''(experimental) Grants permission to create, update, or delete a record, which contains authoritative DNS information for a specified domain or subdomain name.

        Access Level: Write

        Possible conditions:

        - .ifChangeResourceRecordSetsNormalizedRecordNames()
        - .ifChangeResourceRecordSetsRecordTypes()
        - .ifChangeResourceRecordSetsActions()

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ChangeResourceRecordSets.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toChangeResourceRecordSets", []))

    @jsii.member(jsii_name="toChangeTagsForResource")
    def to_change_tags_for_resource(self) -> "Route53":
        '''(experimental) Grants permission to add, edit, or delete tags for a health check or a hosted zone.

        Access Level: Tagging

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ChangeTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toChangeTagsForResource", []))

    @jsii.member(jsii_name="toCreateCidrCollection")
    def to_create_cidr_collection(self) -> "Route53":
        '''(experimental) Grants permission to create a new CIDR collection.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateCidrCollection.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toCreateCidrCollection", []))

    @jsii.member(jsii_name="toCreateHealthCheck")
    def to_create_health_check(self) -> "Route53":
        '''(experimental) Grants permission to create a new health check, which monitors the health and performance of your web applications, web servers, and other resources.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateHealthCheck.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toCreateHealthCheck", []))

    @jsii.member(jsii_name="toCreateHostedZone")
    def to_create_hosted_zone(self) -> "Route53":
        '''(experimental) Grants permission to create a public hosted zone, which you use to specify how the Domain Name System (DNS) routes traffic on the Internet for a domain, such as example.com, and its subdomains.

        Access Level: Write

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateHostedZone.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toCreateHostedZone", []))

    @jsii.member(jsii_name="toCreateKeySigningKey")
    def to_create_key_signing_key(self) -> "Route53":
        '''(experimental) Grants permission to create a new key-signing key associated with a hosted zone.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateKeySigningKey.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toCreateKeySigningKey", []))

    @jsii.member(jsii_name="toCreateQueryLoggingConfig")
    def to_create_query_logging_config(self) -> "Route53":
        '''(experimental) Grants permission to create a configuration for DNS query logging.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateQueryLoggingConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toCreateQueryLoggingConfig", []))

    @jsii.member(jsii_name="toCreateReusableDelegationSet")
    def to_create_reusable_delegation_set(self) -> "Route53":
        '''(experimental) Grants permission to create a delegation set (a group of four name servers) that can be reused by multiple hosted zones.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateReusableDelegationSet.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toCreateReusableDelegationSet", []))

    @jsii.member(jsii_name="toCreateTrafficPolicy")
    def to_create_traffic_policy(self) -> "Route53":
        '''(experimental) Grants permission to create a traffic policy, which you use to create multiple DNS records for one domain name (such as example.com) or one subdomain name (such as www.example.com).

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateTrafficPolicy.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toCreateTrafficPolicy", []))

    @jsii.member(jsii_name="toCreateTrafficPolicyInstance")
    def to_create_traffic_policy_instance(self) -> "Route53":
        '''(experimental) Grants permission to create records in a specified hosted zone based on the settings in a specified traffic policy version.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateTrafficPolicyInstance.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toCreateTrafficPolicyInstance", []))

    @jsii.member(jsii_name="toCreateTrafficPolicyVersion")
    def to_create_traffic_policy_version(self) -> "Route53":
        '''(experimental) Grants permission to create a new version of an existing traffic policy.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateTrafficPolicyVersion.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toCreateTrafficPolicyVersion", []))

    @jsii.member(jsii_name="toCreateVPCAssociationAuthorization")
    def to_create_vpc_association_authorization(self) -> "Route53":
        '''(experimental) Grants permission to authorize the AWS account that created a specified VPC to submit an AssociateVPCWithHostedZone request, which associates the VPC with a specified hosted zone that was created by a different account.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateVPCAssociationAuthorization.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toCreateVPCAssociationAuthorization", []))

    @jsii.member(jsii_name="toDeactivateKeySigningKey")
    def to_deactivate_key_signing_key(self) -> "Route53":
        '''(experimental) Grants permission to deactivate a key-signing key so that it will not be used for signing by DNSSEC.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeactivateKeySigningKey.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toDeactivateKeySigningKey", []))

    @jsii.member(jsii_name="toDeleteCidrCollection")
    def to_delete_cidr_collection(self) -> "Route53":
        '''(experimental) Grants permission to delete a CIDR collection.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeleteCidrCollection.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toDeleteCidrCollection", []))

    @jsii.member(jsii_name="toDeleteHealthCheck")
    def to_delete_health_check(self) -> "Route53":
        '''(experimental) Grants permission to delete a health check.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeleteHealthCheck.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toDeleteHealthCheck", []))

    @jsii.member(jsii_name="toDeleteHostedZone")
    def to_delete_hosted_zone(self) -> "Route53":
        '''(experimental) Grants permission to delete a hosted zone.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeleteHostedZone.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toDeleteHostedZone", []))

    @jsii.member(jsii_name="toDeleteKeySigningKey")
    def to_delete_key_signing_key(self) -> "Route53":
        '''(experimental) Grants permission to delete a key-signing key.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeleteKeySigningKey.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toDeleteKeySigningKey", []))

    @jsii.member(jsii_name="toDeleteQueryLoggingConfig")
    def to_delete_query_logging_config(self) -> "Route53":
        '''(experimental) Grants permission to delete a configuration for DNS query logging.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeleteQueryLoggingConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toDeleteQueryLoggingConfig", []))

    @jsii.member(jsii_name="toDeleteReusableDelegationSet")
    def to_delete_reusable_delegation_set(self) -> "Route53":
        '''(experimental) Grants permission to delete a reusable delegation set.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeleteReusableDelegationSet.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toDeleteReusableDelegationSet", []))

    @jsii.member(jsii_name="toDeleteTrafficPolicy")
    def to_delete_traffic_policy(self) -> "Route53":
        '''(experimental) Grants permission to delete a traffic policy.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeleteTrafficPolicy.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toDeleteTrafficPolicy", []))

    @jsii.member(jsii_name="toDeleteTrafficPolicyInstance")
    def to_delete_traffic_policy_instance(self) -> "Route53":
        '''(experimental) Grants permission to delete a traffic policy instance and all the records that Route 53 created when you created the instance.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeleteTrafficPolicyInstance.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toDeleteTrafficPolicyInstance", []))

    @jsii.member(jsii_name="toDeleteVPCAssociationAuthorization")
    def to_delete_vpc_association_authorization(self) -> "Route53":
        '''(experimental) Grants permission to remove authorization for associating an Amazon Virtual Private Cloud with a Route 53 private hosted zone.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeleteVPCAssociationAuthorization.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toDeleteVPCAssociationAuthorization", []))

    @jsii.member(jsii_name="toDisableHostedZoneDNSSEC")
    def to_disable_hosted_zone_dnssec(self) -> "Route53":
        '''(experimental) Grants permission to disable DNSSEC signing in a specific hosted zone.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_DisableHostedZoneDNSSEC.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toDisableHostedZoneDNSSEC", []))

    @jsii.member(jsii_name="toDisassociateVPCFromHostedZone")
    def to_disassociate_vpc_from_hosted_zone(self) -> "Route53":
        '''(experimental) Grants permission to disassociate an Amazon Virtual Private Cloud from a Route 53 private hosted zone.

        Access Level: Write

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_DisassociateVPCFromHostedZone.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toDisassociateVPCFromHostedZone", []))

    @jsii.member(jsii_name="toEnableHostedZoneDNSSEC")
    def to_enable_hosted_zone_dnssec(self) -> "Route53":
        '''(experimental) Grants permission to enable DNSSEC signing in a specific hosted zone.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_EnableHostedZoneDNSSEC.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toEnableHostedZoneDNSSEC", []))

    @jsii.member(jsii_name="toGetAccountLimit")
    def to_get_account_limit(self) -> "Route53":
        '''(experimental) Grants permission to get the specified limit for the current account, for example, the maximum number of health checks that you can create using the account.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetAccountLimit.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetAccountLimit", []))

    @jsii.member(jsii_name="toGetChange")
    def to_get_change(self) -> "Route53":
        '''(experimental) Grants permission to get the current status of a request to create, update, or delete one or more records.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetChange.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetChange", []))

    @jsii.member(jsii_name="toGetCheckerIpRanges")
    def to_get_checker_ip_ranges(self) -> "Route53":
        '''(experimental) Grants permission to get a list of the IP ranges that are used by Route 53 health checkers to check the health of your resources.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetCheckerIpRanges.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetCheckerIpRanges", []))

    @jsii.member(jsii_name="toGetDNSSEC")
    def to_get_dnssec(self) -> "Route53":
        '''(experimental) Grants permission to get information about DNSSEC for a specific hosted zone, including the key-signing keys in the hosted zone.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetDNSSEC.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetDNSSEC", []))

    @jsii.member(jsii_name="toGetGeoLocation")
    def to_get_geo_location(self) -> "Route53":
        '''(experimental) Grants permission to get information about whether a specified geographic location is supported for Route 53 geolocation records.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetGeoLocation.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetGeoLocation", []))

    @jsii.member(jsii_name="toGetHealthCheck")
    def to_get_health_check(self) -> "Route53":
        '''(experimental) Grants permission to get information about a specified health check.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetHealthCheck.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetHealthCheck", []))

    @jsii.member(jsii_name="toGetHealthCheckCount")
    def to_get_health_check_count(self) -> "Route53":
        '''(experimental) Grants permission to get the number of health checks that are associated with the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetHealthCheckCount.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetHealthCheckCount", []))

    @jsii.member(jsii_name="toGetHealthCheckLastFailureReason")
    def to_get_health_check_last_failure_reason(self) -> "Route53":
        '''(experimental) Grants permission to get the reason that a specified health check failed most recently.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetHealthCheckLastFailureReason.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetHealthCheckLastFailureReason", []))

    @jsii.member(jsii_name="toGetHealthCheckStatus")
    def to_get_health_check_status(self) -> "Route53":
        '''(experimental) Grants permission to get the status of a specified health check.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetHealthCheckStatus.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetHealthCheckStatus", []))

    @jsii.member(jsii_name="toGetHostedZone")
    def to_get_hosted_zone(self) -> "Route53":
        '''(experimental) Grants permission to get information about a specified hosted zone including the four name servers that Route 53 assigned to the hosted zone.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetHostedZone.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetHostedZone", []))

    @jsii.member(jsii_name="toGetHostedZoneCount")
    def to_get_hosted_zone_count(self) -> "Route53":
        '''(experimental) Grants permission to get the number of hosted zones that are associated with the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetHostedZoneCount.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetHostedZoneCount", []))

    @jsii.member(jsii_name="toGetHostedZoneLimit")
    def to_get_hosted_zone_limit(self) -> "Route53":
        '''(experimental) Grants permission to get the specified limit for a specified hosted zone.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetHostedZoneLimit.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetHostedZoneLimit", []))

    @jsii.member(jsii_name="toGetQueryLoggingConfig")
    def to_get_query_logging_config(self) -> "Route53":
        '''(experimental) Grants permission to get information about a specified configuration for DNS query logging.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetQueryLoggingConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetQueryLoggingConfig", []))

    @jsii.member(jsii_name="toGetReusableDelegationSet")
    def to_get_reusable_delegation_set(self) -> "Route53":
        '''(experimental) Grants permission to get information about a specified reusable delegation set, including the four name servers that are assigned to the delegation set.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetReusableDelegationSet.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetReusableDelegationSet", []))

    @jsii.member(jsii_name="toGetReusableDelegationSetLimit")
    def to_get_reusable_delegation_set_limit(self) -> "Route53":
        '''(experimental) Grants permission to get the maximum number of hosted zones that you can associate with the specified reusable delegation set.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetReusableDelegationSetLimit.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetReusableDelegationSetLimit", []))

    @jsii.member(jsii_name="toGetTrafficPolicy")
    def to_get_traffic_policy(self) -> "Route53":
        '''(experimental) Grants permission to get information about a specified traffic policy version.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetTrafficPolicy.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetTrafficPolicy", []))

    @jsii.member(jsii_name="toGetTrafficPolicyInstance")
    def to_get_traffic_policy_instance(self) -> "Route53":
        '''(experimental) Grants permission to get information about a specified traffic policy instance.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetTrafficPolicyInstance.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetTrafficPolicyInstance", []))

    @jsii.member(jsii_name="toGetTrafficPolicyInstanceCount")
    def to_get_traffic_policy_instance_count(self) -> "Route53":
        '''(experimental) Grants permission to get the number of traffic policy instances that are associated with the current AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetTrafficPolicyInstanceCount.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toGetTrafficPolicyInstanceCount", []))

    @jsii.member(jsii_name="toListCidrBlocks")
    def to_list_cidr_blocks(self) -> "Route53":
        '''(experimental) Grants permission to get a list of the CIDR blocks within a specified CIDR collection.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListCidrBlocks.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListCidrBlocks", []))

    @jsii.member(jsii_name="toListCidrCollections")
    def to_list_cidr_collections(self) -> "Route53":
        '''(experimental) Grants permission to get a list of the CIDR collections that are associated with the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListCidrCollections.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListCidrCollections", []))

    @jsii.member(jsii_name="toListCidrLocations")
    def to_list_cidr_locations(self) -> "Route53":
        '''(experimental) Grants permission to get a list of the CIDR locations that belong to a specified CIDR collection.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListCidrLocations.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListCidrLocations", []))

    @jsii.member(jsii_name="toListGeoLocations")
    def to_list_geo_locations(self) -> "Route53":
        '''(experimental) Grants permission to get a list of geographic locations that Route 53 supports for geolocation.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListGeoLocations.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListGeoLocations", []))

    @jsii.member(jsii_name="toListHealthChecks")
    def to_list_health_checks(self) -> "Route53":
        '''(experimental) Grants permission to get a list of the health checks that are associated with the current AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListHealthChecks.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListHealthChecks", []))

    @jsii.member(jsii_name="toListHostedZones")
    def to_list_hosted_zones(self) -> "Route53":
        '''(experimental) Grants permission to get a list of the public and private hosted zones that are associated with the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListHostedZones.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListHostedZones", []))

    @jsii.member(jsii_name="toListHostedZonesByName")
    def to_list_hosted_zones_by_name(self) -> "Route53":
        '''(experimental) Grants permission to get a list of your hosted zones in lexicographic order.

        Hosted zones are sorted by name with the labels reversed, for example, com.example.www

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListHostedZonesByName.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListHostedZonesByName", []))

    @jsii.member(jsii_name="toListHostedZonesByVPC")
    def to_list_hosted_zones_by_vpc(self) -> "Route53":
        '''(experimental) Grants permission to get a list of all the private hosted zones that a specified VPC is associated with.

        Access Level: List

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListHostedZonesByVPC.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListHostedZonesByVPC", []))

    @jsii.member(jsii_name="toListQueryLoggingConfigs")
    def to_list_query_logging_configs(self) -> "Route53":
        '''(experimental) Grants permission to list the configurations for DNS query logging that are associated with the current AWS account or the configuration that is associated with a specified hosted zone.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListQueryLoggingConfigs.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListQueryLoggingConfigs", []))

    @jsii.member(jsii_name="toListResourceRecordSets")
    def to_list_resource_record_sets(self) -> "Route53":
        '''(experimental) Grants permission to list the records in a specified hosted zone.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListResourceRecordSets.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListResourceRecordSets", []))

    @jsii.member(jsii_name="toListReusableDelegationSets")
    def to_list_reusable_delegation_sets(self) -> "Route53":
        '''(experimental) Grants permission to list the reusable delegation sets that are associated with the current AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListReusableDelegationSets.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListReusableDelegationSets", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Route53":
        '''(experimental) Grants permission to list tags for one health check or hosted zone.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTagsForResources")
    def to_list_tags_for_resources(self) -> "Route53":
        '''(experimental) Grants permission to list tags for up to 10 health checks or hosted zones.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListTagsForResources.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListTagsForResources", []))

    @jsii.member(jsii_name="toListTrafficPolicies")
    def to_list_traffic_policies(self) -> "Route53":
        '''(experimental) Grants permission to get information about the latest version for every traffic policy that is associated with the current AWS account.

        Policies are listed in the order in which they were created

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListTrafficPolicies.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListTrafficPolicies", []))

    @jsii.member(jsii_name="toListTrafficPolicyInstances")
    def to_list_traffic_policy_instances(self) -> "Route53":
        '''(experimental) Grants permission to get information about the traffic policy instances that you created by using the current AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListTrafficPolicyInstances.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListTrafficPolicyInstances", []))

    @jsii.member(jsii_name="toListTrafficPolicyInstancesByHostedZone")
    def to_list_traffic_policy_instances_by_hosted_zone(self) -> "Route53":
        '''(experimental) Grants permission to get information about the traffic policy instances that you created in a specified hosted zone.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListTrafficPolicyInstancesByHostedZone.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListTrafficPolicyInstancesByHostedZone", []))

    @jsii.member(jsii_name="toListTrafficPolicyInstancesByPolicy")
    def to_list_traffic_policy_instances_by_policy(self) -> "Route53":
        '''(experimental) Grants permission to get information about the traffic policy instances that you created using a specified traffic policy version.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListTrafficPolicyInstancesByPolicy.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListTrafficPolicyInstancesByPolicy", []))

    @jsii.member(jsii_name="toListTrafficPolicyVersions")
    def to_list_traffic_policy_versions(self) -> "Route53":
        '''(experimental) Grants permission to get information about all the versions for a specified traffic policy.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListTrafficPolicyVersions.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListTrafficPolicyVersions", []))

    @jsii.member(jsii_name="toListVPCAssociationAuthorizations")
    def to_list_vpc_association_authorizations(self) -> "Route53":
        '''(experimental) Grants permission to get a list of the VPCs that were created by other accounts and that can be associated with a specified hosted zone.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListVPCAssociationAuthorizations.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toListVPCAssociationAuthorizations", []))

    @jsii.member(jsii_name="toTestDNSAnswer")
    def to_test_dns_answer(self) -> "Route53":
        '''(experimental) Grants permission to get the value that Route 53 returns in response to a DNS query for a specified record name and type.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_TestDNSAnswer.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toTestDNSAnswer", []))

    @jsii.member(jsii_name="toUpdateHealthCheck")
    def to_update_health_check(self) -> "Route53":
        '''(experimental) Grants permission to update an existing health check.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_UpdateHealthCheck.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toUpdateHealthCheck", []))

    @jsii.member(jsii_name="toUpdateHostedZoneComment")
    def to_update_hosted_zone_comment(self) -> "Route53":
        '''(experimental) Grants permission to update the comment for a specified hosted zone.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_UpdateHostedZoneComment.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toUpdateHostedZoneComment", []))

    @jsii.member(jsii_name="toUpdateTrafficPolicyComment")
    def to_update_traffic_policy_comment(self) -> "Route53":
        '''(experimental) Grants permission to update the comment for a specified traffic policy version.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_UpdateTrafficPolicyComment.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toUpdateTrafficPolicyComment", []))

    @jsii.member(jsii_name="toUpdateTrafficPolicyInstance")
    def to_update_traffic_policy_instance(self) -> "Route53":
        '''(experimental) Grants permission to update the records in a specified hosted zone that were created based on the settings in a specified traffic policy version.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_UpdateTrafficPolicyInstance.html

        :stability: experimental
        '''
        return typing.cast("Route53", jsii.invoke(self, "toUpdateTrafficPolicyInstance", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__11975624c71cab6b0af1b4acc2b2e448bccb68514316a61b0f3fe7c703928cf6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3e7d79f2dd050a95a267ef2b5bb67aec53ec58942e61c9468280af94cfa4dd0f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Route53RecoveryCluster(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Route53RecoveryCluster",
):
    '''(experimental) Statement provider for service `route53-recovery-cluster <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53recoverycluster.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `route53-recovery-cluster <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53recoverycluster.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ade085c73bea1a55c14c6793fa1086fbf855a86dbd844dd539ed0c0790db6952)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAllowSafetyRulesOverrides")
    def if_allow_safety_rules_overrides(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Route53RecoveryCluster":
        '''(experimental) Override safety rules to allow routing control state updates.

        https://docs.aws.amazon.com/routing-control/latest/APIReference/API_UpdateRoutingControlState.html

        Applies to actions:

        - .toUpdateRoutingControlState()
        - .toUpdateRoutingControlStates()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__aebb2c35a638bdbbfa6a6da856faff7aae4be1375deb66b4c5ea9fae095bf1d6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Route53RecoveryCluster", jsii.invoke(self, "ifAllowSafetyRulesOverrides", [value]))

    @jsii.member(jsii_name="onRoutingcontrol")
    def on_routingcontrol(
        self,
        control_panel_id: builtins.str,
        routing_control_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53RecoveryCluster":
        '''(experimental) Adds a resource of type routingcontrol to the statement.

        https://docs.aws.amazon.com/recovery-cluster/latest/api/routingcontrol.html

        :param control_panel_id: - Identifier for the controlPanelId.
        :param routing_control_id: - Identifier for the routingControlId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a3cc8d7e16dbbf31cb51ad625beea3ee9dc3e13578cddadf4b6e479fcc9cff12)
            check_type(argname="argument control_panel_id", value=control_panel_id, expected_type=type_hints["control_panel_id"])
            check_type(argname="argument routing_control_id", value=routing_control_id, expected_type=type_hints["routing_control_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53RecoveryCluster", jsii.invoke(self, "onRoutingcontrol", [control_panel_id, routing_control_id, account, partition]))

    @jsii.member(jsii_name="toGetRoutingControlState")
    def to_get_routing_control_state(self) -> "Route53RecoveryCluster":
        '''(experimental) Grants permission to get a routing control state.

        Access Level: Read

        https://docs.aws.amazon.com/routing-control/latest/APIReference/API_GetRoutingControlState.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryCluster", jsii.invoke(self, "toGetRoutingControlState", []))

    @jsii.member(jsii_name="toListRoutingControls")
    def to_list_routing_controls(self) -> "Route53RecoveryCluster":
        '''(experimental) Grants permission to list routing controls.

        Access Level: Read

        https://docs.aws.amazon.com/routing-control/latest/APIReference/API_ListRoutingControls.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryCluster", jsii.invoke(self, "toListRoutingControls", []))

    @jsii.member(jsii_name="toUpdateRoutingControlState")
    def to_update_routing_control_state(self) -> "Route53RecoveryCluster":
        '''(experimental) Grants permission to update a routing control state.

        Access Level: Write

        Possible conditions:

        - .ifAllowSafetyRulesOverrides()

        https://docs.aws.amazon.com/routing-control/latest/APIReference/API_UpdateRoutingControlState.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryCluster", jsii.invoke(self, "toUpdateRoutingControlState", []))

    @jsii.member(jsii_name="toUpdateRoutingControlStates")
    def to_update_routing_control_states(self) -> "Route53RecoveryCluster":
        '''(experimental) Grants permission to update a batch of routing control states.

        Access Level: Write

        Possible conditions:

        - .ifAllowSafetyRulesOverrides()

        https://docs.aws.amazon.com/routing-control/latest/APIReference/API_UpdateRoutingControlStates.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryCluster", jsii.invoke(self, "toUpdateRoutingControlStates", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4719fa8ea3becd26b35fe8e5598bc373654ea7baaf5d20d3fdc7322936d165f8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ad3da3b2506b43128dcc5377b68df64f9e02bb658c6ef0d3943b33b0f01171ac)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Route53RecoveryControlConfig(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Route53RecoveryControlConfig",
):
    '''(experimental) Statement provider for service `route53-recovery-control-config <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53recoverycontrols.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `route53-recovery-control-config <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53recoverycontrols.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__31c51af1a6522c5b760c4dca26469ff15e03f99d55f52d7f15e3ab8a2798401e)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53RecoveryControlConfig":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/recovery-cluster/latest/api/cluster.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0e0c933c6485374ab644c021d9056ec19e9898f43e66e57842517c0bf760a7b5)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "onCluster", [resource_id, account, partition]))

    @jsii.member(jsii_name="onControlpanel")
    def on_controlpanel(
        self,
        control_panel_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53RecoveryControlConfig":
        '''(experimental) Adds a resource of type controlpanel to the statement.

        https://docs.aws.amazon.com/recovery-cluster/latest/api/controlpanel.html

        :param control_panel_id: - Identifier for the controlPanelId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__31cc026a3a1c0c0de8e331c9ca37660fd2cd451f41b9985b9b186320835df91c)
            check_type(argname="argument control_panel_id", value=control_panel_id, expected_type=type_hints["control_panel_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "onControlpanel", [control_panel_id, account, partition]))

    @jsii.member(jsii_name="onRoutingcontrol")
    def on_routingcontrol(
        self,
        control_panel_id: builtins.str,
        routing_control_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53RecoveryControlConfig":
        '''(experimental) Adds a resource of type routingcontrol to the statement.

        https://docs.aws.amazon.com/recovery-cluster/latest/api/routingcontrol.html

        :param control_panel_id: - Identifier for the controlPanelId.
        :param routing_control_id: - Identifier for the routingControlId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__863a4019fd44e3a387b5116d95a2a264ef50a1774d851eb4d4e416a99774a576)
            check_type(argname="argument control_panel_id", value=control_panel_id, expected_type=type_hints["control_panel_id"])
            check_type(argname="argument routing_control_id", value=routing_control_id, expected_type=type_hints["routing_control_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "onRoutingcontrol", [control_panel_id, routing_control_id, account, partition]))

    @jsii.member(jsii_name="onSafetyrule")
    def on_safetyrule(
        self,
        control_panel_id: builtins.str,
        safety_rule_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53RecoveryControlConfig":
        '''(experimental) Adds a resource of type safetyrule to the statement.

        https://docs.aws.amazon.com/recovery-cluster/latest/api/safetyrule.html

        :param control_panel_id: - Identifier for the controlPanelId.
        :param safety_rule_id: - Identifier for the safetyRuleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cbd670f56ec0cb250ac401f56009bf06c3e9326a374481c6a5e44024fa4d437d)
            check_type(argname="argument control_panel_id", value=control_panel_id, expected_type=type_hints["control_panel_id"])
            check_type(argname="argument safety_rule_id", value=safety_rule_id, expected_type=type_hints["safety_rule_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "onSafetyrule", [control_panel_id, safety_rule_id, account, partition]))

    @jsii.member(jsii_name="toCreateCluster")
    def to_create_cluster(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to create a cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/recovery-cluster/latest/api/cluster.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toCreateCluster", []))

    @jsii.member(jsii_name="toCreateControlPanel")
    def to_create_control_panel(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to create a control panel.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/recovery-cluster/latest/api/controlpanel.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toCreateControlPanel", []))

    @jsii.member(jsii_name="toCreateRoutingControl")
    def to_create_routing_control(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to create a routing control.

        Access Level: Write

        https://docs.aws.amazon.com/recovery-cluster/latest/api/routingcontrol.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toCreateRoutingControl", []))

    @jsii.member(jsii_name="toCreateSafetyRule")
    def to_create_safety_rule(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to create a safety rule.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/recovery-cluster/latest/api/safetyrule.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toCreateSafetyRule", []))

    @jsii.member(jsii_name="toDeleteCluster")
    def to_delete_cluster(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to delete a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/recovery-cluster/latest/api/cluster-clusterarn.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toDeleteCluster", []))

    @jsii.member(jsii_name="toDeleteControlPanel")
    def to_delete_control_panel(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to delete a control panel.

        Access Level: Write

        https://docs.aws.amazon.com/recovery-cluster/latest/api/controlpanel-controlpanelarn.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toDeleteControlPanel", []))

    @jsii.member(jsii_name="toDeleteRoutingControl")
    def to_delete_routing_control(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to delete a routing control.

        Access Level: Write

        https://docs.aws.amazon.com/recovery-cluster/latest/api/routingcontrol-routingcontrolarn.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toDeleteRoutingControl", []))

    @jsii.member(jsii_name="toDeleteSafetyRule")
    def to_delete_safety_rule(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to delete a safety rule.

        Access Level: Write

        https://docs.aws.amazon.com/recovery-cluster/latest/api/safetyrule-safetyrulearn.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toDeleteSafetyRule", []))

    @jsii.member(jsii_name="toDescribeCluster")
    def to_describe_cluster(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to describe a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-cluster/latest/api/cluster-clusterarn.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toDescribeCluster", []))

    @jsii.member(jsii_name="toDescribeControlPanel")
    def to_describe_control_panel(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to describe a control panel.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-cluster/latest/api/controlpanel-controlpanelarn.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toDescribeControlPanel", []))

    @jsii.member(jsii_name="toDescribeRoutingControl")
    def to_describe_routing_control(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to describe a routing control.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-cluster/latest/api/routingcontrol-routingcontrolarn.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toDescribeRoutingControl", []))

    @jsii.member(jsii_name="toDescribeRoutingControlByName")
    def to_describe_routing_control_by_name(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to describe a routing control.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-cluster/latest/api/routingcontrol-routingcontrolarn.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toDescribeRoutingControlByName", []))

    @jsii.member(jsii_name="toDescribeSafetyRule")
    def to_describe_safety_rule(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to describe a safety rule.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-cluster/latest/api/safetyrule-safetyrulearn.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toDescribeSafetyRule", []))

    @jsii.member(jsii_name="toListAssociatedRoute53HealthChecks")
    def to_list_associated_route53_health_checks(
        self,
    ) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to list associated Route 53 health checks.

        Access Level: List

        https://docs.aws.amazon.com/recovery-cluster/latest/api/routingcontrol-routingcontrolarn-associatedroute53healthchecks.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toListAssociatedRoute53HealthChecks", []))

    @jsii.member(jsii_name="toListClusters")
    def to_list_clusters(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to list clusters.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-cluster/latest/api/cluster.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toListClusters", []))

    @jsii.member(jsii_name="toListControlPanels")
    def to_list_control_panels(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to list control panels.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-cluster/latest/api/controlpanels.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toListControlPanels", []))

    @jsii.member(jsii_name="toListRoutingControls")
    def to_list_routing_controls(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to list routing controls.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-cluster/latest/api/controlpanel-controlpanelarn-routingcontrols.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toListRoutingControls", []))

    @jsii.member(jsii_name="toListSafetyRules")
    def to_list_safety_rules(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to list safety rules.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-cluster/latest/api/controlpanel-controlpanelarn-safetyrules.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toListSafetyRules", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-cluster/latest/api/tags-resource-arn.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/recovery-cluster/latest/api/tags-resource-arn.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/recovery-cluster/latest/api/tags-resource-arn.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateControlPanel")
    def to_update_control_panel(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to update a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/recovery-cluster/latest/api/controlpanel.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toUpdateControlPanel", []))

    @jsii.member(jsii_name="toUpdateRoutingControl")
    def to_update_routing_control(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to update a routing control.

        Access Level: Write

        https://docs.aws.amazon.com/recovery-cluster/latest/api/controlpanel-controlpanelarn-routingcontrols.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toUpdateRoutingControl", []))

    @jsii.member(jsii_name="toUpdateSafetyRule")
    def to_update_safety_rule(self) -> "Route53RecoveryControlConfig":
        '''(experimental) Grants permission to update a safety rule.

        Access Level: Write

        https://docs.aws.amazon.com/recovery-cluster/latest/api/safetyrule.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryControlConfig", jsii.invoke(self, "toUpdateSafetyRule", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f7595dd039899900ab3356754f599a6d8dd94d7c28b948c0675cd3197d36af23)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ab78dc9f8312f1a0fd9dfaf72c78d15b4d679dba77e1ab85128c96172d0b4eb8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Route53RecoveryReadiness(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Route53RecoveryReadiness",
):
    '''(experimental) Statement provider for service `route53-recovery-readiness <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53recoveryreadiness.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `route53-recovery-readiness <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53recoveryreadiness.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__71c7088e13648f6927e4f943bff7c727d2a7facae25c6030c8229a081619422c)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onCell")
    def on_cell(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53RecoveryReadiness":
        '''(experimental) Adds a resource of type cell to the statement.

        https://docs.aws.amazon.com/r53recovery/latest/dg/recovery-readiness.recovery-groups.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__740603af3cef1fd9bcaf8761d53bbc11aa653e15e4d9447c56fce37d6f4a2fa9)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "onCell", [resource_id, account, partition]))

    @jsii.member(jsii_name="onReadinesscheck")
    def on_readinesscheck(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53RecoveryReadiness":
        '''(experimental) Adds a resource of type readinesscheck to the statement.

        https://docs.aws.amazon.com/r53recovery/latest/dg/recovery-readiness.readiness-checks.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__24e5a73456f4cc6011ac5ec6e89ebf8e1031974da583d61d77ac499da1b9051e)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "onReadinesscheck", [resource_id, account, partition]))

    @jsii.member(jsii_name="onRecoverygroup")
    def on_recoverygroup(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53RecoveryReadiness":
        '''(experimental) Adds a resource of type recoverygroup to the statement.

        https://docs.aws.amazon.com/r53recovery/latest/dg/recovery-readiness.recovery-groups.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__56924c51ef7278b8723016e2aa5284941727ac9b399e0bce65064b755ee5cff8)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "onRecoverygroup", [resource_id, account, partition]))

    @jsii.member(jsii_name="onResourceset")
    def on_resourceset(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53RecoveryReadiness":
        '''(experimental) Adds a resource of type resourceset to the statement.

        https://docs.aws.amazon.com/r53recovery/latest/dg/recovery-readiness.readiness-checks.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a26aa844136b5f4a9c9a02228eed3a623d3d4b025d2aa3ef30abb536e99727f9)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "onResourceset", [resource_id, account, partition]))

    @jsii.member(jsii_name="toCreateCell")
    def to_create_cell(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to create a new cell.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/recovery-readiness/latest/api/cells.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toCreateCell", []))

    @jsii.member(jsii_name="toCreateCrossAccountAuthorization")
    def to_create_cross_account_authorization(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to create a cross account authorization.

        Access Level: Write

        https://docs.aws.amazon.com/recovery-readiness/latest/api/crossaccountauthorizations.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toCreateCrossAccountAuthorization", []))

    @jsii.member(jsii_name="toCreateReadinessCheck")
    def to_create_readiness_check(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to create a readiness check.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/recovery-readiness/latest/api/readinesschecks.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toCreateReadinessCheck", []))

    @jsii.member(jsii_name="toCreateRecoveryGroup")
    def to_create_recovery_group(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to create a recovery group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/recovery-readiness/latest/api/recoverygroups.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toCreateRecoveryGroup", []))

    @jsii.member(jsii_name="toCreateResourceSet")
    def to_create_resource_set(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to create a resource set.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/recovery-readiness/latest/api/resourcesets.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toCreateResourceSet", []))

    @jsii.member(jsii_name="toDeleteCell")
    def to_delete_cell(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to delete a cell.

        Access Level: Write

        https://docs.aws.amazon.com/recovery-readiness/latest/api/cells-cellname.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toDeleteCell", []))

    @jsii.member(jsii_name="toDeleteCrossAccountAuthorization")
    def to_delete_cross_account_authorization(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to delete a cross account authorization.

        Access Level: Write

        https://docs.aws.amazon.com/recovery-readiness/latest/api/crossaccountauthorizations-crossaccountauthorization.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toDeleteCrossAccountAuthorization", []))

    @jsii.member(jsii_name="toDeleteReadinessCheck")
    def to_delete_readiness_check(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to delete a readiness check.

        Access Level: Write

        https://docs.aws.amazon.com/recovery-readiness/latest/api/readinesschecks-readinesscheckname.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toDeleteReadinessCheck", []))

    @jsii.member(jsii_name="toDeleteRecoveryGroup")
    def to_delete_recovery_group(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to delete a recovery group.

        Access Level: Write

        https://docs.aws.amazon.com/recovery-readiness/latest/api/recoverygroups-recoverygroupname.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toDeleteRecoveryGroup", []))

    @jsii.member(jsii_name="toDeleteResourceSet")
    def to_delete_resource_set(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to delete a resource set.

        Access Level: Write

        https://docs.aws.amazon.com/recovery-readiness/latest/api/resourcesets-resourcesetname.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toDeleteResourceSet", []))

    @jsii.member(jsii_name="toGetArchitectureRecommendations")
    def to_get_architecture_recommendations(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to get architecture recommendations for a recovery group.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-readiness/latest/api/recoverygroups-recoverygroupname-architecturerecommendations.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toGetArchitectureRecommendations", []))

    @jsii.member(jsii_name="toGetCell")
    def to_get_cell(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to get information about a cell.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-readiness/latest/api/cells-cellname.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toGetCell", []))

    @jsii.member(jsii_name="toGetCellReadinessSummary")
    def to_get_cell_readiness_summary(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to get a readiness summary for a cell.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-readiness/latest/api/cellreadiness-cellname.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toGetCellReadinessSummary", []))

    @jsii.member(jsii_name="toGetReadinessCheck")
    def to_get_readiness_check(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to get information about a readiness check.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-readiness/latest/api/readinesschecks-readinesscheckname.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toGetReadinessCheck", []))

    @jsii.member(jsii_name="toGetReadinessCheckResourceStatus")
    def to_get_readiness_check_resource_status(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to get the readiness status for an individual resource.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-readiness/latest/api/readinesschecks-readinesscheckname-resource-resourceidentifier-status.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toGetReadinessCheckResourceStatus", []))

    @jsii.member(jsii_name="toGetReadinessCheckStatus")
    def to_get_readiness_check_status(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to get the status of a readiness check (for a resource set).

        Access Level: Read

        https://docs.aws.amazon.com/recovery-readiness/latest/api/readinesschecks-readinesscheckname-status.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toGetReadinessCheckStatus", []))

    @jsii.member(jsii_name="toGetRecoveryGroup")
    def to_get_recovery_group(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to get information about a recovery group.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-readiness/latest/api/recoverygroups-recoverygroupname.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toGetRecoveryGroup", []))

    @jsii.member(jsii_name="toGetRecoveryGroupReadinessSummary")
    def to_get_recovery_group_readiness_summary(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to get a readiness summary for a recovery group.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-readiness/latest/api/recoverygroupreadiness-recoverygroupname.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toGetRecoveryGroupReadinessSummary", []))

    @jsii.member(jsii_name="toGetResourceSet")
    def to_get_resource_set(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to get information about a resource set.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-readiness/latest/api/resourcesets-resourcesetname.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toGetResourceSet", []))

    @jsii.member(jsii_name="toListCells")
    def to_list_cells(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to list cells.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-readiness/latest/api/cells.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toListCells", []))

    @jsii.member(jsii_name="toListCrossAccountAuthorizations")
    def to_list_cross_account_authorizations(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to list cross account authorizations.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-readiness/latest/api/crossaccountauthorizations.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toListCrossAccountAuthorizations", []))

    @jsii.member(jsii_name="toListReadinessChecks")
    def to_list_readiness_checks(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to list readiness checks.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-readiness/latest/api/readinesschecks.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toListReadinessChecks", []))

    @jsii.member(jsii_name="toListRecoveryGroups")
    def to_list_recovery_groups(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to list recovery groups.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-readiness/latest/api/recoverygroups.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toListRecoveryGroups", []))

    @jsii.member(jsii_name="toListResourceSets")
    def to_list_resource_sets(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to list resource sets.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-readiness/latest/api/resourcesets.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toListResourceSets", []))

    @jsii.member(jsii_name="toListRules")
    def to_list_rules(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to list readiness rules.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-readiness/latest/api/rules.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toListRules", []))

    @jsii.member(jsii_name="toListTagsForResources")
    def to_list_tags_for_resources(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/recovery-readiness/latest/api/tags-resource-arn.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toListTagsForResources", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to add a tag to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/recovery-readiness/latest/api/tags-resource-arn.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to remove a tag from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/recovery-readiness/latest/api/tags-resource-arn.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateCell")
    def to_update_cell(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to update a cell.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/recovery-readiness/latest/api/cells-cellname.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toUpdateCell", []))

    @jsii.member(jsii_name="toUpdateReadinessCheck")
    def to_update_readiness_check(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to update a readiness check.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/recovery-readiness/latest/api/readinesschecks-readinesscheckname.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toUpdateReadinessCheck", []))

    @jsii.member(jsii_name="toUpdateRecoveryGroup")
    def to_update_recovery_group(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to update a recovery group.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/recovery-readiness/latest/api/recoverygroups-recoverygroupname.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toUpdateRecoveryGroup", []))

    @jsii.member(jsii_name="toUpdateResourceSet")
    def to_update_resource_set(self) -> "Route53RecoveryReadiness":
        '''(experimental) Grants permission to update a resource set.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/recovery-readiness/latest/api/resourcesets-resourcesetname.html

        :stability: experimental
        '''
        return typing.cast("Route53RecoveryReadiness", jsii.invoke(self, "toUpdateResourceSet", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__210364fd0a3ebd8664425162c5a82269f1c4c3aa795b8e7765a128133a001fc0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3558e7176c2bc32d8e9ab5b3584519326f2a2232a126691223217677650e27d9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Route53domains(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Route53domains",
):
    '''(experimental) Statement provider for service `route53domains <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53domains.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `route53domains <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53domains.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9e4dd0b23c7c5fc89bbd8c7388c1ada2e0df6417c196d8fcff9fe1aa75404738)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toAcceptDomainTransferFromAnotherAwsAccount")
    def to_accept_domain_transfer_from_another_aws_account(self) -> "Route53domains":
        '''(experimental) Grants permission to accept the transfer of a domain from another AWS account to the current AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_AcceptDomainTransferFromAnotherAwsAccount.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toAcceptDomainTransferFromAnotherAwsAccount", []))

    @jsii.member(jsii_name="toAssociateDelegationSignerToDomain")
    def to_associate_delegation_signer_to_domain(self) -> "Route53domains":
        '''(experimental) Grants permission to associate a new delegation signer to a domain.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_AssociateDelegationSignerToDomain.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toAssociateDelegationSignerToDomain", []))

    @jsii.member(jsii_name="toCancelDomainTransferToAnotherAwsAccount")
    def to_cancel_domain_transfer_to_another_aws_account(self) -> "Route53domains":
        '''(experimental) Grants permission to cancel the transfer of a domain from the current AWS account to another AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_CancelDomainTransferToAnotherAwsAccount.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toCancelDomainTransferToAnotherAwsAccount", []))

    @jsii.member(jsii_name="toCheckDomainAvailability")
    def to_check_domain_availability(self) -> "Route53domains":
        '''(experimental) Grants permission to check the availability of one domain name.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_CheckDomainAvailability.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toCheckDomainAvailability", []))

    @jsii.member(jsii_name="toCheckDomainTransferability")
    def to_check_domain_transferability(self) -> "Route53domains":
        '''(experimental) Grants permission to check whether a domain name can be transferred to Amazon Route 53.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_CheckDomainTransferability.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toCheckDomainTransferability", []))

    @jsii.member(jsii_name="toDeleteDomain")
    def to_delete_domain(self) -> "Route53domains":
        '''(experimental) Grants permission to delete domains.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DeleteDomain.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toDeleteDomain", []))

    @jsii.member(jsii_name="toDeleteTagsForDomain")
    def to_delete_tags_for_domain(self) -> "Route53domains":
        '''(experimental) Grants permission to delete the specified tags for a domain.

        Access Level: Tagging

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DeleteTagsForDomain.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toDeleteTagsForDomain", []))

    @jsii.member(jsii_name="toDisableDomainAutoRenew")
    def to_disable_domain_auto_renew(self) -> "Route53domains":
        '''(experimental) Grants permission to configure Amazon Route 53 to automatically renew the specified domain before the domain registration expires.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DisableDomainAutoRenew.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toDisableDomainAutoRenew", []))

    @jsii.member(jsii_name="toDisableDomainTransferLock")
    def to_disable_domain_transfer_lock(self) -> "Route53domains":
        '''(experimental) Grants permission to remove the transfer lock on the domain (specifically the clientTransferProhibited status) to allow domain transfers.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DisableDomainTransferLock.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toDisableDomainTransferLock", []))

    @jsii.member(jsii_name="toDisassociateDelegationSignerFromDomain")
    def to_disassociate_delegation_signer_from_domain(self) -> "Route53domains":
        '''(experimental) Grants permission to disassociate an existing delegation signer from a domain.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DisassociateDelegationSignerFromDomain.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toDisassociateDelegationSignerFromDomain", []))

    @jsii.member(jsii_name="toEnableDomainAutoRenew")
    def to_enable_domain_auto_renew(self) -> "Route53domains":
        '''(experimental) Grants permission to configure Amazon Route 53 to automatically renew the specified domain before the domain registration expires.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DisableDomainAutoRenew.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toEnableDomainAutoRenew", []))

    @jsii.member(jsii_name="toEnableDomainTransferLock")
    def to_enable_domain_transfer_lock(self) -> "Route53domains":
        '''(experimental) Grants permission to set the transfer lock on the domain (specifically the clientTransferProhibited status) to prevent domain transfers.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_EnableDomainTransferLock.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toEnableDomainTransferLock", []))

    @jsii.member(jsii_name="toGetContactReachabilityStatus")
    def to_get_contact_reachability_status(self) -> "Route53domains":
        '''(experimental) Grants permission to get information about whether the registrant contact has responded for operations that require confirmation that the email address for the registrant contact is valid, such as registering a new domain.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_GetContactReachabilityStatus.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toGetContactReachabilityStatus", []))

    @jsii.member(jsii_name="toGetDomainDetail")
    def to_get_domain_detail(self) -> "Route53domains":
        '''(experimental) Grants permission to get detailed information about a domain.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_GetDomainDetail.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toGetDomainDetail", []))

    @jsii.member(jsii_name="toGetDomainSuggestions")
    def to_get_domain_suggestions(self) -> "Route53domains":
        '''(experimental) Grants permission to get a list of suggested domain names given a string, which can either be a domain name or simply a word or phrase (without spaces).

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_GetDomainSuggestions.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toGetDomainSuggestions", []))

    @jsii.member(jsii_name="toGetOperationDetail")
    def to_get_operation_detail(self) -> "Route53domains":
        '''(experimental) Grants permission to get the current status of an operation that is not completed.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_GetOperationDetail.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toGetOperationDetail", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Route53domains":
        '''(experimental) Grants permission to list all the domain names registered with Amazon Route 53 for the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_ListDomains.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toListOperations")
    def to_list_operations(self) -> "Route53domains":
        '''(experimental) Grants permission to list the operation IDs of operations that are not yet complete.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_ListOperations.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toListOperations", []))

    @jsii.member(jsii_name="toListPrices")
    def to_list_prices(self) -> "Route53domains":
        '''(experimental) Grants permission to list the prices of operations for TLDs.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_ListPrices.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toListPrices", []))

    @jsii.member(jsii_name="toListTagsForDomain")
    def to_list_tags_for_domain(self) -> "Route53domains":
        '''(experimental) Grants permission to list all the tags that are associated with the specified domain.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_ListTagsForDomain.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toListTagsForDomain", []))

    @jsii.member(jsii_name="toPushDomain")
    def to_push_domain(self) -> "Route53domains":
        '''(experimental) Grants permission to change the IPS tag of .uk domain to initiate a transfer process from Route 53 to another registrar.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_PushDomain.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toPushDomain", []))

    @jsii.member(jsii_name="toRegisterDomain")
    def to_register_domain(self) -> "Route53domains":
        '''(experimental) Grants permission to register domains.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_RegisterDomain.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toRegisterDomain", []))

    @jsii.member(jsii_name="toRejectDomainTransferFromAnotherAwsAccount")
    def to_reject_domain_transfer_from_another_aws_account(self) -> "Route53domains":
        '''(experimental) Grants permission to reject the transfer of a domain from another AWS account to the current AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_RejectDomainTransferFromAnotherAwsAccount.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toRejectDomainTransferFromAnotherAwsAccount", []))

    @jsii.member(jsii_name="toRenewDomain")
    def to_renew_domain(self) -> "Route53domains":
        '''(experimental) Grants permission to renew domains for the specified number of years.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_RenewDomain.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toRenewDomain", []))

    @jsii.member(jsii_name="toResendContactReachabilityEmail")
    def to_resend_contact_reachability_email(self) -> "Route53domains":
        '''(experimental) Grants permission to resend the confirmation email to the current email address for the registrant contact for operations that require confirmation that the email address for the registrant contact is valid, such as registering a new domain.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_ResendContactReachabilityEmail.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toResendContactReachabilityEmail", []))

    @jsii.member(jsii_name="toResendOperationAuthorization")
    def to_resend_operation_authorization(self) -> "Route53domains":
        '''(experimental) Grants permission to resend the operation authorization.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_ResendOperationAuthorization.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toResendOperationAuthorization", []))

    @jsii.member(jsii_name="toRetrieveDomainAuthCode")
    def to_retrieve_domain_auth_code(self) -> "Route53domains":
        '''(experimental) Grants permission to get the AuthCode for the domain.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_RetrieveDomainAuthCode.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toRetrieveDomainAuthCode", []))

    @jsii.member(jsii_name="toTransferDomain")
    def to_transfer_domain(self) -> "Route53domains":
        '''(experimental) Grants permission to transfer a domain from another registrar to Amazon Route 53.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_TransferDomain.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toTransferDomain", []))

    @jsii.member(jsii_name="toTransferDomainToAnotherAwsAccount")
    def to_transfer_domain_to_another_aws_account(self) -> "Route53domains":
        '''(experimental) Grants permission to transfer a domain from the current AWS account to another AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_TransferDomainToAnotherAwsAccount.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toTransferDomainToAnotherAwsAccount", []))

    @jsii.member(jsii_name="toUpdateDomainContact")
    def to_update_domain_contact(self) -> "Route53domains":
        '''(experimental) Grants permission to update the contact information for domain.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_UpdateDomainContact.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toUpdateDomainContact", []))

    @jsii.member(jsii_name="toUpdateDomainContactPrivacy")
    def to_update_domain_contact_privacy(self) -> "Route53domains":
        '''(experimental) Grants permission to update the domain contact privacy setting.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_UpdateDomainContactPrivacy.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toUpdateDomainContactPrivacy", []))

    @jsii.member(jsii_name="toUpdateDomainNameservers")
    def to_update_domain_nameservers(self) -> "Route53domains":
        '''(experimental) Grants permission to replace the current set of name servers for a domain with the specified set of name servers.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_UpdateDomainNameservers.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toUpdateDomainNameservers", []))

    @jsii.member(jsii_name="toUpdateTagsForDomain")
    def to_update_tags_for_domain(self) -> "Route53domains":
        '''(experimental) Grants permission to add or update tags for a specified domain.

        Access Level: Tagging

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_UpdateTagsForDomain.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toUpdateTagsForDomain", []))

    @jsii.member(jsii_name="toViewBilling")
    def to_view_billing(self) -> "Route53domains":
        '''(experimental) Grants permission to get all the domain-related billing records for the current AWS account for a specified period.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_ViewBilling.html

        :stability: experimental
        '''
        return typing.cast("Route53domains", jsii.invoke(self, "toViewBilling", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__862f5bb22a3e0d1072fe42ccb1ae7313f93f93e83ac69ea7a3da619222b88c2b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__53ace9245e9cc4add7ec6e1979df61134d452f22e27f97c89b542366a9c9a8f6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Route53resolver(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Route53resolver",
):
    '''(experimental) Statement provider for service `route53resolver <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53resolver.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `route53resolver <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53resolver.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__85c35f23ccb5cc0dace8f631b89f96a648ad34f6f134df45e6184565d648d8c0)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onFirewallConfig")
    def on_firewall_config(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53resolver":
        '''(experimental) Adds a resource of type firewall-config to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-overview.html#access-control-resources

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ed811994eeb26a74f1c85e52b5654f7af933d904f96cf6c6684ad2e2656de5a3)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53resolver", jsii.invoke(self, "onFirewallConfig", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onFirewallDomainList")
    def on_firewall_domain_list(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53resolver":
        '''(experimental) Adds a resource of type firewall-domain-list to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-overview.html#access-control-resources

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__14bcf63b7497aecadb782a2376a201f60b5261ebe3202acde391f561692d5697)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53resolver", jsii.invoke(self, "onFirewallDomainList", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onFirewallRuleGroup")
    def on_firewall_rule_group(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53resolver":
        '''(experimental) Adds a resource of type firewall-rule-group to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-overview.html#access-control-resources

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8d286a89cc561d97948b366615bbaacc58a3b332a1e6c7fc00d2e60afa2111b3)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53resolver", jsii.invoke(self, "onFirewallRuleGroup", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onFirewallRuleGroupAssociation")
    def on_firewall_rule_group_association(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53resolver":
        '''(experimental) Adds a resource of type firewall-rule-group-association to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-overview.html#access-control-resources

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9c07c612f67989901555f40d4506a88a83b9baa48b6c84200979c5eabef96ed0)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53resolver", jsii.invoke(self, "onFirewallRuleGroupAssociation", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onResolverConfig")
    def on_resolver_config(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53resolver":
        '''(experimental) Adds a resource of type resolver-config to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-overview.html#access-control-resources

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c4a1cb46c571680d3ad560c184c905a63ccfefcedeaf1fd3555cc6f15f254029)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53resolver", jsii.invoke(self, "onResolverConfig", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onResolverDnssecConfig")
    def on_resolver_dnssec_config(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53resolver":
        '''(experimental) Adds a resource of type resolver-dnssec-config to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-overview.html#access-control-resources

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8944dc19d25026ebce6e5d94d7328d55bede8c1e11a6b05470f17956db4f3d2d)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53resolver", jsii.invoke(self, "onResolverDnssecConfig", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onResolverEndpoint")
    def on_resolver_endpoint(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53resolver":
        '''(experimental) Adds a resource of type resolver-endpoint to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-overview.html#access-control-resources

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6181c53b23f5277fe52ef81d9806cb23e8f16272444a10bcf8a6a0258c20a0c7)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53resolver", jsii.invoke(self, "onResolverEndpoint", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onResolverQueryLogConfig")
    def on_resolver_query_log_config(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53resolver":
        '''(experimental) Adds a resource of type resolver-query-log-config to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-overview.html#access-control-resources

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fe651e15a6f7a0517f19478fff426d28b4e19b0984f8e9826cfc69af6e709dcc)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53resolver", jsii.invoke(self, "onResolverQueryLogConfig", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onResolverRule")
    def on_resolver_rule(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Route53resolver":
        '''(experimental) Adds a resource of type resolver-rule to the statement.

        https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/access-control-overview.html#access-control-resources

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a3a0f3d061d3383dcac03120be65166fab67b32458c50b99bde90032b015b592)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Route53resolver", jsii.invoke(self, "onResolverRule", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateFirewallRuleGroup")
    def to_associate_firewall_rule_group(self) -> "Route53resolver":
        '''(experimental) Grants permission to associate an Amazon VPC with a specified firewall rule group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_AssociateFirewallRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toAssociateFirewallRuleGroup", []))

    @jsii.member(jsii_name="toAssociateResolverEndpointIpAddress")
    def to_associate_resolver_endpoint_ip_address(self) -> "Route53resolver":
        '''(experimental) Grants permission to associate a specified IP address with a Resolver endpoint.

        This is an IP address that DNS queries pass through on the way to your network (outbound) or your VPCs (inbound)

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_AssociateResolverEndpointIpAddress.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toAssociateResolverEndpointIpAddress", []))

    @jsii.member(jsii_name="toAssociateResolverQueryLogConfig")
    def to_associate_resolver_query_log_config(self) -> "Route53resolver":
        '''(experimental) Grants permission to associate an Amazon VPC with a specified query logging configuration.

        Access Level: Write

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_AssociateResolverQueryLogConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toAssociateResolverQueryLogConfig", []))

    @jsii.member(jsii_name="toAssociateResolverRule")
    def to_associate_resolver_rule(self) -> "Route53resolver":
        '''(experimental) Grants permission to associate a specified Resolver rule with a specified VPC.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_AssociateResolverRule.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toAssociateResolverRule", []))

    @jsii.member(jsii_name="toCreateFirewallDomainList")
    def to_create_firewall_domain_list(self) -> "Route53resolver":
        '''(experimental) Grants permission to create a Firewall domain list.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_CreateFirewallDomainList.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toCreateFirewallDomainList", []))

    @jsii.member(jsii_name="toCreateFirewallRule")
    def to_create_firewall_rule(self) -> "Route53resolver":
        '''(experimental) Grants permission to create a Firewall rule within a Firewall rule group.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_CreateFirewallRule.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toCreateFirewallRule", []))

    @jsii.member(jsii_name="toCreateFirewallRuleGroup")
    def to_create_firewall_rule_group(self) -> "Route53resolver":
        '''(experimental) Grants permission to create a Firewall rule group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_CreateFirewallRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toCreateFirewallRuleGroup", []))

    @jsii.member(jsii_name="toCreateResolverEndpoint")
    def to_create_resolver_endpoint(self) -> "Route53resolver":
        '''(experimental) Grants permission to create a Resolver endpoint. There are two types of Resolver endpoints, inbound and outbound.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_CreateResolverEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toCreateResolverEndpoint", []))

    @jsii.member(jsii_name="toCreateResolverQueryLogConfig")
    def to_create_resolver_query_log_config(self) -> "Route53resolver":
        '''(experimental) Grants permission to create a Resolver query logging configuration, which defines where you want Resolver to save DNS query logs that originate in your VPCs.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_CreateResolverQueryLogConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toCreateResolverQueryLogConfig", []))

    @jsii.member(jsii_name="toCreateResolverRule")
    def to_create_resolver_rule(self) -> "Route53resolver":
        '''(experimental) Grants permission to define how to route queries originating from your VPC out of the VPC.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_CreateResolverRule.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toCreateResolverRule", []))

    @jsii.member(jsii_name="toDeleteFirewallDomainList")
    def to_delete_firewall_domain_list(self) -> "Route53resolver":
        '''(experimental) Grants permission to delete a Firewall domain list.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DeleteFirewallDomainList.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toDeleteFirewallDomainList", []))

    @jsii.member(jsii_name="toDeleteFirewallRule")
    def to_delete_firewall_rule(self) -> "Route53resolver":
        '''(experimental) Grants permission to delete a Firewall rule within a Firewall rule group.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DeleteFirewallRule.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toDeleteFirewallRule", []))

    @jsii.member(jsii_name="toDeleteFirewallRuleGroup")
    def to_delete_firewall_rule_group(self) -> "Route53resolver":
        '''(experimental) Grants permission to delete a Firewall rule group.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DeleteFirewallRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toDeleteFirewallRuleGroup", []))

    @jsii.member(jsii_name="toDeleteResolverEndpoint")
    def to_delete_resolver_endpoint(self) -> "Route53resolver":
        '''(experimental) Grants permission to delete a Resolver endpoint.

        The effect of deleting a Resolver endpoint depends on whether it's an inbound or an outbound endpoint

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DeleteResolverEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toDeleteResolverEndpoint", []))

    @jsii.member(jsii_name="toDeleteResolverQueryLogConfig")
    def to_delete_resolver_query_log_config(self) -> "Route53resolver":
        '''(experimental) Grants permission to delete a Resolver query logging configuration.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DeleteResolverQueryLogConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toDeleteResolverQueryLogConfig", []))

    @jsii.member(jsii_name="toDeleteResolverRule")
    def to_delete_resolver_rule(self) -> "Route53resolver":
        '''(experimental) Grants permission to delete a Resolver rule.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DeleteResolverRule.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toDeleteResolverRule", []))

    @jsii.member(jsii_name="toDisassociateFirewallRuleGroup")
    def to_disassociate_firewall_rule_group(self) -> "Route53resolver":
        '''(experimental) Grants permission to remove the association between a specified Firewall rule group and a specified VPC.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DisassociateFirewallRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toDisassociateFirewallRuleGroup", []))

    @jsii.member(jsii_name="toDisassociateResolverEndpointIpAddress")
    def to_disassociate_resolver_endpoint_ip_address(self) -> "Route53resolver":
        '''(experimental) Grants permission to remove a specified IP address from a Resolver endpoint.

        This is an IP address that DNS queries pass through on the way to your network (outbound) or your VPCs (inbound)

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DisassociateResolverEndpointIpAddress.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toDisassociateResolverEndpointIpAddress", []))

    @jsii.member(jsii_name="toDisassociateResolverQueryLogConfig")
    def to_disassociate_resolver_query_log_config(self) -> "Route53resolver":
        '''(experimental) Grants permission to remove the association between a specified Resolver query logging configuration and a specified VPC.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DisassociateResolverQueryLogConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toDisassociateResolverQueryLogConfig", []))

    @jsii.member(jsii_name="toDisassociateResolverRule")
    def to_disassociate_resolver_rule(self) -> "Route53resolver":
        '''(experimental) Grants permission to remove the association between a specified Resolver rule and a specified VPC.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_DisassociateResolverRule.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toDisassociateResolverRule", []))

    @jsii.member(jsii_name="toGetFirewallConfig")
    def to_get_firewall_config(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about a specified Firewall config.

        Access Level: Read

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetFirewallConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetFirewallConfig", []))

    @jsii.member(jsii_name="toGetFirewallDomainList")
    def to_get_firewall_domain_list(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about a specified Firewall domain list.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetFirewallDomainList.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetFirewallDomainList", []))

    @jsii.member(jsii_name="toGetFirewallRuleGroup")
    def to_get_firewall_rule_group(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about a specified Firewall rule group.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetFirewallRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetFirewallRuleGroup", []))

    @jsii.member(jsii_name="toGetFirewallRuleGroupAssociation")
    def to_get_firewall_rule_group_association(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about an association between a specified Firewall rule group and a VPC.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetFirewallRuleGroupAssociation.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetFirewallRuleGroupAssociation", []))

    @jsii.member(jsii_name="toGetFirewallRuleGroupPolicy")
    def to_get_firewall_rule_group_policy(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about a specified Firewall rule group policy, which specifies the Firewall rule group operations and resources that you want to allow another AWS account to use.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetFirewallRuleGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetFirewallRuleGroupPolicy", []))

    @jsii.member(jsii_name="toGetResolverConfig")
    def to_get_resolver_config(self) -> "Route53resolver":
        '''(experimental) Grants permission to get the Resolver Config status within the specified resource.

        Access Level: Read

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetResolverConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetResolverConfig", []))

    @jsii.member(jsii_name="toGetResolverDnssecConfig")
    def to_get_resolver_dnssec_config(self) -> "Route53resolver":
        '''(experimental) Grants permission to get the DNSSEC validation support status for DNS queries within the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetResolverDnssecConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetResolverDnssecConfig", []))

    @jsii.member(jsii_name="toGetResolverEndpoint")
    def to_get_resolver_endpoint(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about a specified Resolver endpoint, such as whether it's an inbound or an outbound endpoint, and the IP addresses in your VPC that DNS queries are forwarded to on the way into or out of your VPC.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetResolverEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetResolverEndpoint", []))

    @jsii.member(jsii_name="toGetResolverQueryLogConfig")
    def to_get_resolver_query_log_config(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about a specified Resolver query logging configuration, such as the number of VPCs that the configuration is logging queries for and the location that logs are sent to.

        Access Level: Read

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetResolverQueryLogConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetResolverQueryLogConfig", []))

    @jsii.member(jsii_name="toGetResolverQueryLogConfigAssociation")
    def to_get_resolver_query_log_config_association(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about a specified association between a Resolver query logging configuration and an Amazon VPC.

        When you associate a VPC with a query logging configuration, Resolver logs DNS queries that originate in that VPC

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetResolverQueryLogConfigAssociation.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetResolverQueryLogConfigAssociation", []))

    @jsii.member(jsii_name="toGetResolverQueryLogConfigPolicy")
    def to_get_resolver_query_log_config_policy(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about a specified Resolver query logging policy, which specifies the Resolver query logging operations and resources that you want to allow another AWS account to use.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetResolverQueryLogConfigPolicy.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetResolverQueryLogConfigPolicy", []))

    @jsii.member(jsii_name="toGetResolverRule")
    def to_get_resolver_rule(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about a specified Resolver rule, such as the domain name that the rule forwards DNS queries for and the IP address that queries are forwarded to.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetResolverRule.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetResolverRule", []))

    @jsii.member(jsii_name="toGetResolverRuleAssociation")
    def to_get_resolver_rule_association(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about an association between a specified Resolver rule and a VPC.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetResolverRuleAssociation.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetResolverRuleAssociation", []))

    @jsii.member(jsii_name="toGetResolverRulePolicy")
    def to_get_resolver_rule_policy(self) -> "Route53resolver":
        '''(experimental) Grants permission to get information about a Resolver rule policy, which specifies the Resolver operations and resources that you want to allow another AWS account to use.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_GetResolverRulePolicy.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toGetResolverRulePolicy", []))

    @jsii.member(jsii_name="toImportFirewallDomains")
    def to_import_firewall_domains(self) -> "Route53resolver":
        '''(experimental) Grants permission to add, remove or replace Firewall domains in a Firewall domain list.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ImportFirewallDomains.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toImportFirewallDomains", []))

    @jsii.member(jsii_name="toListFirewallConfigs")
    def to_list_firewall_configs(self) -> "Route53resolver":
        '''(experimental) Grants permission to list all the Firewall config that current AWS account is able to check.

        Access Level: List

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListFirewallConfigs.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListFirewallConfigs", []))

    @jsii.member(jsii_name="toListFirewallDomainLists")
    def to_list_firewall_domain_lists(self) -> "Route53resolver":
        '''(experimental) Grants permission to list all the Firewall domain list that current AWS account is able to use.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListFirewallDomainLists.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListFirewallDomainLists", []))

    @jsii.member(jsii_name="toListFirewallDomains")
    def to_list_firewall_domains(self) -> "Route53resolver":
        '''(experimental) Grants permission to list all the Firewall domain under a speicfied Firewall domain list.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListFirewallDomains.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListFirewallDomains", []))

    @jsii.member(jsii_name="toListFirewallRuleGroupAssociations")
    def to_list_firewall_rule_group_associations(self) -> "Route53resolver":
        '''(experimental) Grants permission to list information about associations between Amazon VPCs and Firewall rule group.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListFirewallRuleGroupAssociations.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListFirewallRuleGroupAssociations", []))

    @jsii.member(jsii_name="toListFirewallRuleGroups")
    def to_list_firewall_rule_groups(self) -> "Route53resolver":
        '''(experimental) Grants permission to list all the Firewall rule group that current AWS account is able to use.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListFirewallRuleGroups.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListFirewallRuleGroups", []))

    @jsii.member(jsii_name="toListFirewallRules")
    def to_list_firewall_rules(self) -> "Route53resolver":
        '''(experimental) Grants permission to list all the Firewall rule under a speicfied Firewall rule group.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListFirewallRules.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListFirewallRules", []))

    @jsii.member(jsii_name="toListResolverConfigs")
    def to_list_resolver_configs(self) -> "Route53resolver":
        '''(experimental) Grants permission to list Resolver Config statuses.

        Access Level: List

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListResolverConfigs.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListResolverConfigs", []))

    @jsii.member(jsii_name="toListResolverDnssecConfigs")
    def to_list_resolver_dnssec_configs(self) -> "Route53resolver":
        '''(experimental) Grants permission to list the DNSSEC validation support status for DNS queries.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListResolverDnssecConfigs.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListResolverDnssecConfigs", []))

    @jsii.member(jsii_name="toListResolverEndpointIpAddresses")
    def to_list_resolver_endpoint_ip_addresses(self) -> "Route53resolver":
        '''(experimental) Grants permission to list the IP addresses that DNS queries pass through on the way to your network (outbound) or your VPCs (inbound) for a specified Resolver endpoint.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListResolverEndpointIpAddresses.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListResolverEndpointIpAddresses", []))

    @jsii.member(jsii_name="toListResolverEndpoints")
    def to_list_resolver_endpoints(self) -> "Route53resolver":
        '''(experimental) Grants permission to list all the Resolver endpoints that were created using the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListResolverEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListResolverEndpoints", []))

    @jsii.member(jsii_name="toListResolverQueryLogConfigAssociations")
    def to_list_resolver_query_log_config_associations(self) -> "Route53resolver":
        '''(experimental) Grants permission to list information about associations between Amazon VPCs and query logging configurations.

        Access Level: List

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListResolverQueryLogConfigAssociations.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListResolverQueryLogConfigAssociations", []))

    @jsii.member(jsii_name="toListResolverQueryLogConfigs")
    def to_list_resolver_query_log_configs(self) -> "Route53resolver":
        '''(experimental) Grants permission to list information about the specified query logging configurations, which define where you want Resolver to save DNS query logs and specify the VPCs that you want to log queries for.

        Access Level: List

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListResolverQueryLogConfigs.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListResolverQueryLogConfigs", []))

    @jsii.member(jsii_name="toListResolverRuleAssociations")
    def to_list_resolver_rule_associations(self) -> "Route53resolver":
        '''(experimental) Grants permission to list the associations that were created between Resolver rules and VPCs using the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListResolverRuleAssociations.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListResolverRuleAssociations", []))

    @jsii.member(jsii_name="toListResolverRules")
    def to_list_resolver_rules(self) -> "Route53resolver":
        '''(experimental) Grants permission to list the Resolver rules that were created using the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListResolverRules.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListResolverRules", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Route53resolver":
        '''(experimental) Grants permission to list the tags that you associated with the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutFirewallRuleGroupPolicy")
    def to_put_firewall_rule_group_policy(self) -> "Route53resolver":
        '''(experimental) Grants permission to specify an AWS account that you want to share a Firewall rule group with, the Firewall rule group that you want to share, and the operations that you want the account to be able to perform on the configuration.

        Access Level: Permissions management

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_PutFirewallRuleGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toPutFirewallRuleGroupPolicy", []))

    @jsii.member(jsii_name="toPutResolverQueryLogConfigPolicy")
    def to_put_resolver_query_log_config_policy(self) -> "Route53resolver":
        '''(experimental) Grants permission to specify an AWS account that you want to share a query logging configuration with, the query logging configuration that you want to share, and the operations that you want the account to be able to perform on the configuration.

        Access Level: Permissions management

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_PutResolverQueryLogConfigPolicy.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toPutResolverQueryLogConfigPolicy", []))

    @jsii.member(jsii_name="toPutResolverRulePolicy")
    def to_put_resolver_rule_policy(self) -> "Route53resolver":
        '''(experimental) Grants permission to specify an AWS account that you want to share rules with, the Resolver rules that you want to share, and the operations that you want the account to be able to perform on those rules.

        Access Level: Permissions management

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_PutResolverRulePolicy.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toPutResolverRulePolicy", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Route53resolver":
        '''(experimental) Grants permission to add one or more tags to a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Route53resolver":
        '''(experimental) Grants permission to remove one or more tags from a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateFirewallConfig")
    def to_update_firewall_config(self) -> "Route53resolver":
        '''(experimental) Grants permission to update selected settings for an Firewall config.

        Access Level: Write

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_UpdateFirewallConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toUpdateFirewallConfig", []))

    @jsii.member(jsii_name="toUpdateFirewallDomains")
    def to_update_firewall_domains(self) -> "Route53resolver":
        '''(experimental) Grants permission to add, remove or replace Firewall domains in a Firewall domain list.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_UpdateFirewallDomains.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toUpdateFirewallDomains", []))

    @jsii.member(jsii_name="toUpdateFirewallRule")
    def to_update_firewall_rule(self) -> "Route53resolver":
        '''(experimental) Grants permission to update selected settings for an Firewall rule in a Firewall rule group.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_UpdateFirewallRule.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toUpdateFirewallRule", []))

    @jsii.member(jsii_name="toUpdateFirewallRuleGroupAssociation")
    def to_update_firewall_rule_group_association(self) -> "Route53resolver":
        '''(experimental) Grants permission to update selected settings for an Firewall rule group association.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_UpdateFirewallRuleGroupAssociation.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toUpdateFirewallRuleGroupAssociation", []))

    @jsii.member(jsii_name="toUpdateResolverConfig")
    def to_update_resolver_config(self) -> "Route53resolver":
        '''(experimental) Grants permission to update the Resolver Config status within the specified resource.

        Access Level: Write

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_UpdateResolverConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toUpdateResolverConfig", []))

    @jsii.member(jsii_name="toUpdateResolverDnssecConfig")
    def to_update_resolver_dnssec_config(self) -> "Route53resolver":
        '''(experimental) Grants permission to update the DNSSEC validation support status for DNS queries within the specified resource.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_UpdateResolverDnssecConfig.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toUpdateResolverDnssecConfig", []))

    @jsii.member(jsii_name="toUpdateResolverEndpoint")
    def to_update_resolver_endpoint(self) -> "Route53resolver":
        '''(experimental) Grants permission to update selected settings for an inbound or an outbound Resolver endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_UpdateResolverEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toUpdateResolverEndpoint", []))

    @jsii.member(jsii_name="toUpdateResolverRule")
    def to_update_resolver_rule(self) -> "Route53resolver":
        '''(experimental) Grants permission to update settings for a specified Resolver rule.

        Access Level: Write

        https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_UpdateResolverRule.html

        :stability: experimental
        '''
        return typing.cast("Route53resolver", jsii.invoke(self, "toUpdateResolverRule", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2de17351bd2309d5450b8d5a2e95a156d1f176031780e8f251541a84f4f73385)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9ddb1afd578897b0e26c44cfd3d7c428764e1f16dc8410209377301750345efc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Rum(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Rum"):
    '''(experimental) Statement provider for service `rum <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudwatchrum.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `rum <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudwatchrum.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4b92a30e55311da70673d5356819dbdd338e7cd721b7328c63b06811323aca57)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAppMonitorResource")
    def on_app_monitor_resource(
        self,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Rum":
        '''(experimental) Adds a resource of type AppMonitorResource to the statement.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/API_AppMonitor.html

        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__afbc5fa3b646aaea98e0f4974c2cb3f420494ac2bb3c2fbcada6ae8563720507)
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Rum", jsii.invoke(self, "onAppMonitorResource", [name, account, region, partition]))

    @jsii.member(jsii_name="toBatchCreateRumMetricDefinitions")
    def to_batch_create_rum_metric_definitions(self) -> "Rum":
        '''(experimental) Grants permission to create rum metric definitions.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchrum/latest/APIReference/API_BatchCreateRumMetricDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Rum", jsii.invoke(self, "toBatchCreateRumMetricDefinitions", []))

    @jsii.member(jsii_name="toBatchDeleteRumMetricDefinitions")
    def to_batch_delete_rum_metric_definitions(self) -> "Rum":
        '''(experimental) Grants permission to remove rum metric definitions.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchrum/latest/APIReference/API_BatchDeleteRumMetricDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Rum", jsii.invoke(self, "toBatchDeleteRumMetricDefinitions", []))

    @jsii.member(jsii_name="toBatchGetRumMetricDefinitions")
    def to_batch_get_rum_metric_definitions(self) -> "Rum":
        '''(experimental) Grants permission to get rum metric definitions.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatchrum/latest/APIReference/API_BatchGetRumMetricDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Rum", jsii.invoke(self, "toBatchGetRumMetricDefinitions", []))

    @jsii.member(jsii_name="toCreateAppMonitor")
    def to_create_app_monitor(self) -> "Rum":
        '''(experimental) Grants permission to create appMonitor metadata.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - iam:GetRole

        https://docs.aws.amazon.com/cloudwatchrum/latest/APIReference/API_CreateAppMonitor.html

        :stability: experimental
        '''
        return typing.cast("Rum", jsii.invoke(self, "toCreateAppMonitor", []))

    @jsii.member(jsii_name="toDeleteAppMonitor")
    def to_delete_app_monitor(self) -> "Rum":
        '''(experimental) Grants permission to delete appMonitor metadata.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchrum/latest/APIReference/API_DeleteAppMonitor.html

        :stability: experimental
        '''
        return typing.cast("Rum", jsii.invoke(self, "toDeleteAppMonitor", []))

    @jsii.member(jsii_name="toDeleteRumMetricsDestination")
    def to_delete_rum_metrics_destination(self) -> "Rum":
        '''(experimental) Grants permission to delete rum metrics destinations.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchrum/latest/APIReference/API_DeleteRumMetricsDestination.html

        :stability: experimental
        '''
        return typing.cast("Rum", jsii.invoke(self, "toDeleteRumMetricsDestination", []))

    @jsii.member(jsii_name="toGetAppMonitor")
    def to_get_app_monitor(self) -> "Rum":
        '''(experimental) Grants permission to get appMonitor metadata.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatchrum/latest/APIReference/API_GetAppMonitor.html

        :stability: experimental
        '''
        return typing.cast("Rum", jsii.invoke(self, "toGetAppMonitor", []))

    @jsii.member(jsii_name="toGetAppMonitorData")
    def to_get_app_monitor_data(self) -> "Rum":
        '''(experimental) Grants permission to get appMonitor data.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatchrum/latest/APIReference/API_GetAppMonitorData.html

        :stability: experimental
        '''
        return typing.cast("Rum", jsii.invoke(self, "toGetAppMonitorData", []))

    @jsii.member(jsii_name="toListAppMonitors")
    def to_list_app_monitors(self) -> "Rum":
        '''(experimental) Grants permission to list appMonitors metadata.

        Access Level: List

        https://docs.aws.amazon.com/cloudwatchrum/latest/APIReference/API_ListAppMonitors.html

        :stability: experimental
        '''
        return typing.cast("Rum", jsii.invoke(self, "toListAppMonitors", []))

    @jsii.member(jsii_name="toListRumMetricsDestinations")
    def to_list_rum_metrics_destinations(self) -> "Rum":
        '''(experimental) Grants permission to list rum metrics destinations.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatchrum/latest/APIReference/API_ListRumMetricsDestinations.html

        :stability: experimental
        '''
        return typing.cast("Rum", jsii.invoke(self, "toListRumMetricsDestinations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Rum":
        '''(experimental) Grants permission to list tags for resources.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatchrum/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Rum", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutRumEvents")
    def to_put_rum_events(self) -> "Rum":
        '''(experimental) Grants permission to put RUM events for appmonitor.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchrum/latest/APIReference/API_PutRumEvents.html

        :stability: experimental
        '''
        return typing.cast("Rum", jsii.invoke(self, "toPutRumEvents", []))

    @jsii.member(jsii_name="toPutRumMetricsDestination")
    def to_put_rum_metrics_destination(self) -> "Rum":
        '''(experimental) Grants permission to put rum metrics destinations.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchrum/latest/APIReference/API_PutRumMetricsDestination.html

        :stability: experimental
        '''
        return typing.cast("Rum", jsii.invoke(self, "toPutRumMetricsDestination", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Rum":
        '''(experimental) Grants permission to tag resources.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudwatchrum/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Rum", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Rum":
        '''(experimental) Grants permission to untag resources.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudwatchrum/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Rum", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAppMonitor")
    def to_update_app_monitor(self) -> "Rum":
        '''(experimental) Grants permission to update appmonitor metadata.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - iam:GetRole

        https://docs.aws.amazon.com/cloudwatchrum/latest/APIReference/API_UpdateAppMonitor.html

        :stability: experimental
        '''
        return typing.cast("Rum", jsii.invoke(self, "toUpdateAppMonitor", []))

    @jsii.member(jsii_name="toUpdateRumMetricDefinition")
    def to_update_rum_metric_definition(self) -> "Rum":
        '''(experimental) Grants permission to update rum metric definition.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchrum/latest/APIReference/API_UpdateRumMetricDefinition.html

        :stability: experimental
        '''
        return typing.cast("Rum", jsii.invoke(self, "toUpdateRumMetricDefinition", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b9890a755374ba815f876c66939443111871085a4661f87f6e9dedf83646bf0a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bd0974876fe26151a2b653dafb203eca5384507358a4cf5216101fd17e06490d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class S3(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.S3"):
    '''(experimental) Statement provider for service `s3 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `s3 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__204d2b648480818b30f1f5d14bb9b04ee4cfe6102941cb8acd2e965c7823ce91)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAccessPointNetworkOrigin")
    def if_access_point_network_origin(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by the network origin (Internet or VPC).

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-access-points.html#access-points-policies

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toBypassGovernanceRetention()
        - .toCreateAccessPoint()
        - .toCreateAccessPointForObjectLambda()
        - .toCreateMultiRegionAccessPoint()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointForObjectLambda()
        - .toDeleteAccessPointPolicy()
        - .toDeleteAccessPointPolicyForObjectLambda()
        - .toDeleteMultiRegionAccessPoint()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toGetAccessPoint()
        - .toGetAccessPointConfigurationForObjectLambda()
        - .toGetAccessPointForObjectLambda()
        - .toGetAccessPointPolicy()
        - .toGetAccessPointPolicyForObjectLambda()
        - .toGetAccessPointPolicyStatus()
        - .toGetAccessPointPolicyStatusForObjectLambda()
        - .toGetMultiRegionAccessPoint()
        - .toGetMultiRegionAccessPointPolicy()
        - .toGetMultiRegionAccessPointPolicyStatus()
        - .toGetMultiRegionAccessPointRoutes()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectAttributes()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionAttributes()
        - .toGetObjectVersionTagging()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListMultipartUploadParts()
        - .toPutAccessPointConfigurationForObjectLambda()
        - .toPutAccessPointPolicy()
        - .toPutAccessPointPolicyForObjectLambda()
        - .toPutMultiRegionAccessPointPolicy()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toRestoreObject()
        - .toSubmitMultiRegionAccessPointRoutes()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__751a4a4500eb473a63337cb4d8a7964639f420f39b52e59a634bc519251999f9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifAccessPointNetworkOrigin", [value, operator]))

    @jsii.member(jsii_name="ifAuthType")
    def if_auth_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by authentication method.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toBypassGovernanceRetention()
        - .toCreateAccessPoint()
        - .toCreateAccessPointForObjectLambda()
        - .toCreateBucket()
        - .toCreateJob()
        - .toCreateMultiRegionAccessPoint()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointForObjectLambda()
        - .toDeleteAccessPointPolicy()
        - .toDeleteAccessPointPolicyForObjectLambda()
        - .toDeleteBucket()
        - .toDeleteBucketPolicy()
        - .toDeleteBucketWebsite()
        - .toDeleteJobTagging()
        - .toDeleteMultiRegionAccessPoint()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toDeleteStorageLensConfiguration()
        - .toDeleteStorageLensConfigurationTagging()
        - .toDescribeJob()
        - .toDescribeMultiRegionAccessPointOperation()
        - .toGetAccelerateConfiguration()
        - .toGetAccessPoint()
        - .toGetAccessPointConfigurationForObjectLambda()
        - .toGetAccessPointForObjectLambda()
        - .toGetAccessPointPolicy()
        - .toGetAccessPointPolicyForObjectLambda()
        - .toGetAccessPointPolicyStatus()
        - .toGetAccessPointPolicyStatusForObjectLambda()
        - .toGetAccountPublicAccessBlock()
        - .toGetAnalyticsConfiguration()
        - .toGetBucketAcl()
        - .toGetBucketCORS()
        - .toGetBucketLocation()
        - .toGetBucketLogging()
        - .toGetBucketNotification()
        - .toGetBucketObjectLockConfiguration()
        - .toGetBucketOwnershipControls()
        - .toGetBucketPolicy()
        - .toGetBucketPolicyStatus()
        - .toGetBucketPublicAccessBlock()
        - .toGetBucketRequestPayment()
        - .toGetBucketTagging()
        - .toGetBucketVersioning()
        - .toGetBucketWebsite()
        - .toGetEncryptionConfiguration()
        - .toGetIntelligentTieringConfiguration()
        - .toGetInventoryConfiguration()
        - .toGetJobTagging()
        - .toGetLifecycleConfiguration()
        - .toGetMetricsConfiguration()
        - .toGetMultiRegionAccessPoint()
        - .toGetMultiRegionAccessPointPolicy()
        - .toGetMultiRegionAccessPointPolicyStatus()
        - .toGetMultiRegionAccessPointRoutes()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectAttributes()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectTorrent()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionAttributes()
        - .toGetObjectVersionForReplication()
        - .toGetObjectVersionTagging()
        - .toGetObjectVersionTorrent()
        - .toGetReplicationConfiguration()
        - .toGetStorageLensConfiguration()
        - .toGetStorageLensConfigurationTagging()
        - .toGetStorageLensDashboard()
        - .toListAccessPoints()
        - .toListAccessPointsForObjectLambda()
        - .toListAllMyBuckets()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListJobs()
        - .toListMultiRegionAccessPoints()
        - .toListMultipartUploadParts()
        - .toListStorageLensConfigurations()
        - .toObjectOwnerOverrideToBucketOwner()
        - .toPutAccelerateConfiguration()
        - .toPutAccessPointConfigurationForObjectLambda()
        - .toPutAccessPointPolicy()
        - .toPutAccessPointPolicyForObjectLambda()
        - .toPutAccountPublicAccessBlock()
        - .toPutAnalyticsConfiguration()
        - .toPutBucketAcl()
        - .toPutBucketCORS()
        - .toPutBucketLogging()
        - .toPutBucketNotification()
        - .toPutBucketObjectLockConfiguration()
        - .toPutBucketOwnershipControls()
        - .toPutBucketPolicy()
        - .toPutBucketPublicAccessBlock()
        - .toPutBucketRequestPayment()
        - .toPutBucketTagging()
        - .toPutBucketVersioning()
        - .toPutBucketWebsite()
        - .toPutEncryptionConfiguration()
        - .toPutIntelligentTieringConfiguration()
        - .toPutInventoryConfiguration()
        - .toPutJobTagging()
        - .toPutLifecycleConfiguration()
        - .toPutMetricsConfiguration()
        - .toPutMultiRegionAccessPointPolicy()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toPutReplicationConfiguration()
        - .toPutStorageLensConfiguration()
        - .toPutStorageLensConfigurationTagging()
        - .toReplicateDelete()
        - .toReplicateObject()
        - .toReplicateTags()
        - .toRestoreObject()
        - .toSubmitMultiRegionAccessPointRoutes()
        - .toUpdateJobPriority()
        - .toUpdateJobStatus()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a5fdb27729db99652fa737dd302d280d9f2de56dda0f82a162b9c97dbf9348cb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifAuthType", [value, operator]))

    @jsii.member(jsii_name="ifDataAccessPointAccount")
    def if_data_access_point_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by the AWS Account ID that owns the access point.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-access-points.html#access-points-policies

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toBypassGovernanceRetention()
        - .toCreateAccessPoint()
        - .toCreateAccessPointForObjectLambda()
        - .toCreateMultiRegionAccessPoint()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointForObjectLambda()
        - .toDeleteAccessPointPolicy()
        - .toDeleteAccessPointPolicyForObjectLambda()
        - .toDeleteMultiRegionAccessPoint()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toGetAccessPoint()
        - .toGetAccessPointConfigurationForObjectLambda()
        - .toGetAccessPointForObjectLambda()
        - .toGetAccessPointPolicy()
        - .toGetAccessPointPolicyForObjectLambda()
        - .toGetAccessPointPolicyStatus()
        - .toGetAccessPointPolicyStatusForObjectLambda()
        - .toGetMultiRegionAccessPoint()
        - .toGetMultiRegionAccessPointPolicy()
        - .toGetMultiRegionAccessPointPolicyStatus()
        - .toGetMultiRegionAccessPointRoutes()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectAttributes()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionAttributes()
        - .toGetObjectVersionTagging()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListMultipartUploadParts()
        - .toPutAccessPointConfigurationForObjectLambda()
        - .toPutAccessPointPolicy()
        - .toPutAccessPointPolicyForObjectLambda()
        - .toPutMultiRegionAccessPointPolicy()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toRestoreObject()
        - .toSubmitMultiRegionAccessPointRoutes()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4820bb345e97433a17027aba00bef67456f3aa5fcfc17f794469baeb92b88aa1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifDataAccessPointAccount", [value, operator]))

    @jsii.member(jsii_name="ifDataAccessPointArn")
    def if_data_access_point_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by an access point Amazon Resource Name (ARN).

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-access-points.html#access-points-policies

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toBypassGovernanceRetention()
        - .toCreateAccessPoint()
        - .toCreateAccessPointForObjectLambda()
        - .toCreateMultiRegionAccessPoint()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointForObjectLambda()
        - .toDeleteAccessPointPolicy()
        - .toDeleteAccessPointPolicyForObjectLambda()
        - .toDeleteMultiRegionAccessPoint()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toGetAccessPoint()
        - .toGetAccessPointConfigurationForObjectLambda()
        - .toGetAccessPointForObjectLambda()
        - .toGetAccessPointPolicy()
        - .toGetAccessPointPolicyForObjectLambda()
        - .toGetAccessPointPolicyStatus()
        - .toGetAccessPointPolicyStatusForObjectLambda()
        - .toGetMultiRegionAccessPoint()
        - .toGetMultiRegionAccessPointPolicy()
        - .toGetMultiRegionAccessPointPolicyStatus()
        - .toGetMultiRegionAccessPointRoutes()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectAttributes()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionAttributes()
        - .toGetObjectVersionTagging()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListMultipartUploadParts()
        - .toPutAccessPointConfigurationForObjectLambda()
        - .toPutAccessPointPolicy()
        - .toPutAccessPointPolicyForObjectLambda()
        - .toPutMultiRegionAccessPointPolicy()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toRestoreObject()
        - .toSubmitMultiRegionAccessPointRoutes()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ed3c5b89355b1245024caf4491f5daff814f9352e9abb261ce10303c3e2081e9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifDataAccessPointArn", [value, operator]))

    @jsii.member(jsii_name="ifDelimiter")
    def if_delimiter(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by delimiter parameter.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/walkthrough1.html

        Applies to actions:

        - .toListBucket()
        - .toListBucketVersions()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a3775c1c63deaa7b45bca78c78469aefea0e2a076215690446db46a1b9a8d012)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifDelimiter", [value, operator]))

    @jsii.member(jsii_name="ifExistingJobOperation")
    def if_existing_job_operation(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by operation to updating the job priority.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/batch-ops-job-tags-examples.html

        Applies to actions:

        - .toDeleteJobTagging()
        - .toPutJobTagging()
        - .toUpdateJobPriority()
        - .toUpdateJobStatus()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__44548590f6fe8d94a9731f6522e02416c557ada7ccce6f8398b50dfe8c884cde)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifExistingJobOperation", [value, operator]))

    @jsii.member(jsii_name="ifExistingJobPriority")
    def if_existing_job_priority(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by priority range to cancelling existing jobs.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/batch-ops-job-tags-examples.html

        Applies to actions:

        - .toDeleteJobTagging()
        - .toPutJobTagging()
        - .toUpdateJobPriority()
        - .toUpdateJobStatus()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d570ff5550d4ae8be49d023ce207287b4c3fe0ada1fe12e3b5a6067f8fffed33)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifExistingJobPriority", [value, operator]))

    @jsii.member(jsii_name="ifExistingObjectTag")
    def if_existing_object_tag(
        self,
        key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by existing object tag key and value.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html#tagging-and-policies

        Applies to actions:

        - .toDeleteObjectTagging()
        - .toDeleteObjectVersionTagging()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectAttributes()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionAttributes()
        - .toGetObjectVersionTagging()
        - .toPutObjectAcl()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()

        :param key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fddda013f31ec2e8686cfbf92863b50b3923450b0db1e686a8cfe4d00a9b70b3)
            check_type(argname="argument key", value=key, expected_type=type_hints["key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifExistingObjectTag", [key, value, operator]))

    @jsii.member(jsii_name="ifJobSuspendedCause")
    def if_job_suspended_cause(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by a specific job suspended cause (for example, AWAITING_CONFIRMATION) to cancelling suspended jobs.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/batch-ops-job-tags-examples.html

        Applies to actions:

        - .toUpdateJobStatus()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c9bbdf01b267d2f6ae1a780785f630013fa307127c47e79c609cd6975f2ddc9c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifJobSuspendedCause", [value, operator]))

    @jsii.member(jsii_name="ifLocationconstraint")
    def if_locationconstraint(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by a specific Region.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html#condition-key-bucket-ops-1

        Applies to actions:

        - .toCreateAccessPoint()
        - .toCreateBucket()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d779613e564e85b9ad12f4410730466cefa476640c2ac7b4791d4cd71aa58294)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifLocationconstraint", [value, operator]))

    @jsii.member(jsii_name="ifMaxKeys")
    def if_max_keys(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by maximum number of keys returned in a ListBucket request.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html#example-numeric-condition-operators

        Applies to actions:

        - .toListBucket()
        - .toListBucketVersions()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__59ad79ef41b5379b0cb64a3e69abe4545adbab1ddc002f9d17e5a502c6efdc95)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifMaxKeys", [value, operator]))

    @jsii.member(jsii_name="ifObjectLockLegalHold")
    def if_object_lock_legal_hold(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by object legal hold status.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-legal-holds

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()
        - .toPutObjectLegalHold()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d7b2360228933fb8e4e9d6e77369dda55304f773956461c9a2fc8a99ac4aebc6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifObjectLockLegalHold", [value, operator]))

    @jsii.member(jsii_name="ifObjectLockMode")
    def if_object_lock_mode(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by object retention mode (COMPLIANCE or GOVERNANCE).

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-retention-modes

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()
        - .toPutObjectRetention()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__079f1c2659fe5b41624f2b6cb2c746a8d8a9269d1cc515b97081e88823fd09ac)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifObjectLockMode", [value, operator]))

    @jsii.member(jsii_name="ifObjectLockRemainingRetentionDays")
    def if_object_lock_remaining_retention_days(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by remaining object retention days.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-managing.html#object-lock-managing-retention-limits

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()
        - .toPutObjectRetention()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1824f0a9d14c17aab153131d76cc7b97162e8f6352bcae7c8596b7ac8f48ea8c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifObjectLockRemainingRetentionDays", [value, operator]))

    @jsii.member(jsii_name="ifObjectLockRetainUntilDate")
    def if_object_lock_retain_until_date(
        self,
        value: typing.Union[builtins.str, datetime.datetime, typing.Sequence[typing.Union[builtins.str, datetime.datetime]]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by object retain-until date.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html#object-lock-retention-periods

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()
        - .toPutObjectRetention()

        :param value: The value(s) to check.
        :param operator: Works with `date operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Date>`_. **Default:** ``DateEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__71527fd5a0fb298dbb07b8ab8102b7dd4fd7f574f13d1d0a07a61ee5eb191d9b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifObjectLockRetainUntilDate", [value, operator]))

    @jsii.member(jsii_name="ifPrefix")
    def if_prefix(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by key name prefix.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html#condition-key-bucket-ops-2

        Applies to actions:

        - .toListBucket()
        - .toListBucketVersions()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b375796b49be38bc97653acfa9b6fa1e6caaac426983560f17da532633d29f15)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifPrefix", [value, operator]))

    @jsii.member(jsii_name="ifRequestJobOperation")
    def if_request_job_operation(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by operation to creating jobs.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/batch-ops-job-tags-examples.html

        Applies to actions:

        - .toCreateJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b24f6e6b7601538e2a30a7d08bc3da201adb7dccc3951287686dd132bb17ed4c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifRequestJobOperation", [value, operator]))

    @jsii.member(jsii_name="ifRequestJobPriority")
    def if_request_job_priority(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by priority range to creating new jobs.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/batch-ops-job-tags-examples.html

        Applies to actions:

        - .toCreateJob()
        - .toUpdateJobPriority()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ff4988a2a41e8f07f3d0bf3431b84bed7d703817c30b21b849bafb4a98c506e9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifRequestJobPriority", [value, operator]))

    @jsii.member(jsii_name="ifRequestObjectTag")
    def if_request_object_tag(
        self,
        key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by the tag keys and values to be added to objects.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html#tagging-and-policies

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()
        - .toPutObjectTagging()
        - .toPutObjectVersionTagging()

        :param key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__02977d77ca9f7f74023ef2e21619c46246b21f21b607d70b28e549e2ec5a92f7)
            check_type(argname="argument key", value=key, expected_type=type_hints["key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifRequestObjectTag", [key, value, operator]))

    @jsii.member(jsii_name="ifRequestObjectTagKeys")
    def if_request_object_tag_keys(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by the tag keys to be added to objects.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html#tagging-and-policies

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()
        - .toPutObjectTagging()
        - .toPutObjectVersionTagging()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0d2a81f1543e22dd44e66f0113ff81e94ad22a8b2f20e212a58ab53b83ab33e9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifRequestObjectTagKeys", [value, operator]))

    @jsii.member(jsii_name="ifResourceAccount")
    def if_resource_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by the resource owner AWS account ID.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html#example-object-resource-account

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toBypassGovernanceRetention()
        - .toCreateAccessPoint()
        - .toCreateAccessPointForObjectLambda()
        - .toCreateBucket()
        - .toCreateJob()
        - .toCreateMultiRegionAccessPoint()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointForObjectLambda()
        - .toDeleteAccessPointPolicy()
        - .toDeleteAccessPointPolicyForObjectLambda()
        - .toDeleteBucket()
        - .toDeleteBucketPolicy()
        - .toDeleteBucketWebsite()
        - .toDeleteJobTagging()
        - .toDeleteMultiRegionAccessPoint()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toDeleteStorageLensConfiguration()
        - .toDeleteStorageLensConfigurationTagging()
        - .toDescribeJob()
        - .toDescribeMultiRegionAccessPointOperation()
        - .toGetAccelerateConfiguration()
        - .toGetAccessPoint()
        - .toGetAccessPointConfigurationForObjectLambda()
        - .toGetAccessPointForObjectLambda()
        - .toGetAccessPointPolicy()
        - .toGetAccessPointPolicyForObjectLambda()
        - .toGetAccessPointPolicyStatus()
        - .toGetAccessPointPolicyStatusForObjectLambda()
        - .toGetAccountPublicAccessBlock()
        - .toGetAnalyticsConfiguration()
        - .toGetBucketAcl()
        - .toGetBucketCORS()
        - .toGetBucketLocation()
        - .toGetBucketLogging()
        - .toGetBucketNotification()
        - .toGetBucketObjectLockConfiguration()
        - .toGetBucketOwnershipControls()
        - .toGetBucketPolicy()
        - .toGetBucketPolicyStatus()
        - .toGetBucketPublicAccessBlock()
        - .toGetBucketRequestPayment()
        - .toGetBucketTagging()
        - .toGetBucketVersioning()
        - .toGetBucketWebsite()
        - .toGetEncryptionConfiguration()
        - .toGetIntelligentTieringConfiguration()
        - .toGetInventoryConfiguration()
        - .toGetJobTagging()
        - .toGetLifecycleConfiguration()
        - .toGetMetricsConfiguration()
        - .toGetMultiRegionAccessPoint()
        - .toGetMultiRegionAccessPointPolicy()
        - .toGetMultiRegionAccessPointPolicyStatus()
        - .toGetMultiRegionAccessPointRoutes()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectAttributes()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectTorrent()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionAttributes()
        - .toGetObjectVersionForReplication()
        - .toGetObjectVersionTagging()
        - .toGetObjectVersionTorrent()
        - .toGetReplicationConfiguration()
        - .toGetStorageLensConfiguration()
        - .toGetStorageLensConfigurationTagging()
        - .toGetStorageLensDashboard()
        - .toInitiateReplication()
        - .toListAccessPoints()
        - .toListAccessPointsForObjectLambda()
        - .toListAllMyBuckets()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListJobs()
        - .toListMultiRegionAccessPoints()
        - .toListMultipartUploadParts()
        - .toListStorageLensConfigurations()
        - .toObjectOwnerOverrideToBucketOwner()
        - .toPutAccelerateConfiguration()
        - .toPutAccessPointConfigurationForObjectLambda()
        - .toPutAccessPointPolicy()
        - .toPutAccessPointPolicyForObjectLambda()
        - .toPutAccountPublicAccessBlock()
        - .toPutAnalyticsConfiguration()
        - .toPutBucketAcl()
        - .toPutBucketCORS()
        - .toPutBucketLogging()
        - .toPutBucketNotification()
        - .toPutBucketObjectLockConfiguration()
        - .toPutBucketOwnershipControls()
        - .toPutBucketPolicy()
        - .toPutBucketPublicAccessBlock()
        - .toPutBucketRequestPayment()
        - .toPutBucketTagging()
        - .toPutBucketVersioning()
        - .toPutBucketWebsite()
        - .toPutEncryptionConfiguration()
        - .toPutIntelligentTieringConfiguration()
        - .toPutInventoryConfiguration()
        - .toPutJobTagging()
        - .toPutLifecycleConfiguration()
        - .toPutMetricsConfiguration()
        - .toPutMultiRegionAccessPointPolicy()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toPutReplicationConfiguration()
        - .toPutStorageLensConfiguration()
        - .toPutStorageLensConfigurationTagging()
        - .toReplicateDelete()
        - .toReplicateObject()
        - .toReplicateTags()
        - .toRestoreObject()
        - .toSubmitMultiRegionAccessPointRoutes()
        - .toUpdateJobPriority()
        - .toUpdateJobStatus()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7ced3c080552c34e57b00f0ce20b1969102fb5ed89c5e03d440dad16fa75a033)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifResourceAccount", [value, operator]))

    @jsii.member(jsii_name="ifSignatureAge")
    def if_signature_age(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by the age in milliseconds of the request signature.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toBypassGovernanceRetention()
        - .toCreateAccessPoint()
        - .toCreateAccessPointForObjectLambda()
        - .toCreateBucket()
        - .toCreateJob()
        - .toCreateMultiRegionAccessPoint()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointForObjectLambda()
        - .toDeleteAccessPointPolicy()
        - .toDeleteAccessPointPolicyForObjectLambda()
        - .toDeleteBucket()
        - .toDeleteBucketPolicy()
        - .toDeleteBucketWebsite()
        - .toDeleteJobTagging()
        - .toDeleteMultiRegionAccessPoint()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toDeleteStorageLensConfiguration()
        - .toDeleteStorageLensConfigurationTagging()
        - .toDescribeJob()
        - .toDescribeMultiRegionAccessPointOperation()
        - .toGetAccelerateConfiguration()
        - .toGetAccessPoint()
        - .toGetAccessPointConfigurationForObjectLambda()
        - .toGetAccessPointForObjectLambda()
        - .toGetAccessPointPolicy()
        - .toGetAccessPointPolicyForObjectLambda()
        - .toGetAccessPointPolicyStatus()
        - .toGetAccessPointPolicyStatusForObjectLambda()
        - .toGetAccountPublicAccessBlock()
        - .toGetAnalyticsConfiguration()
        - .toGetBucketAcl()
        - .toGetBucketCORS()
        - .toGetBucketLocation()
        - .toGetBucketLogging()
        - .toGetBucketNotification()
        - .toGetBucketObjectLockConfiguration()
        - .toGetBucketOwnershipControls()
        - .toGetBucketPolicy()
        - .toGetBucketPolicyStatus()
        - .toGetBucketPublicAccessBlock()
        - .toGetBucketRequestPayment()
        - .toGetBucketTagging()
        - .toGetBucketVersioning()
        - .toGetBucketWebsite()
        - .toGetEncryptionConfiguration()
        - .toGetIntelligentTieringConfiguration()
        - .toGetInventoryConfiguration()
        - .toGetJobTagging()
        - .toGetLifecycleConfiguration()
        - .toGetMetricsConfiguration()
        - .toGetMultiRegionAccessPoint()
        - .toGetMultiRegionAccessPointPolicy()
        - .toGetMultiRegionAccessPointPolicyStatus()
        - .toGetMultiRegionAccessPointRoutes()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectAttributes()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectTorrent()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionAttributes()
        - .toGetObjectVersionForReplication()
        - .toGetObjectVersionTagging()
        - .toGetObjectVersionTorrent()
        - .toGetReplicationConfiguration()
        - .toGetStorageLensConfiguration()
        - .toGetStorageLensConfigurationTagging()
        - .toGetStorageLensDashboard()
        - .toListAccessPoints()
        - .toListAccessPointsForObjectLambda()
        - .toListAllMyBuckets()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListJobs()
        - .toListMultiRegionAccessPoints()
        - .toListMultipartUploadParts()
        - .toListStorageLensConfigurations()
        - .toObjectOwnerOverrideToBucketOwner()
        - .toPutAccelerateConfiguration()
        - .toPutAccessPointConfigurationForObjectLambda()
        - .toPutAccessPointPolicy()
        - .toPutAccessPointPolicyForObjectLambda()
        - .toPutAccountPublicAccessBlock()
        - .toPutAnalyticsConfiguration()
        - .toPutBucketAcl()
        - .toPutBucketCORS()
        - .toPutBucketLogging()
        - .toPutBucketNotification()
        - .toPutBucketObjectLockConfiguration()
        - .toPutBucketOwnershipControls()
        - .toPutBucketPolicy()
        - .toPutBucketPublicAccessBlock()
        - .toPutBucketRequestPayment()
        - .toPutBucketTagging()
        - .toPutBucketVersioning()
        - .toPutBucketWebsite()
        - .toPutEncryptionConfiguration()
        - .toPutIntelligentTieringConfiguration()
        - .toPutInventoryConfiguration()
        - .toPutJobTagging()
        - .toPutLifecycleConfiguration()
        - .toPutMetricsConfiguration()
        - .toPutMultiRegionAccessPointPolicy()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toPutReplicationConfiguration()
        - .toPutStorageLensConfiguration()
        - .toPutStorageLensConfigurationTagging()
        - .toReplicateDelete()
        - .toReplicateObject()
        - .toReplicateTags()
        - .toRestoreObject()
        - .toSubmitMultiRegionAccessPointRoutes()
        - .toUpdateJobPriority()
        - .toUpdateJobStatus()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ade8f4fe3b1c87dd8d8681c27a87de74bd618454d71d2bde8a2b6db73bf95d1c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifSignatureAge", [value, operator]))

    @jsii.member(jsii_name="ifSignatureversion")
    def if_signatureversion(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by the version of AWS Signature used on the request.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toBypassGovernanceRetention()
        - .toCreateAccessPoint()
        - .toCreateAccessPointForObjectLambda()
        - .toCreateBucket()
        - .toCreateJob()
        - .toCreateMultiRegionAccessPoint()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointForObjectLambda()
        - .toDeleteAccessPointPolicy()
        - .toDeleteAccessPointPolicyForObjectLambda()
        - .toDeleteBucket()
        - .toDeleteBucketPolicy()
        - .toDeleteBucketWebsite()
        - .toDeleteJobTagging()
        - .toDeleteMultiRegionAccessPoint()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toDeleteStorageLensConfiguration()
        - .toDeleteStorageLensConfigurationTagging()
        - .toDescribeJob()
        - .toDescribeMultiRegionAccessPointOperation()
        - .toGetAccelerateConfiguration()
        - .toGetAccessPoint()
        - .toGetAccessPointConfigurationForObjectLambda()
        - .toGetAccessPointForObjectLambda()
        - .toGetAccessPointPolicy()
        - .toGetAccessPointPolicyForObjectLambda()
        - .toGetAccessPointPolicyStatus()
        - .toGetAccessPointPolicyStatusForObjectLambda()
        - .toGetAccountPublicAccessBlock()
        - .toGetAnalyticsConfiguration()
        - .toGetBucketAcl()
        - .toGetBucketCORS()
        - .toGetBucketLocation()
        - .toGetBucketLogging()
        - .toGetBucketNotification()
        - .toGetBucketObjectLockConfiguration()
        - .toGetBucketOwnershipControls()
        - .toGetBucketPolicy()
        - .toGetBucketPolicyStatus()
        - .toGetBucketPublicAccessBlock()
        - .toGetBucketRequestPayment()
        - .toGetBucketTagging()
        - .toGetBucketVersioning()
        - .toGetBucketWebsite()
        - .toGetEncryptionConfiguration()
        - .toGetIntelligentTieringConfiguration()
        - .toGetInventoryConfiguration()
        - .toGetJobTagging()
        - .toGetLifecycleConfiguration()
        - .toGetMetricsConfiguration()
        - .toGetMultiRegionAccessPoint()
        - .toGetMultiRegionAccessPointPolicy()
        - .toGetMultiRegionAccessPointPolicyStatus()
        - .toGetMultiRegionAccessPointRoutes()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectAttributes()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectTorrent()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionAttributes()
        - .toGetObjectVersionForReplication()
        - .toGetObjectVersionTagging()
        - .toGetObjectVersionTorrent()
        - .toGetReplicationConfiguration()
        - .toGetStorageLensConfiguration()
        - .toGetStorageLensConfigurationTagging()
        - .toGetStorageLensDashboard()
        - .toListAccessPoints()
        - .toListAccessPointsForObjectLambda()
        - .toListAllMyBuckets()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListJobs()
        - .toListMultiRegionAccessPoints()
        - .toListMultipartUploadParts()
        - .toListStorageLensConfigurations()
        - .toObjectOwnerOverrideToBucketOwner()
        - .toPutAccelerateConfiguration()
        - .toPutAccessPointConfigurationForObjectLambda()
        - .toPutAccessPointPolicy()
        - .toPutAccessPointPolicyForObjectLambda()
        - .toPutAccountPublicAccessBlock()
        - .toPutAnalyticsConfiguration()
        - .toPutBucketAcl()
        - .toPutBucketCORS()
        - .toPutBucketLogging()
        - .toPutBucketNotification()
        - .toPutBucketObjectLockConfiguration()
        - .toPutBucketOwnershipControls()
        - .toPutBucketPolicy()
        - .toPutBucketPublicAccessBlock()
        - .toPutBucketRequestPayment()
        - .toPutBucketTagging()
        - .toPutBucketVersioning()
        - .toPutBucketWebsite()
        - .toPutEncryptionConfiguration()
        - .toPutIntelligentTieringConfiguration()
        - .toPutInventoryConfiguration()
        - .toPutJobTagging()
        - .toPutLifecycleConfiguration()
        - .toPutMetricsConfiguration()
        - .toPutMultiRegionAccessPointPolicy()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toPutReplicationConfiguration()
        - .toPutStorageLensConfiguration()
        - .toPutStorageLensConfigurationTagging()
        - .toReplicateDelete()
        - .toReplicateObject()
        - .toReplicateTags()
        - .toRestoreObject()
        - .toSubmitMultiRegionAccessPointRoutes()
        - .toUpdateJobPriority()
        - .toUpdateJobStatus()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__407eaaef7b1741967da702ab4e2278bfe2ae5a15f7da9cbf4e4eddb4e64b8bf9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifSignatureversion", [value, operator]))

    @jsii.member(jsii_name="ifTlsVersion")
    def if_tls_version(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by the TLS version used by the client.

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toBypassGovernanceRetention()
        - .toCreateAccessPoint()
        - .toCreateAccessPointForObjectLambda()
        - .toCreateBucket()
        - .toCreateJob()
        - .toCreateMultiRegionAccessPoint()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointForObjectLambda()
        - .toDeleteAccessPointPolicy()
        - .toDeleteAccessPointPolicyForObjectLambda()
        - .toDeleteBucket()
        - .toDeleteBucketPolicy()
        - .toDeleteBucketWebsite()
        - .toDeleteJobTagging()
        - .toDeleteMultiRegionAccessPoint()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toDeleteStorageLensConfiguration()
        - .toDeleteStorageLensConfigurationTagging()
        - .toDescribeJob()
        - .toDescribeMultiRegionAccessPointOperation()
        - .toGetAccelerateConfiguration()
        - .toGetAccessPoint()
        - .toGetAccessPointConfigurationForObjectLambda()
        - .toGetAccessPointForObjectLambda()
        - .toGetAccessPointPolicy()
        - .toGetAccessPointPolicyForObjectLambda()
        - .toGetAccessPointPolicyStatus()
        - .toGetAccessPointPolicyStatusForObjectLambda()
        - .toGetAccountPublicAccessBlock()
        - .toGetAnalyticsConfiguration()
        - .toGetBucketAcl()
        - .toGetBucketCORS()
        - .toGetBucketLocation()
        - .toGetBucketLogging()
        - .toGetBucketNotification()
        - .toGetBucketObjectLockConfiguration()
        - .toGetBucketOwnershipControls()
        - .toGetBucketPolicy()
        - .toGetBucketPolicyStatus()
        - .toGetBucketPublicAccessBlock()
        - .toGetBucketRequestPayment()
        - .toGetBucketTagging()
        - .toGetBucketVersioning()
        - .toGetBucketWebsite()
        - .toGetEncryptionConfiguration()
        - .toGetIntelligentTieringConfiguration()
        - .toGetInventoryConfiguration()
        - .toGetJobTagging()
        - .toGetLifecycleConfiguration()
        - .toGetMetricsConfiguration()
        - .toGetMultiRegionAccessPoint()
        - .toGetMultiRegionAccessPointPolicy()
        - .toGetMultiRegionAccessPointPolicyStatus()
        - .toGetMultiRegionAccessPointRoutes()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectAttributes()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectTorrent()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionAttributes()
        - .toGetObjectVersionForReplication()
        - .toGetObjectVersionTagging()
        - .toGetObjectVersionTorrent()
        - .toGetReplicationConfiguration()
        - .toGetStorageLensConfiguration()
        - .toGetStorageLensConfigurationTagging()
        - .toGetStorageLensDashboard()
        - .toListAccessPoints()
        - .toListAccessPointsForObjectLambda()
        - .toListAllMyBuckets()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListJobs()
        - .toListMultiRegionAccessPoints()
        - .toListMultipartUploadParts()
        - .toListStorageLensConfigurations()
        - .toObjectOwnerOverrideToBucketOwner()
        - .toPutAccelerateConfiguration()
        - .toPutAccessPointConfigurationForObjectLambda()
        - .toPutAccessPointPolicy()
        - .toPutAccessPointPolicyForObjectLambda()
        - .toPutAccountPublicAccessBlock()
        - .toPutAnalyticsConfiguration()
        - .toPutBucketAcl()
        - .toPutBucketCORS()
        - .toPutBucketLogging()
        - .toPutBucketNotification()
        - .toPutBucketObjectLockConfiguration()
        - .toPutBucketOwnershipControls()
        - .toPutBucketPolicy()
        - .toPutBucketPublicAccessBlock()
        - .toPutBucketRequestPayment()
        - .toPutBucketTagging()
        - .toPutBucketVersioning()
        - .toPutBucketWebsite()
        - .toPutEncryptionConfiguration()
        - .toPutIntelligentTieringConfiguration()
        - .toPutInventoryConfiguration()
        - .toPutJobTagging()
        - .toPutLifecycleConfiguration()
        - .toPutMetricsConfiguration()
        - .toPutMultiRegionAccessPointPolicy()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toPutReplicationConfiguration()
        - .toPutStorageLensConfiguration()
        - .toPutStorageLensConfigurationTagging()
        - .toReplicateDelete()
        - .toReplicateObject()
        - .toReplicateTags()
        - .toRestoreObject()
        - .toSubmitMultiRegionAccessPointRoutes()
        - .toUpdateJobPriority()
        - .toUpdateJobStatus()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b3e2c8bf912b7c825955fa8cfbae470721e5326250b2747c9c52aeea31fd9c1c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifTlsVersion", [value, operator]))

    @jsii.member(jsii_name="ifVersionid")
    def if_versionid(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by a specific object version.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html#getobjectversion-limit-access-to-specific-version-3

        Applies to actions:

        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionAttributes()
        - .toGetObjectVersionTagging()
        - .toGetObjectVersionTorrent()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a79b9fefacc8be1ca4652d0d45bbf47872f01fdde45d15a68cc8c6f87c7449e9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifVersionid", [value, operator]))

    @jsii.member(jsii_name="ifXAmzAcl")
    def if_x_amz_acl(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by canned ACL in the request's x-amz-acl header.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html#permissions

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toCreateAccessPoint()
        - .toCreateBucket()
        - .toPutBucketAcl()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectVersionAcl()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__21c78e7d8586f9a9e086abeab6dd1886976c64a1ca222e0a5419c4f6143ce6af)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifXAmzAcl", [value, operator]))

    @jsii.member(jsii_name="ifXAmzContentSha256")
    def if_x_amz_content_sha256(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by unsigned content in your bucket.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toBypassGovernanceRetention()
        - .toCreateAccessPoint()
        - .toCreateAccessPointForObjectLambda()
        - .toCreateBucket()
        - .toCreateJob()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointForObjectLambda()
        - .toDeleteAccessPointPolicy()
        - .toDeleteAccessPointPolicyForObjectLambda()
        - .toDeleteBucket()
        - .toDeleteBucketPolicy()
        - .toDeleteBucketWebsite()
        - .toDeleteJobTagging()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toDeleteStorageLensConfiguration()
        - .toDeleteStorageLensConfigurationTagging()
        - .toDescribeJob()
        - .toGetAccelerateConfiguration()
        - .toGetAccessPoint()
        - .toGetAccessPointConfigurationForObjectLambda()
        - .toGetAccessPointForObjectLambda()
        - .toGetAccessPointPolicy()
        - .toGetAccessPointPolicyForObjectLambda()
        - .toGetAccessPointPolicyStatus()
        - .toGetAccessPointPolicyStatusForObjectLambda()
        - .toGetAccountPublicAccessBlock()
        - .toGetAnalyticsConfiguration()
        - .toGetBucketAcl()
        - .toGetBucketCORS()
        - .toGetBucketLocation()
        - .toGetBucketLogging()
        - .toGetBucketNotification()
        - .toGetBucketOwnershipControls()
        - .toGetBucketPolicy()
        - .toGetBucketPolicyStatus()
        - .toGetBucketPublicAccessBlock()
        - .toGetBucketRequestPayment()
        - .toGetBucketTagging()
        - .toGetBucketVersioning()
        - .toGetBucketWebsite()
        - .toGetEncryptionConfiguration()
        - .toGetIntelligentTieringConfiguration()
        - .toGetInventoryConfiguration()
        - .toGetJobTagging()
        - .toGetLifecycleConfiguration()
        - .toGetMetricsConfiguration()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectAttributes()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectTorrent()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionAttributes()
        - .toGetObjectVersionForReplication()
        - .toGetObjectVersionTagging()
        - .toGetObjectVersionTorrent()
        - .toGetReplicationConfiguration()
        - .toGetStorageLensConfiguration()
        - .toGetStorageLensConfigurationTagging()
        - .toGetStorageLensDashboard()
        - .toListAccessPoints()
        - .toListAccessPointsForObjectLambda()
        - .toListAllMyBuckets()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListJobs()
        - .toListMultipartUploadParts()
        - .toListStorageLensConfigurations()
        - .toObjectOwnerOverrideToBucketOwner()
        - .toPutAccelerateConfiguration()
        - .toPutAccessPointConfigurationForObjectLambda()
        - .toPutAccessPointPolicy()
        - .toPutAccessPointPolicyForObjectLambda()
        - .toPutAccountPublicAccessBlock()
        - .toPutAnalyticsConfiguration()
        - .toPutBucketAcl()
        - .toPutBucketCORS()
        - .toPutBucketLogging()
        - .toPutBucketNotification()
        - .toPutBucketOwnershipControls()
        - .toPutBucketPolicy()
        - .toPutBucketPublicAccessBlock()
        - .toPutBucketRequestPayment()
        - .toPutBucketTagging()
        - .toPutBucketVersioning()
        - .toPutBucketWebsite()
        - .toPutEncryptionConfiguration()
        - .toPutIntelligentTieringConfiguration()
        - .toPutInventoryConfiguration()
        - .toPutJobTagging()
        - .toPutLifecycleConfiguration()
        - .toPutMetricsConfiguration()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toPutReplicationConfiguration()
        - .toPutStorageLensConfiguration()
        - .toPutStorageLensConfigurationTagging()
        - .toReplicateDelete()
        - .toReplicateObject()
        - .toReplicateTags()
        - .toRestoreObject()
        - .toUpdateJobPriority()
        - .toUpdateJobStatus()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3711a0135e1d2bb0333cd948629d50ed745b9b871dc022e5242c82264eaacc48)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifXAmzContentSha256", [value, operator]))

    @jsii.member(jsii_name="ifXAmzCopySource")
    def if_x_amz_copy_source(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by copy source bucket, prefix, or object in the copy object requests.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html#putobject-limit-copy-source-3

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__578bbad2c16e210d01953835cb5fad5b74cc029dc5083574d0b736569e134c08)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifXAmzCopySource", [value, operator]))

    @jsii.member(jsii_name="ifXAmzGrantFullControl")
    def if_x_amz_grant_full_control(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by x-amz-grant-full-control (full control) header.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html#permissions

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toCreateBucket()
        - .toPutBucketAcl()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectVersionAcl()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ae655e4c1ce50f163cb4ac5e6e505c0feef0ebc6f7cb70e54c873f6805f93243)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifXAmzGrantFullControl", [value, operator]))

    @jsii.member(jsii_name="ifXAmzGrantRead")
    def if_x_amz_grant_read(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by x-amz-grant-read (read access) header.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html#permissions

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toCreateBucket()
        - .toPutBucketAcl()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectVersionAcl()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__06862f08fc97147d5d6a9acc680084b779dbc15fca4ecffec3b253d51dab357f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifXAmzGrantRead", [value, operator]))

    @jsii.member(jsii_name="ifXAmzGrantReadAcp")
    def if_x_amz_grant_read_acp(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by the x-amz-grant-read-acp (read permissions for the ACL) header.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html#permissions

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toCreateBucket()
        - .toPutBucketAcl()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectVersionAcl()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c3213a0470079ac3feca86043de4a489b36c5ffaf6b57a415689c75706b3888e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifXAmzGrantReadAcp", [value, operator]))

    @jsii.member(jsii_name="ifXAmzGrantWrite")
    def if_x_amz_grant_write(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by the x-amz-grant-write (write access) header.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html#permissions

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toCreateBucket()
        - .toPutBucketAcl()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectVersionAcl()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__db566b4c3ffa52c1a24ce77e438751de9897857f337d7648b746067bfeb79675)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifXAmzGrantWrite", [value, operator]))

    @jsii.member(jsii_name="ifXAmzGrantWriteAcp")
    def if_x_amz_grant_write_acp(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by the x-amz-grant-write-acp (write permissions for the ACL) header.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html#permissions

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toCreateBucket()
        - .toPutBucketAcl()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectVersionAcl()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__69e97fe9837b3bc213ac03d35c41ff7699a8615afb7dcb2e3bee2938e6c395c3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifXAmzGrantWriteAcp", [value, operator]))

    @jsii.member(jsii_name="ifXAmzMetadataDirective")
    def if_x_amz_metadata_directive(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by object metadata behavior (COPY or REPLACE) when objects are copied.

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fd225052e3c219e6d54b5b5587da59981a355820cf25f3827918f0094456c0a9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifXAmzMetadataDirective", [value, operator]))

    @jsii.member(jsii_name="ifXAmzObjectOwnership")
    def if_x_amz_object_ownership(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by Object Ownership.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/ensure-object-ownership.html#object-ownership-requiring-bucket-owner-enforced

        Applies to actions:

        - .toCreateBucket()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1ec9e9d8e7f84a4bc0358e9f3fad331ed1a3637f800c8c08c15b7a9d1fbb39a3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifXAmzObjectOwnership", [value, operator]))

    @jsii.member(jsii_name="ifXAmzServerSideEncryption")
    def if_x_amz_server_side_encryption(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by server-side encryption.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingServerSideEncryption.html

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()
        - .toReplicateObject()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c5fe76678f2020046adc769911c21793bd14010b7f56034dcba3a32072080083)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifXAmzServerSideEncryption", [value, operator]))

    @jsii.member(jsii_name="ifXAmzServerSideEncryptionAwsKmsKeyId")
    def if_x_amz_server_side_encryption_aws_kms_key_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by AWS KMS customer managed CMK for server-side encryption.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html#require-sse-kms

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()
        - .toReplicateObject()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__06a9727ba3cbaffa8072b4acc84cfd22c52521cc5a03fd1518eb0db6b9613a34)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifXAmzServerSideEncryptionAwsKmsKeyId", [value, operator]))

    @jsii.member(jsii_name="ifXAmzServerSideEncryptionCustomerAlgorithm")
    def if_x_amz_server_side_encryption_customer_algorithm(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by customer specified algorithm for server-side encryption.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()
        - .toReplicateObject()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d1b098c848a3b39ea8c95dda64ea19497dfbf0e6dfde14e237f2d5bcc8891815)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifXAmzServerSideEncryptionCustomerAlgorithm", [value, operator]))

    @jsii.member(jsii_name="ifXAmzStorageClass")
    def if_x_amz_storage_class(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by storage class.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html#sc-howtoset

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectVersionAcl()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4d70050ada952432da00c73dba4fd3b18d9012922a86cca0d97ab991582150ad)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifXAmzStorageClass", [value, operator]))

    @jsii.member(jsii_name="ifXAmzWebsiteRedirectLocation")
    def if_x_amz_website_redirect_location(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3":
        '''(experimental) Filters access by a specific website redirect location for buckets that are configured as static websites.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/how-to-page-redirect.html#page-redirect-using-rest-api

        Applies to actions:

        - .toBypassGovernanceRetention()
        - .toPutObject()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b13b7f8dd7a529a8534034fcce1401d07e2eb674935f76c6db307c537c4ed0b8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3", jsii.invoke(self, "ifXAmzWebsiteRedirectLocation", [value, operator]))

    @jsii.member(jsii_name="onAccesspoint")
    def on_accesspoint(
        self,
        access_point_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3":
        '''(experimental) Adds a resource of type accesspoint to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-points.html

        :param access_point_name: - Identifier for the accessPointName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e4db8e33a6dca0d640ca3b52b1c3abd621f4ca38de40fad8018242c01f9a59b0)
            check_type(argname="argument access_point_name", value=access_point_name, expected_type=type_hints["access_point_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("S3", jsii.invoke(self, "onAccesspoint", [access_point_name, account, region, partition]))

    @jsii.member(jsii_name="onBucket")
    def on_bucket(
        self,
        bucket_name: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3":
        '''(experimental) Adds a resource of type bucket to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingBucket.html

        :param bucket_name: - Identifier for the bucketName.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__edf525ceda88fd83a8380afedf1c0e1c7786a4b1556f632bd6410b2c67fdc763)
            check_type(argname="argument bucket_name", value=bucket_name, expected_type=type_hints["bucket_name"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("S3", jsii.invoke(self, "onBucket", [bucket_name, partition]))

    @jsii.member(jsii_name="onJob")
    def on_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3":
        '''(experimental) Adds a resource of type job to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/batch-ops-managing-jobs.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3fbc908ab8b712f776837c39a3fdec170c208cb5d7acc0e8e3c14b75c2856c1d)
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("S3", jsii.invoke(self, "onJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onMultiregionaccesspoint")
    def on_multiregionaccesspoint(
        self,
        access_point_alias: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3":
        '''(experimental) Adds a resource of type multiregionaccesspoint to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPointRequests.html

        :param access_point_alias: - Identifier for the accessPointAlias.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dda250a7c218b58f3d9d076ea9ed339c79c72ef8f41e42a15408570f45292836)
            check_type(argname="argument access_point_alias", value=access_point_alias, expected_type=type_hints["access_point_alias"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("S3", jsii.invoke(self, "onMultiregionaccesspoint", [access_point_alias, account, partition]))

    @jsii.member(jsii_name="onMultiregionaccesspointrequestarn")
    def on_multiregionaccesspointrequestarn(
        self,
        operation: builtins.str,
        token: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3":
        '''(experimental) Adds a resource of type multiregionaccesspointrequestarn to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPointRequests.html

        :param operation: - Identifier for the operation.
        :param token: - Identifier for the token.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d6b5f3ede3902c93fea7d9671036dfd8472622e8a7c43bb1c93f265ed7e49a5f)
            check_type(argname="argument operation", value=operation, expected_type=type_hints["operation"])
            check_type(argname="argument token", value=token, expected_type=type_hints["token"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("S3", jsii.invoke(self, "onMultiregionaccesspointrequestarn", [operation, token, account, partition]))

    @jsii.member(jsii_name="onObject")
    def on_object(
        self,
        bucket_name: builtins.str,
        object_name: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3":
        '''(experimental) Adds a resource of type object to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingObjects.html

        :param bucket_name: - Identifier for the bucketName.
        :param object_name: - Identifier for the objectName.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1286302e2fa36c1c44786400c6c676121fcd23c252e646092899e5d2248e1c78)
            check_type(argname="argument bucket_name", value=bucket_name, expected_type=type_hints["bucket_name"])
            check_type(argname="argument object_name", value=object_name, expected_type=type_hints["object_name"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("S3", jsii.invoke(self, "onObject", [bucket_name, object_name, partition]))

    @jsii.member(jsii_name="onObjectlambdaaccesspoint")
    def on_objectlambdaaccesspoint(
        self,
        access_point_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3":
        '''(experimental) Adds a resource of type objectlambdaaccesspoint to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/transforming-objects.html

        :param access_point_name: - Identifier for the accessPointName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__03610984c767ca572111b297111a86953e1f7d714fd398bb09f7eb1c9bfc87b1)
            check_type(argname="argument access_point_name", value=access_point_name, expected_type=type_hints["access_point_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("S3", jsii.invoke(self, "onObjectlambdaaccesspoint", [access_point_name, account, region, partition]))

    @jsii.member(jsii_name="onStoragelensconfiguration")
    def on_storagelensconfiguration(
        self,
        config_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3":
        '''(experimental) Adds a resource of type storagelensconfiguration to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage_lens.html

        :param config_id: - Identifier for the configId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eb51464842dc4c5e08471bf802776ead766964a0ccf7a3960aab35ed02a2af1a)
            check_type(argname="argument config_id", value=config_id, expected_type=type_hints["config_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("S3", jsii.invoke(self, "onStoragelensconfiguration", [config_id, account, region, partition]))

    @jsii.member(jsii_name="toAbortMultipartUpload")
    def to_abort_multipart_upload(self) -> "S3":
        '''(experimental) Grants permission to abort a multipart upload.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointArn()
        - .ifDataAccessPointAccount()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_AbortMultipartUpload.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toAbortMultipartUpload", []))

    @jsii.member(jsii_name="toBypassGovernanceRetention")
    def to_bypass_governance_retention(self) -> "S3":
        '''(experimental) Grants permission to allow circumvention of governance-mode object retention settings.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifRequestObjectTag()
        - .ifRequestObjectTagKeys()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzAcl()
        - .ifXAmzContentSha256()
        - .ifXAmzCopySource()
        - .ifXAmzGrantFullControl()
        - .ifXAmzGrantRead()
        - .ifXAmzGrantReadAcp()
        - .ifXAmzGrantWrite()
        - .ifXAmzGrantWriteAcp()
        - .ifXAmzMetadataDirective()
        - .ifXAmzServerSideEncryption()
        - .ifXAmzServerSideEncryptionAwsKmsKeyId()
        - .ifXAmzServerSideEncryptionCustomerAlgorithm()
        - .ifXAmzStorageClass()
        - .ifXAmzWebsiteRedirectLocation()
        - .ifObjectLockMode()
        - .ifObjectLockRetainUntilDate()
        - .ifObjectLockRemainingRetentionDays()
        - .ifObjectLockLegalHold()

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-managing.html#object-lock-managing-bypass

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toBypassGovernanceRetention", []))

    @jsii.member(jsii_name="toCreateAccessPoint")
    def to_create_access_point(self) -> "S3":
        '''(experimental) Grants permission to create a new access point.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifLocationconstraint()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzAcl()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_CreateAccessPoint.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toCreateAccessPoint", []))

    @jsii.member(jsii_name="toCreateAccessPointForObjectLambda")
    def to_create_access_point_for_object_lambda(self) -> "S3":
        '''(experimental) Grants permission to create an object lambda enabled accesspoint.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_CreateAccessPointForObjectLambda.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toCreateAccessPointForObjectLambda", []))

    @jsii.member(jsii_name="toCreateBucket")
    def to_create_bucket(self) -> "S3":
        '''(experimental) Grants permission to create a new bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifLocationconstraint()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzAcl()
        - .ifXAmzContentSha256()
        - .ifXAmzGrantFullControl()
        - .ifXAmzGrantRead()
        - .ifXAmzGrantReadAcp()
        - .ifXAmzGrantWrite()
        - .ifXAmzGrantWriteAcp()
        - .ifXAmzObjectOwnership()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucket.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toCreateBucket", []))

    @jsii.member(jsii_name="toCreateJob")
    def to_create_job(self) -> "S3":
        '''(experimental) Grants permission to create a new Amazon S3 Batch Operations job.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()
        - .ifRequestJobPriority()
        - .ifRequestJobOperation()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_CreateJob.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toCreateJob", []))

    @jsii.member(jsii_name="toCreateMultiRegionAccessPoint")
    def to_create_multi_region_access_point(self) -> "S3":
        '''(experimental) Grants permission to create a new Multi-Region Access Point.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureversion()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_CreateMultiRegionAccessPoint.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toCreateMultiRegionAccessPoint", []))

    @jsii.member(jsii_name="toDeleteAccessPoint")
    def to_delete_access_point(self) -> "S3":
        '''(experimental) Grants permission to delete the access point named in the URI.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointArn()
        - .ifDataAccessPointAccount()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteAccessPoint.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteAccessPoint", []))

    @jsii.member(jsii_name="toDeleteAccessPointForObjectLambda")
    def to_delete_access_point_for_object_lambda(self) -> "S3":
        '''(experimental) Grants permission to delete the object lambda enabled access point named in the URI.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointArn()
        - .ifDataAccessPointAccount()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteAccessPointForObjectLambda.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteAccessPointForObjectLambda", []))

    @jsii.member(jsii_name="toDeleteAccessPointPolicy")
    def to_delete_access_point_policy(self) -> "S3":
        '''(experimental) Grants permission to delete the policy on a specified access point.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointArn()
        - .ifDataAccessPointAccount()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteAccessPointPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteAccessPointPolicy", []))

    @jsii.member(jsii_name="toDeleteAccessPointPolicyForObjectLambda")
    def to_delete_access_point_policy_for_object_lambda(self) -> "S3":
        '''(experimental) Grants permission to delete the policy on a specified object lambda enabled access point.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointArn()
        - .ifDataAccessPointAccount()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteAccessPointPolicyForObjectLambda.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteAccessPointPolicyForObjectLambda", []))

    @jsii.member(jsii_name="toDeleteBucket")
    def to_delete_bucket(self) -> "S3":
        '''(experimental) Grants permission to delete the bucket named in the URI.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteBucket", []))

    @jsii.member(jsii_name="toDeleteBucketPolicy")
    def to_delete_bucket_policy(self) -> "S3":
        '''(experimental) Grants permission to delete the policy on a specified bucket.

        Access Level: Permissions management

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteBucketPolicy", []))

    @jsii.member(jsii_name="toDeleteBucketWebsite")
    def to_delete_bucket_website(self) -> "S3":
        '''(experimental) Grants permission to remove the website configuration for a bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketWebsite.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteBucketWebsite", []))

    @jsii.member(jsii_name="toDeleteJobTagging")
    def to_delete_job_tagging(self) -> "S3":
        '''(experimental) Grants permission to remove tags from an existing Amazon S3 Batch Operations job.

        Access Level: Tagging

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()
        - .ifExistingJobPriority()
        - .ifExistingJobOperation()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteJobTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteJobTagging", []))

    @jsii.member(jsii_name="toDeleteMultiRegionAccessPoint")
    def to_delete_multi_region_access_point(self) -> "S3":
        '''(experimental) Grants permission to delete the Multi-Region Access Point named in the URI.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureversion()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteMultiRegionAccessPoint.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteMultiRegionAccessPoint", []))

    @jsii.member(jsii_name="toDeleteObject")
    def to_delete_object(self) -> "S3":
        '''(experimental) Grants permission to remove the null version of an object and insert a delete marker, which becomes the current version of the object.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObject.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteObject", []))

    @jsii.member(jsii_name="toDeleteObjectTagging")
    def to_delete_object_tagging(self) -> "S3":
        '''(experimental) Grants permission to use the tagging subresource to remove the entire tag set from the specified object.

        Access Level: Tagging

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteObjectTagging", []))

    @jsii.member(jsii_name="toDeleteObjectVersion")
    def to_delete_object_version(self) -> "S3":
        '''(experimental) Grants permission to remove a specific version of an object.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifVersionid()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObject.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteObjectVersion", []))

    @jsii.member(jsii_name="toDeleteObjectVersionTagging")
    def to_delete_object_version_tagging(self) -> "S3":
        '''(experimental) Grants permission to remove the entire tag set for a specific version of the object.

        Access Level: Tagging

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifVersionid()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteObjectVersionTagging", []))

    @jsii.member(jsii_name="toDeleteStorageLensConfiguration")
    def to_delete_storage_lens_configuration(self) -> "S3":
        '''(experimental) Grants permission to delete an existing Amazon S3 Storage Lens configuration.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteStorageLensConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteStorageLensConfiguration", []))

    @jsii.member(jsii_name="toDeleteStorageLensConfigurationTagging")
    def to_delete_storage_lens_configuration_tagging(self) -> "S3":
        '''(experimental) Grants permission to remove tags from an existing Amazon S3 Storage Lens configuration.

        Access Level: Tagging

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteStorageLensConfigurationTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDeleteStorageLensConfigurationTagging", []))

    @jsii.member(jsii_name="toDescribeJob")
    def to_describe_job(self) -> "S3":
        '''(experimental) Grants permission to retrieve the configuration parameters and status for a batch operations job.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DescribeJob.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDescribeJob", []))

    @jsii.member(jsii_name="toDescribeMultiRegionAccessPointOperation")
    def to_describe_multi_region_access_point_operation(self) -> "S3":
        '''(experimental) Grants permission to retrieve the configurations for a Multi-Region Access Point.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureversion()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DescribeMultiRegionAccessPointOperation.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toDescribeMultiRegionAccessPointOperation", []))

    @jsii.member(jsii_name="toGetAccelerateConfiguration")
    def to_get_accelerate_configuration(self) -> "S3":
        '''(experimental) Grants permission to uses the accelerate subresource to return the Transfer Acceleration state of a bucket, which is either Enabled or Suspended.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAccelerateConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetAccelerateConfiguration", []))

    @jsii.member(jsii_name="toGetAccessPoint")
    def to_get_access_point(self) -> "S3":
        '''(experimental) Grants permission to return configuration information about the specified access point.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPoint.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetAccessPoint", []))

    @jsii.member(jsii_name="toGetAccessPointConfigurationForObjectLambda")
    def to_get_access_point_configuration_for_object_lambda(self) -> "S3":
        '''(experimental) Grants permission to retrieve the configuration of the object lambda enabled access point.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointArn()
        - .ifDataAccessPointAccount()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointConfigurationForObjectLambda.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetAccessPointConfigurationForObjectLambda", []))

    @jsii.member(jsii_name="toGetAccessPointForObjectLambda")
    def to_get_access_point_for_object_lambda(self) -> "S3":
        '''(experimental) Grants permission to create an object lambda enabled accesspoint.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointForObjectLambda.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetAccessPointForObjectLambda", []))

    @jsii.member(jsii_name="toGetAccessPointPolicy")
    def to_get_access_point_policy(self) -> "S3":
        '''(experimental) Grants permission to returns the access point policy associated with the specified access point.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetAccessPointPolicy", []))

    @jsii.member(jsii_name="toGetAccessPointPolicyForObjectLambda")
    def to_get_access_point_policy_for_object_lambda(self) -> "S3":
        '''(experimental) Grants permission to returns the access point policy associated with the specified object lambda enabled access point.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointPolicyForObjectLambda.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetAccessPointPolicyForObjectLambda", []))

    @jsii.member(jsii_name="toGetAccessPointPolicyStatus")
    def to_get_access_point_policy_status(self) -> "S3":
        '''(experimental) Grants permission to return the policy status for a specific access point policy.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointPolicyStatus.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetAccessPointPolicyStatus", []))

    @jsii.member(jsii_name="toGetAccessPointPolicyStatusForObjectLambda")
    def to_get_access_point_policy_status_for_object_lambda(self) -> "S3":
        '''(experimental) Grants permission to return the policy status for a specific object lambda access point policy.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointPolicyStatusForObjectLambda.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetAccessPointPolicyStatusForObjectLambda", []))

    @jsii.member(jsii_name="toGetAccountPublicAccessBlock")
    def to_get_account_public_access_block(self) -> "S3":
        '''(experimental) Grants permission to retrieve the PublicAccessBlock configuration for an AWS account.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetPublicAccessBlock.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetAccountPublicAccessBlock", []))

    @jsii.member(jsii_name="toGetAnalyticsConfiguration")
    def to_get_analytics_configuration(self) -> "S3":
        '''(experimental) Grants permission to get an analytics configuration from an Amazon S3 bucket, identified by the analytics configuration ID.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAnalyticsConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetAnalyticsConfiguration", []))

    @jsii.member(jsii_name="toGetBucketAcl")
    def to_get_bucket_acl(self) -> "S3":
        '''(experimental) Grants permission to use the acl subresource to return the access control list (ACL) of an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAcl.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketAcl", []))

    @jsii.member(jsii_name="toGetBucketCORS")
    def to_get_bucket_cors(self) -> "S3":
        '''(experimental) Grants permission to return the CORS configuration information set for an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketCors.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketCORS", []))

    @jsii.member(jsii_name="toGetBucketLocation")
    def to_get_bucket_location(self) -> "S3":
        '''(experimental) Grants permission to return the Region that an Amazon S3 bucket resides in.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLocation.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketLocation", []))

    @jsii.member(jsii_name="toGetBucketLogging")
    def to_get_bucket_logging(self) -> "S3":
        '''(experimental) Grants permission to return the logging status of an Amazon S3 bucket and the permissions users have to view or modify that status.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLogging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketLogging", []))

    @jsii.member(jsii_name="toGetBucketNotification")
    def to_get_bucket_notification(self) -> "S3":
        '''(experimental) Grants permission to get the notification configuration of an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketNotification.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketNotification", []))

    @jsii.member(jsii_name="toGetBucketObjectLockConfiguration")
    def to_get_bucket_object_lock_configuration(self) -> "S3":
        '''(experimental) Grants permission to get the Object Lock configuration of an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifSignatureversion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectLockConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketObjectLockConfiguration", []))

    @jsii.member(jsii_name="toGetBucketOwnershipControls")
    def to_get_bucket_ownership_controls(self) -> "S3":
        '''(experimental) Grants permission to retrieve ownership controls on a bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketOwnershipControls.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketOwnershipControls", []))

    @jsii.member(jsii_name="toGetBucketPolicy")
    def to_get_bucket_policy(self) -> "S3":
        '''(experimental) Grants permission to return the policy of the specified bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketPolicy", []))

    @jsii.member(jsii_name="toGetBucketPolicyStatus")
    def to_get_bucket_policy_status(self) -> "S3":
        '''(experimental) Grants permission to retrieve the policy status for a specific Amazon S3 bucket, which indicates whether the bucket is public.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketPolicyStatus.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketPolicyStatus", []))

    @jsii.member(jsii_name="toGetBucketPublicAccessBlock")
    def to_get_bucket_public_access_block(self) -> "S3":
        '''(experimental) Grants permission to retrieve the PublicAccessBlock configuration for an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetPublicAccessBlock.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketPublicAccessBlock", []))

    @jsii.member(jsii_name="toGetBucketRequestPayment")
    def to_get_bucket_request_payment(self) -> "S3":
        '''(experimental) Grants permission to return the request payment configuration for an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketRequestPayment.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketRequestPayment", []))

    @jsii.member(jsii_name="toGetBucketTagging")
    def to_get_bucket_tagging(self) -> "S3":
        '''(experimental) Grants permission to return the tag set associated with an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketTagging", []))

    @jsii.member(jsii_name="toGetBucketVersioning")
    def to_get_bucket_versioning(self) -> "S3":
        '''(experimental) Grants permission to return the versioning state of an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketVersioning.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketVersioning", []))

    @jsii.member(jsii_name="toGetBucketWebsite")
    def to_get_bucket_website(self) -> "S3":
        '''(experimental) Grants permission to return the website configuration for an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketWebsite.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetBucketWebsite", []))

    @jsii.member(jsii_name="toGetEncryptionConfiguration")
    def to_get_encryption_configuration(self) -> "S3":
        '''(experimental) Grants permission to return the default encryption configuration an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketEncryption.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetEncryptionConfiguration", []))

    @jsii.member(jsii_name="toGetIntelligentTieringConfiguration")
    def to_get_intelligent_tiering_configuration(self) -> "S3":
        '''(experimental) Grants permission to get an or list all Amazon S3 Intelligent Tiering configuration in a S3 Bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketIntelligentTieringConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetIntelligentTieringConfiguration", []))

    @jsii.member(jsii_name="toGetInventoryConfiguration")
    def to_get_inventory_configuration(self) -> "S3":
        '''(experimental) Grants permission to return an inventory configuration from an Amazon S3 bucket, identified by the inventory configuration ID.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketInventoryConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetInventoryConfiguration", []))

    @jsii.member(jsii_name="toGetJobTagging")
    def to_get_job_tagging(self) -> "S3":
        '''(experimental) Grants permission to return the tag set of an existing Amazon S3 Batch Operations job.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetJobTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetJobTagging", []))

    @jsii.member(jsii_name="toGetLifecycleConfiguration")
    def to_get_lifecycle_configuration(self) -> "S3":
        '''(experimental) Grants permission to return the lifecycle configuration information set on an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLifecycleConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetLifecycleConfiguration", []))

    @jsii.member(jsii_name="toGetMetricsConfiguration")
    def to_get_metrics_configuration(self) -> "S3":
        '''(experimental) Grants permission to get a metrics configuration from an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketMetricsConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetMetricsConfiguration", []))

    @jsii.member(jsii_name="toGetMultiRegionAccessPoint")
    def to_get_multi_region_access_point(self) -> "S3":
        '''(experimental) Grants permission to return configuration information about the specified Multi-Region Access Point.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureversion()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetMultiRegionAccessPoint.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetMultiRegionAccessPoint", []))

    @jsii.member(jsii_name="toGetMultiRegionAccessPointPolicy")
    def to_get_multi_region_access_point_policy(self) -> "S3":
        '''(experimental) Grants permission to returns the access point policy associated with the specified Multi-Region Access Point.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureversion()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetMultiRegionAccessPointPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetMultiRegionAccessPointPolicy", []))

    @jsii.member(jsii_name="toGetMultiRegionAccessPointPolicyStatus")
    def to_get_multi_region_access_point_policy_status(self) -> "S3":
        '''(experimental) Grants permission to return the policy status for a specific Multi-Region Access Point policy.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureversion()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetMultiRegionAccessPointPolicyStatus.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetMultiRegionAccessPointPolicyStatus", []))

    @jsii.member(jsii_name="toGetMultiRegionAccessPointRoutes")
    def to_get_multi_region_access_point_routes(self) -> "S3":
        '''(experimental) Grants permission to return the route configuration for a Multi-Region Access Point.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureversion()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetMultiRegionAccessPointRoutes.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetMultiRegionAccessPointRoutes", []))

    @jsii.member(jsii_name="toGetObject")
    def to_get_object(self) -> "S3":
        '''(experimental) Grants permission to retrieve objects from Amazon S3.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObject", []))

    @jsii.member(jsii_name="toGetObjectAcl")
    def to_get_object_acl(self) -> "S3":
        '''(experimental) Grants permission to return the access control list (ACL) of an object.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectAcl.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectAcl", []))

    @jsii.member(jsii_name="toGetObjectAttributes")
    def to_get_object_attributes(self) -> "S3":
        '''(experimental) Grants permission to retrieve attributes related to a specific object.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectAttributes.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectAttributes", []))

    @jsii.member(jsii_name="toGetObjectLegalHold")
    def to_get_object_legal_hold(self) -> "S3":
        '''(experimental) Grants permission to get an object's current Legal Hold status.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectLegalHold.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectLegalHold", []))

    @jsii.member(jsii_name="toGetObjectRetention")
    def to_get_object_retention(self) -> "S3":
        '''(experimental) Grants permission to retrieve the retention settings for an object.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectRetention.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectRetention", []))

    @jsii.member(jsii_name="toGetObjectTagging")
    def to_get_object_tagging(self) -> "S3":
        '''(experimental) Grants permission to return the tag set of an object.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectTagging", []))

    @jsii.member(jsii_name="toGetObjectTorrent")
    def to_get_object_torrent(self) -> "S3":
        '''(experimental) Grants permission to return torrent files from an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectTorrent.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectTorrent", []))

    @jsii.member(jsii_name="toGetObjectVersion")
    def to_get_object_version(self) -> "S3":
        '''(experimental) Grants permission to retrieve a specific version of an object.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifVersionid()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectVersion", []))

    @jsii.member(jsii_name="toGetObjectVersionAcl")
    def to_get_object_version_acl(self) -> "S3":
        '''(experimental) Grants permission to return the access control list (ACL) of a specific object version.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifVersionid()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectAcl.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectVersionAcl", []))

    @jsii.member(jsii_name="toGetObjectVersionAttributes")
    def to_get_object_version_attributes(self) -> "S3":
        '''(experimental) Grants permission to retrieve attributes related to a specific version of an object.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifVersionid()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectAttributes.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectVersionAttributes", []))

    @jsii.member(jsii_name="toGetObjectVersionForReplication")
    def to_get_object_version_for_replication(self) -> "S3":
        '''(experimental) Grants permission to replicate both unencrypted objects and objects encrypted with SSE-S3 or SSE-KMS.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-config-for-kms-objects.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectVersionForReplication", []))

    @jsii.member(jsii_name="toGetObjectVersionTagging")
    def to_get_object_version_tagging(self) -> "S3":
        '''(experimental) Grants permission to return the tag set for a specific version of the object.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifVersionid()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectVersionTagging", []))

    @jsii.member(jsii_name="toGetObjectVersionTorrent")
    def to_get_object_version_torrent(self) -> "S3":
        '''(experimental) Grants permission to get Torrent files about a different version using the versionId subresource.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifVersionid()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectTorrent.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetObjectVersionTorrent", []))

    @jsii.member(jsii_name="toGetReplicationConfiguration")
    def to_get_replication_configuration(self) -> "S3":
        '''(experimental) Grants permission to get the replication configuration information set on an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketReplication.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetReplicationConfiguration", []))

    @jsii.member(jsii_name="toGetStorageLensConfiguration")
    def to_get_storage_lens_configuration(self) -> "S3":
        '''(experimental) Grants permission to get an Amazon S3 Storage Lens configuration.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetStorageLensConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetStorageLensConfiguration", []))

    @jsii.member(jsii_name="toGetStorageLensConfigurationTagging")
    def to_get_storage_lens_configuration_tagging(self) -> "S3":
        '''(experimental) Grants permission to get the tag set of an existing Amazon S3 Storage Lens configuration.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetStorageLensConfigurationTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetStorageLensConfigurationTagging", []))

    @jsii.member(jsii_name="toGetStorageLensDashboard")
    def to_get_storage_lens_dashboard(self) -> "S3":
        '''(experimental) Grants permission to get an Amazon S3 Storage Lens dashboard.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage_lens_dashboard.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toGetStorageLensDashboard", []))

    @jsii.member(jsii_name="toInitiateReplication")
    def to_initiate_replication(self) -> "S3":
        '''(experimental) Grants permission to initiate the replication process by setting replication status of an object to pending.

        Access Level: Write

        Possible conditions:

        - .ifResourceAccount()

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toInitiateReplication", []))

    @jsii.member(jsii_name="toListAccessPoints")
    def to_list_access_points(self) -> "S3":
        '''(experimental) Grants permission to list access points.

        Access Level: List

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_ListAccessPoints.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toListAccessPoints", []))

    @jsii.member(jsii_name="toListAccessPointsForObjectLambda")
    def to_list_access_points_for_object_lambda(self) -> "S3":
        '''(experimental) Grants permission to list object lambda enabled accesspoints.

        Access Level: List

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_ListAccessPointsForObjectLambda.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toListAccessPointsForObjectLambda", []))

    @jsii.member(jsii_name="toListAllMyBuckets")
    def to_list_all_my_buckets(self) -> "S3":
        '''(experimental) Grants permission to list all buckets owned by the authenticated sender of the request.

        Access Level: List

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListBuckets.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toListAllMyBuckets", []))

    @jsii.member(jsii_name="toListBucket")
    def to_list_bucket(self) -> "S3":
        '''(experimental) Grants permission to list some or all of the objects in an Amazon S3 bucket (up to 1000).

        Access Level: List

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifDelimiter()
        - .ifMaxKeys()
        - .ifPrefix()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toListBucket", []))

    @jsii.member(jsii_name="toListBucketMultipartUploads")
    def to_list_bucket_multipart_uploads(self) -> "S3":
        '''(experimental) Grants permission to list in-progress multipart uploads.

        Access Level: List

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListMultipartUploads.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toListBucketMultipartUploads", []))

    @jsii.member(jsii_name="toListBucketVersions")
    def to_list_bucket_versions(self) -> "S3":
        '''(experimental) Grants permission to list metadata about all the versions of objects in an Amazon S3 bucket.

        Access Level: List

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifDelimiter()
        - .ifMaxKeys()
        - .ifPrefix()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectVersions.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toListBucketVersions", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "S3":
        '''(experimental) Grants permission to list current jobs and jobs that have ended recently.

        Access Level: List

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_ListJobs.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListMultipartUploadParts")
    def to_list_multipart_upload_parts(self) -> "S3":
        '''(experimental) Grants permission to list the parts that have been uploaded for a specific multipart upload.

        Access Level: List

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListParts.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toListMultipartUploadParts", []))

    @jsii.member(jsii_name="toListMultiRegionAccessPoints")
    def to_list_multi_region_access_points(self) -> "S3":
        '''(experimental) Grants permission to list Multi-Region Access Points.

        Access Level: List

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureversion()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_ListMultiRegionAccessPoints.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toListMultiRegionAccessPoints", []))

    @jsii.member(jsii_name="toListStorageLensConfigurations")
    def to_list_storage_lens_configurations(self) -> "S3":
        '''(experimental) Grants permission to list Amazon S3 Storage Lens configurations.

        Access Level: List

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_ListStorageLensConfigurations.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toListStorageLensConfigurations", []))

    @jsii.member(jsii_name="toObjectOwnerOverrideToBucketOwner")
    def to_object_owner_override_to_bucket_owner(self) -> "S3":
        '''(experimental) Grants permission to change replica ownership.

        Access Level: Permissions management

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-change-owner.html#repl-ownership-add-role-permission

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toObjectOwnerOverrideToBucketOwner", []))

    @jsii.member(jsii_name="toPutAccelerateConfiguration")
    def to_put_accelerate_configuration(self) -> "S3":
        '''(experimental) Grants permission to use the accelerate subresource to set the Transfer Acceleration state of an existing S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketAccelerateConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutAccelerateConfiguration", []))

    @jsii.member(jsii_name="toPutAccessPointConfigurationForObjectLambda")
    def to_put_access_point_configuration_for_object_lambda(self) -> "S3":
        '''(experimental) Grants permission to set the configuration of the object lambda enabled access point.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointArn()
        - .ifDataAccessPointAccount()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutAccessPointConfigurationForObjectLambda.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutAccessPointConfigurationForObjectLambda", []))

    @jsii.member(jsii_name="toPutAccessPointPolicy")
    def to_put_access_point_policy(self) -> "S3":
        '''(experimental) Grants permission to associate an access policy with a specified access point.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutAccessPointPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutAccessPointPolicy", []))

    @jsii.member(jsii_name="toPutAccessPointPolicyForObjectLambda")
    def to_put_access_point_policy_for_object_lambda(self) -> "S3":
        '''(experimental) Grants permission to associate an access policy with a specified object lambda enabled access point.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutAccessPointPolicyForObjectLambda.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutAccessPointPolicyForObjectLambda", []))

    @jsii.member(jsii_name="toPutAccessPointPublicAccessBlock")
    def to_put_access_point_public_access_block(self) -> "S3":
        '''(experimental) Grants permission to associate public access block configurations with a specified access point, while creating a access point.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html#access-control-block-public-access-examples-access-point

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutAccessPointPublicAccessBlock", []))

    @jsii.member(jsii_name="toPutAccountPublicAccessBlock")
    def to_put_account_public_access_block(self) -> "S3":
        '''(experimental) Grants permission to create or modify the PublicAccessBlock configuration for an AWS account.

        Access Level: Permissions management

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutPublicAccessBlock.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutAccountPublicAccessBlock", []))

    @jsii.member(jsii_name="toPutAnalyticsConfiguration")
    def to_put_analytics_configuration(self) -> "S3":
        '''(experimental) Grants permission to set an analytics configuration for the bucket, specified by the analytics configuration ID.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketAnalyticsConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutAnalyticsConfiguration", []))

    @jsii.member(jsii_name="toPutBucketAcl")
    def to_put_bucket_acl(self) -> "S3":
        '''(experimental) Grants permission to set the permissions on an existing bucket using access control lists (ACLs).

        Access Level: Permissions management

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzAcl()
        - .ifXAmzContentSha256()
        - .ifXAmzGrantFullControl()
        - .ifXAmzGrantRead()
        - .ifXAmzGrantReadAcp()
        - .ifXAmzGrantWrite()
        - .ifXAmzGrantWriteAcp()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketAcl.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketAcl", []))

    @jsii.member(jsii_name="toPutBucketCORS")
    def to_put_bucket_cors(self) -> "S3":
        '''(experimental) Grants permission to set the CORS configuration for an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketCors.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketCORS", []))

    @jsii.member(jsii_name="toPutBucketLogging")
    def to_put_bucket_logging(self) -> "S3":
        '''(experimental) Grants permission to set the logging parameters for an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketLogging", []))

    @jsii.member(jsii_name="toPutBucketNotification")
    def to_put_bucket_notification(self) -> "S3":
        '''(experimental) Grants permission to receive notifications when certain events happen in an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketNotification.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketNotification", []))

    @jsii.member(jsii_name="toPutBucketObjectLockConfiguration")
    def to_put_bucket_object_lock_configuration(self) -> "S3":
        '''(experimental) Grants permission to put Object Lock configuration on a specific bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifTlsVersion()
        - .ifSignatureversion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectLockConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketObjectLockConfiguration", []))

    @jsii.member(jsii_name="toPutBucketOwnershipControls")
    def to_put_bucket_ownership_controls(self) -> "S3":
        '''(experimental) Grants permission to add, replace or delete ownership controls on a bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketOwnershipControls.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketOwnershipControls", []))

    @jsii.member(jsii_name="toPutBucketPolicy")
    def to_put_bucket_policy(self) -> "S3":
        '''(experimental) Grants permission to add or replace a bucket policy on a bucket.

        Access Level: Permissions management

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketPolicy", []))

    @jsii.member(jsii_name="toPutBucketPublicAccessBlock")
    def to_put_bucket_public_access_block(self) -> "S3":
        '''(experimental) Grants permission to create or modify the PublicAccessBlock configuration for a specific Amazon S3 bucket.

        Access Level: Permissions management

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutPublicAccessBlock.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketPublicAccessBlock", []))

    @jsii.member(jsii_name="toPutBucketRequestPayment")
    def to_put_bucket_request_payment(self) -> "S3":
        '''(experimental) Grants permission to set the request payment configuration of a bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketRequestPayment.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketRequestPayment", []))

    @jsii.member(jsii_name="toPutBucketTagging")
    def to_put_bucket_tagging(self) -> "S3":
        '''(experimental) Grants permission to add a set of tags to an existing Amazon S3 bucket.

        Access Level: Tagging

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketTagging", []))

    @jsii.member(jsii_name="toPutBucketVersioning")
    def to_put_bucket_versioning(self) -> "S3":
        '''(experimental) Grants permission to set the versioning state of an existing Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketVersioning.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketVersioning", []))

    @jsii.member(jsii_name="toPutBucketWebsite")
    def to_put_bucket_website(self) -> "S3":
        '''(experimental) Grants permission to set the configuration of the website that is specified in the website subresource.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutBucketWebsite", []))

    @jsii.member(jsii_name="toPutEncryptionConfiguration")
    def to_put_encryption_configuration(self) -> "S3":
        '''(experimental) Grants permission to set the encryption configuration for an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutEncryptionConfiguration", []))

    @jsii.member(jsii_name="toPutIntelligentTieringConfiguration")
    def to_put_intelligent_tiering_configuration(self) -> "S3":
        '''(experimental) Grants permission to create new or update or delete an existing Amazon S3 Intelligent Tiering configuration.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketIntelligentTieringConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutIntelligentTieringConfiguration", []))

    @jsii.member(jsii_name="toPutInventoryConfiguration")
    def to_put_inventory_configuration(self) -> "S3":
        '''(experimental) Grants permission to add an inventory configuration to the bucket, identified by the inventory ID.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketInventoryConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutInventoryConfiguration", []))

    @jsii.member(jsii_name="toPutJobTagging")
    def to_put_job_tagging(self) -> "S3":
        '''(experimental) Grants permission to replace tags on an existing Amazon S3 Batch Operations job.

        Access Level: Tagging

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()
        - .ifExistingJobPriority()
        - .ifExistingJobOperation()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutJobTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutJobTagging", []))

    @jsii.member(jsii_name="toPutLifecycleConfiguration")
    def to_put_lifecycle_configuration(self) -> "S3":
        '''(experimental) Grants permission to create a new lifecycle configuration for the bucket or replace an existing lifecycle configuration.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLifecycleConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutLifecycleConfiguration", []))

    @jsii.member(jsii_name="toPutMetricsConfiguration")
    def to_put_metrics_configuration(self) -> "S3":
        '''(experimental) Grants permission to set or update a metrics configuration for the CloudWatch request metrics from an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketMetricsConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutMetricsConfiguration", []))

    @jsii.member(jsii_name="toPutMultiRegionAccessPointPolicy")
    def to_put_multi_region_access_point_policy(self) -> "S3":
        '''(experimental) Grants permission to associate an access policy with a specified Multi-Region Access Point.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureversion()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutMultiRegionAccessPointPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutMultiRegionAccessPointPolicy", []))

    @jsii.member(jsii_name="toPutObject")
    def to_put_object(self) -> "S3":
        '''(experimental) Grants permission to add an object to a bucket.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifRequestObjectTag()
        - .ifRequestObjectTagKeys()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzAcl()
        - .ifXAmzContentSha256()
        - .ifXAmzCopySource()
        - .ifXAmzGrantFullControl()
        - .ifXAmzGrantRead()
        - .ifXAmzGrantReadAcp()
        - .ifXAmzGrantWrite()
        - .ifXAmzGrantWriteAcp()
        - .ifXAmzMetadataDirective()
        - .ifXAmzServerSideEncryption()
        - .ifXAmzServerSideEncryptionAwsKmsKeyId()
        - .ifXAmzServerSideEncryptionCustomerAlgorithm()
        - .ifXAmzStorageClass()
        - .ifXAmzWebsiteRedirectLocation()
        - .ifObjectLockMode()
        - .ifObjectLockRetainUntilDate()
        - .ifObjectLockRemainingRetentionDays()
        - .ifObjectLockLegalHold()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutObject", []))

    @jsii.member(jsii_name="toPutObjectAcl")
    def to_put_object_acl(self) -> "S3":
        '''(experimental) Grants permission to set the access control list (ACL) permissions for new or existing objects in an S3 bucket.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzAcl()
        - .ifXAmzContentSha256()
        - .ifXAmzGrantFullControl()
        - .ifXAmzGrantRead()
        - .ifXAmzGrantReadAcp()
        - .ifXAmzGrantWrite()
        - .ifXAmzGrantWriteAcp()
        - .ifXAmzStorageClass()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectAcl.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutObjectAcl", []))

    @jsii.member(jsii_name="toPutObjectLegalHold")
    def to_put_object_legal_hold(self) -> "S3":
        '''(experimental) Grants permission to apply a Legal Hold configuration to the specified object.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()
        - .ifObjectLockLegalHold()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectLegalHold.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutObjectLegalHold", []))

    @jsii.member(jsii_name="toPutObjectRetention")
    def to_put_object_retention(self) -> "S3":
        '''(experimental) Grants permission to place an Object Retention configuration on an object.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()
        - .ifObjectLockMode()
        - .ifObjectLockRetainUntilDate()
        - .ifObjectLockRemainingRetentionDays()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectRetention.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutObjectRetention", []))

    @jsii.member(jsii_name="toPutObjectTagging")
    def to_put_object_tagging(self) -> "S3":
        '''(experimental) Grants permission to set the supplied tag-set to an object that already exists in a bucket.

        Access Level: Tagging

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifRequestObjectTag()
        - .ifRequestObjectTagKeys()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutObjectTagging", []))

    @jsii.member(jsii_name="toPutObjectVersionAcl")
    def to_put_object_version_acl(self) -> "S3":
        '''(experimental) Grants permission to use the acl subresource to set the access control list (ACL) permissions for an object that already exists in a bucket.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifVersionid()
        - .ifXAmzAcl()
        - .ifXAmzContentSha256()
        - .ifXAmzGrantFullControl()
        - .ifXAmzGrantRead()
        - .ifXAmzGrantReadAcp()
        - .ifXAmzGrantWrite()
        - .ifXAmzGrantWriteAcp()
        - .ifXAmzStorageClass()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectAcl.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutObjectVersionAcl", []))

    @jsii.member(jsii_name="toPutObjectVersionTagging")
    def to_put_object_version_tagging(self) -> "S3":
        '''(experimental) Grants permission to set the supplied tag-set for a specific version of an object.

        Access Level: Tagging

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifRequestObjectTag()
        - .ifRequestObjectTagKeys()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifVersionid()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutObjectVersionTagging", []))

    @jsii.member(jsii_name="toPutReplicationConfiguration")
    def to_put_replication_configuration(self) -> "S3":
        '''(experimental) Grants permission to create a new replication configuration or replace an existing one.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketReplication.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutReplicationConfiguration", []))

    @jsii.member(jsii_name="toPutStorageLensConfiguration")
    def to_put_storage_lens_configuration(self) -> "S3":
        '''(experimental) Grants permission to create or update an Amazon S3 Storage Lens configuration.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutStorageLensConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutStorageLensConfiguration", []))

    @jsii.member(jsii_name="toPutStorageLensConfigurationTagging")
    def to_put_storage_lens_configuration_tagging(self) -> "S3":
        '''(experimental) Grants permission to put or replace tags on an existing Amazon S3 Storage Lens configuration.

        Access Level: Tagging

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutStorageLensConfigurationTagging.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toPutStorageLensConfigurationTagging", []))

    @jsii.member(jsii_name="toReplicateDelete")
    def to_replicate_delete(self) -> "S3":
        '''(experimental) Grants permission to replicate delete markers to the destination bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toReplicateDelete", []))

    @jsii.member(jsii_name="toReplicateObject")
    def to_replicate_object(self) -> "S3":
        '''(experimental) Grants permission to replicate objects and object tags to the destination bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()
        - .ifXAmzServerSideEncryption()
        - .ifXAmzServerSideEncryptionAwsKmsKeyId()
        - .ifXAmzServerSideEncryptionCustomerAlgorithm()

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toReplicateObject", []))

    @jsii.member(jsii_name="toReplicateTags")
    def to_replicate_tags(self) -> "S3":
        '''(experimental) Grants permission to replicate object tags to the destination bucket.

        Access Level: Tagging

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toReplicateTags", []))

    @jsii.member(jsii_name="toRestoreObject")
    def to_restore_object(self) -> "S3":
        '''(experimental) Grants permission to restore an archived copy of an object back into Amazon S3.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toRestoreObject", []))

    @jsii.member(jsii_name="toSubmitMultiRegionAccessPointRoutes")
    def to_submit_multi_region_access_point_routes(self) -> "S3":
        '''(experimental) Grants permission to submit a route configuration update for a Multi-Region Access Point.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureversion()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_SubmitMultiRegionAccessPointRoutes.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toSubmitMultiRegionAccessPointRoutes", []))

    @jsii.member(jsii_name="toUpdateJobPriority")
    def to_update_job_priority(self) -> "S3":
        '''(experimental) Grants permission to update the priority of an existing job.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()
        - .ifRequestJobPriority()
        - .ifExistingJobPriority()
        - .ifExistingJobOperation()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_UpdateJobPriority.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toUpdateJobPriority", []))

    @jsii.member(jsii_name="toUpdateJobStatus")
    def to_update_job_status(self) -> "S3":
        '''(experimental) Grants permission to update the status for the specified job.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifResourceAccount()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifTlsVersion()
        - .ifXAmzContentSha256()
        - .ifExistingJobPriority()
        - .ifExistingJobOperation()
        - .ifJobSuspendedCause()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_UpdateJobStatus.html

        :stability: experimental
        '''
        return typing.cast("S3", jsii.invoke(self, "toUpdateJobStatus", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__390d687aefbf8cad0371fc3a5e698a271ed6ff5596da89b5c8291faa41de86ef)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6a8f43ccb94601db1cb36b6bf8ec9898580b2dede5bff80a4c45c011a8f66c21)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class S3ObjectLambda(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.S3ObjectLambda",
):
    '''(experimental) Statement provider for service `s3-object-lambda <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3objectlambda.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `s3-object-lambda <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3objectlambda.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__556cc9a9fcb692b4fa1bcee9bbdef538c2ba64c3820d9066fadf4568d2267439)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAuthType")
    def if_auth_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3ObjectLambda":
        '''(experimental) Filters access by authentication method.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionTagging()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListMultipartUploadParts()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toRestoreObject()
        - .toWriteGetObjectResponse()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f955d7713e35121ba74c422f70e8c40243c8b64f76d2739b7d38455806ad1c5b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "ifAuthType", [value, operator]))

    @jsii.member(jsii_name="ifSignatureAge")
    def if_signature_age(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3ObjectLambda":
        '''(experimental) Filters access by the age in milliseconds of the request signature.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionTagging()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListMultipartUploadParts()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toRestoreObject()
        - .toWriteGetObjectResponse()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__48dcd01ab7c8bc2d6379334a44699f55ddb190513300c07e6cbeb328645864ba)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "ifSignatureAge", [value, operator]))

    @jsii.member(jsii_name="ifTlsVersion")
    def if_tls_version(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3ObjectLambda":
        '''(experimental) Filters access by the TLS version used by the client.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toGetObject()
        - .toGetObjectAcl()
        - .toGetObjectLegalHold()
        - .toGetObjectRetention()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionTagging()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListMultipartUploadParts()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectLegalHold()
        - .toPutObjectRetention()
        - .toPutObjectTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()
        - .toRestoreObject()
        - .toWriteGetObjectResponse()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bd988e81c55a0514389365295da9b3c138f8a83a316b2b598862e5bd6c3a78fb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "ifTlsVersion", [value, operator]))

    @jsii.member(jsii_name="ifVersionid")
    def if_versionid(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3ObjectLambda":
        '''(experimental) Filters access by a specific object version.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/amazon-s3-policy-keys.html/#getobjectversion-limit-access-to-specific-version-3

        Applies to actions:

        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionAcl()
        - .toGetObjectVersionTagging()
        - .toPutObjectVersionAcl()
        - .toPutObjectVersionTagging()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f6ca424b196a3f70b75984cae5a75d1e460dc2c07453a70c6f4aa9e921c49a69)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "ifVersionid", [value, operator]))

    @jsii.member(jsii_name="onObjectlambdaaccesspoint")
    def on_objectlambdaaccesspoint(
        self,
        access_point_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3ObjectLambda":
        '''(experimental) Adds a resource of type objectlambdaaccesspoint to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/transforming-objects.html

        :param access_point_name: - Identifier for the accessPointName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__587692bd20bf47cd8cdfe855da68c74fa5f167ebe010f554d1a9d658c5462676)
            check_type(argname="argument access_point_name", value=access_point_name, expected_type=type_hints["access_point_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "onObjectlambdaaccesspoint", [access_point_name, account, region, partition]))

    @jsii.member(jsii_name="toAbortMultipartUpload")
    def to_abort_multipart_upload(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to abort a multipart upload.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_AbortMultipartUpload.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toAbortMultipartUpload", []))

    @jsii.member(jsii_name="toDeleteObject")
    def to_delete_object(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to remove the null version of an object and insert a delete marker, which becomes the current version of the object.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObject.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toDeleteObject", []))

    @jsii.member(jsii_name="toDeleteObjectTagging")
    def to_delete_object_tagging(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to use the tagging subresource to remove the entire tag set from the specified object.

        Access Level: Tagging

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toDeleteObjectTagging", []))

    @jsii.member(jsii_name="toDeleteObjectVersion")
    def to_delete_object_version(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to remove a specific version of an object.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()
        - .ifVersionid()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObject.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toDeleteObjectVersion", []))

    @jsii.member(jsii_name="toDeleteObjectVersionTagging")
    def to_delete_object_version_tagging(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to remove the entire tag set for a specific version of the object.

        Access Level: Tagging

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()
        - .ifVersionid()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toDeleteObjectVersionTagging", []))

    @jsii.member(jsii_name="toGetObject")
    def to_get_object(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to retrieve objects from Amazon S3.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toGetObject", []))

    @jsii.member(jsii_name="toGetObjectAcl")
    def to_get_object_acl(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to return the access control list (ACL) of an object.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectAcl.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toGetObjectAcl", []))

    @jsii.member(jsii_name="toGetObjectLegalHold")
    def to_get_object_legal_hold(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to get an object's current Legal Hold status.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectLegalHold.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toGetObjectLegalHold", []))

    @jsii.member(jsii_name="toGetObjectRetention")
    def to_get_object_retention(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to retrieve the retention settings for an object.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectRetention.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toGetObjectRetention", []))

    @jsii.member(jsii_name="toGetObjectTagging")
    def to_get_object_tagging(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to return the tag set of an object.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toGetObjectTagging", []))

    @jsii.member(jsii_name="toGetObjectVersion")
    def to_get_object_version(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to retrieve a specific version of an object.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()
        - .ifVersionid()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toGetObjectVersion", []))

    @jsii.member(jsii_name="toGetObjectVersionAcl")
    def to_get_object_version_acl(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to return the access control list (ACL) of a specific object version.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()
        - .ifVersionid()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectAcl.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toGetObjectVersionAcl", []))

    @jsii.member(jsii_name="toGetObjectVersionTagging")
    def to_get_object_version_tagging(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to return the tag set for a specific version of the object.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()
        - .ifVersionid()

        https://docs.aws.amazon.com/AmazonS3/latest/dev/setting-repl-config-perm-overview.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toGetObjectVersionTagging", []))

    @jsii.member(jsii_name="toListBucket")
    def to_list_bucket(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to list some or all of the objects in an Amazon S3 bucket (up to 1000).

        Access Level: List

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toListBucket", []))

    @jsii.member(jsii_name="toListBucketMultipartUploads")
    def to_list_bucket_multipart_uploads(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to list in-progress multipart uploads.

        Access Level: List

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListMultipartUploads.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toListBucketMultipartUploads", []))

    @jsii.member(jsii_name="toListBucketVersions")
    def to_list_bucket_versions(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to list metadata about all the versions of objects in an Amazon S3 bucket.

        Access Level: List

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectVersions.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toListBucketVersions", []))

    @jsii.member(jsii_name="toListMultipartUploadParts")
    def to_list_multipart_upload_parts(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to list the parts that have been uploaded for a specific multipart upload.

        Access Level: List

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListParts.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toListMultipartUploadParts", []))

    @jsii.member(jsii_name="toPutObject")
    def to_put_object(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to add an object to a bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toPutObject", []))

    @jsii.member(jsii_name="toPutObjectAcl")
    def to_put_object_acl(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to set the access control list (ACL) permissions for new or existing objects in an S3 bucket.

        Access Level: Permissions management

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectAcl.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toPutObjectAcl", []))

    @jsii.member(jsii_name="toPutObjectLegalHold")
    def to_put_object_legal_hold(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to apply a Legal Hold configuration to the specified object.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectLegalHold.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toPutObjectLegalHold", []))

    @jsii.member(jsii_name="toPutObjectRetention")
    def to_put_object_retention(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to place an Object Retention configuration on an object.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectRetention.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toPutObjectRetention", []))

    @jsii.member(jsii_name="toPutObjectTagging")
    def to_put_object_tagging(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to set the supplied tag-set to an object that already exists in a bucket.

        Access Level: Tagging

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toPutObjectTagging", []))

    @jsii.member(jsii_name="toPutObjectVersionAcl")
    def to_put_object_version_acl(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to use the acl subresource to set the access control list (ACL) permissions for an object that already exists in a bucket.

        Access Level: Permissions management

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()
        - .ifVersionid()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectAcl.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toPutObjectVersionAcl", []))

    @jsii.member(jsii_name="toPutObjectVersionTagging")
    def to_put_object_version_tagging(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to set the supplied tag-set for a specific version of an object.

        Access Level: Tagging

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()
        - .ifVersionid()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toPutObjectVersionTagging", []))

    @jsii.member(jsii_name="toRestoreObject")
    def to_restore_object(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to restore an archived copy of an object back into Amazon S3.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toRestoreObject", []))

    @jsii.member(jsii_name="toWriteGetObjectResponse")
    def to_write_get_object_response(self) -> "S3ObjectLambda":
        '''(experimental) Grants permission to provide data for GetObject requests send to S3 Object Lambda.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifTlsVersion()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_WriteGetObjectResponse.html

        :stability: experimental
        '''
        return typing.cast("S3ObjectLambda", jsii.invoke(self, "toWriteGetObjectResponse", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f55416826d9221848d8b88fc7428e38a5d4ca8c6eff2c66b340a945d1fc6ca22)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6799652f621c97aa700c759ca379d6c41260c411fe6092de05e9b26ea5e32afd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class S3Outposts(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.S3Outposts",
):
    '''(experimental) Statement provider for service `s3-outposts <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3onoutposts.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `s3-outposts <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3onoutposts.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__20f9c2e24c6f9bb4cd4a7d0127089d57c94accaba02c21974328e91cca369bce)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAccessPointNetworkOrigin")
    def if_access_point_network_origin(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by the network origin (Internet or VPC).

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-access-points.html#access-points-policies

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toCreateAccessPoint()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointPolicy()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toGetAccessPoint()
        - .toGetAccessPointPolicy()
        - .toGetObject()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionTagging()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListMultipartUploadParts()
        - .toPutAccessPointPolicy()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectTagging()
        - .toPutObjectVersionTagging()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fdd5356ee590e27e0e7e1b6144a1a4ee7ee50e3175796b408981696ba9a96e04)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3Outposts", jsii.invoke(self, "ifAccessPointNetworkOrigin", [value, operator]))

    @jsii.member(jsii_name="ifAuthType")
    def if_auth_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by restricting incoming requests to a specific authentication method.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toCreateAccessPoint()
        - .toCreateBucket()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointPolicy()
        - .toDeleteBucket()
        - .toDeleteBucketPolicy()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toGetAccessPoint()
        - .toGetAccessPointPolicy()
        - .toGetBucket()
        - .toGetBucketPolicy()
        - .toGetBucketTagging()
        - .toGetBucketVersioning()
        - .toGetLifecycleConfiguration()
        - .toGetObject()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionTagging()
        - .toListAccessPoints()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListMultipartUploadParts()
        - .toListRegionalBuckets()
        - .toPutAccessPointPolicy()
        - .toPutBucketPolicy()
        - .toPutBucketTagging()
        - .toPutBucketVersioning()
        - .toPutLifecycleConfiguration()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectTagging()
        - .toPutObjectVersionTagging()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f43ca97329eaa701ec31acb7aada4a6175b7d8dc2e72dbae1dd963094bab2985)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3Outposts", jsii.invoke(self, "ifAuthType", [value, operator]))

    @jsii.member(jsii_name="ifDataAccessPointAccount")
    def if_data_access_point_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by the AWS Account ID that owns the access point.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-access-points.html#access-points-policies

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toCreateAccessPoint()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointPolicy()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toGetAccessPoint()
        - .toGetAccessPointPolicy()
        - .toGetObject()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionTagging()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListMultipartUploadParts()
        - .toPutAccessPointPolicy()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectTagging()
        - .toPutObjectVersionTagging()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1b577f641c0fed274eff8d63d3a6767f9b40083e56065a32de03f318099b5156)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3Outposts", jsii.invoke(self, "ifDataAccessPointAccount", [value, operator]))

    @jsii.member(jsii_name="ifDataAccessPointArn")
    def if_data_access_point_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by an access point Amazon Resource Name (ARN).

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toCreateAccessPoint()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointPolicy()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toGetAccessPoint()
        - .toGetAccessPointPolicy()
        - .toGetObject()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionTagging()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListMultipartUploadParts()
        - .toPutAccessPointPolicy()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectTagging()
        - .toPutObjectVersionTagging()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bc4a686a1e1fb68562022b3c1b50e7fce499271414dac55483099d5c40b999e2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3Outposts", jsii.invoke(self, "ifDataAccessPointArn", [value, operator]))

    @jsii.member(jsii_name="ifDelimiter")
    def if_delimiter(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by requiring the delimiter parameter.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/walkthrough1.html

        Applies to actions:

        - .toListBucket()
        - .toListBucketVersions()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b6a747772dd2d84893bd3fcd6f9e7804f1e745130effd5aca578cd828668f993)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3Outposts", jsii.invoke(self, "ifDelimiter", [value, operator]))

    @jsii.member(jsii_name="ifExistingObjectTag")
    def if_existing_object_tag(
        self,
        key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by requiring that an existing object tag has a specific tag key and value.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html#tagging-and-policies

        Applies to actions:

        - .toDeleteObjectTagging()
        - .toDeleteObjectVersionTagging()
        - .toGetObject()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionTagging()
        - .toPutObjectAcl()
        - .toPutObjectTagging()
        - .toPutObjectVersionTagging()

        :param key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ff041a1e4e9c8c5b7cab57e9ddfe211881c109de7259a6dc2c93fcb9c5d32fd2)
            check_type(argname="argument key", value=key, expected_type=type_hints["key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3Outposts", jsii.invoke(self, "ifExistingObjectTag", [key, value, operator]))

    @jsii.member(jsii_name="ifMaxKeys")
    def if_max_keys(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by limiting the maximum number of keys returned in a ListBucket request.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html#example-numeric-condition-operators

        Applies to actions:

        - .toListBucket()
        - .toListBucketVersions()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__97167a2366fd4669a1f274b053fbb117d4a87161e851ead70491d64616854515)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3Outposts", jsii.invoke(self, "ifMaxKeys", [value, operator]))

    @jsii.member(jsii_name="ifPrefix")
    def if_prefix(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by key name prefix.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html#condition-key-bucket-ops-2

        Applies to actions:

        - .toListBucket()
        - .toListBucketVersions()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e34ebf89834f02c4f50b20de959bf642767dde43a8ec711a9f6cebfc1b3dc874)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3Outposts", jsii.invoke(self, "ifPrefix", [value, operator]))

    @jsii.member(jsii_name="ifRequestObjectTag")
    def if_request_object_tag(
        self,
        key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by restricting the tag keys and values allowed on objects.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html#tagging-and-policies

        Applies to actions:

        - .toPutObject()
        - .toPutObjectTagging()
        - .toPutObjectVersionTagging()

        :param key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d9af2c927d8803e49c15e54e57e9b119f3ce6e600a5dd900300acb2840758b8a)
            check_type(argname="argument key", value=key, expected_type=type_hints["key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3Outposts", jsii.invoke(self, "ifRequestObjectTag", [key, value, operator]))

    @jsii.member(jsii_name="ifRequestObjectTagKeys")
    def if_request_object_tag_keys(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by restricting the tag keys allowed on objects.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-tagging.html#tagging-and-policies

        Applies to actions:

        - .toPutObject()
        - .toPutObjectTagging()
        - .toPutObjectVersionTagging()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__72a37a29fffbf1ebb683d7c8555fabefbe9307d4449d2a83717187b5615ab12c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3Outposts", jsii.invoke(self, "ifRequestObjectTagKeys", [value, operator]))

    @jsii.member(jsii_name="ifSignatureAge")
    def if_signature_age(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by identifying the length of time, in milliseconds, that a signature is valid in an authenticated request.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toCreateAccessPoint()
        - .toCreateBucket()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointPolicy()
        - .toDeleteBucket()
        - .toDeleteBucketPolicy()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toGetAccessPoint()
        - .toGetAccessPointPolicy()
        - .toGetBucket()
        - .toGetBucketPolicy()
        - .toGetBucketTagging()
        - .toGetBucketVersioning()
        - .toGetLifecycleConfiguration()
        - .toGetObject()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionTagging()
        - .toListAccessPoints()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListMultipartUploadParts()
        - .toListRegionalBuckets()
        - .toPutAccessPointPolicy()
        - .toPutBucketPolicy()
        - .toPutBucketTagging()
        - .toPutBucketVersioning()
        - .toPutLifecycleConfiguration()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectTagging()
        - .toPutObjectVersionTagging()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8cac5ae78fd491af49821b5f5c968754307968f55a9159b876a0357f3938f4ae)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3Outposts", jsii.invoke(self, "ifSignatureAge", [value, operator]))

    @jsii.member(jsii_name="ifSignatureversion")
    def if_signatureversion(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by identifying the version of AWS Signature that is supported for authenticated requests.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toCreateAccessPoint()
        - .toCreateBucket()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointPolicy()
        - .toDeleteBucket()
        - .toDeleteBucketPolicy()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toGetAccessPoint()
        - .toGetAccessPointPolicy()
        - .toGetBucket()
        - .toGetBucketPolicy()
        - .toGetBucketTagging()
        - .toGetBucketVersioning()
        - .toGetLifecycleConfiguration()
        - .toGetObject()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionTagging()
        - .toListAccessPoints()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListMultipartUploadParts()
        - .toListRegionalBuckets()
        - .toPutAccessPointPolicy()
        - .toPutBucketPolicy()
        - .toPutBucketTagging()
        - .toPutBucketVersioning()
        - .toPutLifecycleConfiguration()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectTagging()
        - .toPutObjectVersionTagging()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__da0b45bf255710f2de5351466165533e0b4b95c24f3b6a20c59e97e366377648)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3Outposts", jsii.invoke(self, "ifSignatureversion", [value, operator]))

    @jsii.member(jsii_name="ifVersionid")
    def if_versionid(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by a specific object version.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html#getobjectversion-limit-access-to-specific-version-3

        Applies to actions:

        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionTagging()
        - .toPutObjectVersionTagging()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__07fb03f2066b0bb73256722de4186cbf3aa08577e2bb76183da88e7517a06ca4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3Outposts", jsii.invoke(self, "ifVersionid", [value, operator]))

    @jsii.member(jsii_name="ifXAmzAcl")
    def if_x_amz_acl(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by requiring the x-amz-acl header with a specific canned ACL in a request.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html#permissions

        Applies to actions:

        - .toPutObject()
        - .toPutObjectAcl()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__29a131c10f04b2c4c9f9f8a46c8f9ab8479006fcef3dc7ce0ec7b48501ecb96d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3Outposts", jsii.invoke(self, "ifXAmzAcl", [value, operator]))

    @jsii.member(jsii_name="ifXAmzContentSha256")
    def if_x_amz_content_sha256(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by disallowing unsigned content in your bucket.

        https://docs.aws.amazon.com/AmazonS3/latest/API/bucket-policy-s3-sigv4-conditions.html

        Applies to actions:

        - .toAbortMultipartUpload()
        - .toCreateAccessPoint()
        - .toCreateBucket()
        - .toDeleteAccessPoint()
        - .toDeleteAccessPointPolicy()
        - .toDeleteBucket()
        - .toDeleteBucketPolicy()
        - .toDeleteObject()
        - .toDeleteObjectTagging()
        - .toDeleteObjectVersion()
        - .toDeleteObjectVersionTagging()
        - .toGetAccessPoint()
        - .toGetAccessPointPolicy()
        - .toGetBucket()
        - .toGetBucketPolicy()
        - .toGetBucketTagging()
        - .toGetBucketVersioning()
        - .toGetLifecycleConfiguration()
        - .toGetObject()
        - .toGetObjectTagging()
        - .toGetObjectVersion()
        - .toGetObjectVersionTagging()
        - .toListAccessPoints()
        - .toListBucket()
        - .toListBucketMultipartUploads()
        - .toListBucketVersions()
        - .toListMultipartUploadParts()
        - .toListRegionalBuckets()
        - .toPutAccessPointPolicy()
        - .toPutBucketPolicy()
        - .toPutBucketTagging()
        - .toPutBucketVersioning()
        - .toPutLifecycleConfiguration()
        - .toPutObject()
        - .toPutObjectAcl()
        - .toPutObjectTagging()
        - .toPutObjectVersionTagging()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c47ac2e0615e6d7e83d4eda69e1d1f0721c8967eeb287640656ba90a943264bd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3Outposts", jsii.invoke(self, "ifXAmzContentSha256", [value, operator]))

    @jsii.member(jsii_name="ifXAmzCopySource")
    def if_x_amz_copy_source(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by restricting the copy source to a specific bucket, prefix, or object.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html#putobject-limit-copy-source-3

        Applies to actions:

        - .toPutObject()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5a40f87b2a1233ae20047354f314918d389f3d0b86759f2e1ab1b385b4ae241f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3Outposts", jsii.invoke(self, "ifXAmzCopySource", [value, operator]))

    @jsii.member(jsii_name="ifXAmzMetadataDirective")
    def if_x_amz_metadata_directive(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by enabling enforcement of object metadata behavior (COPY or REPLACE) when objects are copied.

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html

        Applies to actions:

        - .toPutObject()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__837e10c397bbc0afdd968647b2358272fca8fd878d1a2d1f73dae9c21660f318)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3Outposts", jsii.invoke(self, "ifXAmzMetadataDirective", [value, operator]))

    @jsii.member(jsii_name="ifXAmzServerSideEncryption")
    def if_x_amz_server_side_encryption(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by requiring server-side encryption.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingServerSideEncryption.html

        Applies to actions:

        - .toPutObject()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__83ae660c68cae216859b2f55a4a0124638ded76466c435657762d8d7360fd2d3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3Outposts", jsii.invoke(self, "ifXAmzServerSideEncryption", [value, operator]))

    @jsii.member(jsii_name="ifXAmzStorageClass")
    def if_x_amz_storage_class(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "S3Outposts":
        '''(experimental) Filters access by storage class.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html#sc-howtoset

        Applies to actions:

        - .toPutObject()
        - .toPutObjectAcl()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cab1e3d37159cc70cc2f523fe33ee48fe1f2a5d161246b1adbca0262c06eaff9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("S3Outposts", jsii.invoke(self, "ifXAmzStorageClass", [value, operator]))

    @jsii.member(jsii_name="onAccesspoint")
    def on_accesspoint(
        self,
        outpost_id: builtins.str,
        access_point_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3Outposts":
        '''(experimental) Adds a resource of type accesspoint to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-points.html

        :param outpost_id: - Identifier for the outpostId.
        :param access_point_name: - Identifier for the accessPointName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__63c1db2003777a263ce60a24538505dfd3969922633fe134b46018175abc5a76)
            check_type(argname="argument outpost_id", value=outpost_id, expected_type=type_hints["outpost_id"])
            check_type(argname="argument access_point_name", value=access_point_name, expected_type=type_hints["access_point_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("S3Outposts", jsii.invoke(self, "onAccesspoint", [outpost_id, access_point_name, account, region, partition]))

    @jsii.member(jsii_name="onBucket")
    def on_bucket(
        self,
        outpost_id: builtins.str,
        bucket_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3Outposts":
        '''(experimental) Adds a resource of type bucket to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingBucket.html

        :param outpost_id: - Identifier for the outpostId.
        :param bucket_name: - Identifier for the bucketName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0fae9ff63e69f4b08c7a652b28912c6a3fff599e7df24f7f8c7dc9bab12513cb)
            check_type(argname="argument outpost_id", value=outpost_id, expected_type=type_hints["outpost_id"])
            check_type(argname="argument bucket_name", value=bucket_name, expected_type=type_hints["bucket_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("S3Outposts", jsii.invoke(self, "onBucket", [outpost_id, bucket_name, account, region, partition]))

    @jsii.member(jsii_name="onEndpoint")
    def on_endpoint(
        self,
        outpost_id: builtins.str,
        endpoint_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3Outposts":
        '''(experimental) Adds a resource of type endpoint to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/outposts-endpoints.html

        :param outpost_id: - Identifier for the outpostId.
        :param endpoint_id: - Identifier for the endpointId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1e61328ea1f721736cd78a0ddc05cf6b1f9c9ac72bc0f23f65c35aa463ea5b82)
            check_type(argname="argument outpost_id", value=outpost_id, expected_type=type_hints["outpost_id"])
            check_type(argname="argument endpoint_id", value=endpoint_id, expected_type=type_hints["endpoint_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("S3Outposts", jsii.invoke(self, "onEndpoint", [outpost_id, endpoint_id, account, region, partition]))

    @jsii.member(jsii_name="onObject")
    def on_object(
        self,
        outpost_id: builtins.str,
        bucket_name: builtins.str,
        object_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "S3Outposts":
        '''(experimental) Adds a resource of type object to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingObjects.html

        :param outpost_id: - Identifier for the outpostId.
        :param bucket_name: - Identifier for the bucketName.
        :param object_name: - Identifier for the objectName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7e01404992ddf5f207fcc72cbaafdd14cc474ef2f867b910be2ac8e77c50ecf9)
            check_type(argname="argument outpost_id", value=outpost_id, expected_type=type_hints["outpost_id"])
            check_type(argname="argument bucket_name", value=bucket_name, expected_type=type_hints["bucket_name"])
            check_type(argname="argument object_name", value=object_name, expected_type=type_hints["object_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("S3Outposts", jsii.invoke(self, "onObject", [outpost_id, bucket_name, object_name, account, region, partition]))

    @jsii.member(jsii_name="toAbortMultipartUpload")
    def to_abort_multipart_upload(self) -> "S3Outposts":
        '''(experimental) Grants permission to abort a multipart upload.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointArn()
        - .ifDataAccessPointAccount()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_AbortMultipartUpload.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toAbortMultipartUpload", []))

    @jsii.member(jsii_name="toCreateAccessPoint")
    def to_create_access_point(self) -> "S3Outposts":
        '''(experimental) Grants permission to create a new access point.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_CreateAccessPoint.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toCreateAccessPoint", []))

    @jsii.member(jsii_name="toCreateBucket")
    def to_create_bucket(self) -> "S3Outposts":
        '''(experimental) Grants permission to create a new bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_CreateBucket.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toCreateBucket", []))

    @jsii.member(jsii_name="toCreateEndpoint")
    def to_create_endpoint(self) -> "S3Outposts":
        '''(experimental) Grants permission to create a new endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_s3outposts_CreateEndpoint.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toCreateEndpoint", []))

    @jsii.member(jsii_name="toDeleteAccessPoint")
    def to_delete_access_point(self) -> "S3Outposts":
        '''(experimental) Grants permission to delete the access point named in the URI.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointArn()
        - .ifDataAccessPointAccount()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteAccessPoint.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toDeleteAccessPoint", []))

    @jsii.member(jsii_name="toDeleteAccessPointPolicy")
    def to_delete_access_point_policy(self) -> "S3Outposts":
        '''(experimental) Grants permission to delete the policy on a specified access point.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointArn()
        - .ifDataAccessPointAccount()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteAccessPointPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toDeleteAccessPointPolicy", []))

    @jsii.member(jsii_name="toDeleteBucket")
    def to_delete_bucket(self) -> "S3Outposts":
        '''(experimental) Grants permission to delete the bucket named in the URI.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteBucket.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toDeleteBucket", []))

    @jsii.member(jsii_name="toDeleteBucketPolicy")
    def to_delete_bucket_policy(self) -> "S3Outposts":
        '''(experimental) Grants permission to delete the policy on a specified bucket.

        Access Level: Permissions management

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteBucketPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toDeleteBucketPolicy", []))

    @jsii.member(jsii_name="toDeleteEndpoint")
    def to_delete_endpoint(self) -> "S3Outposts":
        '''(experimental) Grants permission to delete the endpoint named in the URI.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_s3outposts_DeleteEndpoint.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toDeleteEndpoint", []))

    @jsii.member(jsii_name="toDeleteObject")
    def to_delete_object(self) -> "S3Outposts":
        '''(experimental) Grants permission to remove the null version of an object and insert a delete marker, which becomes the current version of the object.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObject.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toDeleteObject", []))

    @jsii.member(jsii_name="toDeleteObjectTagging")
    def to_delete_object_tagging(self) -> "S3Outposts":
        '''(experimental) Grants permission to use the tagging subresource to remove the entire tag set from the specified object.

        Access Level: Tagging

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toDeleteObjectTagging", []))

    @jsii.member(jsii_name="toDeleteObjectVersion")
    def to_delete_object_version(self) -> "S3Outposts":
        '''(experimental) Grants permission to remove a specific version of an object.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifVersionid()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObject.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toDeleteObjectVersion", []))

    @jsii.member(jsii_name="toDeleteObjectVersionTagging")
    def to_delete_object_version_tagging(self) -> "S3Outposts":
        '''(experimental) Grants permission to remove the entire tag set for a specific version of the object.

        Access Level: Tagging

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifVersionid()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toDeleteObjectVersionTagging", []))

    @jsii.member(jsii_name="toGetAccessPoint")
    def to_get_access_point(self) -> "S3Outposts":
        '''(experimental) Grants permission to return configuration information about the specified access point.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPoint.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toGetAccessPoint", []))

    @jsii.member(jsii_name="toGetAccessPointPolicy")
    def to_get_access_point_policy(self) -> "S3Outposts":
        '''(experimental) Grants permission to returns the access point policy associated with the specified access point.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toGetAccessPointPolicy", []))

    @jsii.member(jsii_name="toGetBucket")
    def to_get_bucket(self) -> "S3Outposts":
        '''(experimental) Grants permission to return the bucket configuration associated with an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetBucket.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toGetBucket", []))

    @jsii.member(jsii_name="toGetBucketPolicy")
    def to_get_bucket_policy(self) -> "S3Outposts":
        '''(experimental) Grants permission to return the policy of the specified bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetBucketPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toGetBucketPolicy", []))

    @jsii.member(jsii_name="toGetBucketTagging")
    def to_get_bucket_tagging(self) -> "S3Outposts":
        '''(experimental) Grants permission to return the tag set associated with an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetBucketTagging.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toGetBucketTagging", []))

    @jsii.member(jsii_name="toGetBucketVersioning")
    def to_get_bucket_versioning(self) -> "S3Outposts":
        '''(experimental) Grants permission to return the versioning state of an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketVersioning.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toGetBucketVersioning", []))

    @jsii.member(jsii_name="toGetLifecycleConfiguration")
    def to_get_lifecycle_configuration(self) -> "S3Outposts":
        '''(experimental) Grants permission to return the lifecycle configuration information set on an Amazon S3 bucket.

        Access Level: Read

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetBucketLifecycleConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toGetLifecycleConfiguration", []))

    @jsii.member(jsii_name="toGetObject")
    def to_get_object(self) -> "S3Outposts":
        '''(experimental) Grants permission to retrieve objects from Amazon S3.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toGetObject", []))

    @jsii.member(jsii_name="toGetObjectTagging")
    def to_get_object_tagging(self) -> "S3Outposts":
        '''(experimental) Grants permission to return the tag set of an object.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toGetObjectTagging", []))

    @jsii.member(jsii_name="toGetObjectVersion")
    def to_get_object_version(self) -> "S3Outposts":
        '''(experimental) Grants permission to retrieve a specific version of an object.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifVersionid()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toGetObjectVersion", []))

    @jsii.member(jsii_name="toGetObjectVersionTagging")
    def to_get_object_version_tagging(self) -> "S3Outposts":
        '''(experimental) Grants permission to return the tag set for a specific version of the object.

        Access Level: Read

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifVersionid()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toGetObjectVersionTagging", []))

    @jsii.member(jsii_name="toListAccessPoints")
    def to_list_access_points(self) -> "S3Outposts":
        '''(experimental) Grants permission to list access points.

        Access Level: List

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_ListAccessPoints.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toListAccessPoints", []))

    @jsii.member(jsii_name="toListBucket")
    def to_list_bucket(self) -> "S3Outposts":
        '''(experimental) Grants permission to list some or all of the objects in an Amazon S3 bucket (up to 1000).

        Access Level: List

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifDelimiter()
        - .ifMaxKeys()
        - .ifPrefix()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toListBucket", []))

    @jsii.member(jsii_name="toListBucketMultipartUploads")
    def to_list_bucket_multipart_uploads(self) -> "S3Outposts":
        '''(experimental) Grants permission to list in-progress multipart uploads.

        Access Level: List

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListMultipartUploads.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toListBucketMultipartUploads", []))

    @jsii.member(jsii_name="toListBucketVersions")
    def to_list_bucket_versions(self) -> "S3Outposts":
        '''(experimental) Grants permission to list metadata about all the versions of objects in an Amazon S3 bucket.

        Access Level: List

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifDelimiter()
        - .ifMaxKeys()
        - .ifPrefix()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectVersions.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toListBucketVersions", []))

    @jsii.member(jsii_name="toListEndpoints")
    def to_list_endpoints(self) -> "S3Outposts":
        '''(experimental) Grants permission to list endpoints.

        Access Level: List

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_s3outposts_ListEndpoints.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toListEndpoints", []))

    @jsii.member(jsii_name="toListMultipartUploadParts")
    def to_list_multipart_upload_parts(self) -> "S3Outposts":
        '''(experimental) Grants permission to list the parts that have been uploaded for a specific multipart upload.

        Access Level: List

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListParts.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toListMultipartUploadParts", []))

    @jsii.member(jsii_name="toListOutpostsWithS3")
    def to_list_outposts_with_s3(self) -> "S3Outposts":
        '''(experimental) Grants permission to list outposts with S3 capacity.

        Access Level: List

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_s3outposts_ListOutpostsWithS3.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toListOutpostsWithS3", []))

    @jsii.member(jsii_name="toListRegionalBuckets")
    def to_list_regional_buckets(self) -> "S3Outposts":
        '''(experimental) Grants permission to list all buckets owned by the authenticated sender of the request.

        Access Level: List

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_ListRegionalBuckets.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toListRegionalBuckets", []))

    @jsii.member(jsii_name="toListSharedEndpoints")
    def to_list_shared_endpoints(self) -> "S3Outposts":
        '''(experimental) Grants permission to list shared endpoints.

        Access Level: List

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_s3outposts_ListSharedEndpoints.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toListSharedEndpoints", []))

    @jsii.member(jsii_name="toPutAccessPointPolicy")
    def to_put_access_point_policy(self) -> "S3Outposts":
        '''(experimental) Grants permission to associate an access policy with a specified access point.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutAccessPointPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toPutAccessPointPolicy", []))

    @jsii.member(jsii_name="toPutBucketPolicy")
    def to_put_bucket_policy(self) -> "S3Outposts":
        '''(experimental) Grants permission to add or replace a bucket policy on a bucket.

        Access Level: Permissions management

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutBucketPolicy.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toPutBucketPolicy", []))

    @jsii.member(jsii_name="toPutBucketTagging")
    def to_put_bucket_tagging(self) -> "S3Outposts":
        '''(experimental) Grants permission to add a set of tags to an existing Amazon S3 bucket.

        Access Level: Tagging

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutBucketTagging.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toPutBucketTagging", []))

    @jsii.member(jsii_name="toPutBucketVersioning")
    def to_put_bucket_versioning(self) -> "S3Outposts":
        '''(experimental) Grants permission to set the versioning state of an existing Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketVersioning.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toPutBucketVersioning", []))

    @jsii.member(jsii_name="toPutLifecycleConfiguration")
    def to_put_lifecycle_configuration(self) -> "S3Outposts":
        '''(experimental) Grants permission to create a new lifecycle configuration for the bucket or replace an existing lifecycle configuration.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_PutBucketLifecycleConfiguration.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toPutLifecycleConfiguration", []))

    @jsii.member(jsii_name="toPutObject")
    def to_put_object(self) -> "S3Outposts":
        '''(experimental) Grants permission to add an object to a bucket.

        Access Level: Write

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifRequestObjectTag()
        - .ifRequestObjectTagKeys()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzAcl()
        - .ifXAmzContentSha256()
        - .ifXAmzCopySource()
        - .ifXAmzMetadataDirective()
        - .ifXAmzServerSideEncryption()
        - .ifXAmzStorageClass()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toPutObject", []))

    @jsii.member(jsii_name="toPutObjectAcl")
    def to_put_object_acl(self) -> "S3Outposts":
        '''(experimental) Grants permission to set the access control list (ACL) permissions for an object that already exists in a bucket.

        Access Level: Permissions management

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzAcl()
        - .ifXAmzContentSha256()
        - .ifXAmzStorageClass()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectAcl.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toPutObjectAcl", []))

    @jsii.member(jsii_name="toPutObjectTagging")
    def to_put_object_tagging(self) -> "S3Outposts":
        '''(experimental) Grants permission to set the supplied tag-set to an object that already exists in a bucket.

        Access Level: Tagging

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifRequestObjectTag()
        - .ifRequestObjectTagKeys()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toPutObjectTagging", []))

    @jsii.member(jsii_name="toPutObjectVersionTagging")
    def to_put_object_version_tagging(self) -> "S3Outposts":
        '''(experimental) Grants permission to set the supplied tag-set for a specific version of an object.

        Access Level: Tagging

        Possible conditions:

        - .ifDataAccessPointAccount()
        - .ifDataAccessPointArn()
        - .ifAccessPointNetworkOrigin()
        - .ifExistingObjectTag()
        - .ifRequestObjectTag()
        - .ifRequestObjectTagKeys()
        - .ifAuthType()
        - .ifSignatureAge()
        - .ifSignatureversion()
        - .ifVersionid()
        - .ifXAmzContentSha256()

        https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectTagging.html

        :stability: experimental
        '''
        return typing.cast("S3Outposts", jsii.invoke(self, "toPutObjectVersionTagging", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4cac9dc5e5ce8f650a59a18d4c03356ac3b022be44d1ab481aca28cb19bf1ee1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b6c4cf51ce4f7eab6403410c9a13a2a6ee72e646a42206674d983fbca0cd8ed5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Sagemaker(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Sagemaker",
):
    '''(experimental) Statement provider for service `sagemaker <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsagemaker.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sagemaker <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsagemaker.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0055e807508beb4409e6b4b28e3d4638d559fecb5cdad2cf81dcfbe474ae43ea)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAcceleratorTypes")
    def if_accelerator_types(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the list of all accelerator types associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateEndpointConfig()
        - .toCreateNotebookInstance()
        - .toUpdateNotebookInstance()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8b75e649d689013ac09edbed43983b8af6a061de32cecceb72164edaea18f0e2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifAcceleratorTypes", [value, operator]))

    @jsii.member(jsii_name="ifAppNetworkAccessType")
    def if_app_network_access_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the app network access type associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateDomain()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bd7b567d1403112ec2b671f0887198bca94e08a36573513d9ae5b3f77e97f87a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifAppNetworkAccessType", [value, operator]))

    @jsii.member(jsii_name="ifCustomerMetadataProperties")
    def if_customer_metadata_properties(
        self,
        metadata_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by a metadata key and value pair.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateModelPackage()
        - .toUpdateModelPackage()

        :param metadata_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bea808f90d4480d1165ca8a2ff106f09129c37738a4f2804e0f49e4992d14df9)
            check_type(argname="argument metadata_key", value=metadata_key, expected_type=type_hints["metadata_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifCustomerMetadataProperties", [metadata_key, value, operator]))

    @jsii.member(jsii_name="ifCustomerMetadataPropertiesToRemove")
    def if_customer_metadata_properties_to_remove(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the list of metadata properties associated with the model-package resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toUpdateModelPackage()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__579df637fe9099fa99033699d69f12818d0bd271fa49a0badc96747ccda95e0c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifCustomerMetadataPropertiesToRemove", [value, operator]))

    @jsii.member(jsii_name="ifDirectInternetAccess")
    def if_direct_internet_access(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the direct internet access associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateNotebookInstance()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7a2902af424e5f9a4bc987b918e0b84ec1da064237a9af9c16af6c0d7bb2f619)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifDirectInternetAccess", [value, operator]))

    @jsii.member(jsii_name="ifDomainSharingOutputKmsKey")
    def if_domain_sharing_output_kms_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the Domain sharing output KMS key associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateDomain()
        - .toCreateUserProfile()
        - .toUpdateDomain()
        - .toUpdateUserProfile()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8c96f005592d3abab202aa3471eb94ea18a50f8bac27b21010b5adc4fe5330a0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifDomainSharingOutputKmsKey", [value, operator]))

    @jsii.member(jsii_name="ifFeatureGroupDisableGlueTableCreation")
    def if_feature_group_disable_glue_table_creation(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the DisableGlueTableCreation flag associated with the feature group resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateFeatureGroup()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d4cb42fe449d8f083c5b0a72f2bff12801d363f93bd2a48c169dfe1b708067b8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifFeatureGroupDisableGlueTableCreation", [value]))

    @jsii.member(jsii_name="ifFeatureGroupEnableOnlineStore")
    def if_feature_group_enable_online_store(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the EnableOnlineStore flag associated with feature group in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateFeatureGroup()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1fb6f2c5209abe87c14d199d5a63a96d7f266fe96c7310dd9fe9d86f9f4e8aa2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifFeatureGroupEnableOnlineStore", [value]))

    @jsii.member(jsii_name="ifFeatureGroupOfflineStoreConfig")
    def if_feature_group_offline_store_config(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the presence of an OfflineStoreConfig in the feature group resource in the request.

        This access filter only supports the null-conditional operator

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateFeatureGroup()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__56dd2bdb6db4c02fb6f98fde35388964dfdaee25be8ee47dddb30d160f6fb7a3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifFeatureGroupOfflineStoreConfig", [value]))

    @jsii.member(jsii_name="ifFeatureGroupOfflineStoreKmsKey")
    def if_feature_group_offline_store_kms_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the offline store kms key associated with the feature group resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateFeatureGroup()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4994144a1e93bf3bf9dd58475012ffecff1769bbfc5723a8eef39f6e919e4554)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifFeatureGroupOfflineStoreKmsKey", [value, operator]))

    @jsii.member(jsii_name="ifFeatureGroupOfflineStoreS3Uri")
    def if_feature_group_offline_store_s3_uri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the offline store s3 uri associated with the feature group resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateFeatureGroup()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f40184f2257e3b7dde3f8f130f41c1d22ae2aa06b69b08661d2e2ffa74cbe382)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifFeatureGroupOfflineStoreS3Uri", [value, operator]))

    @jsii.member(jsii_name="ifFeatureGroupOnlineStoreKmsKey")
    def if_feature_group_online_store_kms_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the online store kms key associated with the feature group resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateFeatureGroup()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__be6c4523e8626b2ce16e91c2d41ef98bf70119586417b4cbee503e759f0ce88e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifFeatureGroupOnlineStoreKmsKey", [value, operator]))

    @jsii.member(jsii_name="ifFileSystemAccessMode")
    def if_file_system_access_mode(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by a file system access mode associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateHyperParameterTuningJob()
        - .toCreateTrainingJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__01bf47999420afa84efc82fa3e2cd6894dfbc585d0435f6a4042e83eb4ee84e4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifFileSystemAccessMode", [value, operator]))

    @jsii.member(jsii_name="ifFileSystemDirectoryPath")
    def if_file_system_directory_path(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by a file system directory path associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateHyperParameterTuningJob()
        - .toCreateTrainingJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a11aa4225fd3e9cf8e62c5da03afad2ca8da260882ac4db0717615216ff39d8a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifFileSystemDirectoryPath", [value, operator]))

    @jsii.member(jsii_name="ifFileSystemId")
    def if_file_system_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by a file system ID associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateHyperParameterTuningJob()
        - .toCreateTrainingJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__723a876b4812b8090c52f42f0a571f8b0dc67c606a53107fade7d29a45bcdad5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifFileSystemId", [value, operator]))

    @jsii.member(jsii_name="ifFileSystemType")
    def if_file_system_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by a file system type associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateHyperParameterTuningJob()
        - .toCreateTrainingJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__93d9a5fe93573ac9236a38cf1e142cdd716024b2462ea5ca8772060d4bb8312a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifFileSystemType", [value, operator]))

    @jsii.member(jsii_name="ifHomeEfsFileSystemKmsKey")
    def if_home_efs_file_system_kms_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by a key that is present in the request the user makes to the SageMaker service.

        This key is deprecated. It has been replaced by sagemaker:VolumeKmsKey

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b2dee821f41cf2ced2df66e4b02f95f27b13898fde31b64fb1a8417ee51bc6f7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifHomeEfsFileSystemKmsKey", [value, operator]))

    @jsii.member(jsii_name="ifImageArns")
    def if_image_arns(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the list of all image arns associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateApp()
        - .toCreateDomain()
        - .toCreateSpace()
        - .toCreateUserProfile()
        - .toUpdateDomain()
        - .toUpdateSpace()
        - .toUpdateUserProfile()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__03f2079ebdfc3ebdfe4a6c7747755257159e694d297a73ff901d4da1c05caf67)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifImageArns", [value, operator]))

    @jsii.member(jsii_name="ifImageVersionArns")
    def if_image_version_arns(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the list of all image version arns associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateApp()
        - .toCreateDomain()
        - .toCreateSpace()
        - .toCreateUserProfile()
        - .toUpdateDomain()
        - .toUpdateSpace()
        - .toUpdateUserProfile()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__489ca79438af78e1ad7e1bec6bd280322fc889c5dd9bfaaa15474d260e3acd6a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifImageVersionArns", [value, operator]))

    @jsii.member(jsii_name="ifInstanceTypes")
    def if_instance_types(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the list of all instance types associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateApp()
        - .toCreateDataQualityJobDefinition()
        - .toCreateDomain()
        - .toCreateEndpointConfig()
        - .toCreateHyperParameterTuningJob()
        - .toCreateModelBiasJobDefinition()
        - .toCreateModelExplainabilityJobDefinition()
        - .toCreateModelQualityJobDefinition()
        - .toCreateMonitoringSchedule()
        - .toCreateNotebookInstance()
        - .toCreateProcessingJob()
        - .toCreateSpace()
        - .toCreateTrainingJob()
        - .toCreateTransformJob()
        - .toCreateUserProfile()
        - .toUpdateDomain()
        - .toUpdateMonitoringSchedule()
        - .toUpdateNotebookInstance()
        - .toUpdateSpace()
        - .toUpdateTrainingJob()
        - .toUpdateUserProfile()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__053a4bdedb133ac1a7742fb7e1f783677acafec5c3ea00ed1d1880897eac59fe)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifInstanceTypes", [value, operator]))

    @jsii.member(jsii_name="ifInterContainerTrafficEncryption")
    def if_inter_container_traffic_encryption(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the inter container traffic encryption associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateAutoMLJob()
        - .toCreateAutoMLJobV2()
        - .toCreateDataQualityJobDefinition()
        - .toCreateHyperParameterTuningJob()
        - .toCreateModelBiasJobDefinition()
        - .toCreateModelExplainabilityJobDefinition()
        - .toCreateModelQualityJobDefinition()
        - .toCreateMonitoringSchedule()
        - .toCreateProcessingJob()
        - .toCreateTrainingJob()
        - .toUpdateMonitoringSchedule()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eb3fd666fc868c0418af611f7481e08bec2feda884a81b245883215e5095198f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifInterContainerTrafficEncryption", [value]))

    @jsii.member(jsii_name="ifKeepAlivePeriod")
    def if_keep_alive_period(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the keep-alive period associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateTrainingJob()
        - .toUpdateTrainingJob()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9cbba4d3ce9fae6e47181d0b491f1d97ae1200da2fce2d92fc630aedf4dcdc24)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifKeepAlivePeriod", [value, operator]))

    @jsii.member(jsii_name="ifMaxRuntimeInSeconds")
    def if_max_runtime_in_seconds(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the max runtime in seconds associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateDataQualityJobDefinition()
        - .toCreateHyperParameterTuningJob()
        - .toCreateModelBiasJobDefinition()
        - .toCreateModelExplainabilityJobDefinition()
        - .toCreateModelQualityJobDefinition()
        - .toCreateMonitoringSchedule()
        - .toCreateProcessingJob()
        - .toCreateTrainingJob()
        - .toUpdateMonitoringSchedule()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__14b03243663c31a56705cfc9e2a642ebd6076678d510bb67655abf8cca7be95f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifMaxRuntimeInSeconds", [value, operator]))

    @jsii.member(jsii_name="ifMinimumInstanceMetadataServiceVersion")
    def if_minimum_instance_metadata_service_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the minimum instance metadata service version used by the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateNotebookInstance()
        - .toUpdateNotebookInstance()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__11bd224fa445d1495b9758924fedd9efe3940068cb20311f91fe40282978fc1c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifMinimumInstanceMetadataServiceVersion", [value, operator]))

    @jsii.member(jsii_name="ifModelApprovalStatus")
    def if_model_approval_status(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the model approval status with the model-package in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateModelPackage()
        - .toUpdateModelPackage()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3cfdfb87c0b8b641ff938da1bdd634434af2b556eb117ff9af28f8095a951093)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifModelApprovalStatus", [value, operator]))

    @jsii.member(jsii_name="ifModelArn")
    def if_model_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the model arn associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateEndpointConfig()
        - .toCreateTransformJob()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__793dc4b82967dd8ce70ceb32db0a584a03a4561dd64a387b231db12068d58025)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifModelArn", [value, operator]))

    @jsii.member(jsii_name="ifNetworkIsolation")
    def if_network_isolation(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the network isolation associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateDataQualityJobDefinition()
        - .toCreateHyperParameterTuningJob()
        - .toCreateModel()
        - .toCreateModelBiasJobDefinition()
        - .toCreateModelExplainabilityJobDefinition()
        - .toCreateModelQualityJobDefinition()
        - .toCreateMonitoringSchedule()
        - .toCreateProcessingJob()
        - .toCreateTrainingJob()
        - .toUpdateMonitoringSchedule()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__df23f51f619b278cc0c6724bb77e1ff1292c169f916c2570905907bb14a2c371)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifNetworkIsolation", [value]))

    @jsii.member(jsii_name="ifOutputKmsKey")
    def if_output_kms_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the output kms key associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateAutoMLJob()
        - .toCreateAutoMLJobV2()
        - .toCreateDataQualityJobDefinition()
        - .toCreateHyperParameterTuningJob()
        - .toCreateLabelingJob()
        - .toCreateModelBiasJobDefinition()
        - .toCreateModelExplainabilityJobDefinition()
        - .toCreateModelQualityJobDefinition()
        - .toCreateMonitoringSchedule()
        - .toCreateProcessingJob()
        - .toCreateTrainingJob()
        - .toCreateTransformJob()
        - .toUpdateMonitoringSchedule()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cf541c6a98855568607a6887277126095e6daae1cfcf67cae47ac22292d81a7e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifOutputKmsKey", [value, operator]))

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by a tag key and value pair.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to resource types:

        - device
        - device-fleet
        - edge-packaging-job
        - edge-deployment-plan
        - flow-definition
        - human-task-ui
        - inference-recommendations-job
        - inference-experiment
        - labeling-job
        - workteam
        - workforce
        - domain
        - user-profile
        - space
        - app
        - app-image-config
        - studio-lifecycle-config
        - notebook-instance
        - code-repository
        - image
        - algorithm
        - training-job
        - processing-job
        - hyper-parameter-tuning-job
        - project
        - model-package
        - model-package-group
        - model
        - endpoint-config
        - endpoint
        - transform-job
        - compilation-job
        - automl-job
        - monitoring-schedule
        - data-quality-job-definition
        - model-quality-job-definition
        - model-bias-job-definition
        - model-explainability-job-definition
        - experiment
        - experiment-trial
        - experiment-trial-component
        - feature-group
        - pipeline
        - artifact
        - context
        - action
        - lineage-group
        - model-card
        - model-card-export-job

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__404bd6abf3382e2e2ab0fb6b7425865af19bdff8c9d7cdc8d5c08dd0dc7b28c8)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifResourceTagExists")
    def if_resource_tag_exists(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the preface string for a tag key and value pair attached to a resource.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9a97dc0bedb25ddfa1f276db7645e07e7021b7041236bfb4dd5ecc6bdb8724e7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifResourceTagExists", [value, operator]))

    @jsii.member(jsii_name="ifRootAccess")
    def if_root_access(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the root access associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateNotebookInstance()
        - .toUpdateNotebookInstance()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6d84cb41b41ad05914e995b64d96b56f6e7bc73048031e9f73abc2acad2f3398)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifRootAccess", [value, operator]))

    @jsii.member(jsii_name="ifServerlessMaxConcurrency")
    def if_serverless_max_concurrency(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by limiting maximum concurrency used for Serverless inference in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateEndpointConfig()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9a56494c453682d3960504b6662fdd5908cf0d76704a170b8ff1bc54f35a5e0c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifServerlessMaxConcurrency", [value, operator]))

    @jsii.member(jsii_name="ifServerlessMemorySize")
    def if_serverless_memory_size(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by limiting memory size used for Serverless inference in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateEndpointConfig()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b14758d6261962fc38420d4169b89a8837f24cacecae40483616a37edbabcc00)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifServerlessMemorySize", [value, operator]))

    @jsii.member(jsii_name="ifTargetModel")
    def if_target_model(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the target model associated with the Multi-Model Endpoint in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toInvokeEndpoint()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__83a1f281f80dc72072a3e2cbaae8204b581f21af3a669deef8c348ccb62c98f1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifTargetModel", [value, operator]))

    @jsii.member(jsii_name="ifVolumeKmsKey")
    def if_volume_kms_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the volume kms key associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateAutoMLJob()
        - .toCreateAutoMLJobV2()
        - .toCreateDataQualityJobDefinition()
        - .toCreateDomain()
        - .toCreateEndpointConfig()
        - .toCreateHyperParameterTuningJob()
        - .toCreateLabelingJob()
        - .toCreateModelBiasJobDefinition()
        - .toCreateModelExplainabilityJobDefinition()
        - .toCreateModelQualityJobDefinition()
        - .toCreateMonitoringSchedule()
        - .toCreateNotebookInstance()
        - .toCreateProcessingJob()
        - .toCreateTrainingJob()
        - .toCreateTransformJob()
        - .toUpdateMonitoringSchedule()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5f7f81027bda93f155ad29fbb13a0c57a512cfdd9fcb53cfd6b11df8ee2fe2f1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifVolumeKmsKey", [value, operator]))

    @jsii.member(jsii_name="ifVpcSecurityGroupIds")
    def if_vpc_security_group_ids(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the list of all VPC security group ids associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateAutoMLJob()
        - .toCreateAutoMLJobV2()
        - .toCreateDataQualityJobDefinition()
        - .toCreateDomain()
        - .toCreateHyperParameterTuningJob()
        - .toCreateModel()
        - .toCreateModelBiasJobDefinition()
        - .toCreateModelExplainabilityJobDefinition()
        - .toCreateModelQualityJobDefinition()
        - .toCreateMonitoringSchedule()
        - .toCreateNotebookInstance()
        - .toCreateProcessingJob()
        - .toCreateTrainingJob()
        - .toCreateUserProfile()
        - .toUpdateDomain()
        - .toUpdateMonitoringSchedule()
        - .toUpdateUserProfile()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dc5285641c598ac848c8f96ac7d4f187d599123090452c6f6bea6719e80acef3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifVpcSecurityGroupIds", [value, operator]))

    @jsii.member(jsii_name="ifVpcSubnets")
    def if_vpc_subnets(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the list of all VPC subnets associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateAutoMLJob()
        - .toCreateAutoMLJobV2()
        - .toCreateDataQualityJobDefinition()
        - .toCreateDomain()
        - .toCreateHyperParameterTuningJob()
        - .toCreateModel()
        - .toCreateModelBiasJobDefinition()
        - .toCreateModelExplainabilityJobDefinition()
        - .toCreateModelQualityJobDefinition()
        - .toCreateMonitoringSchedule()
        - .toCreateNotebookInstance()
        - .toCreateProcessingJob()
        - .toCreateTrainingJob()
        - .toUpdateMonitoringSchedule()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__650a9ea5d2ca7d4247a4da6b27fbbf7115104db82941af82bc5eb77743f03859)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifVpcSubnets", [value, operator]))

    @jsii.member(jsii_name="ifWorkteamArn")
    def if_workteam_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the workteam arn associated to the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateFlowDefinition()
        - .toCreateLabelingJob()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7a9cdef098e6ee19e45bc212da2ae631eeb1407301c979321ce11d1a2e355ddc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifWorkteamArn", [value, operator]))

    @jsii.member(jsii_name="ifWorkteamType")
    def if_workteam_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sagemaker":
        '''(experimental) Filters access by the workteam type associated to the request. This can be public-crowd, private-crowd or vendor-crowd.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsagemaker.html#amazonsagemaker-policy-keys

        Applies to actions:

        - .toCreateFlowDefinition()
        - .toCreateLabelingJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6ea77127a1e28fd01e13831d5e69c4a64c82ba66c437904e0cb58f5fa2ef2182)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sagemaker", jsii.invoke(self, "ifWorkteamType", [value, operator]))

    @jsii.member(jsii_name="onAction")
    def on_action(
        self,
        action_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type action to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ActionSummary.html

        :param action_name: - Identifier for the actionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7863676364db59b8d3219a3d4740b00160b1a28e1022efed0ccbd28f8ca4a0c0)
            check_type(argname="argument action_name", value=action_name, expected_type=type_hints["action_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onAction", [action_name, account, region, partition]))

    @jsii.member(jsii_name="onAlgorithm")
    def on_algorithm(
        self,
        algorithm_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type algorithm to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/algorithms-choose.html

        :param algorithm_name: - Identifier for the algorithmName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__796e81830b1eaacf7b9c2dd58e1e29a2829bc10fc4c9535a2521d9019cd7629d)
            check_type(argname="argument algorithm_name", value=algorithm_name, expected_type=type_hints["algorithm_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onAlgorithm", [algorithm_name, account, region, partition]))

    @jsii.member(jsii_name="onApp")
    def on_app(
        self,
        domain_id: builtins.str,
        user_profile_name: builtins.str,
        app_type: builtins.str,
        app_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type app to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/studio-entity-status.html

        :param domain_id: - Identifier for the domainId.
        :param user_profile_name: - Identifier for the userProfileName.
        :param app_type: - Identifier for the appType.
        :param app_name: - Identifier for the appName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8b26604fe5c6673ced72519c4395d67d1c223236910e6fff9b848e05fb240a23)
            check_type(argname="argument domain_id", value=domain_id, expected_type=type_hints["domain_id"])
            check_type(argname="argument user_profile_name", value=user_profile_name, expected_type=type_hints["user_profile_name"])
            check_type(argname="argument app_type", value=app_type, expected_type=type_hints["app_type"])
            check_type(argname="argument app_name", value=app_name, expected_type=type_hints["app_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onApp", [domain_id, user_profile_name, app_type, app_name, account, region, partition]))

    @jsii.member(jsii_name="onAppImageConfig")
    def on_app_image_config(
        self,
        app_image_config_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type app-image-config to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/studio-byoi-create.html

        :param app_image_config_name: - Identifier for the appImageConfigName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8b42aa6af10417e2f703fbaefa19c4fe2961e4b28718ee72a1d26738a187d847)
            check_type(argname="argument app_image_config_name", value=app_image_config_name, expected_type=type_hints["app_image_config_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onAppImageConfig", [app_image_config_name, account, region, partition]))

    @jsii.member(jsii_name="onArtifact")
    def on_artifact(
        self,
        hash_of_artifact_source: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type artifact to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ArtifactSummary.html

        :param hash_of_artifact_source: - Identifier for the hashOfArtifactSource.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9e898da66b886a3715e8d188d4e84c04942175348cf46b64341cf94cc4981582)
            check_type(argname="argument hash_of_artifact_source", value=hash_of_artifact_source, expected_type=type_hints["hash_of_artifact_source"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onArtifact", [hash_of_artifact_source, account, region, partition]))

    @jsii.member(jsii_name="onAutomlJob")
    def on_automl_job(
        self,
        auto_ml_job_job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type automl-job to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/autopilot-automate-model-development.html

        :param auto_ml_job_job_name: - Identifier for the autoMLJobJobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4d232b13481f75812dc9bb5674aa90a214318e4bfc24c1ab50e6a44f6fc0b0c6)
            check_type(argname="argument auto_ml_job_job_name", value=auto_ml_job_job_name, expected_type=type_hints["auto_ml_job_job_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onAutomlJob", [auto_ml_job_job_name, account, region, partition]))

    @jsii.member(jsii_name="onCodeRepository")
    def on_code_repository(
        self,
        code_repository_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type code-repository to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/nbi-git-repo.html

        :param code_repository_name: - Identifier for the codeRepositoryName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__20c9eba04963e54b880c766f84763778836627411b992174eb8aaf139376d237)
            check_type(argname="argument code_repository_name", value=code_repository_name, expected_type=type_hints["code_repository_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onCodeRepository", [code_repository_name, account, region, partition]))

    @jsii.member(jsii_name="onCompilationJob")
    def on_compilation_job(
        self,
        compilation_job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type compilation-job to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CompilationJobSummary.html

        :param compilation_job_name: - Identifier for the compilationJobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__540860134303763fae931c9b635a57e51a5e545b92d507d6fb29b286be3c1c88)
            check_type(argname="argument compilation_job_name", value=compilation_job_name, expected_type=type_hints["compilation_job_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onCompilationJob", [compilation_job_name, account, region, partition]))

    @jsii.member(jsii_name="onContext")
    def on_context(
        self,
        context_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type context to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ContextSummary.html

        :param context_name: - Identifier for the contextName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__17825cb8f22b7e7e18daf9e35ac01a54c235ca41a7be1a47ef173399c1e5cc5f)
            check_type(argname="argument context_name", value=context_name, expected_type=type_hints["context_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onContext", [context_name, account, region, partition]))

    @jsii.member(jsii_name="onDataQualityJobDefinition")
    def on_data_quality_job_definition(
        self,
        data_quality_job_definition_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type data-quality-job-definition to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-data-quality.html

        :param data_quality_job_definition_name: - Identifier for the dataQualityJobDefinitionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__be1e2c46845f61ab844791887bc943a97155d44d3f558c5670dd76df1fc7fa53)
            check_type(argname="argument data_quality_job_definition_name", value=data_quality_job_definition_name, expected_type=type_hints["data_quality_job_definition_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onDataQualityJobDefinition", [data_quality_job_definition_name, account, region, partition]))

    @jsii.member(jsii_name="onDevice")
    def on_device(
        self,
        device_fleet_name: builtins.str,
        device_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type device to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/neo-edge-devices.html

        :param device_fleet_name: - Identifier for the deviceFleetName.
        :param device_name: - Identifier for the deviceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6935be1530a251f69c0e8bf465c0ce2c495ae6357de4e8fa460b1ce132eee710)
            check_type(argname="argument device_fleet_name", value=device_fleet_name, expected_type=type_hints["device_fleet_name"])
            check_type(argname="argument device_name", value=device_name, expected_type=type_hints["device_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onDevice", [device_fleet_name, device_name, account, region, partition]))

    @jsii.member(jsii_name="onDeviceFleet")
    def on_device_fleet(
        self,
        device_fleet_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type device-fleet to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/edge-device-fleet.html

        :param device_fleet_name: - Identifier for the deviceFleetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ab02cc8abf076599810efb9572af72aff900e01586a441808c6145256703c9b3)
            check_type(argname="argument device_fleet_name", value=device_fleet_name, expected_type=type_hints["device_fleet_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onDeviceFleet", [device_fleet_name, account, region, partition]))

    @jsii.member(jsii_name="onDomain")
    def on_domain(
        self,
        domain_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type domain to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/studio-entity-status.html

        :param domain_id: - Identifier for the domainId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3a533bd466d24ad07ded287744ef6bf964eeaeb3700e705ddf51f844f94e15d3)
            check_type(argname="argument domain_id", value=domain_id, expected_type=type_hints["domain_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onDomain", [domain_id, account, region, partition]))

    @jsii.member(jsii_name="onEdgeDeploymentPlan")
    def on_edge_deployment_plan(
        self,
        edge_deployment_plan_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type edge-deployment-plan to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/edge.html

        :param edge_deployment_plan_name: - Identifier for the edgeDeploymentPlanName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cf4cbdb468737e083f9ec26f8c7e079aa1a0e340076075a7ac6bc5a60a2e7f94)
            check_type(argname="argument edge_deployment_plan_name", value=edge_deployment_plan_name, expected_type=type_hints["edge_deployment_plan_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onEdgeDeploymentPlan", [edge_deployment_plan_name, account, region, partition]))

    @jsii.member(jsii_name="onEdgePackagingJob")
    def on_edge_packaging_job(
        self,
        edge_packaging_job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type edge-packaging-job to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/edge-packaging-job.html

        :param edge_packaging_job_name: - Identifier for the edgePackagingJobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__478e9b855121c62a04b8ad67f8b3e99578ff45562bbfed8d724e13c8ef92d279)
            check_type(argname="argument edge_packaging_job_name", value=edge_packaging_job_name, expected_type=type_hints["edge_packaging_job_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onEdgePackagingJob", [edge_packaging_job_name, account, region, partition]))

    @jsii.member(jsii_name="onEndpoint")
    def on_endpoint(
        self,
        endpoint_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type endpoint to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/realtime-endpoints.html

        :param endpoint_name: - Identifier for the endpointName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f8a8f4439bd1cc2f18a1a883ad496ec681114164eb49473112d58053f64415f1)
            check_type(argname="argument endpoint_name", value=endpoint_name, expected_type=type_hints["endpoint_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onEndpoint", [endpoint_name, account, region, partition]))

    @jsii.member(jsii_name="onEndpointConfig")
    def on_endpoint_config(
        self,
        endpoint_config_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type endpoint-config to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/realtime-endpoints.html

        :param endpoint_config_name: - Identifier for the endpointConfigName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ac4f2afa5bf6b00fbb136c79e9f026bc3f1f5d29e5c10ded95a17b0a25cd9443)
            check_type(argname="argument endpoint_config_name", value=endpoint_config_name, expected_type=type_hints["endpoint_config_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onEndpointConfig", [endpoint_config_name, account, region, partition]))

    @jsii.member(jsii_name="onExperiment")
    def on_experiment(
        self,
        experiment_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type experiment to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_Experiment.html

        :param experiment_name: - Identifier for the experimentName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5b11b9c286e941dd22e209bfc6f6acaaea361d2d4c8a0ef240f58793feed71b3)
            check_type(argname="argument experiment_name", value=experiment_name, expected_type=type_hints["experiment_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onExperiment", [experiment_name, account, region, partition]))

    @jsii.member(jsii_name="onExperimentTrial")
    def on_experiment_trial(
        self,
        trial_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type experiment-trial to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_Trial.html

        :param trial_name: - Identifier for the trialName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__816238b87cfa136779250b3abd25e31be58ac4e97e073dadb87e8d0a1a084039)
            check_type(argname="argument trial_name", value=trial_name, expected_type=type_hints["trial_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onExperimentTrial", [trial_name, account, region, partition]))

    @jsii.member(jsii_name="onExperimentTrialComponent")
    def on_experiment_trial_component(
        self,
        trial_component_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type experiment-trial-component to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_TrialComponent.html

        :param trial_component_name: - Identifier for the trialComponentName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__765679dca7cc45ce640b88247eb7237c8b2e193eeccc1efefca69e1c04c32bd2)
            check_type(argname="argument trial_component_name", value=trial_component_name, expected_type=type_hints["trial_component_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onExperimentTrialComponent", [trial_component_name, account, region, partition]))

    @jsii.member(jsii_name="onFeatureGroup")
    def on_feature_group(
        self,
        feature_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type feature-group to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store.html

        :param feature_group_name: - Identifier for the featureGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5912bc0ca12b6889eab535bea747936aa271803655077b91972a6faa1917df8e)
            check_type(argname="argument feature_group_name", value=feature_group_name, expected_type=type_hints["feature_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onFeatureGroup", [feature_group_name, account, region, partition]))

    @jsii.member(jsii_name="onFlowDefinition")
    def on_flow_definition(
        self,
        flow_definition_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type flow-definition to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/a2i-create-flow-definition.html

        :param flow_definition_name: - Identifier for the flowDefinitionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__159c8968c1c06dd2b9ded2423da177a3d2de576ddfbc61c5251a0ba65eb9550c)
            check_type(argname="argument flow_definition_name", value=flow_definition_name, expected_type=type_hints["flow_definition_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onFlowDefinition", [flow_definition_name, account, region, partition]))

    @jsii.member(jsii_name="onHub")
    def on_hub(
        self,
        hub_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type hub to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/jumpstart-content-sharing.html

        :param hub_name: - Identifier for the hubName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__682eecdb6402faa677bb7b94725bffaa828ad06b1967434c5377cef5be7c1398)
            check_type(argname="argument hub_name", value=hub_name, expected_type=type_hints["hub_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onHub", [hub_name, account, region, partition]))

    @jsii.member(jsii_name="onHubContent")
    def on_hub_content(
        self,
        hub_name: builtins.str,
        hub_content_type: builtins.str,
        hub_content_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type hub-content to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/jumpstart-content-sharing.html

        :param hub_name: - Identifier for the hubName.
        :param hub_content_type: - Identifier for the hubContentType.
        :param hub_content_name: - Identifier for the hubContentName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9a1c127bafd1752ec7ddc338f45000056f156f8cd98065ac90105ff364f72567)
            check_type(argname="argument hub_name", value=hub_name, expected_type=type_hints["hub_name"])
            check_type(argname="argument hub_content_type", value=hub_content_type, expected_type=type_hints["hub_content_type"])
            check_type(argname="argument hub_content_name", value=hub_content_name, expected_type=type_hints["hub_content_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onHubContent", [hub_name, hub_content_type, hub_content_name, account, region, partition]))

    @jsii.member(jsii_name="onHumanLoop")
    def on_human_loop(
        self,
        human_loop_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type human-loop to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/a2i-start-human-loop.html

        :param human_loop_name: - Identifier for the humanLoopName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__300eb028ffecc8c818e582f3154083ebc599947b3d56d39b4528b0346661a24b)
            check_type(argname="argument human_loop_name", value=human_loop_name, expected_type=type_hints["human_loop_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onHumanLoop", [human_loop_name, account, region, partition]))

    @jsii.member(jsii_name="onHumanTaskUi")
    def on_human_task_ui(
        self,
        human_task_ui_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type human-task-ui to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/a2i-instructions-overview.html

        :param human_task_ui_name: - Identifier for the humanTaskUiName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__00ffa16a4c46e1c15d3b157f723db16c26941a57909b16bf823ed431535b04e3)
            check_type(argname="argument human_task_ui_name", value=human_task_ui_name, expected_type=type_hints["human_task_ui_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onHumanTaskUi", [human_task_ui_name, account, region, partition]))

    @jsii.member(jsii_name="onHyperParameterTuningJob")
    def on_hyper_parameter_tuning_job(
        self,
        hyper_parameter_tuning_job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type hyper-parameter-tuning-job to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/automatic-model-tuning-how-it-works.html

        :param hyper_parameter_tuning_job_name: - Identifier for the hyperParameterTuningJobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__99e58ae553c70ce888ac5905074ff968d05770bf4d913667a3fbf9c8bfca31f7)
            check_type(argname="argument hyper_parameter_tuning_job_name", value=hyper_parameter_tuning_job_name, expected_type=type_hints["hyper_parameter_tuning_job_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onHyperParameterTuningJob", [hyper_parameter_tuning_job_name, account, region, partition]))

    @jsii.member(jsii_name="onImage")
    def on_image(
        self,
        image_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type image to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/studio-byoi.html

        :param image_name: - Identifier for the imageName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__98c63974480cedc4877aa7ebd1768301b5e74d63a65ddaf2f5e31c9309539c95)
            check_type(argname="argument image_name", value=image_name, expected_type=type_hints["image_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onImage", [image_name, account, region, partition]))

    @jsii.member(jsii_name="onImageVersion")
    def on_image_version(
        self,
        image_name: builtins.str,
        version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type image-version to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/studio-byoi.html

        :param image_name: - Identifier for the imageName.
        :param version: - Identifier for the version.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ebb217492b666a905088056314a1390d6f75113cc9333d057ed703e39b28db39)
            check_type(argname="argument image_name", value=image_name, expected_type=type_hints["image_name"])
            check_type(argname="argument version", value=version, expected_type=type_hints["version"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onImageVersion", [image_name, version, account, region, partition]))

    @jsii.member(jsii_name="onInferenceExperiment")
    def on_inference_experiment(
        self,
        inference_experiment_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type inference-experiment to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/inference-experiment.html

        :param inference_experiment_name: - Identifier for the inferenceExperimentName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e0a2bdac1abafb84c9d80f4c24f6446f8fba7dd9ac59b19e8335f271471d3f88)
            check_type(argname="argument inference_experiment_name", value=inference_experiment_name, expected_type=type_hints["inference_experiment_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onInferenceExperiment", [inference_experiment_name, account, region, partition]))

    @jsii.member(jsii_name="onInferenceRecommendationsJob")
    def on_inference_recommendations_job(
        self,
        inference_recommendations_job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type inference-recommendations-job to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/inference-recommender-recommendation-jobs.html

        :param inference_recommendations_job_name: - Identifier for the inferenceRecommendationsJobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c75ad3b13bad4306cc3de0270d422d7924f6c8a60481ead63aa4419c9b807293)
            check_type(argname="argument inference_recommendations_job_name", value=inference_recommendations_job_name, expected_type=type_hints["inference_recommendations_job_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onInferenceRecommendationsJob", [inference_recommendations_job_name, account, region, partition]))

    @jsii.member(jsii_name="onLabelingJob")
    def on_labeling_job(
        self,
        labeling_job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type labeling-job to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/sms.html

        :param labeling_job_name: - Identifier for the labelingJobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__40feca216d525bdb958d495a575f1d82336eca7be9ad98a64951abcd0db793f9)
            check_type(argname="argument labeling_job_name", value=labeling_job_name, expected_type=type_hints["labeling_job_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onLabelingJob", [labeling_job_name, account, region, partition]))

    @jsii.member(jsii_name="onLineageGroup")
    def on_lineage_group(
        self,
        lineage_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type lineage-group to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_LineageGroupSummary.html

        :param lineage_group_name: - Identifier for the lineageGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d0e98aae84721bf08eb7f0da67d3c2105e764ac54985dee4ee902d057b2e9ff9)
            check_type(argname="argument lineage_group_name", value=lineage_group_name, expected_type=type_hints["lineage_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onLineageGroup", [lineage_group_name, account, region, partition]))

    @jsii.member(jsii_name="onModel")
    def on_model(
        self,
        model_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type model to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/realtime-endpoints.html

        :param model_name: - Identifier for the modelName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7e4a79c642c7042f12a5f0d896add1b2c0d71bb48627d00b7e619dc5e139d154)
            check_type(argname="argument model_name", value=model_name, expected_type=type_hints["model_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onModel", [model_name, account, region, partition]))

    @jsii.member(jsii_name="onModelBiasJobDefinition")
    def on_model_bias_job_definition(
        self,
        model_bias_job_definition_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type model-bias-job-definition to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-detect-post-training-bias.html

        :param model_bias_job_definition_name: - Identifier for the modelBiasJobDefinitionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__27ee2f17c7f072db3db08385b802dbbe5695cf970003124add8aa22496404231)
            check_type(argname="argument model_bias_job_definition_name", value=model_bias_job_definition_name, expected_type=type_hints["model_bias_job_definition_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onModelBiasJobDefinition", [model_bias_job_definition_name, account, region, partition]))

    @jsii.member(jsii_name="onModelCard")
    def on_model_card(
        self,
        model_card_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type model-card to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ModelCard.html

        :param model_card_name: - Identifier for the modelCardName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e6964b63280577dd56ebd9426115ff58e9322954faa6974f8a3124a1cd40b5ca)
            check_type(argname="argument model_card_name", value=model_card_name, expected_type=type_hints["model_card_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onModelCard", [model_card_name, account, region, partition]))

    @jsii.member(jsii_name="onModelCardExportJob")
    def on_model_card_export_job(
        self,
        model_card_name: builtins.str,
        export_job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type model-card-export-job to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ModelCardExportJob.html

        :param model_card_name: - Identifier for the modelCardName.
        :param export_job_name: - Identifier for the exportJobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7bbf9ee248c97de86fe031f75c934ae9b9b082d90679060014187036446fefad)
            check_type(argname="argument model_card_name", value=model_card_name, expected_type=type_hints["model_card_name"])
            check_type(argname="argument export_job_name", value=export_job_name, expected_type=type_hints["export_job_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onModelCardExportJob", [model_card_name, export_job_name, account, region, partition]))

    @jsii.member(jsii_name="onModelExplainabilityJobDefinition")
    def on_model_explainability_job_definition(
        self,
        model_explainability_job_definition_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type model-explainability-job-definition to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-model-explainability.html

        :param model_explainability_job_definition_name: - Identifier for the modelExplainabilityJobDefinitionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__aa5a83ea034d7f244198ff41c70140f6e5a85abd1d8306f359228e42dd4fdf9b)
            check_type(argname="argument model_explainability_job_definition_name", value=model_explainability_job_definition_name, expected_type=type_hints["model_explainability_job_definition_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onModelExplainabilityJobDefinition", [model_explainability_job_definition_name, account, region, partition]))

    @jsii.member(jsii_name="onModelPackage")
    def on_model_package(
        self,
        model_package_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type model-package to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ModelPackage.html

        :param model_package_name: - Identifier for the modelPackageName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cc89dc57eeac927db3fffd51f78981bb19435907cee528b9762cccf6161aa5cc)
            check_type(argname="argument model_package_name", value=model_package_name, expected_type=type_hints["model_package_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onModelPackage", [model_package_name, account, region, partition]))

    @jsii.member(jsii_name="onModelPackageGroup")
    def on_model_package_group(
        self,
        model_package_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type model-package-group to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-model-group.html

        :param model_package_group_name: - Identifier for the modelPackageGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6110e80ff6fce02bce0eff6d6fdd338a65a3ffd476620d640af8ea734bf3bcb2)
            check_type(argname="argument model_package_group_name", value=model_package_group_name, expected_type=type_hints["model_package_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onModelPackageGroup", [model_package_group_name, account, region, partition]))

    @jsii.member(jsii_name="onModelQualityJobDefinition")
    def on_model_quality_job_definition(
        self,
        model_quality_job_definition_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type model-quality-job-definition to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-model-quality.html

        :param model_quality_job_definition_name: - Identifier for the modelQualityJobDefinitionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__11af252dfccbd6b02f76c3a3ad9f1d3bdd5ec282cecc1686899f9789919e719d)
            check_type(argname="argument model_quality_job_definition_name", value=model_quality_job_definition_name, expected_type=type_hints["model_quality_job_definition_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onModelQualityJobDefinition", [model_quality_job_definition_name, account, region, partition]))

    @jsii.member(jsii_name="onMonitoringSchedule")
    def on_monitoring_schedule(
        self,
        monitoring_schedule_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type monitoring-schedule to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-scheduling.html

        :param monitoring_schedule_name: - Identifier for the monitoringScheduleName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c76f311a2cb276f0e81076245cbf02bf633afbe364d33a48ba40006d0f129b81)
            check_type(argname="argument monitoring_schedule_name", value=monitoring_schedule_name, expected_type=type_hints["monitoring_schedule_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onMonitoringSchedule", [monitoring_schedule_name, account, region, partition]))

    @jsii.member(jsii_name="onMonitoringScheduleAlert")
    def on_monitoring_schedule_alert(
        self,
        monitoring_schedule_name: builtins.str,
        monitoring_schedule_alert_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type monitoring-schedule-alert to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/model-monitor-scheduling.html

        :param monitoring_schedule_name: - Identifier for the monitoringScheduleName.
        :param monitoring_schedule_alert_name: - Identifier for the monitoringScheduleAlertName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fcd862db13619eb528fe1c91c7d2ee13bf312ee3c7287467d617fa19c2266631)
            check_type(argname="argument monitoring_schedule_name", value=monitoring_schedule_name, expected_type=type_hints["monitoring_schedule_name"])
            check_type(argname="argument monitoring_schedule_alert_name", value=monitoring_schedule_alert_name, expected_type=type_hints["monitoring_schedule_alert_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onMonitoringScheduleAlert", [monitoring_schedule_name, monitoring_schedule_alert_name, account, region, partition]))

    @jsii.member(jsii_name="onNotebookInstance")
    def on_notebook_instance(
        self,
        notebook_instance_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type notebook-instance to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/nbi.html

        :param notebook_instance_name: - Identifier for the notebookInstanceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4986cb9ca9b55048cfb744701360cabceed033f68303193697aa7413d2e645ea)
            check_type(argname="argument notebook_instance_name", value=notebook_instance_name, expected_type=type_hints["notebook_instance_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onNotebookInstance", [notebook_instance_name, account, region, partition]))

    @jsii.member(jsii_name="onNotebookInstanceLifecycleConfig")
    def on_notebook_instance_lifecycle_config(
        self,
        notebook_instance_lifecycle_config_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type notebook-instance-lifecycle-config to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/notebook-lifecycle-config.html

        :param notebook_instance_lifecycle_config_name: - Identifier for the notebookInstanceLifecycleConfigName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fbf71bbc77be6298b931df7f75a5b90b058d5b45ad6cb30b629f1248aba006b3)
            check_type(argname="argument notebook_instance_lifecycle_config_name", value=notebook_instance_lifecycle_config_name, expected_type=type_hints["notebook_instance_lifecycle_config_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onNotebookInstanceLifecycleConfig", [notebook_instance_lifecycle_config_name, account, region, partition]))

    @jsii.member(jsii_name="onPipeline")
    def on_pipeline(
        self,
        pipeline_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type pipeline to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_Pipeline.html

        :param pipeline_name: - Identifier for the pipelineName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c26c116684aea5f0becd9447cf320222efc77fe4db849c583938c7b77aa843fc)
            check_type(argname="argument pipeline_name", value=pipeline_name, expected_type=type_hints["pipeline_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onPipeline", [pipeline_name, account, region, partition]))

    @jsii.member(jsii_name="onPipelineExecution")
    def on_pipeline_execution(
        self,
        pipeline_name: builtins.str,
        random_string: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type pipeline-execution to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_PipelineExecution.html

        :param pipeline_name: - Identifier for the pipelineName.
        :param random_string: - Identifier for the randomString.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cc1b461516b3ca48fc9a5abdf0234faa49ebe10575f48aee754e29dd8fd01cee)
            check_type(argname="argument pipeline_name", value=pipeline_name, expected_type=type_hints["pipeline_name"])
            check_type(argname="argument random_string", value=random_string, expected_type=type_hints["random_string"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onPipelineExecution", [pipeline_name, random_string, account, region, partition]))

    @jsii.member(jsii_name="onProcessingJob")
    def on_processing_job(
        self,
        processing_job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type processing-job to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/processing-job.html

        :param processing_job_name: - Identifier for the processingJobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b1f400f3cb274254c36806db76d79a3f9e2f1457623bcbce735b8beca46d12cb)
            check_type(argname="argument processing_job_name", value=processing_job_name, expected_type=type_hints["processing_job_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onProcessingJob", [processing_job_name, account, region, partition]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type project to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-projects-whatis.html

        :param project_name: - Identifier for the projectName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__da3de3213eed4ee45e513e0d0374c1eb1dd5150eabc0ca95d7ae5de82644023e)
            check_type(argname="argument project_name", value=project_name, expected_type=type_hints["project_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onProject", [project_name, account, region, partition]))

    @jsii.member(jsii_name="onSharedModel")
    def on_shared_model(
        self,
        shared_model_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type shared-model to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/canvas-collaborate-permissions.html

        :param shared_model_id: - Identifier for the sharedModelId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b38e7744ea55406529b6fcd7ab31f5ce285d9dcac7a1c56d3016395a773ee379)
            check_type(argname="argument shared_model_id", value=shared_model_id, expected_type=type_hints["shared_model_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onSharedModel", [shared_model_id, account, region, partition]))

    @jsii.member(jsii_name="onSharedModelEvent")
    def on_shared_model_event(
        self,
        event_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type shared-model-event to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/canvas-collaborate-permissions.html

        :param event_id: - Identifier for the eventId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b2e0866dae97ed5e16e0baf811ccfa11c8ab0d7c563caf7d3f114bfffd1ee1e7)
            check_type(argname="argument event_id", value=event_id, expected_type=type_hints["event_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onSharedModelEvent", [event_id, account, region, partition]))

    @jsii.member(jsii_name="onSpace")
    def on_space(
        self,
        domain_id: builtins.str,
        space_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type space to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/studio-entity-status.html

        :param domain_id: - Identifier for the domainId.
        :param space_name: - Identifier for the spaceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__44c6a82fcc7526d434ffff3e1e8d47c1684cfc3ef72215fe0637756adf6f7cc8)
            check_type(argname="argument domain_id", value=domain_id, expected_type=type_hints["domain_id"])
            check_type(argname="argument space_name", value=space_name, expected_type=type_hints["space_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onSpace", [domain_id, space_name, account, region, partition]))

    @jsii.member(jsii_name="onStudioLifecycleConfig")
    def on_studio_lifecycle_config(
        self,
        studio_lifecycle_config_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type studio-lifecycle-config to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/studio-lcc.html

        :param studio_lifecycle_config_name: - Identifier for the studioLifecycleConfigName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d1d3beef3b095b21e8713c958ce623d7c718ed14c0b6990e3d83f8beb2acf68d)
            check_type(argname="argument studio_lifecycle_config_name", value=studio_lifecycle_config_name, expected_type=type_hints["studio_lifecycle_config_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onStudioLifecycleConfig", [studio_lifecycle_config_name, account, region, partition]))

    @jsii.member(jsii_name="onTrainingJob")
    def on_training_job(
        self,
        training_job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type training-job to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/how-it-works-training.html

        :param training_job_name: - Identifier for the trainingJobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9e7bf52e3b195642f933a3d01fb1797fde061c39725304a411b1a950795f3647)
            check_type(argname="argument training_job_name", value=training_job_name, expected_type=type_hints["training_job_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onTrainingJob", [training_job_name, account, region, partition]))

    @jsii.member(jsii_name="onTransformJob")
    def on_transform_job(
        self,
        transform_job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type transform-job to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_TransformJob.html.html

        :param transform_job_name: - Identifier for the transformJobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__acf964369d11a91e43b4bc9d2eab1ec61cf498f6696174657394bf24a79dc084)
            check_type(argname="argument transform_job_name", value=transform_job_name, expected_type=type_hints["transform_job_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onTransformJob", [transform_job_name, account, region, partition]))

    @jsii.member(jsii_name="onUserProfile")
    def on_user_profile(
        self,
        domain_id: builtins.str,
        user_profile_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type user-profile to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/studio-entity-status.html

        :param domain_id: - Identifier for the domainId.
        :param user_profile_name: - Identifier for the userProfileName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__112038a0c0f21714a3e75ec931ed39e1af380668c86294421daddc32160804ab)
            check_type(argname="argument domain_id", value=domain_id, expected_type=type_hints["domain_id"])
            check_type(argname="argument user_profile_name", value=user_profile_name, expected_type=type_hints["user_profile_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onUserProfile", [domain_id, user_profile_name, account, region, partition]))

    @jsii.member(jsii_name="onWorkforce")
    def on_workforce(
        self,
        workforce_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type workforce to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/sms-workforce-management.html

        :param workforce_name: - Identifier for the workforceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__aeea7282546dbcea8ae5e74b74768001c3944c6dafe47297c255025527f20e97)
            check_type(argname="argument workforce_name", value=workforce_name, expected_type=type_hints["workforce_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onWorkforce", [workforce_name, account, region, partition]))

    @jsii.member(jsii_name="onWorkteam")
    def on_workteam(
        self,
        workteam_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sagemaker":
        '''(experimental) Adds a resource of type workteam to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/sms-workforce-management.html

        :param workteam_name: - Identifier for the workteamName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__467160d2ff33f276998b2700930e9965d18b70dfcc8ead8d2bf914cd9cc70e10)
            check_type(argname="argument workteam_name", value=workteam_name, expected_type=type_hints["workteam_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sagemaker", jsii.invoke(self, "onWorkteam", [workteam_name, account, region, partition]))

    @jsii.member(jsii_name="toAddAssociation")
    def to_add_association(self) -> "Sagemaker":
        '''(experimental) Grants permission to associate a lineage entity (artifact, context, action, experiment, experiment-trial-component) to each other.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_AddAssociation.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toAddAssociation", []))

    @jsii.member(jsii_name="toAddTags")
    def to_add_tags(self) -> "Sagemaker":
        '''(experimental) Grants permission to add or overwrite one or more tags for the specified Amazon SageMaker resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_AddTags.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toAddTags", []))

    @jsii.member(jsii_name="toAssociateTrialComponent")
    def to_associate_trial_component(self) -> "Sagemaker":
        '''(experimental) Grants permission to associate a trial component with a trial.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_AssociateTrialComponent.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toAssociateTrialComponent", []))

    @jsii.member(jsii_name="toBatchDescribeModelPackage")
    def to_batch_describe_model_package(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe one or more ModelPackages.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_BatchDescribeModelPackage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toBatchDescribeModelPackage", []))

    @jsii.member(jsii_name="toBatchGetMetrics")
    def to_batch_get_metrics(self) -> "Sagemaker":
        '''(experimental) Grants permission to retrieve metrics associated with SageMaker Resources such as Training Jobs or Trial Components.

        This API is not publicly exposed at this point, however admins can control this action

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toBatchGetMetrics", []))

    @jsii.member(jsii_name="toBatchGetRecord")
    def to_batch_get_record(self) -> "Sagemaker":
        '''(experimental) Grants permission to get a batch of records from one or more feature groups.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_feature_store_BatchGetRecord.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toBatchGetRecord", []))

    @jsii.member(jsii_name="toBatchPutMetrics")
    def to_batch_put_metrics(self) -> "Sagemaker":
        '''(experimental) Grants permission to publish metrics associated with a SageMaker Resource such as a Training Job or Trial Component.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toBatchPutMetrics", []))

    @jsii.member(jsii_name="toCreateAction")
    def to_create_action(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an action.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateAction.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateAction", []))

    @jsii.member(jsii_name="toCreateAlgorithm")
    def to_create_algorithm(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an algorithm.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateAlgorithm.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateAlgorithm", []))

    @jsii.member(jsii_name="toCreateApp")
    def to_create_app(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an App for a SageMaker UserProfile or Space.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceTypes()
        - .ifImageArns()
        - .ifImageVersionArns()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateApp.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateApp", []))

    @jsii.member(jsii_name="toCreateAppImageConfig")
    def to_create_app_image_config(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an AppImageConfig.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateAppImageConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateAppImageConfig", []))

    @jsii.member(jsii_name="toCreateArtifact")
    def to_create_artifact(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an artifact.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateArtifact.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateArtifact", []))

    @jsii.member(jsii_name="toCreateAutoMLJob")
    def to_create_auto_ml_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an AutoML job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInterContainerTrafficEncryption()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateAutoMLJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateAutoMLJob", []))

    @jsii.member(jsii_name="toCreateAutoMLJobV2")
    def to_create_auto_ml_job_v2(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a V2 AutoML job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInterContainerTrafficEncryption()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateAutoMLJobV2.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateAutoMLJobV2", []))

    @jsii.member(jsii_name="toCreateCodeRepository")
    def to_create_code_repository(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a CodeRepository.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateCodeRepository.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateCodeRepository", []))

    @jsii.member(jsii_name="toCreateCompilationJob")
    def to_create_compilation_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a compilation job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateCompilationJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateCompilationJob", []))

    @jsii.member(jsii_name="toCreateContext")
    def to_create_context(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a context.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateContext.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateContext", []))

    @jsii.member(jsii_name="toCreateDataQualityJobDefinition")
    def to_create_data_quality_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a data quality job definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceTypes()
        - .ifInterContainerTrafficEncryption()
        - .ifMaxRuntimeInSeconds()
        - .ifNetworkIsolation()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateDataQualityJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateDataQualityJobDefinition", []))

    @jsii.member(jsii_name="toCreateDeviceFleet")
    def to_create_device_fleet(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a device fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateDeviceFleet.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateDeviceFleet", []))

    @jsii.member(jsii_name="toCreateDomain")
    def to_create_domain(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a Domain for SageMaker Studio.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAppNetworkAccessType()
        - .ifInstanceTypes()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()
        - .ifDomainSharingOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifImageArns()
        - .ifImageVersionArns()

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateDomain.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateDomain", []))

    @jsii.member(jsii_name="toCreateEdgeDeploymentPlan")
    def to_create_edge_deployment_plan(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an edge deployment plan.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateEdgeDeploymentPlan.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateEdgeDeploymentPlan", []))

    @jsii.member(jsii_name="toCreateEdgeDeploymentStage")
    def to_create_edge_deployment_stage(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an edge deployment stage.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateEdgeDeploymentStage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateEdgeDeploymentStage", []))

    @jsii.member(jsii_name="toCreateEdgePackagingJob")
    def to_create_edge_packaging_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an edge packaging job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateEdgePackagingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateEdgePackagingJob", []))

    @jsii.member(jsii_name="toCreateEndpoint")
    def to_create_endpoint(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an endpoint using the endpoint configuration specified in the request.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateEndpoint", []))

    @jsii.member(jsii_name="toCreateEndpointConfig")
    def to_create_endpoint_config(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an endpoint configuration that can be deployed using Amazon SageMaker hosting services.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAcceleratorTypes()
        - .ifInstanceTypes()
        - .ifModelArn()
        - .ifVolumeKmsKey()
        - .ifServerlessMaxConcurrency()
        - .ifServerlessMemorySize()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateEndpointConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateEndpointConfig", []))

    @jsii.member(jsii_name="toCreateExperiment")
    def to_create_experiment(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an experiment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateExperiment.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateExperiment", []))

    @jsii.member(jsii_name="toCreateFeatureGroup")
    def to_create_feature_group(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a feature group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifFeatureGroupOnlineStoreKmsKey()
        - .ifFeatureGroupOfflineStoreKmsKey()
        - .ifFeatureGroupOfflineStoreS3Uri()
        - .ifFeatureGroupEnableOnlineStore()
        - .ifFeatureGroupOfflineStoreConfig()
        - .ifFeatureGroupDisableGlueTableCreation()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateFeatureGroup.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateFeatureGroup", []))

    @jsii.member(jsii_name="toCreateFlowDefinition")
    def to_create_flow_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a flow definition, which defines settings for a human workflow.

        Access Level: Write

        Possible conditions:

        - .ifWorkteamArn()
        - .ifWorkteamType()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateFlowDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateFlowDefinition", []))

    @jsii.member(jsii_name="toCreateHub")
    def to_create_hub(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a hub.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateHub.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateHub", []))

    @jsii.member(jsii_name="toCreateHumanTaskUi")
    def to_create_human_task_ui(self) -> "Sagemaker":
        '''(experimental) Grants permission to define the settings you will use for the human review workflow user interface.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateHumanTaskUi.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateHumanTaskUi", []))

    @jsii.member(jsii_name="toCreateHyperParameterTuningJob")
    def to_create_hyper_parameter_tuning_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a hyper parameter tuning job that can be deployed using Amazon SageMaker.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifFileSystemAccessMode()
        - .ifFileSystemDirectoryPath()
        - .ifFileSystemId()
        - .ifFileSystemType()
        - .ifInstanceTypes()
        - .ifInterContainerTrafficEncryption()
        - .ifMaxRuntimeInSeconds()
        - .ifNetworkIsolation()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateHyperParameterTuningJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateHyperParameterTuningJob", []))

    @jsii.member(jsii_name="toCreateImage")
    def to_create_image(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a SageMaker Image.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateImage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateImage", []))

    @jsii.member(jsii_name="toCreateImageVersion")
    def to_create_image_version(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a SageMaker ImageVersion.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateImageVersion.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateImageVersion", []))

    @jsii.member(jsii_name="toCreateInferenceExperiment")
    def to_create_inference_experiment(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an inference experiment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateInferenceExperiment.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateInferenceExperiment", []))

    @jsii.member(jsii_name="toCreateInferenceRecommendationsJob")
    def to_create_inference_recommendations_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an inference recommendations job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateInferenceRecommendationsJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateInferenceRecommendationsJob", []))

    @jsii.member(jsii_name="toCreateLabelingJob")
    def to_create_labeling_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to start a labeling job.

        A labeling job takes unlabeled data in and produces labeled data as output, which can be used for training SageMaker models

        Access Level: Write

        Possible conditions:

        - .ifWorkteamArn()
        - .ifWorkteamType()
        - .ifVolumeKmsKey()
        - .ifOutputKmsKey()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateLabelingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateLabelingJob", []))

    @jsii.member(jsii_name="toCreateLineageGroupPolicy")
    def to_create_lineage_group_policy(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a lineage group policy.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateLineageGroupPolicy", []))

    @jsii.member(jsii_name="toCreateModel")
    def to_create_model(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a model in Amazon SageMaker.

        In the request, you specify a name for the model and describe one or more containers

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifNetworkIsolation()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateModel.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateModel", []))

    @jsii.member(jsii_name="toCreateModelBiasJobDefinition")
    def to_create_model_bias_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a model bias job definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceTypes()
        - .ifInterContainerTrafficEncryption()
        - .ifMaxRuntimeInSeconds()
        - .ifNetworkIsolation()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateModelBiasJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateModelBiasJobDefinition", []))

    @jsii.member(jsii_name="toCreateModelCard")
    def to_create_model_card(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a model card.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateModelCard.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateModelCard", []))

    @jsii.member(jsii_name="toCreateModelCardExportJob")
    def to_create_model_card_export_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an export job for a model card.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateModelCardExportJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateModelCardExportJob", []))

    @jsii.member(jsii_name="toCreateModelExplainabilityJobDefinition")
    def to_create_model_explainability_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a model explainability job definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceTypes()
        - .ifInterContainerTrafficEncryption()
        - .ifMaxRuntimeInSeconds()
        - .ifNetworkIsolation()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateModelExplainabilityJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateModelExplainabilityJobDefinition", []))

    @jsii.member(jsii_name="toCreateModelPackage")
    def to_create_model_package(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a ModelPackage.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifModelApprovalStatus()
        - .ifCustomerMetadataProperties()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateModelPackage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateModelPackage", []))

    @jsii.member(jsii_name="toCreateModelPackageGroup")
    def to_create_model_package_group(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a ModelPackageGroup.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateModelPackageGroup.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateModelPackageGroup", []))

    @jsii.member(jsii_name="toCreateModelQualityJobDefinition")
    def to_create_model_quality_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a model quality job definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceTypes()
        - .ifInterContainerTrafficEncryption()
        - .ifMaxRuntimeInSeconds()
        - .ifNetworkIsolation()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateModelQualityJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateModelQualityJobDefinition", []))

    @jsii.member(jsii_name="toCreateMonitoringSchedule")
    def to_create_monitoring_schedule(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a monitoring schedule.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceTypes()
        - .ifInterContainerTrafficEncryption()
        - .ifMaxRuntimeInSeconds()
        - .ifNetworkIsolation()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateMonitoringSchedule.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateMonitoringSchedule", []))

    @jsii.member(jsii_name="toCreateNotebookInstance")
    def to_create_notebook_instance(self) -> "Sagemaker":
        '''(experimental) Grants permission to create an Amazon SageMaker notebook instance.

        A notebook instance is an Amazon EC2 instance running on a Jupyter Notebook

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAcceleratorTypes()
        - .ifDirectInternetAccess()
        - .ifInstanceTypes()
        - .ifMinimumInstanceMetadataServiceVersion()
        - .ifRootAccess()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateNotebookInstance.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateNotebookInstance", []))

    @jsii.member(jsii_name="toCreateNotebookInstanceLifecycleConfig")
    def to_create_notebook_instance_lifecycle_config(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a notebook instance lifecycle configuration that can be deployed using Amazon SageMaker.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateNotebookInstanceLifecycleConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateNotebookInstanceLifecycleConfig", []))

    @jsii.member(jsii_name="toCreatePipeline")
    def to_create_pipeline(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a pipeline.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreatePipeline.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreatePipeline", []))

    @jsii.member(jsii_name="toCreatePresignedDomainUrl")
    def to_create_presigned_domain_url(self) -> "Sagemaker":
        '''(experimental) Grants permission to return a URL that you can use from your browser to connect to the Domain as a specified UserProfile when AuthMode is 'IAM'.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreatePresignedDomainUrl.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreatePresignedDomainUrl", []))

    @jsii.member(jsii_name="toCreatePresignedNotebookInstanceUrl")
    def to_create_presigned_notebook_instance_url(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a URL that you can use from your browser to connect to the Notebook Instance.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreatePresignedNotebookInstanceUrl.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreatePresignedNotebookInstanceUrl", []))

    @jsii.member(jsii_name="toCreateProcessingJob")
    def to_create_processing_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to start a processing job.

        After processing completes, Amazon SageMaker saves the resulting artifacts and other optional output to an Amazon S3 location that you specify

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceTypes()
        - .ifMaxRuntimeInSeconds()
        - .ifNetworkIsolation()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()
        - .ifInterContainerTrafficEncryption()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateProcessingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateProcessingJob", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a Project.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateProject.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toCreateSharedModel")
    def to_create_shared_model(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a shared model in a SageMaker Studio application.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/canvas-collaborate-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateSharedModel", []))

    @jsii.member(jsii_name="toCreateSpace")
    def to_create_space(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a Space for a SageMaker Domain.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceTypes()
        - .ifImageArns()
        - .ifImageVersionArns()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateSpace.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateSpace", []))

    @jsii.member(jsii_name="toCreateStudioLifecycleConfig")
    def to_create_studio_lifecycle_config(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a Studio Lifecycle Configuration that can be deployed using Amazon SageMaker.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateStudioLifecycleConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateStudioLifecycleConfig", []))

    @jsii.member(jsii_name="toCreateTrainingJob")
    def to_create_training_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to start a model training job.

        After training completes, Amazon SageMaker saves the resulting model artifacts and other optional output to an Amazon S3 location that you specify

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifFileSystemAccessMode()
        - .ifFileSystemDirectoryPath()
        - .ifFileSystemId()
        - .ifFileSystemType()
        - .ifInstanceTypes()
        - .ifInterContainerTrafficEncryption()
        - .ifMaxRuntimeInSeconds()
        - .ifNetworkIsolation()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()
        - .ifKeepAlivePeriod()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateTrainingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateTrainingJob", []))

    @jsii.member(jsii_name="toCreateTransformJob")
    def to_create_transform_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to start a transform job.

        After the results are obtained, Amazon SageMaker saves them to an Amazon S3 location that you specify

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceTypes()
        - .ifModelArn()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateTransformJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateTransformJob", []))

    @jsii.member(jsii_name="toCreateTrial")
    def to_create_trial(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a trial.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateTrial.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateTrial", []))

    @jsii.member(jsii_name="toCreateTrialComponent")
    def to_create_trial_component(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a trial component.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateTrialComponent.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateTrialComponent", []))

    @jsii.member(jsii_name="toCreateUserProfile")
    def to_create_user_profile(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a UserProfile for a SageMaker Domain.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifVpcSecurityGroupIds()
        - .ifInstanceTypes()
        - .ifDomainSharingOutputKmsKey()
        - .ifImageArns()
        - .ifImageVersionArns()

        Dependent actions:

        - iam:PassRole
        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateUserProfile", []))

    @jsii.member(jsii_name="toCreateWorkforce")
    def to_create_workforce(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a workforce.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateWorkforce.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateWorkforce", []))

    @jsii.member(jsii_name="toCreateWorkteam")
    def to_create_workteam(self) -> "Sagemaker":
        '''(experimental) Grants permission to create a workteam.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateWorkteam.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toCreateWorkteam", []))

    @jsii.member(jsii_name="toDeleteAction")
    def to_delete_action(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete an action.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteAction.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteAction", []))

    @jsii.member(jsii_name="toDeleteAlgorithm")
    def to_delete_algorithm(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete an algorithm.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteAlgorithm.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteAlgorithm", []))

    @jsii.member(jsii_name="toDeleteApp")
    def to_delete_app(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete an App.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteApp.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteApp", []))

    @jsii.member(jsii_name="toDeleteAppImageConfig")
    def to_delete_app_image_config(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete an AppImageConfig.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteAppImageConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteAppImageConfig", []))

    @jsii.member(jsii_name="toDeleteArtifact")
    def to_delete_artifact(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete an artifact.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteArtifact.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteArtifact", []))

    @jsii.member(jsii_name="toDeleteAssociation")
    def to_delete_association(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete the association from a lineage entity (artifact, context, action, experiment, experiment-trial-component) to another.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteAssociation.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteAssociation", []))

    @jsii.member(jsii_name="toDeleteCodeRepository")
    def to_delete_code_repository(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a CodeRepository.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteCodeRepository.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteCodeRepository", []))

    @jsii.member(jsii_name="toDeleteContext")
    def to_delete_context(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a context.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteContext.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteContext", []))

    @jsii.member(jsii_name="toDeleteDataQualityJobDefinition")
    def to_delete_data_quality_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete the data quality job definition created using the CreateDataQualityJobDefinition API.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteDataQualityJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteDataQualityJobDefinition", []))

    @jsii.member(jsii_name="toDeleteDeviceFleet")
    def to_delete_device_fleet(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a device fleet.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteDeviceFleet.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteDeviceFleet", []))

    @jsii.member(jsii_name="toDeleteDomain")
    def to_delete_domain(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a Domain.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteDomain.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteDomain", []))

    @jsii.member(jsii_name="toDeleteEdgeDeploymentPlan")
    def to_delete_edge_deployment_plan(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete an edge deployment plan.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteEdgeDeploymentPlan.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteEdgeDeploymentPlan", []))

    @jsii.member(jsii_name="toDeleteEdgeDeploymentStage")
    def to_delete_edge_deployment_stage(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete an edge deployment stage.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteEdgeDeploymentStage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteEdgeDeploymentStage", []))

    @jsii.member(jsii_name="toDeleteEndpoint")
    def to_delete_endpoint(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete an endpoint.

        Amazon SageMaker frees up all the resources that were deployed when the endpoint was created

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteEndpoint", []))

    @jsii.member(jsii_name="toDeleteEndpointConfig")
    def to_delete_endpoint_config(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete the endpoint configuration created using the CreateEndpointConfig API.

        The DeleteEndpointConfig API deletes only the specified configuration. It does not delete any endpoints created using the configuration

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteEndpointConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteEndpointConfig", []))

    @jsii.member(jsii_name="toDeleteExperiment")
    def to_delete_experiment(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete an experiment.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteExperiment.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteExperiment", []))

    @jsii.member(jsii_name="toDeleteFeatureGroup")
    def to_delete_feature_group(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a feature group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteFeatureGroup.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteFeatureGroup", []))

    @jsii.member(jsii_name="toDeleteFlowDefinition")
    def to_delete_flow_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete the specified flow definition.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteFlowDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteFlowDefinition", []))

    @jsii.member(jsii_name="toDeleteHub")
    def to_delete_hub(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete hubs.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteHub.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteHub", []))

    @jsii.member(jsii_name="toDeleteHubContent")
    def to_delete_hub_content(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete hub content.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteHubContent.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteHubContent", []))

    @jsii.member(jsii_name="toDeleteHumanLoop")
    def to_delete_human_loop(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a specified human loop.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteHumanLoop.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteHumanLoop", []))

    @jsii.member(jsii_name="toDeleteHumanTaskUi")
    def to_delete_human_task_ui(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete the specified human task user interface (worker task template).

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteHumanTaskUi.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteHumanTaskUi", []))

    @jsii.member(jsii_name="toDeleteImage")
    def to_delete_image(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a SageMaker Image.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteImage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteImage", []))

    @jsii.member(jsii_name="toDeleteImageVersion")
    def to_delete_image_version(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a SageMaker ImageVersion.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteImageVersion.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteImageVersion", []))

    @jsii.member(jsii_name="toDeleteInferenceExperiment")
    def to_delete_inference_experiment(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete an inference experiment.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteInferenceExperiment.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteInferenceExperiment", []))

    @jsii.member(jsii_name="toDeleteLineageGroupPolicy")
    def to_delete_lineage_group_policy(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a lineage group policy.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteLineageGroupPolicy", []))

    @jsii.member(jsii_name="toDeleteModel")
    def to_delete_model(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a model created using the CreateModel API.

        The DeleteModel API deletes only the model entry in Amazon SageMaker that you created by calling the CreateModel API. It does not delete model artifacts, inference code, or the IAM role that you specified when creating the model

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteModel.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteModel", []))

    @jsii.member(jsii_name="toDeleteModelBiasJobDefinition")
    def to_delete_model_bias_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete the model bias job definition created using the CreateModelBiasJobDefinition API.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteModelBiasJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteModelBiasJobDefinition", []))

    @jsii.member(jsii_name="toDeleteModelCard")
    def to_delete_model_card(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a model card.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteModelCard.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteModelCard", []))

    @jsii.member(jsii_name="toDeleteModelExplainabilityJobDefinition")
    def to_delete_model_explainability_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete the model explainability job definition created using the CreateModelExplainabilityJobDefinition API.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteModelExplainabilityJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteModelExplainabilityJobDefinition", []))

    @jsii.member(jsii_name="toDeleteModelPackage")
    def to_delete_model_package(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a ModelPackage.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteModelPackage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteModelPackage", []))

    @jsii.member(jsii_name="toDeleteModelPackageGroup")
    def to_delete_model_package_group(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a ModelPackageGroup.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteModelPackageGroup.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteModelPackageGroup", []))

    @jsii.member(jsii_name="toDeleteModelPackageGroupPolicy")
    def to_delete_model_package_group_policy(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a ModelPackageGroup policy.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteModelPackageGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteModelPackageGroupPolicy", []))

    @jsii.member(jsii_name="toDeleteModelQualityJobDefinition")
    def to_delete_model_quality_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete the model quality job definition created using the CreateModelQualityJobDefinition API.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteModelQualityJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteModelQualityJobDefinition", []))

    @jsii.member(jsii_name="toDeleteMonitoringSchedule")
    def to_delete_monitoring_schedule(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a monitoring schedule.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteMonitoringSchedule.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteMonitoringSchedule", []))

    @jsii.member(jsii_name="toDeleteNotebookInstance")
    def to_delete_notebook_instance(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a Amazon SageMaker notebook instance.

        Before you can delete a notebook instance, you must call the StopNotebookInstance API

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteNotebookInstance.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteNotebookInstance", []))

    @jsii.member(jsii_name="toDeleteNotebookInstanceLifecycleConfig")
    def to_delete_notebook_instance_lifecycle_config(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a notebook instance lifecycle configuration.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteNotebookInstanceLifecycleConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteNotebookInstanceLifecycleConfig", []))

    @jsii.member(jsii_name="toDeletePipeline")
    def to_delete_pipeline(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeletePipeline.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeletePipeline", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a project.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteProject.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDeleteRecord")
    def to_delete_record(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a record from a feature group.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_feature_store_DeleteRecord.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteRecord", []))

    @jsii.member(jsii_name="toDeleteSpace")
    def to_delete_space(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a Space.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteSpace.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteSpace", []))

    @jsii.member(jsii_name="toDeleteStudioLifecycleConfig")
    def to_delete_studio_lifecycle_config(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a Studio Lifecycle Configuration.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteStudioLifecycleConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteStudioLifecycleConfig", []))

    @jsii.member(jsii_name="toDeleteTags")
    def to_delete_tags(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete the specified set of tags from an Amazon SageMaker resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteTags.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteTags", []))

    @jsii.member(jsii_name="toDeleteTrial")
    def to_delete_trial(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a trial.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteTrial.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteTrial", []))

    @jsii.member(jsii_name="toDeleteTrialComponent")
    def to_delete_trial_component(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a trial component.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteTrialComponent.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteTrialComponent", []))

    @jsii.member(jsii_name="toDeleteUserProfile")
    def to_delete_user_profile(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a UserProfile.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteUserProfile", []))

    @jsii.member(jsii_name="toDeleteWorkforce")
    def to_delete_workforce(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a workforce.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteWorkforce.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteWorkforce", []))

    @jsii.member(jsii_name="toDeleteWorkteam")
    def to_delete_workteam(self) -> "Sagemaker":
        '''(experimental) Grants permission to delete a workteam.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteWorkteam.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeleteWorkteam", []))

    @jsii.member(jsii_name="toDeregisterDevices")
    def to_deregister_devices(self) -> "Sagemaker":
        '''(experimental) Grants permission to deregister a set of devices.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeregisterDevices.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDeregisterDevices", []))

    @jsii.member(jsii_name="toDescribeAction")
    def to_describe_action(self) -> "Sagemaker":
        '''(experimental) Grants permission to get information about an action.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeAction.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeAction", []))

    @jsii.member(jsii_name="toDescribeAlgorithm")
    def to_describe_algorithm(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe an algorithm.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeAlgorithm.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeAlgorithm", []))

    @jsii.member(jsii_name="toDescribeApp")
    def to_describe_app(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe an App.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeApp.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeApp", []))

    @jsii.member(jsii_name="toDescribeAppImageConfig")
    def to_describe_app_image_config(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe an AppImageConfig.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeAppImageConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeAppImageConfig", []))

    @jsii.member(jsii_name="toDescribeArtifact")
    def to_describe_artifact(self) -> "Sagemaker":
        '''(experimental) Grants permission to get information about an artifact.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeArtifact.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeArtifact", []))

    @jsii.member(jsii_name="toDescribeAutoMLJob")
    def to_describe_auto_ml_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe an AutoML job that was created via the CreateAutoMLJob API.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeAutoMLJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeAutoMLJob", []))

    @jsii.member(jsii_name="toDescribeAutoMLJobV2")
    def to_describe_auto_ml_job_v2(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe an AutoML job that was created via the CreateAutoMLJobV2 API.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeAutoMLJobV2.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeAutoMLJobV2", []))

    @jsii.member(jsii_name="toDescribeCodeRepository")
    def to_describe_code_repository(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe a CodeRepository.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeCodeRepository.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeCodeRepository", []))

    @jsii.member(jsii_name="toDescribeCompilationJob")
    def to_describe_compilation_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a compilation job.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeCompilationJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeCompilationJob", []))

    @jsii.member(jsii_name="toDescribeContext")
    def to_describe_context(self) -> "Sagemaker":
        '''(experimental) Grants permission to get information about a context.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeContext.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeContext", []))

    @jsii.member(jsii_name="toDescribeDataQualityJobDefinition")
    def to_describe_data_quality_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a data quality job definition.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeDataQualityJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeDataQualityJobDefinition", []))

    @jsii.member(jsii_name="toDescribeDevice")
    def to_describe_device(self) -> "Sagemaker":
        '''(experimental) Grants permission to access information about a device.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeDevice.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeDevice", []))

    @jsii.member(jsii_name="toDescribeDeviceFleet")
    def to_describe_device_fleet(self) -> "Sagemaker":
        '''(experimental) Grants permission to access information about a device fleet.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeDeviceFleet.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeDeviceFleet", []))

    @jsii.member(jsii_name="toDescribeDomain")
    def to_describe_domain(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe a Domain.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeDomain.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeDomain", []))

    @jsii.member(jsii_name="toDescribeEdgeDeploymentPlan")
    def to_describe_edge_deployment_plan(self) -> "Sagemaker":
        '''(experimental) Grants permission to access information about an edge deployment plan.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeEdgeDeploymentPlan.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeEdgeDeploymentPlan", []))

    @jsii.member(jsii_name="toDescribeEdgePackagingJob")
    def to_describe_edge_packaging_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to access information about an edge packaging job.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeEdgePackagingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeEdgePackagingJob", []))

    @jsii.member(jsii_name="toDescribeEndpoint")
    def to_describe_endpoint(self) -> "Sagemaker":
        '''(experimental) Grants permission to return the description of an endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeEndpoint", []))

    @jsii.member(jsii_name="toDescribeEndpointConfig")
    def to_describe_endpoint_config(self) -> "Sagemaker":
        '''(experimental) Grants permission to return the description of an endpoint configuration, which was created using the CreateEndpointConfig API.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeEndpointConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeEndpointConfig", []))

    @jsii.member(jsii_name="toDescribeExperiment")
    def to_describe_experiment(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about an experiment.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeExperiment.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeExperiment", []))

    @jsii.member(jsii_name="toDescribeFeatureGroup")
    def to_describe_feature_group(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a feature group.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeFeatureGroup.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeFeatureGroup", []))

    @jsii.member(jsii_name="toDescribeFeatureMetadata")
    def to_describe_feature_metadata(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a feature metadata.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeFeatureMetadata.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeFeatureMetadata", []))

    @jsii.member(jsii_name="toDescribeFlowDefinition")
    def to_describe_flow_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about the specified flow definition.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeFlowDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeFlowDefinition", []))

    @jsii.member(jsii_name="toDescribeHub")
    def to_describe_hub(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe hubs.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeHub.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeHub", []))

    @jsii.member(jsii_name="toDescribeHubContent")
    def to_describe_hub_content(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe hub content.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeHubContent.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeHubContent", []))

    @jsii.member(jsii_name="toDescribeHumanLoop")
    def to_describe_human_loop(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about the specified human loop.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeHumanLoop.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeHumanLoop", []))

    @jsii.member(jsii_name="toDescribeHumanTaskUi")
    def to_describe_human_task_ui(self) -> "Sagemaker":
        '''(experimental) Grants permission to return detailed information about the specified human review workflow user interface.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeHumanTaskUi.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeHumanTaskUi", []))

    @jsii.member(jsii_name="toDescribeHyperParameterTuningJob")
    def to_describe_hyper_parameter_tuning_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe a hyper parameter tuning job that was created via the CreateHyperParameterTuningJob API.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeHyperParameterTuningJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeHyperParameterTuningJob", []))

    @jsii.member(jsii_name="toDescribeImage")
    def to_describe_image(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a SageMaker Image.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeImage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeImage", []))

    @jsii.member(jsii_name="toDescribeImageVersion")
    def to_describe_image_version(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a SageMaker ImageVersion.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeImageVersion.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeImageVersion", []))

    @jsii.member(jsii_name="toDescribeInferenceExperiment")
    def to_describe_inference_experiment(self) -> "Sagemaker":
        '''(experimental) Grants permission to get information about an inference experiment.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeInferenceExperiment.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeInferenceExperiment", []))

    @jsii.member(jsii_name="toDescribeInferenceRecommendationsJob")
    def to_describe_inference_recommendations_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to get information about an inference recommendations job.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeInferenceRecommendationsJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeInferenceRecommendationsJob", []))

    @jsii.member(jsii_name="toDescribeLabelingJob")
    def to_describe_labeling_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a labeling job.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeLabelingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeLabelingJob", []))

    @jsii.member(jsii_name="toDescribeLineageGroup")
    def to_describe_lineage_group(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe a lineage group.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeLineageGroup.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeLineageGroup", []))

    @jsii.member(jsii_name="toDescribeModel")
    def to_describe_model(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe a model that you created using the CreateModel API.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeModel.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeModel", []))

    @jsii.member(jsii_name="toDescribeModelBiasJobDefinition")
    def to_describe_model_bias_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a model bias job definition.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeModelBiasJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeModelBiasJobDefinition", []))

    @jsii.member(jsii_name="toDescribeModelCard")
    def to_describe_model_card(self) -> "Sagemaker":
        '''(experimental) Grants permission to get information about a model card.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeModelCard.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeModelCard", []))

    @jsii.member(jsii_name="toDescribeModelCardExportJob")
    def to_describe_model_card_export_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to get information about a model card export job.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeModelCardExportJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeModelCardExportJob", []))

    @jsii.member(jsii_name="toDescribeModelExplainabilityJobDefinition")
    def to_describe_model_explainability_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a model explainability job definition.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeModelExplainabilityJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeModelExplainabilityJobDefinition", []))

    @jsii.member(jsii_name="toDescribeModelPackage")
    def to_describe_model_package(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe a ModelPackage.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeModelPackage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeModelPackage", []))

    @jsii.member(jsii_name="toDescribeModelPackageGroup")
    def to_describe_model_package_group(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe a ModelPackageGroup.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeModelPackageGroup.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeModelPackageGroup", []))

    @jsii.member(jsii_name="toDescribeModelQualityJobDefinition")
    def to_describe_model_quality_job_definition(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a model quality job definition.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeModelQualityJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeModelQualityJobDefinition", []))

    @jsii.member(jsii_name="toDescribeMonitoringSchedule")
    def to_describe_monitoring_schedule(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a monitoring schedule.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeMonitoringSchedule.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeMonitoringSchedule", []))

    @jsii.member(jsii_name="toDescribeNotebookInstance")
    def to_describe_notebook_instance(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a notebook instance.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeNotebookInstance.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeNotebookInstance", []))

    @jsii.member(jsii_name="toDescribeNotebookInstanceLifecycleConfig")
    def to_describe_notebook_instance_lifecycle_config(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe a notebook instance lifecycle configuration that was created via the CreateNotebookInstanceLifecycleConfig API.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeNotebookInstanceLifecycleConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeNotebookInstanceLifecycleConfig", []))

    @jsii.member(jsii_name="toDescribePipeline")
    def to_describe_pipeline(self) -> "Sagemaker":
        '''(experimental) Grants permission to get information about a pipeline.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribePipeline.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribePipeline", []))

    @jsii.member(jsii_name="toDescribePipelineDefinitionForExecution")
    def to_describe_pipeline_definition_for_execution(self) -> "Sagemaker":
        '''(experimental) Grants permission to get the pipeline definition for a pipeline execution.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribePipelineDefinitionForExecution.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribePipelineDefinitionForExecution", []))

    @jsii.member(jsii_name="toDescribePipelineExecution")
    def to_describe_pipeline_execution(self) -> "Sagemaker":
        '''(experimental) Grants permission to get information about a pipeline execution.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribePipelineExecution.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribePipelineExecution", []))

    @jsii.member(jsii_name="toDescribeProcessingJob")
    def to_describe_processing_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a processing job.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeProcessingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeProcessingJob", []))

    @jsii.member(jsii_name="toDescribeProject")
    def to_describe_project(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe a project.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeProject.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeProject", []))

    @jsii.member(jsii_name="toDescribeSharedModel")
    def to_describe_shared_model(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe a shared model in a SageMaker Studio application.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/canvas-collaborate-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeSharedModel", []))

    @jsii.member(jsii_name="toDescribeSpace")
    def to_describe_space(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe a Space.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeSpace.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeSpace", []))

    @jsii.member(jsii_name="toDescribeStudioLifecycleConfig")
    def to_describe_studio_lifecycle_config(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe a Studio Lifecycle Configuration.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeStudioLifecycleConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeStudioLifecycleConfig", []))

    @jsii.member(jsii_name="toDescribeSubscribedWorkteam")
    def to_describe_subscribed_workteam(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a subscribed workteam.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeSubscribedWorkteam.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeSubscribedWorkteam", []))

    @jsii.member(jsii_name="toDescribeTrainingJob")
    def to_describe_training_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a training job.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeTrainingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeTrainingJob", []))

    @jsii.member(jsii_name="toDescribeTransformJob")
    def to_describe_transform_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a transform job.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeTransformJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeTransformJob", []))

    @jsii.member(jsii_name="toDescribeTrial")
    def to_describe_trial(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a trial.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeTrial.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeTrial", []))

    @jsii.member(jsii_name="toDescribeTrialComponent")
    def to_describe_trial_component(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a trial component.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeTrialComponent.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeTrialComponent", []))

    @jsii.member(jsii_name="toDescribeUserProfile")
    def to_describe_user_profile(self) -> "Sagemaker":
        '''(experimental) Grants permission to describe a UserProfile.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeUserProfile", []))

    @jsii.member(jsii_name="toDescribeWorkforce")
    def to_describe_workforce(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a workforce.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeWorkforce.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeWorkforce", []))

    @jsii.member(jsii_name="toDescribeWorkteam")
    def to_describe_workteam(self) -> "Sagemaker":
        '''(experimental) Grants permission to return information about a workteam.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeWorkteam.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDescribeWorkteam", []))

    @jsii.member(jsii_name="toDisableSagemakerServicecatalogPortfolio")
    def to_disable_sagemaker_servicecatalog_portfolio(self) -> "Sagemaker":
        '''(experimental) Grants permission to disable a SageMaker Service Catalog Portfolio.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DisableSagemakerServicecatalogPortfolio.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDisableSagemakerServicecatalogPortfolio", []))

    @jsii.member(jsii_name="toDisassociateTrialComponent")
    def to_disassociate_trial_component(self) -> "Sagemaker":
        '''(experimental) Grants permission to disassociate a trial component from a trial.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DisassociateTrialComponent.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toDisassociateTrialComponent", []))

    @jsii.member(jsii_name="toEnableSagemakerServicecatalogPortfolio")
    def to_enable_sagemaker_servicecatalog_portfolio(self) -> "Sagemaker":
        '''(experimental) Grants permission to enable a SageMaker Service Catalog Portfolio.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_EnableSagemakerServicecatalogPortfolio.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toEnableSagemakerServicecatalogPortfolio", []))

    @jsii.member(jsii_name="toGetDeployments")
    def to_get_deployments(self) -> "Sagemaker":
        '''(experimental) Grants permission to get deployment plan for device.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_edge_GetDeployments.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toGetDeployments", []))

    @jsii.member(jsii_name="toGetDeviceFleetReport")
    def to_get_device_fleet_report(self) -> "Sagemaker":
        '''(experimental) Grants permission to access a summary of the devices in a device fleet.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_GetDeviceFleetReport.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toGetDeviceFleetReport", []))

    @jsii.member(jsii_name="toGetDeviceRegistration")
    def to_get_device_registration(self) -> "Sagemaker":
        '''(experimental) Grants permission to get device registration.

        After you deploy a model onto edge devices this api is used to get current device registration

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_edge_GetDeviceRegistration.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toGetDeviceRegistration", []))

    @jsii.member(jsii_name="toGetLineageGroupPolicy")
    def to_get_lineage_group_policy(self) -> "Sagemaker":
        '''(experimental) Grants permission to retreive a lineage group policy.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_GetLineageGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toGetLineageGroupPolicy", []))

    @jsii.member(jsii_name="toGetModelPackageGroupPolicy")
    def to_get_model_package_group_policy(self) -> "Sagemaker":
        '''(experimental) Grants permission to get a ModelPackageGroup policy.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_GetModelPackageGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toGetModelPackageGroupPolicy", []))

    @jsii.member(jsii_name="toGetRecord")
    def to_get_record(self) -> "Sagemaker":
        '''(experimental) Grants permission to get a record from a feature group.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_feature_store_GetRecord.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toGetRecord", []))

    @jsii.member(jsii_name="toGetSagemakerServicecatalogPortfolioStatus")
    def to_get_sagemaker_servicecatalog_portfolio_status(self) -> "Sagemaker":
        '''(experimental) Grants permission to get a SageMaker Service Catalog Portfolio.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_GetSagemakerServicecatalogPortfolioStatus.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toGetSagemakerServicecatalogPortfolioStatus", []))

    @jsii.member(jsii_name="toGetSearchSuggestions")
    def to_get_search_suggestions(self) -> "Sagemaker":
        '''(experimental) Grants permission to get search suggestions when provided with a keyword.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_GetSearchSuggestions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toGetSearchSuggestions", []))

    @jsii.member(jsii_name="toImportHubContent")
    def to_import_hub_content(self) -> "Sagemaker":
        '''(experimental) Grants permission to import hub content.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sagemaker:AddTags

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ImportHubContent.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toImportHubContent", []))

    @jsii.member(jsii_name="toInvokeEndpoint")
    def to_invoke_endpoint(self) -> "Sagemaker":
        '''(experimental) Grants permission to invoke an endpoint.

        After you deploy a model into production using Amazon SageMaker hosting services, your client applications use this API to get inferences from the model hosted at the specified endpoint

        Access Level: Read

        Possible conditions:

        - .ifTargetModel()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_runtime_InvokeEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toInvokeEndpoint", []))

    @jsii.member(jsii_name="toInvokeEndpointAsync")
    def to_invoke_endpoint_async(self) -> "Sagemaker":
        '''(experimental) Grants permission to get inferences from the hosted model at the specified endpoint in an asynchronous manner.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_runtime_InvokeEndpointAsync.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toInvokeEndpointAsync", []))

    @jsii.member(jsii_name="toListActions")
    def to_list_actions(self) -> "Sagemaker":
        '''(experimental) Grants permission to list actions.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListActions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListActions", []))

    @jsii.member(jsii_name="toListAlgorithms")
    def to_list_algorithms(self) -> "Sagemaker":
        '''(experimental) Grants permission to list Algorithms.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListAlgorithms.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListAlgorithms", []))

    @jsii.member(jsii_name="toListAliases")
    def to_list_aliases(self) -> "Sagemaker":
        '''(experimental) Grants permission to list Aliases that belong to a SageMaker Image or Sagemaker ImageVersion.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListAliases.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListAliases", []))

    @jsii.member(jsii_name="toListAppImageConfigs")
    def to_list_app_image_configs(self) -> "Sagemaker":
        '''(experimental) Grants permission to list the AppImageConfigs in your account.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListAppImageConfigs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListAppImageConfigs", []))

    @jsii.member(jsii_name="toListApps")
    def to_list_apps(self) -> "Sagemaker":
        '''(experimental) Grants permission to list the Apps in your account.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListApps.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListApps", []))

    @jsii.member(jsii_name="toListArtifacts")
    def to_list_artifacts(self) -> "Sagemaker":
        '''(experimental) Grants permission to list artifacts.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListArtifacts.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListArtifacts", []))

    @jsii.member(jsii_name="toListAssociations")
    def to_list_associations(self) -> "Sagemaker":
        '''(experimental) Grants permission to list associations.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListAssociations.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListAssociations", []))

    @jsii.member(jsii_name="toListAutoMLJobs")
    def to_list_auto_ml_jobs(self) -> "Sagemaker":
        '''(experimental) Grants permission to list AutoML jobs.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListAutoMLJobs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListAutoMLJobs", []))

    @jsii.member(jsii_name="toListCandidatesForAutoMLJob")
    def to_list_candidates_for_auto_ml_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to lists candidates for an AutoML job.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListCandidatesForAutoMLJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListCandidatesForAutoMLJob", []))

    @jsii.member(jsii_name="toListCodeRepositories")
    def to_list_code_repositories(self) -> "Sagemaker":
        '''(experimental) Grants permission to list code repositories.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListCodeRepositories.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListCodeRepositories", []))

    @jsii.member(jsii_name="toListCompilationJobs")
    def to_list_compilation_jobs(self) -> "Sagemaker":
        '''(experimental) Grants permission to list compilation jobs.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListCompilationJobs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListCompilationJobs", []))

    @jsii.member(jsii_name="toListContexts")
    def to_list_contexts(self) -> "Sagemaker":
        '''(experimental) Grants permission to list contexts.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListContexts.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListContexts", []))

    @jsii.member(jsii_name="toListDataQualityJobDefinitions")
    def to_list_data_quality_job_definitions(self) -> "Sagemaker":
        '''(experimental) Grants permission to list data quality job definitions.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListDataQualityJobDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListDataQualityJobDefinitions", []))

    @jsii.member(jsii_name="toListDeviceFleets")
    def to_list_device_fleets(self) -> "Sagemaker":
        '''(experimental) Grants permission to list device fleets.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListDeviceFleets.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListDeviceFleets", []))

    @jsii.member(jsii_name="toListDevices")
    def to_list_devices(self) -> "Sagemaker":
        '''(experimental) Grants permission to list devices.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListDevices.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListDevices", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Sagemaker":
        '''(experimental) Grants permission to list the Domains in your account.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListDomains.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toListEdgeDeploymentPlans")
    def to_list_edge_deployment_plans(self) -> "Sagemaker":
        '''(experimental) Grants permission to list edge deployment plans.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListEdgeDeploymentPlans.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListEdgeDeploymentPlans", []))

    @jsii.member(jsii_name="toListEdgePackagingJobs")
    def to_list_edge_packaging_jobs(self) -> "Sagemaker":
        '''(experimental) Grants permission to list edge packaging jobs.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListEdgePackagingJobs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListEdgePackagingJobs", []))

    @jsii.member(jsii_name="toListEndpointConfigs")
    def to_list_endpoint_configs(self) -> "Sagemaker":
        '''(experimental) Grants permission to list endpoint configurations.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListEndpointConfigs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListEndpointConfigs", []))

    @jsii.member(jsii_name="toListEndpoints")
    def to_list_endpoints(self) -> "Sagemaker":
        '''(experimental) Grants permission to list endpoints.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListEndpoints", []))

    @jsii.member(jsii_name="toListExperiments")
    def to_list_experiments(self) -> "Sagemaker":
        '''(experimental) Grants permission to list experiments.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListExperiments.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListExperiments", []))

    @jsii.member(jsii_name="toListFeatureGroups")
    def to_list_feature_groups(self) -> "Sagemaker":
        '''(experimental) Grants permission to list feature groups.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListFeatureGroups.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListFeatureGroups", []))

    @jsii.member(jsii_name="toListFlowDefinitions")
    def to_list_flow_definitions(self) -> "Sagemaker":
        '''(experimental) Grants permission to return summary information about flow definitions, given the specified parameters.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListFlowDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListFlowDefinitions", []))

    @jsii.member(jsii_name="toListHubContents")
    def to_list_hub_contents(self) -> "Sagemaker":
        '''(experimental) Grants permission to list newest versions of hub content.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListHubContents.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListHubContents", []))

    @jsii.member(jsii_name="toListHubContentVersions")
    def to_list_hub_content_versions(self) -> "Sagemaker":
        '''(experimental) Grants permission to list all versions of hub content.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListHubContentVersions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListHubContentVersions", []))

    @jsii.member(jsii_name="toListHubs")
    def to_list_hubs(self) -> "Sagemaker":
        '''(experimental) Grants permission to list hubs.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListHubs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListHubs", []))

    @jsii.member(jsii_name="toListHumanLoops")
    def to_list_human_loops(self) -> "Sagemaker":
        '''(experimental) Grants permission to return summary information about human loops, given the specified parameters.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListHumanLoops.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListHumanLoops", []))

    @jsii.member(jsii_name="toListHumanTaskUis")
    def to_list_human_task_uis(self) -> "Sagemaker":
        '''(experimental) Grants permission to return summary information about human review workflow user interfaces, given the specified parameters.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListHumanTaskUis.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListHumanTaskUis", []))

    @jsii.member(jsii_name="toListHyperParameterTuningJobs")
    def to_list_hyper_parameter_tuning_jobs(self) -> "Sagemaker":
        '''(experimental) Grants permission to list hyper parameter tuning jobs.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListHyperParameterTuningJobs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListHyperParameterTuningJobs", []))

    @jsii.member(jsii_name="toListImages")
    def to_list_images(self) -> "Sagemaker":
        '''(experimental) Grants permission to list SageMaker Images in your account.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListImages.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListImages", []))

    @jsii.member(jsii_name="toListImageVersions")
    def to_list_image_versions(self) -> "Sagemaker":
        '''(experimental) Grants permission to list ImageVersions that belong to a SageMaker Image.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListImageVersions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListImageVersions", []))

    @jsii.member(jsii_name="toListInferenceExperiments")
    def to_list_inference_experiments(self) -> "Sagemaker":
        '''(experimental) Grants permission to list inference experiments.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListInferenceExperiments.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListInferenceExperiments", []))

    @jsii.member(jsii_name="toListInferenceRecommendationsJobs")
    def to_list_inference_recommendations_jobs(self) -> "Sagemaker":
        '''(experimental) Grants permission to list inference recommendations jobs.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListInferenceRecommendationsJobs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListInferenceRecommendationsJobs", []))

    @jsii.member(jsii_name="toListInferenceRecommendationsJobSteps")
    def to_list_inference_recommendations_job_steps(self) -> "Sagemaker":
        '''(experimental) Grants permission to list inference recommendations job steps.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListInferenceRecommendationsJobSteps.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListInferenceRecommendationsJobSteps", []))

    @jsii.member(jsii_name="toListLabelingJobs")
    def to_list_labeling_jobs(self) -> "Sagemaker":
        '''(experimental) Grants permission to list labeling jobs.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListLabelingJobs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListLabelingJobs", []))

    @jsii.member(jsii_name="toListLabelingJobsForWorkteam")
    def to_list_labeling_jobs_for_workteam(self) -> "Sagemaker":
        '''(experimental) Grants permission to list labeling jobs for workteam.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListLabelingJobs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListLabelingJobsForWorkteam", []))

    @jsii.member(jsii_name="toListLineageGroups")
    def to_list_lineage_groups(self) -> "Sagemaker":
        '''(experimental) Grants permission to list lineage groups.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListLineageGroups.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListLineageGroups", []))

    @jsii.member(jsii_name="toListModelBiasJobDefinitions")
    def to_list_model_bias_job_definitions(self) -> "Sagemaker":
        '''(experimental) Grants permission to list model bias job definitions.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListModelBiasJobDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListModelBiasJobDefinitions", []))

    @jsii.member(jsii_name="toListModelCardExportJobs")
    def to_list_model_card_export_jobs(self) -> "Sagemaker":
        '''(experimental) Grants permission to list export jobs for a model card.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListModelCardExportJobs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListModelCardExportJobs", []))

    @jsii.member(jsii_name="toListModelCards")
    def to_list_model_cards(self) -> "Sagemaker":
        '''(experimental) Grants permission to list model cards.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListModelCards.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListModelCards", []))

    @jsii.member(jsii_name="toListModelCardVersions")
    def to_list_model_card_versions(self) -> "Sagemaker":
        '''(experimental) Grants permission to list versions of a model card.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListModelCardVersions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListModelCardVersions", []))

    @jsii.member(jsii_name="toListModelExplainabilityJobDefinitions")
    def to_list_model_explainability_job_definitions(self) -> "Sagemaker":
        '''(experimental) Grants permission to list model explainability job definitions.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListModelExplainabilityJobDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListModelExplainabilityJobDefinitions", []))

    @jsii.member(jsii_name="toListModelMetadata")
    def to_list_model_metadata(self) -> "Sagemaker":
        '''(experimental) Grants permission to list model metadata for inference recommendations jobs.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListModelMetadata.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListModelMetadata", []))

    @jsii.member(jsii_name="toListModelPackageGroups")
    def to_list_model_package_groups(self) -> "Sagemaker":
        '''(experimental) Grants permission to list ModelPackageGroups.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListModelPackageGroups.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListModelPackageGroups", []))

    @jsii.member(jsii_name="toListModelPackages")
    def to_list_model_packages(self) -> "Sagemaker":
        '''(experimental) Grants permission to list ModelPackages.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListModelPackages.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListModelPackages", []))

    @jsii.member(jsii_name="toListModelQualityJobDefinitions")
    def to_list_model_quality_job_definitions(self) -> "Sagemaker":
        '''(experimental) Grants permission to list model quality job definitions.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListModelQualityJobDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListModelQualityJobDefinitions", []))

    @jsii.member(jsii_name="toListModels")
    def to_list_models(self) -> "Sagemaker":
        '''(experimental) Grants permission to list the models created with the CreateModel API.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListModels.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListModels", []))

    @jsii.member(jsii_name="toListMonitoringAlertHistory")
    def to_list_monitoring_alert_history(self) -> "Sagemaker":
        '''(experimental) Grants permission to list the history of a monitoring alert.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListMonitoringHistory.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListMonitoringAlertHistory", []))

    @jsii.member(jsii_name="toListMonitoringAlerts")
    def to_list_monitoring_alerts(self) -> "Sagemaker":
        '''(experimental) Grants permission to list monitoring alerts.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListMonitoringAlerts.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListMonitoringAlerts", []))

    @jsii.member(jsii_name="toListMonitoringExecutions")
    def to_list_monitoring_executions(self) -> "Sagemaker":
        '''(experimental) Grants permission to list monitoring executions.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListMonitoringExecutions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListMonitoringExecutions", []))

    @jsii.member(jsii_name="toListMonitoringSchedules")
    def to_list_monitoring_schedules(self) -> "Sagemaker":
        '''(experimental) Grants permission to list monitoring schedules.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListMonitoringSchedules.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListMonitoringSchedules", []))

    @jsii.member(jsii_name="toListNotebookInstanceLifecycleConfigs")
    def to_list_notebook_instance_lifecycle_configs(self) -> "Sagemaker":
        '''(experimental) Grants permission to list the notebook instance lifecycle configurations that can be deployed using Amazon SageMaker.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListNotebookInstanceLifecycleConfigs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListNotebookInstanceLifecycleConfigs", []))

    @jsii.member(jsii_name="toListNotebookInstances")
    def to_list_notebook_instances(self) -> "Sagemaker":
        '''(experimental) Grants permission to list the Amazon SageMaker notebook instances in the requester's account in an AWS Region.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListNotebookInstances.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListNotebookInstances", []))

    @jsii.member(jsii_name="toListPipelineExecutions")
    def to_list_pipeline_executions(self) -> "Sagemaker":
        '''(experimental) Grants permission to list executions for a pipeline.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListPipelineExecutions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListPipelineExecutions", []))

    @jsii.member(jsii_name="toListPipelineExecutionSteps")
    def to_list_pipeline_execution_steps(self) -> "Sagemaker":
        '''(experimental) Grants permission to list steps for a pipeline execution.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListPipelineExecutionSteps.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListPipelineExecutionSteps", []))

    @jsii.member(jsii_name="toListPipelineParametersForExecution")
    def to_list_pipeline_parameters_for_execution(self) -> "Sagemaker":
        '''(experimental) Grants permission to list parameters for a pipeline execution.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListPipelineParametersForExecution.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListPipelineParametersForExecution", []))

    @jsii.member(jsii_name="toListPipelines")
    def to_list_pipelines(self) -> "Sagemaker":
        '''(experimental) Grants permission to list pipelines.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListPipelines.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListPipelines", []))

    @jsii.member(jsii_name="toListProcessingJobs")
    def to_list_processing_jobs(self) -> "Sagemaker":
        '''(experimental) Grants permission to list processing jobs.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListProcessingJobs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListProcessingJobs", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Sagemaker":
        '''(experimental) Grants permission to list Projects.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListProjects.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListSharedModelEvents")
    def to_list_shared_model_events(self) -> "Sagemaker":
        '''(experimental) Grants permission to list shared model events.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/canvas-collaborate-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListSharedModelEvents", []))

    @jsii.member(jsii_name="toListSharedModels")
    def to_list_shared_models(self) -> "Sagemaker":
        '''(experimental) Grants permission to list shared models.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/canvas-collaborate-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListSharedModels", []))

    @jsii.member(jsii_name="toListSharedModelVersions")
    def to_list_shared_model_versions(self) -> "Sagemaker":
        '''(experimental) Grants permission to list shared model versions.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/dg/canvas-collaborate-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListSharedModelVersions", []))

    @jsii.member(jsii_name="toListSpaces")
    def to_list_spaces(self) -> "Sagemaker":
        '''(experimental) Grants permission to list the Spaces in your account.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListSpaces.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListSpaces", []))

    @jsii.member(jsii_name="toListStageDevices")
    def to_list_stage_devices(self) -> "Sagemaker":
        '''(experimental) Grants permission to list stage devices.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListStageDevices.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListStageDevices", []))

    @jsii.member(jsii_name="toListStudioLifecycleConfigs")
    def to_list_studio_lifecycle_configs(self) -> "Sagemaker":
        '''(experimental) Grants permission to list the Studio Lifecycle Configurations that can be deployed using Amazon SageMaker.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListStudioLifecycleConfigs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListStudioLifecycleConfigs", []))

    @jsii.member(jsii_name="toListSubscribedWorkteams")
    def to_list_subscribed_workteams(self) -> "Sagemaker":
        '''(experimental) Grants permission to list subscribed workteams.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListSubscribedWorkteams.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListSubscribedWorkteams", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Sagemaker":
        '''(experimental) Grants permission to list the tag set associated with the specified resource.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListTags.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toListTrainingJobs")
    def to_list_training_jobs(self) -> "Sagemaker":
        '''(experimental) Grants permission to list training jobs.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListTrainingJobs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListTrainingJobs", []))

    @jsii.member(jsii_name="toListTrainingJobsForHyperParameterTuningJob")
    def to_list_training_jobs_for_hyper_parameter_tuning_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to list training jobs for a hyper parameter tuning job.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListTrainingJobsForHyperParameterTuningJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListTrainingJobsForHyperParameterTuningJob", []))

    @jsii.member(jsii_name="toListTransformJobs")
    def to_list_transform_jobs(self) -> "Sagemaker":
        '''(experimental) Grants permission to list transform jobs.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListTransformJobs.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListTransformJobs", []))

    @jsii.member(jsii_name="toListTrialComponents")
    def to_list_trial_components(self) -> "Sagemaker":
        '''(experimental) Grants permission to list trial components.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListTrialComponents.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListTrialComponents", []))

    @jsii.member(jsii_name="toListTrials")
    def to_list_trials(self) -> "Sagemaker":
        '''(experimental) Grants permission to list trials.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListTrials.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListTrials", []))

    @jsii.member(jsii_name="toListUserProfiles")
    def to_list_user_profiles(self) -> "Sagemaker":
        '''(experimental) Grants permission to list the UserProfiles in your account.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListUserProfiles.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListUserProfiles", []))

    @jsii.member(jsii_name="toListWorkforces")
    def to_list_workforces(self) -> "Sagemaker":
        '''(experimental) Grants permission to list workforces.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListWorkforces.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListWorkforces", []))

    @jsii.member(jsii_name="toListWorkteams")
    def to_list_workteams(self) -> "Sagemaker":
        '''(experimental) Grants permission to list workteams.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_ListWorkteams.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toListWorkteams", []))

    @jsii.member(jsii_name="toPutLineageGroupPolicy")
    def to_put_lineage_group_policy(self) -> "Sagemaker":
        '''(experimental) Grants permission to put a lineage group policy.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toPutLineageGroupPolicy", []))

    @jsii.member(jsii_name="toPutModelPackageGroupPolicy")
    def to_put_model_package_group_policy(self) -> "Sagemaker":
        '''(experimental) Grants permission to put a ModelPackageGroup policy.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_PutModelPackageGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toPutModelPackageGroupPolicy", []))

    @jsii.member(jsii_name="toPutRecord")
    def to_put_record(self) -> "Sagemaker":
        '''(experimental) Grants permission to put a record to a feature group.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_feature_store_PutRecord.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toPutRecord", []))

    @jsii.member(jsii_name="toQueryLineage")
    def to_query_lineage(self) -> "Sagemaker":
        '''(experimental) Grants permission to explore the lineage graph.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_QueryLineage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toQueryLineage", []))

    @jsii.member(jsii_name="toRegisterDevices")
    def to_register_devices(self) -> "Sagemaker":
        '''(experimental) Grants permission to register a set of devices.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_RegisterDevices.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toRegisterDevices", []))

    @jsii.member(jsii_name="toRenderUiTemplate")
    def to_render_ui_template(self) -> "Sagemaker":
        '''(experimental) Grants permission to render a UI template used for a human annotation task.

        Access Level: Read

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_RenderUiTemplate.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toRenderUiTemplate", []))

    @jsii.member(jsii_name="toRetryPipelineExecution")
    def to_retry_pipeline_execution(self) -> "Sagemaker":
        '''(experimental) Grants permission to retry a pipeline execution.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_RetryPipelineExecution.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toRetryPipelineExecution", []))

    @jsii.member(jsii_name="toSearch")
    def to_search(self) -> "Sagemaker":
        '''(experimental) Grants permission to search for SageMaker objects.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_Search.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toSearch", []))

    @jsii.member(jsii_name="toSendHeartbeat")
    def to_send_heartbeat(self) -> "Sagemaker":
        '''(experimental) Grants permission to publish heartbeat data from devices.

        After you deploy a model onto edge devices this api is used to report device status

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_edge_SendHeartbeat.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toSendHeartbeat", []))

    @jsii.member(jsii_name="toSendPipelineExecutionStepFailure")
    def to_send_pipeline_execution_step_failure(self) -> "Sagemaker":
        '''(experimental) Grants permission to fail a pending callback step.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_SendPipelineExecutionStepFailure.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toSendPipelineExecutionStepFailure", []))

    @jsii.member(jsii_name="toSendPipelineExecutionStepSuccess")
    def to_send_pipeline_execution_step_success(self) -> "Sagemaker":
        '''(experimental) Grants permission to succeed a pending callback step.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_SendPipelineExecutionStepSuccess.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toSendPipelineExecutionStepSuccess", []))

    @jsii.member(jsii_name="toSendSharedModelEvent")
    def to_send_shared_model_event(self) -> "Sagemaker":
        '''(experimental) Grants permission to send a shared model event.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/canvas-collaborate-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toSendSharedModelEvent", []))

    @jsii.member(jsii_name="toStartEdgeDeploymentStage")
    def to_start_edge_deployment_stage(self) -> "Sagemaker":
        '''(experimental) Grants permission to start an edge deployment stage.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StartEdgeDeploymentStage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStartEdgeDeploymentStage", []))

    @jsii.member(jsii_name="toStartHumanLoop")
    def to_start_human_loop(self) -> "Sagemaker":
        '''(experimental) Grants permission to start a human loop.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StartHumanLoop.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStartHumanLoop", []))

    @jsii.member(jsii_name="toStartInferenceExperiment")
    def to_start_inference_experiment(self) -> "Sagemaker":
        '''(experimental) Grants permission to start an inference experiment.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StartInferenceExperiment.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStartInferenceExperiment", []))

    @jsii.member(jsii_name="toStartMonitoringSchedule")
    def to_start_monitoring_schedule(self) -> "Sagemaker":
        '''(experimental) Grants permission to start a monitoring schedule.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StartMonitoringSchedule.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStartMonitoringSchedule", []))

    @jsii.member(jsii_name="toStartNotebookInstance")
    def to_start_notebook_instance(self) -> "Sagemaker":
        '''(experimental) Grants permission to start a notebook instance.

        This launches an EC2 instance with the latest version of the libraries and attaches your EBS volume

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StartNotebookInstance.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStartNotebookInstance", []))

    @jsii.member(jsii_name="toStartPipelineExecution")
    def to_start_pipeline_execution(self) -> "Sagemaker":
        '''(experimental) Grants permission to start a pipeline execution.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StartPipelineExecution.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStartPipelineExecution", []))

    @jsii.member(jsii_name="toStopAutoMLJob")
    def to_stop_auto_ml_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to stop a running AutoML job.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StopAutoMLJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopAutoMLJob", []))

    @jsii.member(jsii_name="toStopCompilationJob")
    def to_stop_compilation_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to stop a compilation job.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StopCompilationJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopCompilationJob", []))

    @jsii.member(jsii_name="toStopEdgeDeploymentStage")
    def to_stop_edge_deployment_stage(self) -> "Sagemaker":
        '''(experimental) Grants permission to stop an edge deployment stage.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StopEdgeDeploymentStage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopEdgeDeploymentStage", []))

    @jsii.member(jsii_name="toStopEdgePackagingJob")
    def to_stop_edge_packaging_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to stop an edge packaging job.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StopEdgePackagingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopEdgePackagingJob", []))

    @jsii.member(jsii_name="toStopHumanLoop")
    def to_stop_human_loop(self) -> "Sagemaker":
        '''(experimental) Grants permission to stop a specified human loop.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StopHumanLoop.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopHumanLoop", []))

    @jsii.member(jsii_name="toStopHyperParameterTuningJob")
    def to_stop_hyper_parameter_tuning_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to stop a running hyper parameter tuning job create via the CreateHyperParameterTuningJob.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StopHyperParameterTuningJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopHyperParameterTuningJob", []))

    @jsii.member(jsii_name="toStopInferenceExperiment")
    def to_stop_inference_experiment(self) -> "Sagemaker":
        '''(experimental) Grants permission to stop an inference experiment.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StopInferenceExperiment.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopInferenceExperiment", []))

    @jsii.member(jsii_name="toStopInferenceRecommendationsJob")
    def to_stop_inference_recommendations_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to stop an inference recommendations job.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StopInferenceRecommendationsJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopInferenceRecommendationsJob", []))

    @jsii.member(jsii_name="toStopLabelingJob")
    def to_stop_labeling_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to stop a labeling job. Any labels already generated will be exported before stopping.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StopLabelingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopLabelingJob", []))

    @jsii.member(jsii_name="toStopMonitoringSchedule")
    def to_stop_monitoring_schedule(self) -> "Sagemaker":
        '''(experimental) Grants permission to stop a monitoring schedule.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StopMonitoringSchedule.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopMonitoringSchedule", []))

    @jsii.member(jsii_name="toStopNotebookInstance")
    def to_stop_notebook_instance(self) -> "Sagemaker":
        '''(experimental) Grants permission to stop a notebook instance.

        This terminates the EC2 instance. Before terminating the instance, Amazon SageMaker disconnects the EBS volume from it. Amazon SageMaker preserves the EBS volume

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StopNotebookInstance.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopNotebookInstance", []))

    @jsii.member(jsii_name="toStopPipelineExecution")
    def to_stop_pipeline_execution(self) -> "Sagemaker":
        '''(experimental) Grants permission to stop a pipeline execution.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StopPipelineExecution.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopPipelineExecution", []))

    @jsii.member(jsii_name="toStopProcessingJob")
    def to_stop_processing_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to stop a processing job.

        To stop a job, Amazon SageMaker sends the algorithm the SIGTERM signal, which delays job termination for 120 seconds

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StopProcessingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopProcessingJob", []))

    @jsii.member(jsii_name="toStopTrainingJob")
    def to_stop_training_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to stop a training job.

        To stop a job, Amazon SageMaker sends the algorithm the SIGTERM signal, which delays job termination for 120 seconds

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StopTrainingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopTrainingJob", []))

    @jsii.member(jsii_name="toStopTransformJob")
    def to_stop_transform_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to stop a transform job.

        When Amazon SageMaker receives a StopTransformJob request, the status of the job changes to Stopping. After Amazon SageMaker stops the job, the status is set to Stopped

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StopTransformJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toStopTransformJob", []))

    @jsii.member(jsii_name="toUpdateAction")
    def to_update_action(self) -> "Sagemaker":
        '''(experimental) Grants permission to update an action.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateAction.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateAction", []))

    @jsii.member(jsii_name="toUpdateAppImageConfig")
    def to_update_app_image_config(self) -> "Sagemaker":
        '''(experimental) Grants permission to update an AppImageConfig.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateAppImageConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateAppImageConfig", []))

    @jsii.member(jsii_name="toUpdateArtifact")
    def to_update_artifact(self) -> "Sagemaker":
        '''(experimental) Grants permission to update an artifact.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateArtifact.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateArtifact", []))

    @jsii.member(jsii_name="toUpdateCodeRepository")
    def to_update_code_repository(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a CodeRepository.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateCodeRepository.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateCodeRepository", []))

    @jsii.member(jsii_name="toUpdateContext")
    def to_update_context(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a context.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateContext.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateContext", []))

    @jsii.member(jsii_name="toUpdateDeviceFleet")
    def to_update_device_fleet(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a device fleet.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateDeviceFleet.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateDeviceFleet", []))

    @jsii.member(jsii_name="toUpdateDevices")
    def to_update_devices(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a set of devices.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateDevices.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateDevices", []))

    @jsii.member(jsii_name="toUpdateDomain")
    def to_update_domain(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a Domain.

        Access Level: Write

        Possible conditions:

        - .ifVpcSecurityGroupIds()
        - .ifInstanceTypes()
        - .ifDomainSharingOutputKmsKey()
        - .ifImageArns()
        - .ifImageVersionArns()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateDomain.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateDomain", []))

    @jsii.member(jsii_name="toUpdateEndpoint")
    def to_update_endpoint(self) -> "Sagemaker":
        '''(experimental) Grants permission to update an endpoint to use the endpoint configuration specified in the request.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateEndpoint", []))

    @jsii.member(jsii_name="toUpdateEndpointWeightsAndCapacities")
    def to_update_endpoint_weights_and_capacities(self) -> "Sagemaker":
        '''(experimental) Grants permission to update variant weight, capacity, or both of one or more variants associated with an endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateEndpointWeightsAndCapacities.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateEndpointWeightsAndCapacities", []))

    @jsii.member(jsii_name="toUpdateExperiment")
    def to_update_experiment(self) -> "Sagemaker":
        '''(experimental) Grants permission to update an experiment.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateExperiment.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateExperiment", []))

    @jsii.member(jsii_name="toUpdateFeatureGroup")
    def to_update_feature_group(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a feature group.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateFeatureGroup.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateFeatureGroup", []))

    @jsii.member(jsii_name="toUpdateFeatureMetadata")
    def to_update_feature_metadata(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a feature metadata.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateFeatureMetadata.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateFeatureMetadata", []))

    @jsii.member(jsii_name="toUpdateHub")
    def to_update_hub(self) -> "Sagemaker":
        '''(experimental) Grants permission to update hubs.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateHub.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateHub", []))

    @jsii.member(jsii_name="toUpdateImage")
    def to_update_image(self) -> "Sagemaker":
        '''(experimental) Grants permission to update the properties of a SageMaker Image.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateImage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateImage", []))

    @jsii.member(jsii_name="toUpdateImageVersion")
    def to_update_image_version(self) -> "Sagemaker":
        '''(experimental) Grants permission to update the properties of a SageMaker ImageVersion.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateImageVersion.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateImageVersion", []))

    @jsii.member(jsii_name="toUpdateInferenceExperiment")
    def to_update_inference_experiment(self) -> "Sagemaker":
        '''(experimental) Grants permission to update an inference experiment.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateInferenceExperiment.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateInferenceExperiment", []))

    @jsii.member(jsii_name="toUpdateModelCard")
    def to_update_model_card(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a model card.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateModelCard.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateModelCard", []))

    @jsii.member(jsii_name="toUpdateModelPackage")
    def to_update_model_package(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a ModelPackage.

        Access Level: Write

        Possible conditions:

        - .ifModelApprovalStatus()
        - .ifCustomerMetadataProperties()
        - .ifCustomerMetadataPropertiesToRemove()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateModelPackage.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateModelPackage", []))

    @jsii.member(jsii_name="toUpdateMonitoringAlert")
    def to_update_monitoring_alert(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a monitoring alert.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateMonitoringAlert.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateMonitoringAlert", []))

    @jsii.member(jsii_name="toUpdateMonitoringSchedule")
    def to_update_monitoring_schedule(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a monitoring schedule.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceTypes()
        - .ifMaxRuntimeInSeconds()
        - .ifNetworkIsolation()
        - .ifOutputKmsKey()
        - .ifVolumeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()
        - .ifInterContainerTrafficEncryption()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateMonitoringSchedule.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateMonitoringSchedule", []))

    @jsii.member(jsii_name="toUpdateNotebookInstance")
    def to_update_notebook_instance(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a notebook instance.

        Notebook instance updates include upgrading or downgrading the EC2 instance used for your notebook instance to accommodate changes in your workload requirements

        Access Level: Write

        Possible conditions:

        - .ifAcceleratorTypes()
        - .ifInstanceTypes()
        - .ifMinimumInstanceMetadataServiceVersion()
        - .ifRootAccess()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateNotebookInstance.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateNotebookInstance", []))

    @jsii.member(jsii_name="toUpdateNotebookInstanceLifecycleConfig")
    def to_update_notebook_instance_lifecycle_config(self) -> "Sagemaker":
        '''(experimental) Grants permission to updates a notebook instance lifecycle configuration created with the CreateNotebookInstanceLifecycleConfig API.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateNotebookInstanceLifecycleConfig.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateNotebookInstanceLifecycleConfig", []))

    @jsii.member(jsii_name="toUpdatePipeline")
    def to_update_pipeline(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a pipeline.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdatePipeline.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdatePipeline", []))

    @jsii.member(jsii_name="toUpdatePipelineExecution")
    def to_update_pipeline_execution(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a pipeline execution.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdatePipelineExecution.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdatePipelineExecution", []))

    @jsii.member(jsii_name="toUpdateProject")
    def to_update_project(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a Project.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateProject.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateProject", []))

    @jsii.member(jsii_name="toUpdateSharedModel")
    def to_update_shared_model(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a shared model.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/canvas-collaborate-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateSharedModel", []))

    @jsii.member(jsii_name="toUpdateSpace")
    def to_update_space(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a Space.

        Access Level: Write

        Possible conditions:

        - .ifInstanceTypes()
        - .ifImageArns()
        - .ifImageVersionArns()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateSpace.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateSpace", []))

    @jsii.member(jsii_name="toUpdateTrainingJob")
    def to_update_training_job(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a training job.

        Access Level: Write

        Possible conditions:

        - .ifInstanceTypes()
        - .ifKeepAlivePeriod()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateTrainingJob.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateTrainingJob", []))

    @jsii.member(jsii_name="toUpdateTrial")
    def to_update_trial(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a trial.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateTrial.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateTrial", []))

    @jsii.member(jsii_name="toUpdateTrialComponent")
    def to_update_trial_component(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a trial component.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateTrialComponent.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateTrialComponent", []))

    @jsii.member(jsii_name="toUpdateUserProfile")
    def to_update_user_profile(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a UserProfile.

        Access Level: Write

        Possible conditions:

        - .ifInstanceTypes()
        - .ifVpcSecurityGroupIds()
        - .ifInstanceTypes()
        - .ifDomainSharingOutputKmsKey()
        - .ifImageArns()
        - .ifImageVersionArns()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateUserProfile", []))

    @jsii.member(jsii_name="toUpdateWorkforce")
    def to_update_workforce(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a workforce.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateWorkforce.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateWorkforce", []))

    @jsii.member(jsii_name="toUpdateWorkteam")
    def to_update_workteam(self) -> "Sagemaker":
        '''(experimental) Grants permission to update a workteam.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateWorkteam.html

        :stability: experimental
        '''
        return typing.cast("Sagemaker", jsii.invoke(self, "toUpdateWorkteam", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__21fabe9fa35db96efd4fc41546e87b74541ec510a8cd1c012531f0943a93ca23)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__85fe82884422cb8e242d71ba21fe14f0f5b53e56d05491d52ca7ab6fbc983c6a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class SagemakerGeospatial(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.SagemakerGeospatial",
):
    '''(experimental) Statement provider for service `sagemaker-geospatial <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsagemakergeospatialcapabilities.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sagemaker-geospatial <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsagemakergeospatialcapabilities.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9f025d179e4168e5730ecd3a8961e9302fb7dc6698f1822054f250fd719dbdc3)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onEarthObservationJob")
    def on_earth_observation_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SagemakerGeospatial":
        '''(experimental) Adds a resource of type EarthObservationJob to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/geospatial-eoj.html

        :param job_id: - Identifier for the jobID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8fe8637a3c8d47ee93e3621d947ae2efdb25fc7828bd42b0c1bc57f927d30045)
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "onEarthObservationJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onRasterDataCollection")
    def on_raster_data_collection(
        self,
        collection_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SagemakerGeospatial":
        '''(experimental) Adds a resource of type RasterDataCollection to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/geospatial-rdc.html

        :param collection_id: - Identifier for the collectionID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__919ac3adda749c9faf85f09ec284663d0bb7692d65a007b7d314516439d6c8ae)
            check_type(argname="argument collection_id", value=collection_id, expected_type=type_hints["collection_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "onRasterDataCollection", [collection_id, account, region, partition]))

    @jsii.member(jsii_name="onVectorEnrichmentJob")
    def on_vector_enrichment_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SagemakerGeospatial":
        '''(experimental) Adds a resource of type VectorEnrichmentJob to the statement.

        https://docs.aws.amazon.com/sagemaker/latest/dg/geospatial-vej.html

        :param job_id: - Identifier for the jobID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7d18716091460fb28815de64868ab4f676e7ef41eb928943265e14ad04619ee2)
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "onVectorEnrichmentJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="toDeleteEarthObservationJob")
    def to_delete_earth_observation_job(self) -> "SagemakerGeospatial":
        '''(experimental) Grants permission to the DeleteEarthObservationJob operation which deletes an existing earth observation job.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_geospatial_DeleteEarthObservationJob.html

        :stability: experimental
        '''
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "toDeleteEarthObservationJob", []))

    @jsii.member(jsii_name="toDeleteVectorEnrichmentJob")
    def to_delete_vector_enrichment_job(self) -> "SagemakerGeospatial":
        '''(experimental) Grants permission to the DeleteVectorEnrichmentJob operation which deletes an existing vector enrichment job.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_geospatial_DeleteVectorEnrichmentJob.html

        :stability: experimental
        '''
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "toDeleteVectorEnrichmentJob", []))

    @jsii.member(jsii_name="toExportEarthObservationJob")
    def to_export_earth_observation_job(self) -> "SagemakerGeospatial":
        '''(experimental) Grants permission to copy results of an earth observation job to an S3 location.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_geospatial_ExportEarthObservationJob.html

        :stability: experimental
        '''
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "toExportEarthObservationJob", []))

    @jsii.member(jsii_name="toExportVectorEnrichmentJob")
    def to_export_vector_enrichment_job(self) -> "SagemakerGeospatial":
        '''(experimental) Grants permission to copy results of an VectorEnrichmentJob to an S3 location.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_geospatial_ExportVectorEnrichmentJob.html

        :stability: experimental
        '''
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "toExportVectorEnrichmentJob", []))

    @jsii.member(jsii_name="toGetEarthObservationJob")
    def to_get_earth_observation_job(self) -> "SagemakerGeospatial":
        '''(experimental) Grants permission to return details about the earth observation job.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_geospatial_GetEarthObservationJob.html

        :stability: experimental
        '''
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "toGetEarthObservationJob", []))

    @jsii.member(jsii_name="toGetRasterDataCollection")
    def to_get_raster_data_collection(self) -> "SagemakerGeospatial":
        '''(experimental) Grants permission to return details about the raster data collection.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_geospatial_GetRasterDataCollection.html

        :stability: experimental
        '''
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "toGetRasterDataCollection", []))

    @jsii.member(jsii_name="toGetTile")
    def to_get_tile(self) -> "SagemakerGeospatial":
        '''(experimental) Grants permission to get the tile of an earth observation job.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_geospatial_GetTile.html

        :stability: experimental
        '''
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "toGetTile", []))

    @jsii.member(jsii_name="toGetVectorEnrichmentJob")
    def to_get_vector_enrichment_job(self) -> "SagemakerGeospatial":
        '''(experimental) Grants permission to return details about the vector enrichment job.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_geospatial_GetVectorEnrichmentJob.html

        :stability: experimental
        '''
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "toGetVectorEnrichmentJob", []))

    @jsii.member(jsii_name="toListEarthObservationJobs")
    def to_list_earth_observation_jobs(self) -> "SagemakerGeospatial":
        '''(experimental) Grants permission to return an array of earth observation jobs associated with the current account.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_geospatial_ListEarthObservationJobs.html

        :stability: experimental
        '''
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "toListEarthObservationJobs", []))

    @jsii.member(jsii_name="toListRasterDataCollections")
    def to_list_raster_data_collections(self) -> "SagemakerGeospatial":
        '''(experimental) Grants permission to return an array of aster data collections associated with the given model name.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_geospatial_ListRasterDataCollections.html

        :stability: experimental
        '''
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "toListRasterDataCollections", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "SagemakerGeospatial":
        '''(experimental) Grants permission to lists tag for an SageMaker Geospatial resource.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_geospatial_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListVectorEnrichmentJobs")
    def to_list_vector_enrichment_jobs(self) -> "SagemakerGeospatial":
        '''(experimental) Grants permission to return an array of vector enrichment jobs associated with the current account.

        Access Level: List

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_geospatial_ListVectorEnrichmentJobs.html

        :stability: experimental
        '''
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "toListVectorEnrichmentJobs", []))

    @jsii.member(jsii_name="toSearchRasterDataCollection")
    def to_search_raster_data_collection(self) -> "SagemakerGeospatial":
        '''(experimental) Grants permission to query raster data collections.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_geospatial_SearchRasterDataCollection.html

        :stability: experimental
        '''
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "toSearchRasterDataCollection", []))

    @jsii.member(jsii_name="toStartEarthObservationJob")
    def to_start_earth_observation_job(self) -> "SagemakerGeospatial":
        '''(experimental) Grants permission to the StartEarthObservationJob operation which starts a new earth observation job to your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_geospatial_StartEarthObservationJob.html

        :stability: experimental
        '''
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "toStartEarthObservationJob", []))

    @jsii.member(jsii_name="toStartVectorEnrichmentJob")
    def to_start_vector_enrichment_job(self) -> "SagemakerGeospatial":
        '''(experimental) Grants permission to the StartVectorEnrichmentJob operation which starts a new vector enrichment job to your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_geospatial_StartVectorEnrichmentJob.html

        :stability: experimental
        '''
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "toStartVectorEnrichmentJob", []))

    @jsii.member(jsii_name="toStopEarthObservationJob")
    def to_stop_earth_observation_job(self) -> "SagemakerGeospatial":
        '''(experimental) Grants permission to the StopEarthObservationJob operation which stops an existing earth observation job.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_geospatial_StopEarthObservationJob.html

        :stability: experimental
        '''
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "toStopEarthObservationJob", []))

    @jsii.member(jsii_name="toStopVectorEnrichmentJob")
    def to_stop_vector_enrichment_job(self) -> "SagemakerGeospatial":
        '''(experimental) Grants permission to the StopVectorEnrichmentJob operation which stops an existing vector enrichment job.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_geospatial_StopVectorEnrichmentJob.html

        :stability: experimental
        '''
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "toStopVectorEnrichmentJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "SagemakerGeospatial":
        '''(experimental) Grants permission to tag an SageMaker Geospatial resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_geospatial_TagResource.html

        :stability: experimental
        '''
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "SagemakerGeospatial":
        '''(experimental) Grants permission to untag an SageMaker Geospatial resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_geospatial_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("SagemakerGeospatial", jsii.invoke(self, "toUntagResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__528f9e89ffb2fe77e536e022b00a0807730d4a44b7f764ea8304a34105e7ea54)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8a6e8d7afff6b99dc9796be0d92921e2195cc68ee7e568a8fc81b38551a535d0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class SagemakerGroundtruthSynthetic(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.SagemakerGroundtruthSynthetic",
):
    '''(experimental) Statement provider for service `sagemaker-groundtruth-synthetic <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsagemakergroundtruthsynthetic.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sagemaker-groundtruth-synthetic <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsagemakergroundtruthsynthetic.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__11d8a2a5586fbfcd5411050f23d43fdb5476695228ee26f1e69a25480aefef24)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "SagemakerGroundtruthSynthetic":
        '''(experimental) Grants permission to create a project.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("SagemakerGroundtruthSynthetic", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "SagemakerGroundtruthSynthetic":
        '''(experimental) Grants permission to delete a project.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("SagemakerGroundtruthSynthetic", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toGetAccountDetails")
    def to_get_account_details(self) -> "SagemakerGroundtruthSynthetic":
        '''(experimental) Grants permission to get account details.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("SagemakerGroundtruthSynthetic", jsii.invoke(self, "toGetAccountDetails", []))

    @jsii.member(jsii_name="toGetBatch")
    def to_get_batch(self) -> "SagemakerGroundtruthSynthetic":
        '''(experimental) Grants permission to get a batch.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("SagemakerGroundtruthSynthetic", jsii.invoke(self, "toGetBatch", []))

    @jsii.member(jsii_name="toGetProject")
    def to_get_project(self) -> "SagemakerGroundtruthSynthetic":
        '''(experimental) Grants permission to get a project.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("SagemakerGroundtruthSynthetic", jsii.invoke(self, "toGetProject", []))

    @jsii.member(jsii_name="toListBatchDataTransfers")
    def to_list_batch_data_transfers(self) -> "SagemakerGroundtruthSynthetic":
        '''(experimental) Grants permission to list batch data transfers.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("SagemakerGroundtruthSynthetic", jsii.invoke(self, "toListBatchDataTransfers", []))

    @jsii.member(jsii_name="toListBatchSummaries")
    def to_list_batch_summaries(self) -> "SagemakerGroundtruthSynthetic":
        '''(experimental) Grants permission to list batch summaries.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("SagemakerGroundtruthSynthetic", jsii.invoke(self, "toListBatchSummaries", []))

    @jsii.member(jsii_name="toListProjectDataTransfers")
    def to_list_project_data_transfers(self) -> "SagemakerGroundtruthSynthetic":
        '''(experimental) Grants permission to list project data transfers.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("SagemakerGroundtruthSynthetic", jsii.invoke(self, "toListProjectDataTransfers", []))

    @jsii.member(jsii_name="toListProjectSummaries")
    def to_list_project_summaries(self) -> "SagemakerGroundtruthSynthetic":
        '''(experimental) Grants permission to list project summaries.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("SagemakerGroundtruthSynthetic", jsii.invoke(self, "toListProjectSummaries", []))

    @jsii.member(jsii_name="toStartBatchDataTransfer")
    def to_start_batch_data_transfer(self) -> "SagemakerGroundtruthSynthetic":
        '''(experimental) Grants permission to start a batch data transfer.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("SagemakerGroundtruthSynthetic", jsii.invoke(self, "toStartBatchDataTransfer", []))

    @jsii.member(jsii_name="toStartProjectDataTransfer")
    def to_start_project_data_transfer(self) -> "SagemakerGroundtruthSynthetic":
        '''(experimental) Grants permission to start a project data transfer.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("SagemakerGroundtruthSynthetic", jsii.invoke(self, "toStartProjectDataTransfer", []))

    @jsii.member(jsii_name="toUpdateBatch")
    def to_update_batch(self) -> "SagemakerGroundtruthSynthetic":
        '''(experimental) Grants permission to update a batch.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("SagemakerGroundtruthSynthetic", jsii.invoke(self, "toUpdateBatch", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__45dbcf1a28a99da5abaef61a99e512eeb1534165fc153219a4bd4b81181d1d63)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6535a5d5b6bd97a77bdec7d2621c9e1fac770501de51287e77bde3b28c0d56dd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Savingsplans(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Savingsplans",
):
    '''(experimental) Statement provider for service `savingsplans <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssavingsplans.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `savingsplans <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssavingsplans.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2e051a89bfef609922681f2bfc704c0e2b4e61a241f04a4146db8d384f2467e0)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onSavingsplan")
    def on_savingsplan(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Savingsplans":
        '''(experimental) Adds a resource of type savingsplan to the statement.

        https://docs.aws.amazon.com/savingsplans/latest/userguide/API_SavingsPlan.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__189a5972dbf2620252fa0364830674113e42bb9dbe8c0323d9fb0f4bdc7c3fc0)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Savingsplans", jsii.invoke(self, "onSavingsplan", [resource_id, account, partition]))

    @jsii.member(jsii_name="toCreateSavingsPlan")
    def to_create_savings_plan(self) -> "Savingsplans":
        '''(experimental) Grants permission to create a savings plan.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/savingsplans/latest/APIReference/API_CreateSavingsPlan.html

        :stability: experimental
        '''
        return typing.cast("Savingsplans", jsii.invoke(self, "toCreateSavingsPlan", []))

    @jsii.member(jsii_name="toDeleteQueuedSavingsPlan")
    def to_delete_queued_savings_plan(self) -> "Savingsplans":
        '''(experimental) Grants permission to delete the queued savings plan associated with customers account.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/savingsplans/latest/APIReference/API_DeleteQueuedSavingsPlan.html

        :stability: experimental
        '''
        return typing.cast("Savingsplans", jsii.invoke(self, "toDeleteQueuedSavingsPlan", []))

    @jsii.member(jsii_name="toDescribeSavingsPlanRates")
    def to_describe_savings_plan_rates(self) -> "Savingsplans":
        '''(experimental) Grants permission to describe the rates associated with customers savings plan.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/savingsplans/latest/APIReference/API_DescribeSavingsPlanRates.html

        :stability: experimental
        '''
        return typing.cast("Savingsplans", jsii.invoke(self, "toDescribeSavingsPlanRates", []))

    @jsii.member(jsii_name="toDescribeSavingsPlans")
    def to_describe_savings_plans(self) -> "Savingsplans":
        '''(experimental) Grants permission to describe the savings plans associated with customers account.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/savingsplans/latest/APIReference/API_DescribeSavingsPlans.html

        :stability: experimental
        '''
        return typing.cast("Savingsplans", jsii.invoke(self, "toDescribeSavingsPlans", []))

    @jsii.member(jsii_name="toDescribeSavingsPlansOfferingRates")
    def to_describe_savings_plans_offering_rates(self) -> "Savingsplans":
        '''(experimental) Grants permission to describe the rates assciated with savings plans offerings.

        Access Level: Read

        https://docs.aws.amazon.com/savingsplans/latest/APIReference/API_DescribeSavingsPlansOfferingRates.html

        :stability: experimental
        '''
        return typing.cast("Savingsplans", jsii.invoke(self, "toDescribeSavingsPlansOfferingRates", []))

    @jsii.member(jsii_name="toDescribeSavingsPlansOfferings")
    def to_describe_savings_plans_offerings(self) -> "Savingsplans":
        '''(experimental) Grants permission to describe the savings plans offerings that customer is eligible to purchase.

        Access Level: Read

        https://docs.aws.amazon.com/savingsplans/latest/APIReference/API_DescribeSavingsPlansOfferings.html

        :stability: experimental
        '''
        return typing.cast("Savingsplans", jsii.invoke(self, "toDescribeSavingsPlansOfferings", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Savingsplans":
        '''(experimental) Grants permission to list tags for a savings plan.

        Access Level: List

        https://docs.aws.amazon.com/savingsplans/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Savingsplans", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Savingsplans":
        '''(experimental) Grants permission to tag a savings plan.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/savingsplans/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Savingsplans", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Savingsplans":
        '''(experimental) Grants permission to untag a savings plan.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/savingsplans/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Savingsplans", jsii.invoke(self, "toUntagResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__72536760ada142415d995a43d4fc03a489fd6e5b6efe678411af47a46293e129)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4d2c0fb849232a2194327b0f463852641642259d0637a58a913760a0fdf822e0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Scheduler(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Scheduler",
):
    '''(experimental) Statement provider for service `scheduler <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoneventbridgescheduler.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `scheduler <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoneventbridgescheduler.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cc132cc4f1027b0af3d0fb279b72619b76691d942c25b6f6983b57d69fdfffdd)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onSchedule")
    def on_schedule(
        self,
        group_name: builtins.str,
        schedule_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Scheduler":
        '''(experimental) Adds a resource of type schedule to the statement.

        https://docs.aws.amazon.com/scheduler/latest/UserGuide/managing-schedule.html

        :param group_name: - Identifier for the groupName.
        :param schedule_name: - Identifier for the scheduleName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1287e9f9062dfc34d8eddf85a8c1219a0dbd02a4c3ba6d3559f0e52425fe0d53)
            check_type(argname="argument group_name", value=group_name, expected_type=type_hints["group_name"])
            check_type(argname="argument schedule_name", value=schedule_name, expected_type=type_hints["schedule_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Scheduler", jsii.invoke(self, "onSchedule", [group_name, schedule_name, account, region, partition]))

    @jsii.member(jsii_name="onScheduleGroup")
    def on_schedule_group(
        self,
        group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Scheduler":
        '''(experimental) Adds a resource of type schedule-group to the statement.

        https://docs.aws.amazon.com/scheduler/latest/UserGuide/managing-schedule-group.html

        :param group_name: - Identifier for the groupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__05ea99d9a2af1a5c3da661ff332b852973a83f97aaead057a1b0268a47844c2d)
            check_type(argname="argument group_name", value=group_name, expected_type=type_hints["group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Scheduler", jsii.invoke(self, "onScheduleGroup", [group_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateSchedule")
    def to_create_schedule(self) -> "Scheduler":
        '''(experimental) Grants permission to create an Amazon EventBridge Scheduler schedule.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/scheduler/latest/APIReference/API_CreateSchedule.html

        :stability: experimental
        '''
        return typing.cast("Scheduler", jsii.invoke(self, "toCreateSchedule", []))

    @jsii.member(jsii_name="toCreateScheduleGroup")
    def to_create_schedule_group(self) -> "Scheduler":
        '''(experimental) Grants permission to create an Amazon EventBridge Scheduler schedule group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/scheduler/latest/APIReference/API_CreateScheduleGroup.html

        :stability: experimental
        '''
        return typing.cast("Scheduler", jsii.invoke(self, "toCreateScheduleGroup", []))

    @jsii.member(jsii_name="toDeleteSchedule")
    def to_delete_schedule(self) -> "Scheduler":
        '''(experimental) Grants permission to delete an Amazon EventBridge Scheduler schedule.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/scheduler/latest/APIReference/API_DeleteSchedule.html

        :stability: experimental
        '''
        return typing.cast("Scheduler", jsii.invoke(self, "toDeleteSchedule", []))

    @jsii.member(jsii_name="toDeleteScheduleGroup")
    def to_delete_schedule_group(self) -> "Scheduler":
        '''(experimental) Grants permission to delete an Amazon EventBridge Scheduler schedule group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/scheduler/latest/APIReference/API_DeleteScheduleGroup.html

        :stability: experimental
        '''
        return typing.cast("Scheduler", jsii.invoke(self, "toDeleteScheduleGroup", []))

    @jsii.member(jsii_name="toGetSchedule")
    def to_get_schedule(self) -> "Scheduler":
        '''(experimental) Grants permission to view details about an Amazon EventBridge Scheduler schedule.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/scheduler/latest/APIReference/API_GetSchedule.html

        :stability: experimental
        '''
        return typing.cast("Scheduler", jsii.invoke(self, "toGetSchedule", []))

    @jsii.member(jsii_name="toGetScheduleGroup")
    def to_get_schedule_group(self) -> "Scheduler":
        '''(experimental) Grants permission to view details about an Amazon EventBridge Scheduler schedule group.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/scheduler/latest/APIReference/API_GetScheduleGroup.html

        :stability: experimental
        '''
        return typing.cast("Scheduler", jsii.invoke(self, "toGetScheduleGroup", []))

    @jsii.member(jsii_name="toListScheduleGroups")
    def to_list_schedule_groups(self) -> "Scheduler":
        '''(experimental) Grants permission to list the Amazon EventBridge Scheduler schedule groups in your account.

        Access Level: List

        https://docs.aws.amazon.com/scheduler/latest/APIReference/API_ListScheduleGroups.html

        :stability: experimental
        '''
        return typing.cast("Scheduler", jsii.invoke(self, "toListScheduleGroups", []))

    @jsii.member(jsii_name="toListSchedules")
    def to_list_schedules(self) -> "Scheduler":
        '''(experimental) Grants permission to list the Amazon EventBridge Scheduler schedules in your account.

        Access Level: List

        https://docs.aws.amazon.com/scheduler/latest/APIReference/API_ListSchedules.html

        :stability: experimental
        '''
        return typing.cast("Scheduler", jsii.invoke(self, "toListSchedules", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Scheduler":
        '''(experimental) Grants permission to lists tag for an Amazon EventBridge Scheduler resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/scheduler/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Scheduler", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Scheduler":
        '''(experimental) Grants permission to tag an Amazon EventBridge Scheduler resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/scheduler/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Scheduler", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Scheduler":
        '''(experimental) Grants permission to untag an Amazon EventBridge Scheduler resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/scheduler/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Scheduler", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateSchedule")
    def to_update_schedule(self) -> "Scheduler":
        '''(experimental) Grants permission to modify an Amazon EventBridge Scheduler schedule.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/scheduler/latest/APIReference/API_UpdateSchedule.html

        :stability: experimental
        '''
        return typing.cast("Scheduler", jsii.invoke(self, "toUpdateSchedule", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__985b20f741f91e93a7bf04dd0d199cd0ad40f34539c6cec4ce488cd4a6d88f0a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fe787b4a2e5b5d07e459ca737f8d45513d373a373a952e900071e0a6f23edfae)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Schemas(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Schemas"):
    '''(experimental) Statement provider for service `schemas <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoneventbridgeschemas.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `schemas <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoneventbridgeschemas.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e12400e27b63c38f82d1c83218b47c27a2ac124932c45ecb53d575225ef20f3e)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDiscoverer")
    def on_discoverer(
        self,
        discoverer_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Schemas":
        '''(experimental) Adds a resource of type discoverer to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/iam-identity-based-access-control-eventbridge.html

        :param discoverer_id: - Identifier for the discovererId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6f452d41835600865d404defed4a8b010b202d112d4a57214f852f661716f721)
            check_type(argname="argument discoverer_id", value=discoverer_id, expected_type=type_hints["discoverer_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Schemas", jsii.invoke(self, "onDiscoverer", [discoverer_id, account, region, partition]))

    @jsii.member(jsii_name="onRegistry")
    def on_registry(
        self,
        registry_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Schemas":
        '''(experimental) Adds a resource of type registry to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/iam-identity-based-access-control-eventbridge.html

        :param registry_name: - Identifier for the registryName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__866b3364177032b55de7c8bc704b9d5b37344d1a4ec41bd94794f93f1bd88d2d)
            check_type(argname="argument registry_name", value=registry_name, expected_type=type_hints["registry_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Schemas", jsii.invoke(self, "onRegistry", [registry_name, account, region, partition]))

    @jsii.member(jsii_name="onSchema")
    def on_schema(
        self,
        registry_name: builtins.str,
        schema_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Schemas":
        '''(experimental) Adds a resource of type schema to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/iam-identity-based-access-control-eventbridge.html

        :param registry_name: - Identifier for the registryName.
        :param schema_name: - Identifier for the schemaName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__51a9cfc7b457bcbd2c7e22a0b4fa37723e13cbf27c92ec34a560f817d90c7275)
            check_type(argname="argument registry_name", value=registry_name, expected_type=type_hints["registry_name"])
            check_type(argname="argument schema_name", value=schema_name, expected_type=type_hints["schema_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Schemas", jsii.invoke(self, "onSchema", [registry_name, schema_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateDiscoverer")
    def to_create_discoverer(self) -> "Schemas":
        '''(experimental) Grants permission to create an event schema discoverer.

        Once created, your events will be automatically map into corresponding schema documents

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-discoverers-id-discovererid.html#CreateDiscoverer

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toCreateDiscoverer", []))

    @jsii.member(jsii_name="toCreateRegistry")
    def to_create_registry(self) -> "Schemas":
        '''(experimental) Grants permission to create a new schema registry in your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname.html#CreateRegistry

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toCreateRegistry", []))

    @jsii.member(jsii_name="toCreateSchema")
    def to_create_schema(self) -> "Schemas":
        '''(experimental) Grants permission to create a new schema in your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas-name-schemaname.html#CreateSchema

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toCreateSchema", []))

    @jsii.member(jsii_name="toDeleteDiscoverer")
    def to_delete_discoverer(self) -> "Schemas":
        '''(experimental) Grants permission to delete discoverer in your account.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-discoverers-id-discovererid.html#DeleteDiscoverer

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toDeleteDiscoverer", []))

    @jsii.member(jsii_name="toDeleteRegistry")
    def to_delete_registry(self) -> "Schemas":
        '''(experimental) Grants permission to delete an existing registry in your account.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname.html#DeleteRegistry

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toDeleteRegistry", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "Schemas":
        '''(experimental) Grants permission to delete the resource-based policy attached to a given registry.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-policy.html#DeleteResourcePolicy

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteSchema")
    def to_delete_schema(self) -> "Schemas":
        '''(experimental) Grants permission to delete an existing schema in your account.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas-name-schemaname.html#DeleteSchema

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toDeleteSchema", []))

    @jsii.member(jsii_name="toDeleteSchemaVersion")
    def to_delete_schema_version(self) -> "Schemas":
        '''(experimental) Grants permission to delete a specific version of schema in your account.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas-name-schemaname-version-schemaversion.html#DeleteSchemaVersion

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toDeleteSchemaVersion", []))

    @jsii.member(jsii_name="toDescribeCodeBinding")
    def to_describe_code_binding(self) -> "Schemas":
        '''(experimental) Grants permission to retrieve metadata for generated code for specific schema in your account.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas-name-schemaname-language-language.html#DescribeCodeBinding

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toDescribeCodeBinding", []))

    @jsii.member(jsii_name="toDescribeDiscoverer")
    def to_describe_discoverer(self) -> "Schemas":
        '''(experimental) Grants permission to retrieve discoverer metadata in your account.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-discoverers-id-discovererid.html#DescribeDiscoverer

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toDescribeDiscoverer", []))

    @jsii.member(jsii_name="toDescribeRegistry")
    def to_describe_registry(self) -> "Schemas":
        '''(experimental) Grants permission to describe an existing registry metadata in your account.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname.html#DescribeRegistry

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toDescribeRegistry", []))

    @jsii.member(jsii_name="toDescribeSchema")
    def to_describe_schema(self) -> "Schemas":
        '''(experimental) Grants permission to retrieve an existing schema in your account.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas-name-schemaname.html#DescribeSchema

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toDescribeSchema", []))

    @jsii.member(jsii_name="toExportSchema")
    def to_export_schema(self) -> "Schemas":
        '''(experimental) Grants permission to export the AWS registry or discovered schemas in OpenAPI 3 format to JSONSchema format.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-policy.html#ExportSchema

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toExportSchema", []))

    @jsii.member(jsii_name="toGetCodeBindingSource")
    def to_get_code_binding_source(self) -> "Schemas":
        '''(experimental) Grants permission to retrieve metadata for generated code for specific schema in your account.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas-name-schemaname-language-language-source.html#GetCodeBindingSource

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toGetCodeBindingSource", []))

    @jsii.member(jsii_name="toGetDiscoveredSchema")
    def to_get_discovered_schema(self) -> "Schemas":
        '''(experimental) Grants permission to retrieve a schema for the provided list of sample events.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-discover.html#GetDiscoveredSchema

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toGetDiscoveredSchema", []))

    @jsii.member(jsii_name="toGetResourcePolicy")
    def to_get_resource_policy(self) -> "Schemas":
        '''(experimental) Grants permission to retrieve the resource-based policy attached to a given registry.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-policy.html#GetResourcePolicy

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toGetResourcePolicy", []))

    @jsii.member(jsii_name="toListDiscoverers")
    def to_list_discoverers(self) -> "Schemas":
        '''(experimental) Grants permission to list all discoverers in your account.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-discoverers.html#ListDiscoverers

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toListDiscoverers", []))

    @jsii.member(jsii_name="toListRegistries")
    def to_list_registries(self) -> "Schemas":
        '''(experimental) Grants permission to list all registries in your account.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries.html#ListRegistries

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toListRegistries", []))

    @jsii.member(jsii_name="toListSchemas")
    def to_list_schemas(self) -> "Schemas":
        '''(experimental) Grants permission to list all schemas.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas.html#ListSchemas

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toListSchemas", []))

    @jsii.member(jsii_name="toListSchemaVersions")
    def to_list_schema_versions(self) -> "Schemas":
        '''(experimental) Grants permission to list all versions of a schema.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas-name-schemaname-versions.html#ListSchemaVersions

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toListSchemaVersions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Schemas":
        '''(experimental) Grants permission to lists tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/tags-resource-arn.html#ListTagsForResource

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutCodeBinding")
    def to_put_code_binding(self) -> "Schemas":
        '''(experimental) Grants permission to generate code for specific schema in your account.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas-name-schemaname-language-language.html#PutCodeBinding

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toPutCodeBinding", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "Schemas":
        '''(experimental) Grants permission to attach a resource-based policy to a given registry.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-policy.html#PutResourcePolicy

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toSearchSchemas")
    def to_search_schemas(self) -> "Schemas":
        '''(experimental) Grants permission to search schemas based on specified keywords in your account.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas-search.html#SearchSchemas

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toSearchSchemas", []))

    @jsii.member(jsii_name="toStartDiscoverer")
    def to_start_discoverer(self) -> "Schemas":
        '''(experimental) Grants permission to start the specified discoverer.

        Once started the discoverer will automatically register schemas for published events to configured source in your account

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-discoverers-id-discovererid.html#StartDiscoverer

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toStartDiscoverer", []))

    @jsii.member(jsii_name="toStopDiscoverer")
    def to_stop_discoverer(self) -> "Schemas":
        '''(experimental) Grants permission to stop the specified discoverer.

        Once stopped the discoverer will no longer register schemas for published events to configured source in your account

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-discoverers-id-discovererid.html#StopDiscoverer

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toStopDiscoverer", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Schemas":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/tags-resource-arn.html#TagResource

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Schemas":
        '''(experimental) Grants permission to remove a tag from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/tags-resource-arn.html#UntagResource

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDiscoverer")
    def to_update_discoverer(self) -> "Schemas":
        '''(experimental) Grants permission to update an existing discoverer in your account.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-discoverers-id-discovererid.html#UpdateDiscoverer

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toUpdateDiscoverer", []))

    @jsii.member(jsii_name="toUpdateRegistry")
    def to_update_registry(self) -> "Schemas":
        '''(experimental) Grants permission to update an existing registry metadata in your account.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname.html#UpdateRegistry

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toUpdateRegistry", []))

    @jsii.member(jsii_name="toUpdateSchema")
    def to_update_schema(self) -> "Schemas":
        '''(experimental) Grants permission to update an existing schema in your account.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/schema-reference/v1-registries-name-registryname-schemas-name-schemaname.html#UpdateSchema

        :stability: experimental
        '''
        return typing.cast("Schemas", jsii.invoke(self, "toUpdateSchema", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__66b4ccfa6708d5322fa6effb804e614ba88953f0e8353052c835672e5e156ddd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__942c0b33b76a030dbb4446158295b9f5a0bf7b17caaf85bbcad71084dc772324)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Scn(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Scn"):
    '''(experimental) Statement provider for service `scn <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupplychain.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `scn <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupplychain.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__04821c10c101abebf062fd39f5af049b7c0f658d3d8bc737d0c7a557658ac786)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onInstance")
    def on_instance(
        self,
        instance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Scn":
        '''(experimental) Adds a resource of type instance to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupplychain.html

        :param instance_id: - Identifier for the instanceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9264aa8fb78ec71792f3d5c37137131461014d5d41aed566c5fb6b9f2ba71dea)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Scn", jsii.invoke(self, "onInstance", [instance_id, account, region, partition]))

    @jsii.member(jsii_name="toAssignAdminPermissionsToUser")
    def to_assign_admin_permissions_to_user(self) -> "Scn":
        '''(experimental) Grants permission to add AWS Supply Chain administrator permission to federated user.

        Access Level: Write

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupplychain.html

        :stability: experimental
        '''
        return typing.cast("Scn", jsii.invoke(self, "toAssignAdminPermissionsToUser", []))

    @jsii.member(jsii_name="toCreateInstance")
    def to_create_instance(self) -> "Scn":
        '''(experimental) Grants permission to create a new AWS Supply Chain instance.

        Access Level: Write

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupplychain.html

        :stability: experimental
        '''
        return typing.cast("Scn", jsii.invoke(self, "toCreateInstance", []))

    @jsii.member(jsii_name="toCreateSSOApplication")
    def to_create_sso_application(self) -> "Scn":
        '''(experimental) Grants permission to create IAM Identity Center application for a AWS Supply Chain instance.

        Access Level: Write

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupplychain.html

        :stability: experimental
        '''
        return typing.cast("Scn", jsii.invoke(self, "toCreateSSOApplication", []))

    @jsii.member(jsii_name="toDeleteInstance")
    def to_delete_instance(self) -> "Scn":
        '''(experimental) Grants permission to delete an AWS Supply Chain instance.

        Access Level: Write

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupplychain.html

        :stability: experimental
        '''
        return typing.cast("Scn", jsii.invoke(self, "toDeleteInstance", []))

    @jsii.member(jsii_name="toDeleteSSOApplication")
    def to_delete_sso_application(self) -> "Scn":
        '''(experimental) Grants permission to delete IAM Identity Center application of the AWS Supply Chain instance.

        Access Level: Write

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupplychain.html

        :stability: experimental
        '''
        return typing.cast("Scn", jsii.invoke(self, "toDeleteSSOApplication", []))

    @jsii.member(jsii_name="toDescribeInstance")
    def to_describe_instance(self) -> "Scn":
        '''(experimental) Grants permission to view details of an AWS Supply Chain instance.

        Access Level: Read

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupplychain.html

        :stability: experimental
        '''
        return typing.cast("Scn", jsii.invoke(self, "toDescribeInstance", []))

    @jsii.member(jsii_name="toListAdminUsers")
    def to_list_admin_users(self) -> "Scn":
        '''(experimental) Grants permission to list AWS Supply Chain administrators of an instance.

        Access Level: List

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupplychain.html

        :stability: experimental
        '''
        return typing.cast("Scn", jsii.invoke(self, "toListAdminUsers", []))

    @jsii.member(jsii_name="toListInstances")
    def to_list_instances(self) -> "Scn":
        '''(experimental) Grants permission to view the AWS Supply Chain instances associated with an AWS account.

        Access Level: List

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupplychain.html

        :stability: experimental
        '''
        return typing.cast("Scn", jsii.invoke(self, "toListInstances", []))

    @jsii.member(jsii_name="toRemoveAdminPermissionsForUser")
    def to_remove_admin_permissions_for_user(self) -> "Scn":
        '''(experimental) Grants permission to remove AWS Supply Chain administrator permission from federated user.

        Access Level: Write

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupplychain.html

        :stability: experimental
        '''
        return typing.cast("Scn", jsii.invoke(self, "toRemoveAdminPermissionsForUser", []))

    @jsii.member(jsii_name="toUpdateInstance")
    def to_update_instance(self) -> "Scn":
        '''(experimental) Grants permission to update an AWS Supply Chain instance.

        Access Level: Write

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupplychain.html

        :stability: experimental
        '''
        return typing.cast("Scn", jsii.invoke(self, "toUpdateInstance", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8ab554b01092d6c78ad6ac11f86657a32287841ec7f62260245755ce9ff6abdb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0f5158a57dd9898a98c3d66ecd49850516435f035bb3b44a42c362dfface42c6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Sdb(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Sdb"):
    '''(experimental) Statement provider for service `sdb <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsimpledb.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sdb <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsimpledb.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__62ae9074a9ea9615e3b93c198fd1f7623321b7f8c1057d5484912389ae03aaff)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDomain")
    def on_domain(
        self,
        domain_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sdb":
        '''(experimental) Adds a resource of type domain to the statement.

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/DataModel.html

        :param domain_name: - Identifier for the domainName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7a2e5fa4900bd17442e87b5ffa3f75440504644dfa80515dce96b6b9bd4176cd)
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sdb", jsii.invoke(self, "onDomain", [domain_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchDeleteAttributes")
    def to_batch_delete_attributes(self) -> "Sdb":
        '''(experimental) Performs multiple DeleteAttributes operations in a single call, which reduces round trips and latencies.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/SDB_API_BatchDeleteAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "toBatchDeleteAttributes", []))

    @jsii.member(jsii_name="toBatchPutAttributes")
    def to_batch_put_attributes(self) -> "Sdb":
        '''(experimental) With the BatchPutAttributes operation, you can perform multiple PutAttribute operations in a single call.

        With the BatchPutAttributes operation, you can perform multiple PutAttribute operations in a single call

        Access Level: Write

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/SDB_API_BatchPutAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "toBatchPutAttributes", []))

    @jsii.member(jsii_name="toCreateDomain")
    def to_create_domain(self) -> "Sdb":
        '''(experimental) The CreateDomain operation creates a new domain.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/SDB_API_CreateDomain.html

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "toCreateDomain", []))

    @jsii.member(jsii_name="toDeleteAttributes")
    def to_delete_attributes(self) -> "Sdb":
        '''(experimental) Deletes one or more attributes associated with the item.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/SDB_API_DeleteAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "toDeleteAttributes", []))

    @jsii.member(jsii_name="toDeleteDomain")
    def to_delete_domain(self) -> "Sdb":
        '''(experimental) The DeleteDomain operation deletes a domain.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/SDB_API_DeleteDomain.html

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "toDeleteDomain", []))

    @jsii.member(jsii_name="toDomainMetadata")
    def to_domain_metadata(self) -> "Sdb":
        '''(experimental) Returns information about the domain, including when the domain was created, the number of items and attributes, and the size of attribute names and values.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/SDB_API_DomainMetadata.html

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "toDomainMetadata", []))

    @jsii.member(jsii_name="toGetAttributes")
    def to_get_attributes(self) -> "Sdb":
        '''(experimental) Returns all of the attributes associated with the item.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/SDB_API_GetAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "toGetAttributes", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Sdb":
        '''(experimental) Description for ListDomains.

        Access Level: List

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/SDB_API_ListDomains.html

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toPutAttributes")
    def to_put_attributes(self) -> "Sdb":
        '''(experimental) The PutAttributes operation creates or replaces attributes in an item.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/SDB_API_PutAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "toPutAttributes", []))

    @jsii.member(jsii_name="toSelect")
    def to_select(self) -> "Sdb":
        '''(experimental) Description for Select.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonSimpleDB/latest/DeveloperGuide/SDB_API_Select.html

        :stability: experimental
        '''
        return typing.cast("Sdb", jsii.invoke(self, "toSelect", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2b9b4f1bd95a982ca84eeb440c37f352f42476948e858a4f4583a54977e2df29)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ee620ef099565a31ddd1aed87c21ad85908020d20d66500c6961091b19d45003)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Secretsmanager(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Secretsmanager",
):
    '''(experimental) Statement provider for service `secretsmanager <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssecretsmanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `secretsmanager <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssecretsmanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__63c2210c9c1f23cf1409ca6e48d6aebb0063fc0a72e1861fea23e29094a6d699)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAddReplicaRegions")
    def if_add_replica_regions(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by the list of Regions in which to replicate the secret.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toCreateSecret()
        - .toReplicateSecretToRegions()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__346c3e74abb8b696cbb4254341d905e09133286c29ec9b22f3fe78487aae22f0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifAddReplicaRegions", [value, operator]))

    @jsii.member(jsii_name="ifBlockPublicPolicy")
    def if_block_public_policy(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by whether the resource policy blocks broad AWS account access.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toPutResourcePolicy()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1c3b06f1245b75f9a9f8123f869855bd6b26c8410b1c5464ae7f8868e69bf053)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifBlockPublicPolicy", [value]))

    @jsii.member(jsii_name="ifDescription")
    def if_description(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by the description text in the request.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toCreateSecret()
        - .toUpdateSecret()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7b1fa93528d106f17aa67f7979d2a130b5f50647f7e84acd889fd65c9be4334e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifDescription", [value, operator]))

    @jsii.member(jsii_name="ifForceDeleteWithoutRecovery")
    def if_force_delete_without_recovery(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by whether the secret is to be deleted immediately without any recovery window.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toDeleteSecret()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__903d98438388df7460dba1861bc0d02bf9e298c7ef8f25a9beb71369c3015d24)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifForceDeleteWithoutRecovery", [value]))

    @jsii.member(jsii_name="ifForceOverwriteReplicaSecret")
    def if_force_overwrite_replica_secret(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by whether to overwrite a secret with the same name in the destination Region.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toCreateSecret()
        - .toReplicateSecretToRegions()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f357db7bc2007a8c39db59377a4009ba84439420e4abfbb7df1df962765c6d41)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifForceOverwriteReplicaSecret", [value]))

    @jsii.member(jsii_name="ifKmsKeyId")
    def if_kms_key_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by the ARN of the KMS key in the request.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toCreateSecret()
        - .toUpdateSecret()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2c3aeed3de11f1d5d374584883605a7f8d1634c40f195aa20d6397096a2043c7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifKmsKeyId", [value, operator]))

    @jsii.member(jsii_name="ifModifyRotationRules")
    def if_modify_rotation_rules(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by whether the rotation rules of the secret are to be modified.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toRotateSecret()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__57aa5290dadaa3e597c113897e82bed43b5fed4cb9cc7e99cf76c56b64572187)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifModifyRotationRules", [value]))

    @jsii.member(jsii_name="ifName")
    def if_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by the friendly name of the secret in the request.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toCreateSecret()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cf4161ffc70e5c63997a21b8e78ed18d3d6931d0afd738bcf6be7bd08ec7fd02)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifName", [value, operator]))

    @jsii.member(jsii_name="ifRecoveryWindowInDays")
    def if_recovery_window_in_days(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by the number of days that Secrets Manager waits before it can delete the secret.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toDeleteSecret()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e1942306124dcd44c2cb2f60323c3ed95c9ac4ee2a4aff1dc829bde75d5c1f48)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifRecoveryWindowInDays", [value, operator]))

    @jsii.member(jsii_name="ifResource")
    def if_resource(
        self,
        allow_rotation_lambda_arn: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by the ARN of the rotation Lambda function associated with the secret.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toCancelRotateSecret()
        - .toDeleteResourcePolicy()
        - .toDeleteSecret()
        - .toDescribeSecret()
        - .toGetResourcePolicy()
        - .toGetSecretValue()
        - .toListSecretVersionIds()
        - .toPutResourcePolicy()
        - .toPutSecretValue()
        - .toRemoveRegionsFromReplication()
        - .toReplicateSecretToRegions()
        - .toRestoreSecret()
        - .toRotateSecret()
        - .toStopReplicationToReplica()
        - .toTagResource()
        - .toUntagResource()
        - .toUpdateSecret()
        - .toUpdateSecretVersionStage()
        - .toValidateResourcePolicy()

        Applies to resource types:

        - Secret

        :param allow_rotation_lambda_arn: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__45b5b5bb58dcd9ac75a694c2dfcab7960e41865785038191b69e434c6fd4273f)
            check_type(argname="argument allow_rotation_lambda_arn", value=allow_rotation_lambda_arn, expected_type=type_hints["allow_rotation_lambda_arn"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifResource", [allow_rotation_lambda_arn, value, operator]))

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by a tag key and value pair.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toCancelRotateSecret()
        - .toCreateSecret()
        - .toDeleteResourcePolicy()
        - .toDeleteSecret()
        - .toDescribeSecret()
        - .toGetResourcePolicy()
        - .toGetSecretValue()
        - .toListSecretVersionIds()
        - .toPutResourcePolicy()
        - .toPutSecretValue()
        - .toRemoveRegionsFromReplication()
        - .toReplicateSecretToRegions()
        - .toRestoreSecret()
        - .toRotateSecret()
        - .toStopReplicationToReplica()
        - .toTagResource()
        - .toUntagResource()
        - .toUpdateSecret()
        - .toUpdateSecretVersionStage()
        - .toValidateResourcePolicy()

        Applies to resource types:

        - Secret

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a640854a0ec658c056cc2e5744c633fcdcfdb30ac9c560a316910b6f8ebfee6a)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifRotateImmediately")
    def if_rotate_immediately(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by whether the secret is to be rotated immediately.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toRotateSecret()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__45a1740bd806ac144bc8331c38af97cc95cfdcff6f598d1635059f98f192f9b3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifRotateImmediately", [value]))

    @jsii.member(jsii_name="ifRotationLambdaARN")
    def if_rotation_lambda_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by the ARN of the rotation Lambda function in the request.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toRotateSecret()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f302f23cac9a5b1a193a526e398206adb09a880b7099bfc0dee864c7ee29e0c3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifRotationLambdaARN", [value, operator]))

    @jsii.member(jsii_name="ifSecretId")
    def if_secret_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by the SecretID value in the request.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toCancelRotateSecret()
        - .toDeleteResourcePolicy()
        - .toDeleteSecret()
        - .toDescribeSecret()
        - .toGetResourcePolicy()
        - .toGetSecretValue()
        - .toListSecretVersionIds()
        - .toPutResourcePolicy()
        - .toPutSecretValue()
        - .toRemoveRegionsFromReplication()
        - .toReplicateSecretToRegions()
        - .toRestoreSecret()
        - .toRotateSecret()
        - .toStopReplicationToReplica()
        - .toTagResource()
        - .toUntagResource()
        - .toUpdateSecret()
        - .toUpdateSecretVersionStage()
        - .toValidateResourcePolicy()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__79b31cd04209550d05450b2ea1734fdec59bd2b0b76c4c90aaa271c9c3f111a9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifSecretId", [value, operator]))

    @jsii.member(jsii_name="ifSecretPrimaryRegion")
    def if_secret_primary_region(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by primary region in which the secret is created.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toCancelRotateSecret()
        - .toDeleteResourcePolicy()
        - .toDeleteSecret()
        - .toDescribeSecret()
        - .toGetResourcePolicy()
        - .toGetSecretValue()
        - .toListSecretVersionIds()
        - .toPutResourcePolicy()
        - .toPutSecretValue()
        - .toRemoveRegionsFromReplication()
        - .toReplicateSecretToRegions()
        - .toRestoreSecret()
        - .toRotateSecret()
        - .toStopReplicationToReplica()
        - .toTagResource()
        - .toUntagResource()
        - .toUpdateSecret()
        - .toUpdateSecretVersionStage()
        - .toValidateResourcePolicy()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7a064fe8b96f0ae05cd7e2152ea9f2464015c1ce4c6ddabfdcbda4c92521cb9a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifSecretPrimaryRegion", [value, operator]))

    @jsii.member(jsii_name="ifVersionId")
    def if_version_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by the unique identifier of the version of the secret in the request.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toGetSecretValue()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__22cbd397d618a495591361efae0f81f7395e8520342c025caedccf02d7667ef7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifVersionId", [value, operator]))

    @jsii.member(jsii_name="ifVersionStage")
    def if_version_stage(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Secretsmanager":
        '''(experimental) Filters access by the list of version stages in the request.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-contextkeys

        Applies to actions:

        - .toGetSecretValue()
        - .toUpdateSecretVersionStage()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b5e644c821cade590cacf332f352efa88c5f0d00857e2b6ac19e3e394668e44f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Secretsmanager", jsii.invoke(self, "ifVersionStage", [value, operator]))

    @jsii.member(jsii_name="onSecret")
    def on_secret(
        self,
        secret_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Secretsmanager":
        '''(experimental) Adds a resource of type Secret to the statement.

        https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_iam-permissions.html#iam-resources

        :param secret_id: - Identifier for the secretId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifResourceTag() - .ifResource()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__66dcb05eda6852751969cb2d14703f9f24c684492fad4203f21342ffb75bcad0)
            check_type(argname="argument secret_id", value=secret_id, expected_type=type_hints["secret_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Secretsmanager", jsii.invoke(self, "onSecret", [secret_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelRotateSecret")
    def to_cancel_rotate_secret(self) -> "Secretsmanager":
        '''(experimental) Grants permission to cancel an in-progress secret rotation.

        Access Level: Write

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()
        - .ifAwsResourceTag()
        - .ifSecretPrimaryRegion()

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_CancelRotateSecret.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toCancelRotateSecret", []))

    @jsii.member(jsii_name="toCreateSecret")
    def to_create_secret(self) -> "Secretsmanager":
        '''(experimental) Grants permission to create a secret that stores encrypted data that can be queried and rotated.

        Access Level: Write

        Possible conditions:

        - .ifName()
        - .ifDescription()
        - .ifKmsKeyId()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()
        - .ifAwsTagKeys()
        - .ifResourceTag()
        - .ifAddReplicaRegions()
        - .ifForceOverwriteReplicaSecret()

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_CreateSecret.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toCreateSecret", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "Secretsmanager":
        '''(experimental) Grants permission to delete the resource policy attached to a secret.

        Access Level: Permissions management

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()
        - .ifAwsResourceTag()
        - .ifSecretPrimaryRegion()

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteSecret")
    def to_delete_secret(self) -> "Secretsmanager":
        '''(experimental) Grants permission to delete a secret.

        Access Level: Write

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifRecoveryWindowInDays()
        - .ifForceDeleteWithoutRecovery()
        - .ifResourceTag()
        - .ifAwsResourceTag()
        - .ifSecretPrimaryRegion()

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toDeleteSecret", []))

    @jsii.member(jsii_name="toDescribeSecret")
    def to_describe_secret(self) -> "Secretsmanager":
        '''(experimental) Grants permission to retrieve the metadata about a secret, but not the encrypted data.

        Access Level: Read

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()
        - .ifAwsResourceTag()
        - .ifSecretPrimaryRegion()

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DescribeSecret.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toDescribeSecret", []))

    @jsii.member(jsii_name="toGetRandomPassword")
    def to_get_random_password(self) -> "Secretsmanager":
        '''(experimental) Grants permission to generate a random string for use in password creation.

        Access Level: Read

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetRandomPassword.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toGetRandomPassword", []))

    @jsii.member(jsii_name="toGetResourcePolicy")
    def to_get_resource_policy(self) -> "Secretsmanager":
        '''(experimental) Grants permission to get the resource policy attached to a secret.

        Access Level: Read

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()
        - .ifAwsResourceTag()
        - .ifSecretPrimaryRegion()

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toGetResourcePolicy", []))

    @jsii.member(jsii_name="toGetSecretValue")
    def to_get_secret_value(self) -> "Secretsmanager":
        '''(experimental) Grants permission to retrieve and decrypt the encrypted data.

        Access Level: Read

        Possible conditions:

        - .ifSecretId()
        - .ifVersionId()
        - .ifVersionStage()
        - .ifResource()
        - .ifResourceTag()
        - .ifAwsResourceTag()
        - .ifSecretPrimaryRegion()

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toGetSecretValue", []))

    @jsii.member(jsii_name="toListSecrets")
    def to_list_secrets(self) -> "Secretsmanager":
        '''(experimental) Grants permission to list the available secrets.

        Access Level: List

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_ListSecrets.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toListSecrets", []))

    @jsii.member(jsii_name="toListSecretVersionIds")
    def to_list_secret_version_ids(self) -> "Secretsmanager":
        '''(experimental) Grants permission to list the available versions of a secret.

        Access Level: Read

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()
        - .ifAwsResourceTag()
        - .ifSecretPrimaryRegion()

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_ListSecretVersionIds.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toListSecretVersionIds", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "Secretsmanager":
        '''(experimental) Grants permission to attach a resource policy to a secret.

        Access Level: Permissions management

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()
        - .ifAwsResourceTag()
        - .ifBlockPublicPolicy()
        - .ifSecretPrimaryRegion()

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_PutResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toPutSecretValue")
    def to_put_secret_value(self) -> "Secretsmanager":
        '''(experimental) Grants permission to create a new version of the secret with new encrypted data.

        Access Level: Write

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()
        - .ifAwsResourceTag()
        - .ifSecretPrimaryRegion()

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_PutSecretValue.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toPutSecretValue", []))

    @jsii.member(jsii_name="toRemoveRegionsFromReplication")
    def to_remove_regions_from_replication(self) -> "Secretsmanager":
        '''(experimental) Grants permission to remove regions from replication.

        Access Level: Write

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()
        - .ifAwsResourceTag()
        - .ifSecretPrimaryRegion()

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_RemoveRegionsFromReplication.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toRemoveRegionsFromReplication", []))

    @jsii.member(jsii_name="toReplicateSecretToRegions")
    def to_replicate_secret_to_regions(self) -> "Secretsmanager":
        '''(experimental) Grants permission to convert an existing secret to a multi-Region secret and begin replicating the secret to a list of new regions.

        Access Level: Write

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()
        - .ifAwsResourceTag()
        - .ifSecretPrimaryRegion()
        - .ifAddReplicaRegions()
        - .ifForceOverwriteReplicaSecret()

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_ReplicateSecretToRegions.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toReplicateSecretToRegions", []))

    @jsii.member(jsii_name="toRestoreSecret")
    def to_restore_secret(self) -> "Secretsmanager":
        '''(experimental) Grants permission to cancel deletion of a secret.

        Access Level: Write

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()
        - .ifAwsResourceTag()
        - .ifSecretPrimaryRegion()

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_RestoreSecret.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toRestoreSecret", []))

    @jsii.member(jsii_name="toRotateSecret")
    def to_rotate_secret(self) -> "Secretsmanager":
        '''(experimental) Grants permission to start rotation of a secret.

        Access Level: Write

        Possible conditions:

        - .ifSecretId()
        - .ifRotationLambdaARN()
        - .ifResource()
        - .ifResourceTag()
        - .ifAwsResourceTag()
        - .ifSecretPrimaryRegion()
        - .ifModifyRotationRules()
        - .ifRotateImmediately()

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_RotateSecret.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toRotateSecret", []))

    @jsii.member(jsii_name="toStopReplicationToReplica")
    def to_stop_replication_to_replica(self) -> "Secretsmanager":
        '''(experimental) Grants permission to remove the secret from replication and promote the secret to a regional secret in the replica Region.

        Access Level: Write

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()
        - .ifAwsResourceTag()
        - .ifSecretPrimaryRegion()

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_StopReplicationToReplica.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toStopReplicationToReplica", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Secretsmanager":
        '''(experimental) Grants permission to add tags to a secret.

        Access Level: Tagging

        Possible conditions:

        - .ifSecretId()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifResource()
        - .ifResourceTag()
        - .ifAwsResourceTag()
        - .ifSecretPrimaryRegion()

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Secretsmanager":
        '''(experimental) Grants permission to remove tags from a secret.

        Access Level: Tagging

        Possible conditions:

        - .ifSecretId()
        - .ifAwsTagKeys()
        - .ifResource()
        - .ifResourceTag()
        - .ifAwsResourceTag()
        - .ifSecretPrimaryRegion()

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateSecret")
    def to_update_secret(self) -> "Secretsmanager":
        '''(experimental) Grants permission to update a secret with new metadata or with a new version of the encrypted data.

        Access Level: Write

        Possible conditions:

        - .ifSecretId()
        - .ifDescription()
        - .ifKmsKeyId()
        - .ifResource()
        - .ifResourceTag()
        - .ifAwsResourceTag()
        - .ifSecretPrimaryRegion()

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_UpdateSecret.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toUpdateSecret", []))

    @jsii.member(jsii_name="toUpdateSecretVersionStage")
    def to_update_secret_version_stage(self) -> "Secretsmanager":
        '''(experimental) Grants permission to move a stage from one secret to another.

        Access Level: Write

        Possible conditions:

        - .ifSecretId()
        - .ifVersionStage()
        - .ifResource()
        - .ifResourceTag()
        - .ifAwsResourceTag()
        - .ifSecretPrimaryRegion()

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_UpdateSecretVersionStage.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toUpdateSecretVersionStage", []))

    @jsii.member(jsii_name="toValidateResourcePolicy")
    def to_validate_resource_policy(self) -> "Secretsmanager":
        '''(experimental) Grants permission to validate a resource policy before attaching policy.

        Access Level: Permissions management

        Possible conditions:

        - .ifSecretId()
        - .ifResource()
        - .ifResourceTag()
        - .ifAwsResourceTag()
        - .ifSecretPrimaryRegion()

        https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_ValidateResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Secretsmanager", jsii.invoke(self, "toValidateResourcePolicy", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__561f5567c9fc35993dae2a4b841dab0f378d15d4683cf4038bdd6f9569104ac1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__24ed7db0edfca67b0bfd96fc518f69355c5c66e6ef563262db65d62559f0c292)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Securityhub(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Securityhub",
):
    '''(experimental) Statement provider for service `securityhub <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssecurityhub.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `securityhub <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssecurityhub.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d282eb7d5d5f833a3c847832520f471cf7950bbe01363eeba50eff9005b942d4)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifASFFSyntaxPath")
    def if_asff_syntax_path(
        self,
        a_sff_syntax_path: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Securityhub":
        '''(experimental) Filters access by the specified fields and values in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-asffsyntaxpath

        Applies to actions:

        - .toBatchUpdateFindings()

        :param a_sff_syntax_path: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f601b80df00d6ff10ad2192531e64c58e778a4b4ce7f63c8d33edd17bbdfbedf)
            check_type(argname="argument a_sff_syntax_path", value=a_sff_syntax_path, expected_type=type_hints["a_sff_syntax_path"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Securityhub", jsii.invoke(self, "ifASFFSyntaxPath", [a_sff_syntax_path, value, operator]))

    @jsii.member(jsii_name="ifTargetAccount")
    def if_target_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Securityhub":
        '''(experimental) Filters access by the AwsAccountId field that is specified in the request.

        https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-access.html#conditions

        Applies to actions:

        - .toBatchImportFindings()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d8c19d9740bc6046812aa3af15837c56e864a66b0d782e7cc20423b3ae25b935)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Securityhub", jsii.invoke(self, "ifTargetAccount", [value, operator]))

    @jsii.member(jsii_name="onFindingAggregator")
    def on_finding_aggregator(
        self,
        finding_aggregator_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Securityhub":
        '''(experimental) Adds a resource of type finding-aggregator to the statement.

        https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-access.html#resources

        :param finding_aggregator_id: - Identifier for the findingAggregatorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__59561e857ee43db03cc3ddc3c12b96fadf2e5ea71f817ea411bc8ce2965340d5)
            check_type(argname="argument finding_aggregator_id", value=finding_aggregator_id, expected_type=type_hints["finding_aggregator_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Securityhub", jsii.invoke(self, "onFindingAggregator", [finding_aggregator_id, account, region, partition]))

    @jsii.member(jsii_name="onHub")
    def on_hub(
        self,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Securityhub":
        '''(experimental) Adds a resource of type hub to the statement.

        https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-access.html#resources

        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0097544895391113be59f1ab22393350dfede16a5d5100fea77e3b61dcbc80be)
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Securityhub", jsii.invoke(self, "onHub", [account, region, partition]))

    @jsii.member(jsii_name="onProduct")
    def on_product(
        self,
        company: builtins.str,
        product_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Securityhub":
        '''(experimental) Adds a resource of type product to the statement.

        https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-access.html#resources

        :param company: - Identifier for the company.
        :param product_id: - Identifier for the productId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__219ff1e692b48fae32eda615147e24ec9eba22038a28cab8df696245d0d3ea17)
            check_type(argname="argument company", value=company, expected_type=type_hints["company"])
            check_type(argname="argument product_id", value=product_id, expected_type=type_hints["product_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Securityhub", jsii.invoke(self, "onProduct", [company, product_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptAdministratorInvitation")
    def to_accept_administrator_invitation(self) -> "Securityhub":
        '''(experimental) Grants permission to accept Security Hub invitations to become a member account.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AcceptAdministratorInvitation.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toAcceptAdministratorInvitation", []))

    @jsii.member(jsii_name="toAcceptInvitation")
    def to_accept_invitation(self) -> "Securityhub":
        '''(experimental) Grants permission to accept Security Hub invitations to become a member account.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AcceptInvitation.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toAcceptInvitation", []))

    @jsii.member(jsii_name="toBatchDisableStandards")
    def to_batch_disable_standards(self) -> "Securityhub":
        '''(experimental) Grants permission to disable standards in Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchDisableStandards.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toBatchDisableStandards", []))

    @jsii.member(jsii_name="toBatchEnableStandards")
    def to_batch_enable_standards(self) -> "Securityhub":
        '''(experimental) Grants permission to enable standards in Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchEnableStandards.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toBatchEnableStandards", []))

    @jsii.member(jsii_name="toBatchGetSecurityControls")
    def to_batch_get_security_controls(self) -> "Securityhub":
        '''(experimental) Grants permission to get details about specific security controls identified by ID or ARN.

        Access Level: Read

        Dependent actions:

        - securityhub:DescribeStandardsControls

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchGetSecurityControls.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toBatchGetSecurityControls", []))

    @jsii.member(jsii_name="toBatchGetStandardsControlAssociations")
    def to_batch_get_standards_control_associations(self) -> "Securityhub":
        '''(experimental) Grants permission to get the enablement status of a batch of security controls in standards.

        Access Level: Read

        Dependent actions:

        - securityhub:DescribeStandardsControls

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchGetStandardsControlAssociations.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toBatchGetStandardsControlAssociations", []))

    @jsii.member(jsii_name="toBatchImportFindings")
    def to_batch_import_findings(self) -> "Securityhub":
        '''(experimental) Grants permission to import findings into Security Hub from an integrated product.

        Access Level: Write

        Possible conditions:

        - .ifTargetAccount()

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchImportFindings.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toBatchImportFindings", []))

    @jsii.member(jsii_name="toBatchUpdateFindings")
    def to_batch_update_findings(self) -> "Securityhub":
        '''(experimental) Grants permission to update customer-controlled fields for a selected set of Security Hub findings.

        Access Level: Write

        Possible conditions:

        - .ifASFFSyntaxPath()

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchUpdateFindings.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toBatchUpdateFindings", []))

    @jsii.member(jsii_name="toBatchUpdateStandardsControlAssociations")
    def to_batch_update_standards_control_associations(self) -> "Securityhub":
        '''(experimental) Grants permission to update the enablement status of a batch of security controls in standards.

        Access Level: Write

        Dependent actions:

        - securityhub:UpdateStandardsControl

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchUpdateStandardsControlAssociations.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toBatchUpdateStandardsControlAssociations", []))

    @jsii.member(jsii_name="toCreateActionTarget")
    def to_create_action_target(self) -> "Securityhub":
        '''(experimental) Grants permission to create custom actions in Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_CreateActionTarget.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toCreateActionTarget", []))

    @jsii.member(jsii_name="toCreateFindingAggregator")
    def to_create_finding_aggregator(self) -> "Securityhub":
        '''(experimental) Grants permission to create a finding aggregator, which contains the cross-Region finding aggregation configuration.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateFindingAggregator.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toCreateFindingAggregator", []))

    @jsii.member(jsii_name="toCreateInsight")
    def to_create_insight(self) -> "Securityhub":
        '''(experimental) Grants permission to create insights in Security Hub. Insights are collections of related findings.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_CreateInsight.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toCreateInsight", []))

    @jsii.member(jsii_name="toCreateMembers")
    def to_create_members(self) -> "Securityhub":
        '''(experimental) Grants permission to create member accounts in Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_CreateMembers.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toCreateMembers", []))

    @jsii.member(jsii_name="toDeclineInvitations")
    def to_decline_invitations(self) -> "Securityhub":
        '''(experimental) Grants permission to decline Security Hub invitations to become a member account.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DeclineInvitations.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDeclineInvitations", []))

    @jsii.member(jsii_name="toDeleteActionTarget")
    def to_delete_action_target(self) -> "Securityhub":
        '''(experimental) Grants permission to delete custom actions in Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DeleteActionTarget.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDeleteActionTarget", []))

    @jsii.member(jsii_name="toDeleteFindingAggregator")
    def to_delete_finding_aggregator(self) -> "Securityhub":
        '''(experimental) Grants permission to delete a finding aggregator, which disables finding aggregation across Regions.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DeleteFindingAggregator.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDeleteFindingAggregator", []))

    @jsii.member(jsii_name="toDeleteInsight")
    def to_delete_insight(self) -> "Securityhub":
        '''(experimental) Grants permission to delete insights from Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DeleteInsight.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDeleteInsight", []))

    @jsii.member(jsii_name="toDeleteInvitations")
    def to_delete_invitations(self) -> "Securityhub":
        '''(experimental) Grants permission to delete Security Hub invitations to become a member account.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DeleteInvitations.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDeleteInvitations", []))

    @jsii.member(jsii_name="toDeleteMembers")
    def to_delete_members(self) -> "Securityhub":
        '''(experimental) Grants permission to delete Security Hub member accounts.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DeleteMembers.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDeleteMembers", []))

    @jsii.member(jsii_name="toDescribeActionTargets")
    def to_describe_action_targets(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve a list of custom actions using the API.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DescribeActionTargets.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDescribeActionTargets", []))

    @jsii.member(jsii_name="toDescribeHub")
    def to_describe_hub(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve information about the hub resource in your account.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DescribeHub.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDescribeHub", []))

    @jsii.member(jsii_name="toDescribeOrganizationConfiguration")
    def to_describe_organization_configuration(self) -> "Securityhub":
        '''(experimental) Grants permission to describe the organization configuration for Security Hub.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DescribeOrganizationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDescribeOrganizationConfiguration", []))

    @jsii.member(jsii_name="toDescribeProducts")
    def to_describe_products(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve information about the available Security Hub product integrations.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DescribeProducts.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDescribeProducts", []))

    @jsii.member(jsii_name="toDescribeStandards")
    def to_describe_standards(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve information about Security Hub standards.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DescribeStandards.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDescribeStandards", []))

    @jsii.member(jsii_name="toDescribeStandardsControls")
    def to_describe_standards_controls(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve information about Security Hub standards controls.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DescribeStandardsControls.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDescribeStandardsControls", []))

    @jsii.member(jsii_name="toDisableImportFindingsForProduct")
    def to_disable_import_findings_for_product(self) -> "Securityhub":
        '''(experimental) Grants permission to disable the findings importing for a Security Hub integrated product.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DisableImportFindingsForProduct.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDisableImportFindingsForProduct", []))

    @jsii.member(jsii_name="toDisableOrganizationAdminAccount")
    def to_disable_organization_admin_account(self) -> "Securityhub":
        '''(experimental) Grants permission to remove the Security Hub administrator account for your organization.

        Access Level: Write

        Dependent actions:

        - organizations:DescribeOrganization

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DisableOrganizationAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDisableOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toDisableSecurityHub")
    def to_disable_security_hub(self) -> "Securityhub":
        '''(experimental) Grants permission to disable Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DisableSecurityHub.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDisableSecurityHub", []))

    @jsii.member(jsii_name="toDisassociateFromAdministratorAccount")
    def to_disassociate_from_administrator_account(self) -> "Securityhub":
        '''(experimental) Grants permission to a Security Hub member account to disassociate from the associated administrator account.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DisassociateFromAdministratorAccount.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDisassociateFromAdministratorAccount", []))

    @jsii.member(jsii_name="toDisassociateFromMasterAccount")
    def to_disassociate_from_master_account(self) -> "Securityhub":
        '''(experimental) Grants permission to a Security Hub member account to disassociate from the associated master account.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DisassociateFromMasterAccount.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDisassociateFromMasterAccount", []))

    @jsii.member(jsii_name="toDisassociateMembers")
    def to_disassociate_members(self) -> "Securityhub":
        '''(experimental) Grants permission to disassociate Security Hub member accounts from the associated administrator account.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DisassociateMembers.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toDisassociateMembers", []))

    @jsii.member(jsii_name="toEnableImportFindingsForProduct")
    def to_enable_import_findings_for_product(self) -> "Securityhub":
        '''(experimental) Grants permission to enable the findings importing for a Security Hub integrated product.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_EnableImportFindingsForProduct.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toEnableImportFindingsForProduct", []))

    @jsii.member(jsii_name="toEnableOrganizationAdminAccount")
    def to_enable_organization_admin_account(self) -> "Securityhub":
        '''(experimental) Grants permission to designate a Security Hub administrator account for your organization.

        Access Level: Write

        Dependent actions:

        - organizations:DescribeOrganization
        - organizations:EnableAWSServiceAccess
        - organizations:RegisterDelegatedAdministrator

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_EnableOrganizationAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toEnableOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toEnableSecurityHub")
    def to_enable_security_hub(self) -> "Securityhub":
        '''(experimental) Grants permission to enable Security Hub.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_EnableSecurityHub.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toEnableSecurityHub", []))

    @jsii.member(jsii_name="toGetAdhocInsightResults")
    def to_get_adhoc_insight_results(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve insight results by providing a set of filters instead of an insight ARN.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetAdhocInsightResults.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetAdhocInsightResults", []))

    @jsii.member(jsii_name="toGetAdministratorAccount")
    def to_get_administrator_account(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve details about the Security Hub administrator account.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetAdministratorAccount.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetAdministratorAccount", []))

    @jsii.member(jsii_name="toGetControlFindingSummary")
    def to_get_control_finding_summary(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve a security score and counts of finding and control statuses for a security standard.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetControlFindingSummary.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetControlFindingSummary", []))

    @jsii.member(jsii_name="toGetEnabledStandards")
    def to_get_enabled_standards(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve a list of the standards that are enabled in Security Hub.

        Access Level: List

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetEnabledStandards.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetEnabledStandards", []))

    @jsii.member(jsii_name="toGetFindingAggregator")
    def to_get_finding_aggregator(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve details for a finding aggregator, which configures finding aggregation across Regions.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetFindingAggregator.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetFindingAggregator", []))

    @jsii.member(jsii_name="toGetFindings")
    def to_get_findings(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve a list of findings from Security Hub.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetFindings.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetFindings", []))

    @jsii.member(jsii_name="toGetFreeTrialEndDate")
    def to_get_free_trial_end_date(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve the end date for an account's free trial of Security Hub.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetFreeTrialEndDate.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetFreeTrialEndDate", []))

    @jsii.member(jsii_name="toGetFreeTrialUsage")
    def to_get_free_trial_usage(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve information about Security Hub usage during the free trial period.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetFreeTrialUsage.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetFreeTrialUsage", []))

    @jsii.member(jsii_name="toGetInsightFindingTrend")
    def to_get_insight_finding_trend(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve an insight finding trend from Security Hub in order to generate a graph.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetInsightFindingTrend.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetInsightFindingTrend", []))

    @jsii.member(jsii_name="toGetInsightResults")
    def to_get_insight_results(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve insight results from Security Hub.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetInsightResults.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetInsightResults", []))

    @jsii.member(jsii_name="toGetInsights")
    def to_get_insights(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve Security Hub insights.

        Access Level: List

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetInsights.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetInsights", []))

    @jsii.member(jsii_name="toGetInvitationsCount")
    def to_get_invitations_count(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve the count of Security Hub membership invitations sent to the account.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetInvitationsCount.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetInvitationsCount", []))

    @jsii.member(jsii_name="toGetMasterAccount")
    def to_get_master_account(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve details about the Security Hub master account.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetMasterAccount.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetMasterAccount", []))

    @jsii.member(jsii_name="toGetMembers")
    def to_get_members(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve the details of Security Hub member accounts.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetMembers.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetMembers", []))

    @jsii.member(jsii_name="toGetUsage")
    def to_get_usage(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve information about Security Hub usage by accounts.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetUsage.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toGetUsage", []))

    @jsii.member(jsii_name="toInviteMembers")
    def to_invite_members(self) -> "Securityhub":
        '''(experimental) Grants permission to invite other AWS accounts to become Security Hub member accounts.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_InviteMembers.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toInviteMembers", []))

    @jsii.member(jsii_name="toListControlEvaluationSummaries")
    def to_list_control_evaluation_summaries(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve a list of controls for a standard, including the control IDs, statuses and finding counts.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListControlEvaluationSummaries.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toListControlEvaluationSummaries", []))

    @jsii.member(jsii_name="toListEnabledProductsForImport")
    def to_list_enabled_products_for_import(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve the Security Hub integrated products that are currently enabled.

        Access Level: List

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListEnabledProductsForImport.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toListEnabledProductsForImport", []))

    @jsii.member(jsii_name="toListFindingAggregators")
    def to_list_finding_aggregators(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve a list of finding aggregators, which contain the cross-Region finding aggregation configuration.

        Access Level: List

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateFindingAggregator.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toListFindingAggregators", []))

    @jsii.member(jsii_name="toListInvitations")
    def to_list_invitations(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve the Security Hub invitations sent to the account.

        Access Level: List

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListInvitations.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toListInvitations", []))

    @jsii.member(jsii_name="toListMembers")
    def to_list_members(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve details about Security Hub member accounts associated with the administrator account.

        Access Level: List

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListMembers.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toListMembers", []))

    @jsii.member(jsii_name="toListOrganizationAdminAccounts")
    def to_list_organization_admin_accounts(self) -> "Securityhub":
        '''(experimental) Grants permission to list the Security Hub administrator accounts for your organization.

        Access Level: List

        Dependent actions:

        - organizations:DescribeOrganization

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListOrganizationAdminAccounts.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toListOrganizationAdminAccounts", []))

    @jsii.member(jsii_name="toListSecurityControlDefinitions")
    def to_list_security_control_definitions(self) -> "Securityhub":
        '''(experimental) Grants permission to retrieve a list of security control definitions, which contain details for security controls in the current region.

        Access Level: List

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListSecurityControlDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toListSecurityControlDefinitions", []))

    @jsii.member(jsii_name="toListStandardsControlAssociations")
    def to_list_standards_control_associations(self) -> "Securityhub":
        '''(experimental) Grants permission to list the enablement status of a security control in standards.

        Access Level: List

        Dependent actions:

        - securityhub:DescribeStandardsControls

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListStandardsControlAssociations.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toListStandardsControlAssociations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Securityhub":
        '''(experimental) Grants permission to list of tags associated with a resource.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toSendFindingEvents")
    def to_send_finding_events(self) -> "Securityhub":
        '''(experimental) Grants permission to use a custom action to send Security Hub findings to Amazon EventBridge.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_SendFindingEvents.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toSendFindingEvents", []))

    @jsii.member(jsii_name="toSendInsightEvents")
    def to_send_insight_events(self) -> "Securityhub":
        '''(experimental) Grants permission to use a custom action to send Security Hub insights to Amazon EventBridge.

        Access Level: Read

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_SendInsightEvents.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toSendInsightEvents", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Securityhub":
        '''(experimental) Grants permission to add tags to a Security Hub resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Securityhub":
        '''(experimental) Grants permission to remove tags from a Security Hub resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateActionTarget")
    def to_update_action_target(self) -> "Securityhub":
        '''(experimental) Grants permission to update custom actions in Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateActionTarget.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toUpdateActionTarget", []))

    @jsii.member(jsii_name="toUpdateFindingAggregator")
    def to_update_finding_aggregator(self) -> "Securityhub":
        '''(experimental) Grants permission to update a finding aggregator, which contains the cross-Region finding aggregation configuration.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateFindingAggregator.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toUpdateFindingAggregator", []))

    @jsii.member(jsii_name="toUpdateFindings")
    def to_update_findings(self) -> "Securityhub":
        '''(experimental) Grants permission to update Security Hub findings.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateFindings.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toUpdateFindings", []))

    @jsii.member(jsii_name="toUpdateInsight")
    def to_update_insight(self) -> "Securityhub":
        '''(experimental) Grants permission to update insights in Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateInsight.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toUpdateInsight", []))

    @jsii.member(jsii_name="toUpdateOrganizationConfiguration")
    def to_update_organization_configuration(self) -> "Securityhub":
        '''(experimental) Grants permission to update the organization configuration for Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateOrganizationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toUpdateOrganizationConfiguration", []))

    @jsii.member(jsii_name="toUpdateSecurityHubConfiguration")
    def to_update_security_hub_configuration(self) -> "Securityhub":
        '''(experimental) Grants permission to update Security Hub configuration.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateSecurityHubConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toUpdateSecurityHubConfiguration", []))

    @jsii.member(jsii_name="toUpdateStandardsControl")
    def to_update_standards_control(self) -> "Securityhub":
        '''(experimental) Grants permission to update Security Hub standards controls.

        Access Level: Write

        https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateStandardsControl.html

        :stability: experimental
        '''
        return typing.cast("Securityhub", jsii.invoke(self, "toUpdateStandardsControl", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__065c6fde105a5cc26656d516fefeafdb50611d79dab03f9ccb669efc3ec7d1e8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__78805481c0fc1807a6f54b8d433cba5942c70895e7bd03e4cb2c1f3adb649024)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Securitylake(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Securitylake",
):
    '''(experimental) Statement provider for service `securitylake <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsecuritylake.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `securitylake <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsecuritylake.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2765ee2a63346742e067ce4f042051473dd135523be5c62247a9c530face779f)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toCreateAwsLogSource")
    def to_create_aws_log_source(self) -> "Securitylake":
        '''(experimental) Grants permission to enable any source type in any region for accounts that are either part of a trusted organization or standalone accounts.

        Access Level: Write

        Dependent actions:

        - glue:CreateDatabase
        - glue:CreateTable
        - glue:GetDatabase
        - glue:GetTable
        - iam:CreateServiceLinkedRole
        - kms:CreateGrant
        - kms:DescribeKey

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_CreateAwsLogSource.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toCreateAwsLogSource", []))

    @jsii.member(jsii_name="toCreateCustomLogSource")
    def to_create_custom_log_source(self) -> "Securitylake":
        '''(experimental) Grants permission to add a custom source name.

        Access Level: Write

        Dependent actions:

        - glue:CreateCrawler
        - glue:CreateDatabase
        - glue:CreateTable
        - glue:StartCrawlerSchedule
        - iam:DeleteRolePolicy
        - iam:GetRole
        - iam:PassRole
        - iam:PutRolePolicy
        - kms:CreateGrant
        - kms:DescribeKey
        - kms:GenerateDataKey
        - lakeformation:GrantPermissions
        - lakeformation:RegisterResource
        - s3:ListBucket
        - s3:PutObject

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_CreateCustomLogSource.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toCreateCustomLogSource", []))

    @jsii.member(jsii_name="toCreateDatalake")
    def to_create_datalake(self) -> "Securitylake":
        '''(experimental) Grants permission to create a new Security Data Lake.

        Access Level: Write

        Dependent actions:

        - events:PutRule
        - events:PutTargets
        - iam:CreateServiceLinkedRole
        - iam:DeleteRolePolicy
        - iam:GetRole
        - iam:PassRole
        - iam:PutRolePolicy
        - kms:CreateGrant
        - kms:DescribeKey
        - lakeformation:GetDataLakeSettings
        - lakeformation:PutDataLakeSettings
        - lambda:CreateEventSourceMapping
        - lambda:CreateFunction
        - organizations:DescribeOrganization
        - organizations:ListDelegatedServicesForAccount
        - s3:CreateBucket
        - s3:ListBucket
        - s3:PutBucketPolicy
        - s3:PutBucketPublicAccessBlock
        - s3:PutBucketVersioning
        - sqs:CreateQueue
        - sqs:GetQueueAttributes
        - sqs:SetQueueAttributes

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_CreateDatalake.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toCreateDatalake", []))

    @jsii.member(jsii_name="toCreateDatalakeAutoEnable")
    def to_create_datalake_auto_enable(self) -> "Securitylake":
        '''(experimental) Grants permission to add to the configuration for automatically enabling Amazon Security Lake access for new organization accounts.

        Access Level: Write

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_CreateDatalakeAutoEnable.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toCreateDatalakeAutoEnable", []))

    @jsii.member(jsii_name="toCreateDatalakeDelegatedAdmin")
    def to_create_datalake_delegated_admin(self) -> "Securitylake":
        '''(experimental) Grants permission to designate the Amazon Security Lake administrator account for the organization.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - organizations:DescribeOrganization
        - organizations:EnableAWSServiceAccess
        - organizations:ListDelegatedAdministrators
        - organizations:ListDelegatedServicesForAccount
        - organizations:RegisterDelegatedAdministrator

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_CreateDatalakeDelegatedAdmin.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toCreateDatalakeDelegatedAdmin", []))

    @jsii.member(jsii_name="toCreateDatalakeExceptionsSubscription")
    def to_create_datalake_exceptions_subscription(self) -> "Securitylake":
        '''(experimental) Grants permission to get instant notifications about exceptions by subscribing to the SNS topics for exception notifications.

        Access Level: Write

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_CreateDatalakeExceptionsSubscription.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toCreateDatalakeExceptionsSubscription", []))

    @jsii.member(jsii_name="toCreateSubscriber")
    def to_create_subscriber(self) -> "Securitylake":
        '''(experimental) Grants permission to create a subscription permission for accounts that are already enabled.

        Access Level: Write

        Dependent actions:

        - iam:CreateRole
        - iam:DeleteRolePolicy
        - iam:GetRole
        - iam:PutRolePolicy
        - lakeformation:GrantPermissions
        - lakeformation:ListPermissions
        - lakeformation:RegisterResource
        - lakeformation:RevokePermissions
        - ram:GetResourceShareAssociations
        - ram:GetResourceShares
        - ram:UpdateResourceShare
        - s3:PutObject

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_CreateSubscriber.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toCreateSubscriber", []))

    @jsii.member(jsii_name="toCreateSubscriptionNotificationConfiguration")
    def to_create_subscription_notification_configuration(self) -> "Securitylake":
        '''(experimental) Grants permission to create a webhook invocation to notify a client when there is new data in the Data Lake.

        Access Level: Write

        Dependent actions:

        - events:CreateApiDestination
        - events:CreateConnection
        - events:DescribeRule
        - events:ListApiDestinations
        - events:ListConnections
        - events:PutRule
        - events:PutTargets
        - iam:DeleteRolePolicy
        - iam:GetRole
        - iam:PassRole
        - s3:GetBucketNotification
        - s3:PutBucketNotification
        - sqs:CreateQueue
        - sqs:DeleteQueue
        - sqs:GetQueueAttributes
        - sqs:GetQueueUrl
        - sqs:SetQueueAttributes

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_CreateSubscriptionNotificationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toCreateSubscriptionNotificationConfiguration", []))

    @jsii.member(jsii_name="toDeleteAwsLogSource")
    def to_delete_aws_log_source(self) -> "Securitylake":
        '''(experimental) Grants permission to disable any source type in any region for accounts that are either part of a trusted organization or standalone accounts.

        Access Level: Write

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_DeleteAwsLogSource.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toDeleteAwsLogSource", []))

    @jsii.member(jsii_name="toDeleteCustomLogSource")
    def to_delete_custom_log_source(self) -> "Securitylake":
        '''(experimental) Grants permission to remove a custom source name.

        Access Level: Write

        Dependent actions:

        - glue:StopCrawlerSchedule

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_DeleteCustomLogSource.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toDeleteCustomLogSource", []))

    @jsii.member(jsii_name="toDeleteDatalake")
    def to_delete_datalake(self) -> "Securitylake":
        '''(experimental) Grants permission to delete all Security Data Lakes.

        Access Level: Write

        Dependent actions:

        - organizations:DescribeOrganization
        - organizations:ListDelegatedAdministrators
        - organizations:ListDelegatedServicesForAccount

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_DeleteDatalake.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toDeleteDatalake", []))

    @jsii.member(jsii_name="toDeleteDatalakeAutoEnable")
    def to_delete_datalake_auto_enable(self) -> "Securitylake":
        '''(experimental) Grants permission to remove from the existing configuration the automatic enabling of Amazon Security Lake access for new organization accounts.

        Access Level: Write

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_DeleteDatalakeAutoEnable.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toDeleteDatalakeAutoEnable", []))

    @jsii.member(jsii_name="toDeleteDatalakeDelegatedAdmin")
    def to_delete_datalake_delegated_admin(self) -> "Securitylake":
        '''(experimental) Grants permission to remove the Delegated Administrator account and disable Amazon Security Lake as a service for this organization.

        Access Level: Write

        Dependent actions:

        - organizations:DeregisterDelegatedAdministrator
        - organizations:DescribeOrganization
        - organizations:ListDelegatedServicesForAccount

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_DeleteDatalakeDelegatedAdmin.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toDeleteDatalakeDelegatedAdmin", []))

    @jsii.member(jsii_name="toDeleteDatalakeExceptionsSubscription")
    def to_delete_datalake_exceptions_subscription(self) -> "Securitylake":
        '''(experimental) Grants permission to unsubscribe from SNS topics for exception notifications. Also, removes the SNS exception notifications topic.

        Access Level: Write

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_DeleteDatalakeExceptionsSubscription.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toDeleteDatalakeExceptionsSubscription", []))

    @jsii.member(jsii_name="toDeleteSubscriber")
    def to_delete_subscriber(self) -> "Securitylake":
        '''(experimental) Grants permission to delete the specified subscription permissions for accounts that are already enabled.

        Access Level: Write

        Dependent actions:

        - events:DeleteApiDestination
        - events:DeleteConnection
        - events:DeleteRule
        - events:DescribeRule
        - events:ListApiDestinations
        - events:ListTargetsByRule
        - events:RemoveTargets
        - iam:DeleteRole
        - iam:DeleteRolePolicy
        - iam:GetRole
        - iam:ListRolePolicies
        - lakeformation:ListPermissions
        - lakeformation:RevokePermissions
        - sqs:DeleteQueue
        - sqs:GetQueueUrl

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_DeleteSubscriber.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toDeleteSubscriber", []))

    @jsii.member(jsii_name="toDeleteSubscriptionNotificationConfiguration")
    def to_delete_subscription_notification_configuration(self) -> "Securitylake":
        '''(experimental) Grants permission to remove a webhook invocation to notify a client when there is new data in the Data Lake.

        Access Level: Write

        Dependent actions:

        - events:DeleteApiDestination
        - events:DeleteConnection
        - events:DeleteRule
        - events:DescribeRule
        - events:ListApiDestinations
        - events:ListTargetsByRule
        - events:RemoveTargets
        - iam:DeleteRole
        - iam:DeleteRolePolicy
        - iam:GetRole
        - iam:ListRolePolicies
        - lakeformation:RevokePermissions
        - sqs:DeleteQueue
        - sqs:GetQueueUrl

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_DeleteSubscriptionNotificationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toDeleteSubscriptionNotificationConfiguration", []))

    @jsii.member(jsii_name="toGetDatalake")
    def to_get_datalake(self) -> "Securitylake":
        '''(experimental) Grants permission to get information on the Security Data Lake.

        Access Level: Read

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_GetDatalake.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toGetDatalake", []))

    @jsii.member(jsii_name="toGetDatalakeAutoEnable")
    def to_get_datalake_auto_enable(self) -> "Securitylake":
        '''(experimental) Grants permission to get an organization’s configuration setting for the automatic enabling of Amazon Security Lake access for new organization accounts.

        Access Level: Read

        Dependent actions:

        - organizations:DescribeOrganization

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_GetDatalakeAutoEnable.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toGetDatalakeAutoEnable", []))

    @jsii.member(jsii_name="toGetDatalakeExceptionsExpiry")
    def to_get_datalake_exceptions_expiry(self) -> "Securitylake":
        '''(experimental) Grants permission to allow user to query what was set as the expiration period for the exception message.

        Access Level: Read

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_GetDatalakeExceptionsExpiry.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toGetDatalakeExceptionsExpiry", []))

    @jsii.member(jsii_name="toGetDatalakeExceptionsSubscription")
    def to_get_datalake_exceptions_subscription(self) -> "Securitylake":
        '''(experimental) Grants permission to query the protocol and endpoint that were supplied when subscribing to the SNS topics for exception notifications.

        Access Level: Read

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_GetDatalakeExceptionsSubscription.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toGetDatalakeExceptionsSubscription", []))

    @jsii.member(jsii_name="toGetDatalakeStatus")
    def to_get_datalake_status(self) -> "Securitylake":
        '''(experimental) Grants permission to get a static snapshot of the Security Data Lake in the current region, including enabled accounts and log sources.

        Access Level: Read

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_GetDatalakeStatus.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toGetDatalakeStatus", []))

    @jsii.member(jsii_name="toGetSubscriber")
    def to_get_subscriber(self) -> "Securitylake":
        '''(experimental) Grants permission to get subscription information for a subscription permission for accounts that are already enabled.

        Access Level: Read

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_GetSubscriber.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toGetSubscriber", []))

    @jsii.member(jsii_name="toGetSubscriptionNotificationConfiguration")
    def to_get_subscription_notification_configuration(self) -> "Securitylake":
        '''(experimental) Grants permission to get information for a webhook invocation to notify a client when there is new data in the Data Lake.

        Access Level: Read

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_GetSubscriptionNotificationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toGetSubscriptionNotificationConfiguration", []))

    @jsii.member(jsii_name="toListDatalakeExceptions")
    def to_list_datalake_exceptions(self) -> "Securitylake":
        '''(experimental) Grants permission to get the list of all non-retry-able failures.

        Access Level: List

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_ListDatalakeExceptions.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toListDatalakeExceptions", []))

    @jsii.member(jsii_name="toListLogSources")
    def to_list_log_sources(self) -> "Securitylake":
        '''(experimental) Grants permission to show the estate view of enabled accounts with the enabled sources in the enabled regions.

        Access Level: List

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_ListLogSources.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toListLogSources", []))

    @jsii.member(jsii_name="toListSubscribers")
    def to_list_subscribers(self) -> "Securitylake":
        '''(experimental) Grants permission to list all subscription permissions for accounts that are already enabled.

        Access Level: List

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_ListSubscribers.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toListSubscribers", []))

    @jsii.member(jsii_name="toUpdateDatalake")
    def to_update_datalake(self) -> "Securitylake":
        '''(experimental) Grants permission to update a Security Data Lake.

        Access Level: Write

        Dependent actions:

        - events:PutRule
        - events:PutTargets
        - iam:CreateServiceLinkedRole
        - iam:DeleteRolePolicy
        - iam:GetRole
        - iam:PutRolePolicy
        - kms:CreateGrant
        - kms:DescribeKey
        - lakeformation:GetDataLakeSettings
        - lakeformation:PutDataLakeSettings
        - lambda:CreateEventSourceMapping
        - lambda:CreateFunction
        - organizations:DescribeOrganization
        - organizations:ListDelegatedServicesForAccount
        - s3:CreateBucket
        - s3:ListBucket
        - s3:PutBucketPolicy
        - s3:PutBucketPublicAccessBlock
        - s3:PutBucketVersioning
        - sqs:CreateQueue
        - sqs:GetQueueAttributes
        - sqs:SetQueueAttributes

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_UpdateDatalake.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toUpdateDatalake", []))

    @jsii.member(jsii_name="toUpdateDatalakeExceptionsExpiry")
    def to_update_datalake_exceptions_expiry(self) -> "Securitylake":
        '''(experimental) Grants permission to control the time-to-live (TTL) for the exception message to remain in service cache.

        Access Level: Write

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_UpdateDatalakeExceptionsExpiry.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toUpdateDatalakeExceptionsExpiry", []))

    @jsii.member(jsii_name="toUpdateDatalakeExceptionsSubscription")
    def to_update_datalake_exceptions_subscription(self) -> "Securitylake":
        '''(experimental) Grants permission to update subscriptions to the SNS topics for exception notifications.

        Access Level: Write

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_UpdateDatalakeExceptionsSubscription.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toUpdateDatalakeExceptionsSubscription", []))

    @jsii.member(jsii_name="toUpdateSubscriber")
    def to_update_subscriber(self) -> "Securitylake":
        '''(experimental) Grants permission to update subscription information for a subscription permission for accounts that are already enabled.

        Access Level: Write

        Dependent actions:

        - events:CreateApiDestination
        - events:CreateConnection
        - events:DescribeRule
        - events:ListApiDestinations
        - events:ListConnections
        - events:PutRule
        - events:PutTargets
        - iam:DeleteRolePolicy
        - iam:GetRole
        - iam:PutRolePolicy

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_UpdateSubscriber.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toUpdateSubscriber", []))

    @jsii.member(jsii_name="toUpdateSubscriptionNotificationConfiguration")
    def to_update_subscription_notification_configuration(self) -> "Securitylake":
        '''(experimental) Grants permission to update a webhook invocation to notify a client when there is new data in the Data Lake.

        Access Level: Write

        Dependent actions:

        - events:CreateApiDestination
        - events:CreateConnection
        - events:DescribeRule
        - events:ListApiDestinations
        - events:ListConnections
        - events:PutRule
        - events:PutTargets
        - iam:CreateServiceLinkedRole
        - iam:DeleteRolePolicy
        - iam:GetRole
        - iam:PassRole
        - iam:PutRolePolicy
        - s3:CreateBucket
        - s3:GetBucketNotification
        - s3:ListBucket
        - s3:PutBucketNotification
        - s3:PutBucketPolicy
        - s3:PutBucketPublicAccessBlock
        - s3:PutBucketVersioning
        - s3:PutLifecycleConfiguration
        - sqs:CreateQueue
        - sqs:DeleteQueue
        - sqs:GetQueueAttributes
        - sqs:GetQueueUrl
        - sqs:SetQueueAttributes

        https://docs.aws.amazon.com/security-lake/latest/APIReference/API_UpdateSubscriptionNotificationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Securitylake", jsii.invoke(self, "toUpdateSubscriptionNotificationConfiguration", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c6382b21583add71c9f12c48f81666da10825f0315812fd8d803044fa0624162)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__24b4ff0200a7d39918983dd565edd022eb872fbe1777bfb8dd95d955e067bfda)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Serverlessrepo(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Serverlessrepo",
):
    '''(experimental) Statement provider for service `serverlessrepo <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsserverlessapplicationrepository.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `serverlessrepo <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsserverlessapplicationrepository.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1d1da0eb9512ba7950976de8b2661f12f08ee885b41f1c30edd7134420aa552a)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifApplicationType")
    def if_application_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Serverlessrepo":
        '''(experimental) Filters access by application type.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/applications.html

        Applies to actions:

        - .toCreateCloudFormationChangeSet()
        - .toCreateCloudFormationTemplate()
        - .toGetApplication()
        - .toListApplicationDependencies()
        - .toListApplicationVersions()
        - .toSearchApplications()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d88dc0962ec9b8bc8e720fc9582d392022e5e96820beb986e7bbb65dd9caf0e6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Serverlessrepo", jsii.invoke(self, "ifApplicationType", [value, operator]))

    @jsii.member(jsii_name="onApplications")
    def on_applications(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Serverlessrepo":
        '''(experimental) Adds a resource of type applications to the statement.

        https://docs.aws.amazon.com/serverlessrepo/latest/devguide/applications.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__98aee4a12946db0cc506479815d250aec935e13e3154b1e6e2d24f3e7bde5f62)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Serverlessrepo", jsii.invoke(self, "onApplications", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "Serverlessrepo":
        '''(experimental) Grants permission to create an application, optionally including an AWS SAM file to create the first application version in the same call.

        Access Level: Write

        https://docs.aws.amazon.com/serverlessrepo/latest/devguide/applications.html

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toCreateApplicationVersion")
    def to_create_application_version(self) -> "Serverlessrepo":
        '''(experimental) Grants permission to create an application version.

        Access Level: Write

        https://docs.aws.amazon.com/serverlessrepo/latest/devguide/applications-applicationid-versions-semanticversion.html

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toCreateApplicationVersion", []))

    @jsii.member(jsii_name="toCreateCloudFormationChangeSet")
    def to_create_cloud_formation_change_set(self) -> "Serverlessrepo":
        '''(experimental) Grants permission to create an AWS CloudFormation ChangeSet for the given application.

        Access Level: Write

        Possible conditions:

        - .ifApplicationType()

        https://docs.aws.amazon.com/serverlessrepo/latest/devguide/applications-applicationid-changesets.html

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toCreateCloudFormationChangeSet", []))

    @jsii.member(jsii_name="toCreateCloudFormationTemplate")
    def to_create_cloud_formation_template(self) -> "Serverlessrepo":
        '''(experimental) Grants permission to create an AWS CloudFormation template.

        Access Level: Write

        Possible conditions:

        - .ifApplicationType()

        https://docs.aws.amazon.com/serverlessrepo/latest/devguide/applications-applicationid-templates.html

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toCreateCloudFormationTemplate", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "Serverlessrepo":
        '''(experimental) Grants permission to delete the specified application.

        Access Level: Write

        https://docs.aws.amazon.com/serverlessrepo/latest/devguide/applications-applicationid.html

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toGetApplication")
    def to_get_application(self) -> "Serverlessrepo":
        '''(experimental) Grants permission to get the specified application.

        Access Level: Read

        Possible conditions:

        - .ifApplicationType()

        https://docs.aws.amazon.com/serverlessrepo/latest/devguide/applications-applicationid.html

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toGetApplication", []))

    @jsii.member(jsii_name="toGetApplicationPolicy")
    def to_get_application_policy(self) -> "Serverlessrepo":
        '''(experimental) Grants permission to get the policy for the specified application.

        Access Level: Read

        https://docs.aws.amazon.com/serverlessrepo/latest/devguide/applications-applicationid-policy.html

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toGetApplicationPolicy", []))

    @jsii.member(jsii_name="toGetCloudFormationTemplate")
    def to_get_cloud_formation_template(self) -> "Serverlessrepo":
        '''(experimental) Grants permission to get the specified AWS CloudFormation template.

        Access Level: Read

        https://docs.aws.amazon.com/serverlessrepo/latest/devguide/applications-applicationid-templates-templateid.html

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toGetCloudFormationTemplate", []))

    @jsii.member(jsii_name="toListApplicationDependencies")
    def to_list_application_dependencies(self) -> "Serverlessrepo":
        '''(experimental) Grants permission to retrieve the list of applications nested in the containing application.

        Access Level: List

        Possible conditions:

        - .ifApplicationType()

        https://docs.aws.amazon.com/serverlessrepo/latest/devguide/applications-applicationid-dependencies.html

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toListApplicationDependencies", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "Serverlessrepo":
        '''(experimental) Grants permission to list applications owned by the requester.

        Access Level: List

        https://docs.aws.amazon.com/serverlessrepo/latest/devguide/applications.html

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListApplicationVersions")
    def to_list_application_versions(self) -> "Serverlessrepo":
        '''(experimental) Grants permission to list versions for the specified application owned by the requester.

        Access Level: List

        Possible conditions:

        - .ifApplicationType()

        https://docs.aws.amazon.com/serverlessrepo/latest/devguide/applications-applicationid-versions.html

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toListApplicationVersions", []))

    @jsii.member(jsii_name="toPutApplicationPolicy")
    def to_put_application_policy(self) -> "Serverlessrepo":
        '''(experimental) Grants permission to put the policy for the specified application.

        Access Level: Write

        https://docs.aws.amazon.com/serverlessrepo/latest/devguide/applications-applicationid-policy.html

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toPutApplicationPolicy", []))

    @jsii.member(jsii_name="toSearchApplications")
    def to_search_applications(self) -> "Serverlessrepo":
        '''(experimental) Grants permission to get all applications authorized for this user.

        Access Level: Read

        Possible conditions:

        - .ifApplicationType()

        https://docs.aws.amazon.com/serverlessrepo/latest/devguide/applications-applicationid.html

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toSearchApplications", []))

    @jsii.member(jsii_name="toUnshareApplication")
    def to_unshare_application(self) -> "Serverlessrepo":
        '''(experimental) Grants permission to unshare the specified application.

        Access Level: Write

        https://docs.aws.amazon.com/serverlessrepo/latest/devguide/applications-applicationid.html

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toUnshareApplication", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "Serverlessrepo":
        '''(experimental) Grants permission to update meta-data of the application.

        Access Level: Write

        https://docs.aws.amazon.com/serverlessrepo/latest/devguide/applications-applicationid.html

        :stability: experimental
        '''
        return typing.cast("Serverlessrepo", jsii.invoke(self, "toUpdateApplication", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__214346c3466f8b883d9d87a248a49a7463ace1a5982ef5b3986430a524578916)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__83d3407d51b29a7a1543bf6d0c6bc9dd8f2ae038602289ebc3143fcc758cecd7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Servicecatalog(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Servicecatalog",
):
    '''(experimental) Statement provider for service `servicecatalog <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsservicecatalog.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `servicecatalog <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsservicecatalog.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7a5e96a94c6a32b7b0c39b7e3ebe740bbbbd68252bb6719190f25539a1570fc3)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAccountLevel")
    def if_account_level(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Servicecatalog":
        '''(experimental) Filters access by user to see and perform actions on resources created by anyone in the account.

        https://docs.aws.amazon.com/servicecatalog/latest/adminguide/permissions-examples.html

        Applies to actions:

        - .toCreateProvisionedProductPlan()
        - .toDeleteProvisionedProductPlan()
        - .toDescribeProvisionedProduct()
        - .toDescribeProvisionedProductPlan()
        - .toDescribeRecord()
        - .toDescribeServiceActionExecutionParameters()
        - .toExecuteProvisionedProductPlan()
        - .toExecuteProvisionedProductServiceAction()
        - .toListProvisionedProductPlans()
        - .toListRecordHistory()
        - .toListServiceActionsForProvisioningArtifact()
        - .toListStackInstancesForProvisionedProduct()
        - .toScanProvisionedProducts()
        - .toSearchProvisionedProducts()
        - .toTerminateProvisionedProduct()
        - .toUpdateProvisionedProduct()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dba344aee5408f59fafb3905d774c3f02bc6d747e4d4d0aa4e32cab428d01b77)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Servicecatalog", jsii.invoke(self, "ifAccountLevel", [value, operator]))

    @jsii.member(jsii_name="ifResource")
    def if_resource(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Servicecatalog":
        '''(experimental) Filters access by controlling what value can be specified as the Resource parameter in an AppRegistry associate resource API.

        https://docs.aws.amazon.com/servicecatalog/latest/adminguide/permissions-examples.html

        Applies to actions:

        - .toAssociateResource()
        - .toDisassociateResource()
        - .toGetAssociatedResource()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__56bc8246d4d66c4a0a738222a6a09222090fa6f1542637c6956a66d2d763110f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Servicecatalog", jsii.invoke(self, "ifResource", [value, operator]))

    @jsii.member(jsii_name="ifResourceType")
    def if_resource_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Servicecatalog":
        '''(experimental) Filters access by controlling what value can be specified as the ResourceType parameter in an AppRegistry associate resource API.

        https://docs.aws.amazon.com/servicecatalog/latest/adminguide/permissions-examples.html

        Applies to actions:

        - .toAssociateResource()
        - .toDisassociateResource()
        - .toGetAssociatedResource()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__86744fc574cb8902d17c35efe7dd7ef3f53099df1412c884dbf33cd6ea9960f0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Servicecatalog", jsii.invoke(self, "ifResourceType", [value, operator]))

    @jsii.member(jsii_name="ifRoleLevel")
    def if_role_level(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Servicecatalog":
        '''(experimental) Filters access by user to see and perform actions on resources created either by them or by anyone federating into the same role as them.

        https://docs.aws.amazon.com/servicecatalog/latest/adminguide/permissions-examples.html

        Applies to actions:

        - .toCreateProvisionedProductPlan()
        - .toDeleteProvisionedProductPlan()
        - .toDescribeProvisionedProduct()
        - .toDescribeProvisionedProductPlan()
        - .toDescribeRecord()
        - .toDescribeServiceActionExecutionParameters()
        - .toExecuteProvisionedProductPlan()
        - .toExecuteProvisionedProductServiceAction()
        - .toListProvisionedProductPlans()
        - .toListRecordHistory()
        - .toListServiceActionsForProvisioningArtifact()
        - .toListStackInstancesForProvisionedProduct()
        - .toScanProvisionedProducts()
        - .toSearchProvisionedProducts()
        - .toTerminateProvisionedProduct()
        - .toUpdateProvisionedProduct()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5d889a778659fe4df315b48c96a4c54f58219ac77628aba7dad0a1618ba4cfe5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Servicecatalog", jsii.invoke(self, "ifRoleLevel", [value, operator]))

    @jsii.member(jsii_name="ifUserLevel")
    def if_user_level(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Servicecatalog":
        '''(experimental) Filters access by user to see and perform actions on only resources that they created.

        https://docs.aws.amazon.com/servicecatalog/latest/adminguide/permissions-examples.html

        Applies to actions:

        - .toCreateProvisionedProductPlan()
        - .toDeleteProvisionedProductPlan()
        - .toDescribeProvisionedProduct()
        - .toDescribeProvisionedProductPlan()
        - .toDescribeRecord()
        - .toDescribeServiceActionExecutionParameters()
        - .toExecuteProvisionedProductPlan()
        - .toExecuteProvisionedProductServiceAction()
        - .toListProvisionedProductPlans()
        - .toListRecordHistory()
        - .toListServiceActionsForProvisioningArtifact()
        - .toListStackInstancesForProvisionedProduct()
        - .toScanProvisionedProducts()
        - .toSearchProvisionedProducts()
        - .toTerminateProvisionedProduct()
        - .toUpdateProvisionedProduct()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2688565885b095e90903e8023bf1b8f161bf6fca2530f18c53d3e51b37c8bb0f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Servicecatalog", jsii.invoke(self, "ifUserLevel", [value, operator]))

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        application_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Servicecatalog":
        '''(experimental) Adds a resource of type Application to the statement.

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_CreateApplication.html

        :param application_id: - Identifier for the applicationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1cb3282a1afaa9055e0e4c949bbe9fa9bb23e97db6ce48bf3e1820612699b018)
            check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Servicecatalog", jsii.invoke(self, "onApplication", [application_id, account, region, partition]))

    @jsii.member(jsii_name="onAttributeGroup")
    def on_attribute_group(
        self,
        attribute_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Servicecatalog":
        '''(experimental) Adds a resource of type AttributeGroup to the statement.

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_CreateAttributeGroup.html

        :param attribute_group_id: - Identifier for the attributeGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cf1a8939f88adbbe6d9ee42884f77f8f82cc6a01219d2561937e24e60aac4b7e)
            check_type(argname="argument attribute_group_id", value=attribute_group_id, expected_type=type_hints["attribute_group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Servicecatalog", jsii.invoke(self, "onAttributeGroup", [attribute_group_id, account, region, partition]))

    @jsii.member(jsii_name="onPortfolio")
    def on_portfolio(
        self,
        portfolio_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Servicecatalog":
        '''(experimental) Adds a resource of type Portfolio to the statement.

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_PortfolioDetail.html

        :param portfolio_id: - Identifier for the portfolioId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1ef43de883bfc1c1925a33523f80805ccbd08675311652004e1dca371a84dc24)
            check_type(argname="argument portfolio_id", value=portfolio_id, expected_type=type_hints["portfolio_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Servicecatalog", jsii.invoke(self, "onPortfolio", [portfolio_id, account, region, partition]))

    @jsii.member(jsii_name="onProduct")
    def on_product(
        self,
        product_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Servicecatalog":
        '''(experimental) Adds a resource of type Product to the statement.

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ProductViewDetail.html

        :param product_id: - Identifier for the productId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bb569c8d418d95489d24e6c0d4f6b852c895f115a9cfd0e3cb9c6d77679d9c4b)
            check_type(argname="argument product_id", value=product_id, expected_type=type_hints["product_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Servicecatalog", jsii.invoke(self, "onProduct", [product_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptPortfolioShare")
    def to_accept_portfolio_share(self) -> "Servicecatalog":
        '''(experimental) Grants permission to accept a portfolio that has been shared with you.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_AcceptPortfolioShare.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toAcceptPortfolioShare", []))

    @jsii.member(jsii_name="toAssociateAttributeGroup")
    def to_associate_attribute_group(self) -> "Servicecatalog":
        '''(experimental) Grants permission to associate an attribute group with an application.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_AssociateAttributeGroup.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toAssociateAttributeGroup", []))

    @jsii.member(jsii_name="toAssociateBudgetWithResource")
    def to_associate_budget_with_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to associate a budget with a resource.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_AssociateBudgetWithResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toAssociateBudgetWithResource", []))

    @jsii.member(jsii_name="toAssociatePrincipalWithPortfolio")
    def to_associate_principal_with_portfolio(self) -> "Servicecatalog":
        '''(experimental) Grants permission to associate an IAM principal with a portfolio, giving the specified principal access to any products associated with the specified portfolio.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_AssociatePrincipalWithPortfolio.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toAssociatePrincipalWithPortfolio", []))

    @jsii.member(jsii_name="toAssociateProductWithPortfolio")
    def to_associate_product_with_portfolio(self) -> "Servicecatalog":
        '''(experimental) Grants permission to associate a product with a portfolio.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_AssociateProductWithPortfolio.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toAssociateProductWithPortfolio", []))

    @jsii.member(jsii_name="toAssociateResource")
    def to_associate_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to associate a resource with an application.

        Access Level: Write

        Possible conditions:

        - .ifResourceType()
        - .ifResource()

        Dependent actions:

        - cloudformation:DescribeStacks
        - resource-groups:CreateGroup
        - resource-groups:GetGroup
        - resource-groups:Tag

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_AssociateResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toAssociateResource", []))

    @jsii.member(jsii_name="toAssociateServiceActionWithProvisioningArtifact")
    def to_associate_service_action_with_provisioning_artifact(
        self,
    ) -> "Servicecatalog":
        '''(experimental) Grants permission to associate an action with a provisioning artifact.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_AssociateServiceActionWithProvisioningArtifact.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toAssociateServiceActionWithProvisioningArtifact", []))

    @jsii.member(jsii_name="toAssociateTagOptionWithResource")
    def to_associate_tag_option_with_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to associate the specified TagOption with the specified portfolio or product.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_AssociateTagOptionWithResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toAssociateTagOptionWithResource", []))

    @jsii.member(jsii_name="toBatchAssociateServiceActionWithProvisioningArtifact")
    def to_batch_associate_service_action_with_provisioning_artifact(
        self,
    ) -> "Servicecatalog":
        '''(experimental) Grants permission to associate multiple self-service actions with provisioning artifacts.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_BatchAssociateServiceActionWithProvisioningArtifact.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toBatchAssociateServiceActionWithProvisioningArtifact", []))

    @jsii.member(jsii_name="toBatchDisassociateServiceActionFromProvisioningArtifact")
    def to_batch_disassociate_service_action_from_provisioning_artifact(
        self,
    ) -> "Servicecatalog":
        '''(experimental) Grants permission to disassociate a batch of self-service actions from the specified provisioning artifact.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_BatchDisassociateServiceActionFromProvisioningArtifact.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toBatchDisassociateServiceActionFromProvisioningArtifact", []))

    @jsii.member(jsii_name="toCopyProduct")
    def to_copy_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to copy the specified source product to the specified target product or a new product.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_CopyProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCopyProduct", []))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "Servicecatalog":
        '''(experimental) Grants permission to create an application.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toCreateAttributeGroup")
    def to_create_attribute_group(self) -> "Servicecatalog":
        '''(experimental) Grants permission to create an attribute group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_CreateAttributeGroup.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCreateAttributeGroup", []))

    @jsii.member(jsii_name="toCreateConstraint")
    def to_create_constraint(self) -> "Servicecatalog":
        '''(experimental) Grants permission to create a constraint on an associated product and portfolio.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_CreateConstraint.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCreateConstraint", []))

    @jsii.member(jsii_name="toCreatePortfolio")
    def to_create_portfolio(self) -> "Servicecatalog":
        '''(experimental) Grants permission to create a portfolio.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_CreatePortfolio.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCreatePortfolio", []))

    @jsii.member(jsii_name="toCreatePortfolioShare")
    def to_create_portfolio_share(self) -> "Servicecatalog":
        '''(experimental) Grants permission to share a portfolio you own with another AWS account.

        Access Level: Permissions management

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_CreatePortfolioShare.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCreatePortfolioShare", []))

    @jsii.member(jsii_name="toCreateProduct")
    def to_create_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to create a product and that product's first provisioning artifact.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_CreateProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCreateProduct", []))

    @jsii.member(jsii_name="toCreateProvisionedProductPlan")
    def to_create_provisioned_product_plan(self) -> "Servicecatalog":
        '''(experimental) Grants permission to add a new provisioned product plan.

        Access Level: Write

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_CreateProvisionedProductPlan.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCreateProvisionedProductPlan", []))

    @jsii.member(jsii_name="toCreateProvisioningArtifact")
    def to_create_provisioning_artifact(self) -> "Servicecatalog":
        '''(experimental) Grants permission to add a new provisioning artifact to an existing product.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_CreateProvisioningArtifact.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCreateProvisioningArtifact", []))

    @jsii.member(jsii_name="toCreateServiceAction")
    def to_create_service_action(self) -> "Servicecatalog":
        '''(experimental) Grants permission to create a self-service action.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_CreateServiceAction.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCreateServiceAction", []))

    @jsii.member(jsii_name="toCreateTagOption")
    def to_create_tag_option(self) -> "Servicecatalog":
        '''(experimental) Grants permission to create a TagOption.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_CreateTagOption.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toCreateTagOption", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "Servicecatalog":
        '''(experimental) Grants permission to delete an application if all associations have been removed from the application.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toDeleteAttributeGroup")
    def to_delete_attribute_group(self) -> "Servicecatalog":
        '''(experimental) Grants permission to delete an attribute group if all associations have been removed from the attribute group.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_DeleteAttributeGroup.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDeleteAttributeGroup", []))

    @jsii.member(jsii_name="toDeleteConstraint")
    def to_delete_constraint(self) -> "Servicecatalog":
        '''(experimental) Grants permission to remove and delete an existing constraint from an associated product and portfolio.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DeleteConstraint.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDeleteConstraint", []))

    @jsii.member(jsii_name="toDeletePortfolio")
    def to_delete_portfolio(self) -> "Servicecatalog":
        '''(experimental) Grants permission to delete a portfolio if all associations and shares have been removed from the portfolio.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DeletePortfolio.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDeletePortfolio", []))

    @jsii.member(jsii_name="toDeletePortfolioShare")
    def to_delete_portfolio_share(self) -> "Servicecatalog":
        '''(experimental) Grants permission to unshare a portfolio you own from an AWS account you previously shared the portfolio with.

        Access Level: Permissions management

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DeletePortfolioShare.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDeletePortfolioShare", []))

    @jsii.member(jsii_name="toDeleteProduct")
    def to_delete_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to delete a product if all associations have been removed from the product.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DeleteProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDeleteProduct", []))

    @jsii.member(jsii_name="toDeleteProvisionedProductPlan")
    def to_delete_provisioned_product_plan(self) -> "Servicecatalog":
        '''(experimental) Grants permission to delete a provisioned product plan.

        Access Level: Write

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DeleteProvisionedProductPlan.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDeleteProvisionedProductPlan", []))

    @jsii.member(jsii_name="toDeleteProvisioningArtifact")
    def to_delete_provisioning_artifact(self) -> "Servicecatalog":
        '''(experimental) Grants permission to delete a provisioning artifact from a product.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DeleteProvisioningArtifact.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDeleteProvisioningArtifact", []))

    @jsii.member(jsii_name="toDeleteServiceAction")
    def to_delete_service_action(self) -> "Servicecatalog":
        '''(experimental) Grants permission to delete a self-service action.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DeleteServiceAction.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDeleteServiceAction", []))

    @jsii.member(jsii_name="toDeleteTagOption")
    def to_delete_tag_option(self) -> "Servicecatalog":
        '''(experimental) Grants permission to delete the specified TagOption.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DeleteTagOption.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDeleteTagOption", []))

    @jsii.member(jsii_name="toDescribeConstraint")
    def to_describe_constraint(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe a constraint.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeConstraint.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeConstraint", []))

    @jsii.member(jsii_name="toDescribeCopyProductStatus")
    def to_describe_copy_product_status(self) -> "Servicecatalog":
        '''(experimental) Grants permission to get the status of the specified copy product operation.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeCopyProductStatus.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeCopyProductStatus", []))

    @jsii.member(jsii_name="toDescribePortfolio")
    def to_describe_portfolio(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe a portfolio.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribePortfolio.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribePortfolio", []))

    @jsii.member(jsii_name="toDescribePortfolioShares")
    def to_describe_portfolio_shares(self) -> "Servicecatalog":
        '''(experimental) Grants permission to view a summary of each of the portfolio shares that were created for the specified portfolio.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribePortfolioShares.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribePortfolioShares", []))

    @jsii.member(jsii_name="toDescribePortfolioShareStatus")
    def to_describe_portfolio_share_status(self) -> "Servicecatalog":
        '''(experimental) Grants permission to get the status of the specified portfolio share operation.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribePortfolioShareStatus.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribePortfolioShareStatus", []))

    @jsii.member(jsii_name="toDescribeProduct")
    def to_describe_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe a product as an end-user.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeProduct", []))

    @jsii.member(jsii_name="toDescribeProductAsAdmin")
    def to_describe_product_as_admin(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe a product as an admin.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeProductAsAdmin.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeProductAsAdmin", []))

    @jsii.member(jsii_name="toDescribeProductView")
    def to_describe_product_view(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe a product as an end-user.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeProductView.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeProductView", []))

    @jsii.member(jsii_name="toDescribeProvisionedProduct")
    def to_describe_provisioned_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe a provisioned product.

        Access Level: Read

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeProvisionedProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeProvisionedProduct", []))

    @jsii.member(jsii_name="toDescribeProvisionedProductPlan")
    def to_describe_provisioned_product_plan(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe a provisioned product plan.

        Access Level: Read

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeProvisionedProductPlan.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeProvisionedProductPlan", []))

    @jsii.member(jsii_name="toDescribeProvisioningArtifact")
    def to_describe_provisioning_artifact(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe a provisioning artifact.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeProvisioningArtifact.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeProvisioningArtifact", []))

    @jsii.member(jsii_name="toDescribeProvisioningParameters")
    def to_describe_provisioning_parameters(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe the parameters that you need to specify to successfully provision a specified provisioning artifact.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeProvisioningParameters.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeProvisioningParameters", []))

    @jsii.member(jsii_name="toDescribeRecord")
    def to_describe_record(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe a record and lists any outputs.

        Access Level: Read

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeRecord.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeRecord", []))

    @jsii.member(jsii_name="toDescribeServiceAction")
    def to_describe_service_action(self) -> "Servicecatalog":
        '''(experimental) Grants permission to describe a self-service action.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeServiceAction.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeServiceAction", []))

    @jsii.member(jsii_name="toDescribeServiceActionExecutionParameters")
    def to_describe_service_action_execution_parameters(self) -> "Servicecatalog":
        '''(experimental) Grants permission to get the default parameters if you executed the specified Service Action on the specified Provisioned Product.

        Access Level: Read

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeServiceActionExecutionParameters.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeServiceActionExecutionParameters", []))

    @jsii.member(jsii_name="toDescribeTagOption")
    def to_describe_tag_option(self) -> "Servicecatalog":
        '''(experimental) Grants permission to get information about the specified TagOption.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DescribeTagOption.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDescribeTagOption", []))

    @jsii.member(jsii_name="toDisableAWSOrganizationsAccess")
    def to_disable_aws_organizations_access(self) -> "Servicecatalog":
        '''(experimental) Grants permission to disable portfolio sharing through AWS Organizations feature.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DisableAWSOrganizationsAccess.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDisableAWSOrganizationsAccess", []))

    @jsii.member(jsii_name="toDisassociateAttributeGroup")
    def to_disassociate_attribute_group(self) -> "Servicecatalog":
        '''(experimental) Grants permission to disassociate an attribute group from an application.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_DisassociateAttributeGroup.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDisassociateAttributeGroup", []))

    @jsii.member(jsii_name="toDisassociateBudgetFromResource")
    def to_disassociate_budget_from_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to disassociate a budget from a resource.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DisassociateBudgetFromResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDisassociateBudgetFromResource", []))

    @jsii.member(jsii_name="toDisassociatePrincipalFromPortfolio")
    def to_disassociate_principal_from_portfolio(self) -> "Servicecatalog":
        '''(experimental) Grants permission to disassociate an IAM principal from a portfolio.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DisassociatePrincipalFromPortfolio.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDisassociatePrincipalFromPortfolio", []))

    @jsii.member(jsii_name="toDisassociateProductFromPortfolio")
    def to_disassociate_product_from_portfolio(self) -> "Servicecatalog":
        '''(experimental) Grants permission to disassociate a product from a portfolio.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DisassociateProductFromPortfolio.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDisassociateProductFromPortfolio", []))

    @jsii.member(jsii_name="toDisassociateResource")
    def to_disassociate_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to disassociate a resource from an application.

        Access Level: Write

        Possible conditions:

        - .ifResourceType()
        - .ifResource()

        Dependent actions:

        - resource-groups:DeleteGroup

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_DisassociateResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDisassociateResource", []))

    @jsii.member(jsii_name="toDisassociateServiceActionFromProvisioningArtifact")
    def to_disassociate_service_action_from_provisioning_artifact(
        self,
    ) -> "Servicecatalog":
        '''(experimental) Grants permission to disassociate the specified self-service action association from the specified provisioning artifact.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DisassociateServiceActionFromProvisioningArtifact.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDisassociateServiceActionFromProvisioningArtifact", []))

    @jsii.member(jsii_name="toDisassociateTagOptionFromResource")
    def to_disassociate_tag_option_from_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to disassociate the specified TagOption from the specified resource.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_DisassociateTagOptionFromResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toDisassociateTagOptionFromResource", []))

    @jsii.member(jsii_name="toEnableAWSOrganizationsAccess")
    def to_enable_aws_organizations_access(self) -> "Servicecatalog":
        '''(experimental) Grants permission to enable portfolio sharing feature through AWS Organizations.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_EnableAWSOrganizationsAccess.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toEnableAWSOrganizationsAccess", []))

    @jsii.member(jsii_name="toExecuteProvisionedProductPlan")
    def to_execute_provisioned_product_plan(self) -> "Servicecatalog":
        '''(experimental) Grants permission to execute a provisioned product plan.

        Access Level: Write

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ExecuteProvisionedProductPlan.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toExecuteProvisionedProductPlan", []))

    @jsii.member(jsii_name="toExecuteProvisionedProductServiceAction")
    def to_execute_provisioned_product_service_action(self) -> "Servicecatalog":
        '''(experimental) Grants permission to executes a provisioned product plan.

        Access Level: Write

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ExecuteProvisionedProductServiceAction.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toExecuteProvisionedProductServiceAction", []))

    @jsii.member(jsii_name="toGetApplication")
    def to_get_application(self) -> "Servicecatalog":
        '''(experimental) Grants permission to get an application.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_GetApplication.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toGetApplication", []))

    @jsii.member(jsii_name="toGetAssociatedResource")
    def to_get_associated_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to get information about a resource associated to an application.

        Access Level: Read

        Possible conditions:

        - .ifResourceType()
        - .ifResource()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_GetAssociatedResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toGetAssociatedResource", []))

    @jsii.member(jsii_name="toGetAttributeGroup")
    def to_get_attribute_group(self) -> "Servicecatalog":
        '''(experimental) Grants permission to get an attribute group.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_GetAttributeGroup.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toGetAttributeGroup", []))

    @jsii.member(jsii_name="toGetAWSOrganizationsAccessStatus")
    def to_get_aws_organizations_access_status(self) -> "Servicecatalog":
        '''(experimental) Grants permission to get the access status of AWS Organization portfolio share feature.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_GetAWSOrganizationsAccessStatus.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toGetAWSOrganizationsAccessStatus", []))

    @jsii.member(jsii_name="toGetConfiguration")
    def to_get_configuration(self) -> "Servicecatalog":
        '''(experimental) Grants permission to read AppRegistry configurations.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_GetConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toGetConfiguration", []))

    @jsii.member(jsii_name="toGetProvisionedProductOutputs")
    def to_get_provisioned_product_outputs(self) -> "Servicecatalog":
        '''(experimental) Grants permission to get the provisioned product output with either provisioned product id or name.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_GetProvisionedProductOutputs.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toGetProvisionedProductOutputs", []))

    @jsii.member(jsii_name="toImportAsProvisionedProduct")
    def to_import_as_provisioned_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to import a resource into a provisioned product.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ImportAsProvisionedProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toImportAsProvisionedProduct", []))

    @jsii.member(jsii_name="toListAcceptedPortfolioShares")
    def to_list_accepted_portfolio_shares(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the portfolios that have been shared with you and you have accepted.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListAcceptedPortfolioShares.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListAcceptedPortfolioShares", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list your applications.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_ListApplications.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListAssociatedAttributeGroups")
    def to_list_associated_attribute_groups(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the attribute groups associated with an application.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_ListAssociatedAttributeGroups.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListAssociatedAttributeGroups", []))

    @jsii.member(jsii_name="toListAssociatedResources")
    def to_list_associated_resources(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the resources associated with an application.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_ListAssociatedResources.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListAssociatedResources", []))

    @jsii.member(jsii_name="toListAttributeGroups")
    def to_list_attribute_groups(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list your attribute groups.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_ListAttributeGroups.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListAttributeGroups", []))

    @jsii.member(jsii_name="toListAttributeGroupsForApplication")
    def to_list_attribute_groups_for_application(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the associated attribute groups for a given application.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_ListAttributeGroupsForApplication.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListAttributeGroupsForApplication", []))

    @jsii.member(jsii_name="toListBudgetsForResource")
    def to_list_budgets_for_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list all the budgets associated to a resource.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListBudgetsForResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListBudgetsForResource", []))

    @jsii.member(jsii_name="toListConstraintsForPortfolio")
    def to_list_constraints_for_portfolio(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list constraints associated with a given portfolio.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListConstraintsForPortfolio.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListConstraintsForPortfolio", []))

    @jsii.member(jsii_name="toListLaunchPaths")
    def to_list_launch_paths(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the different ways to launch a given product as an end-user.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListLaunchPaths.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListLaunchPaths", []))

    @jsii.member(jsii_name="toListOrganizationPortfolioAccess")
    def to_list_organization_portfolio_access(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the organization nodes that have access to the specified portfolio.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListOrganizationPortfolioAccess.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListOrganizationPortfolioAccess", []))

    @jsii.member(jsii_name="toListPortfolioAccess")
    def to_list_portfolio_access(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the AWS accounts you have shared a given portfolio with.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListPortfolioAccess.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListPortfolioAccess", []))

    @jsii.member(jsii_name="toListPortfolios")
    def to_list_portfolios(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the portfolios in your account.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListPortfolios.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListPortfolios", []))

    @jsii.member(jsii_name="toListPortfoliosForProduct")
    def to_list_portfolios_for_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the portfolios associated with a given product.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListPortfoliosForProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListPortfoliosForProduct", []))

    @jsii.member(jsii_name="toListPrincipalsForPortfolio")
    def to_list_principals_for_portfolio(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the IAM principals associated with a given portfolio.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListPrincipalsForPortfolio.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListPrincipalsForPortfolio", []))

    @jsii.member(jsii_name="toListProvisionedProductPlans")
    def to_list_provisioned_product_plans(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the provisioned product plans.

        Access Level: List

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListProvisionedProductPlans.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListProvisionedProductPlans", []))

    @jsii.member(jsii_name="toListProvisioningArtifacts")
    def to_list_provisioning_artifacts(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the provisioning artifacts associated with a given product.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListProvisioningArtifacts.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListProvisioningArtifacts", []))

    @jsii.member(jsii_name="toListProvisioningArtifactsForServiceAction")
    def to_list_provisioning_artifacts_for_service_action(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list all provisioning artifacts for the specified self-service action.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListProvisioningArtifactsForServiceAction.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListProvisioningArtifactsForServiceAction", []))

    @jsii.member(jsii_name="toListRecordHistory")
    def to_list_record_history(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list all the records in your account or all the records related to a given provisioned product.

        Access Level: List

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListRecordHistory.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListRecordHistory", []))

    @jsii.member(jsii_name="toListResourcesForTagOption")
    def to_list_resources_for_tag_option(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the resources associated with the specified TagOption.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListResourcesForTagOption.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListResourcesForTagOption", []))

    @jsii.member(jsii_name="toListServiceActions")
    def to_list_service_actions(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list all self-service actions.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListServiceActions.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListServiceActions", []))

    @jsii.member(jsii_name="toListServiceActionsForProvisioningArtifact")
    def to_list_service_actions_for_provisioning_artifact(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list all the service actions associated with the specified provisioning artifact in your account.

        Access Level: List

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListServiceActionsForProvisioningArtifact.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListServiceActionsForProvisioningArtifact", []))

    @jsii.member(jsii_name="toListStackInstancesForProvisionedProduct")
    def to_list_stack_instances_for_provisioned_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list account, region and status of each stack instances that are associated with a CFN_STACKSET type provisioned product.

        Access Level: List

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListStackInstancesForProvisionedProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListStackInstancesForProvisionedProduct", []))

    @jsii.member(jsii_name="toListTagOptions")
    def to_list_tag_options(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the specified TagOptions or all TagOptions.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ListTagOptions.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListTagOptions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the tags for a service catalog appregistry resource.

        Access Level: Read

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toProvisionProduct")
    def to_provision_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to provision a product with a specified provisioning artifact and launch parameters.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ProvisionProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toProvisionProduct", []))

    @jsii.member(jsii_name="toPutConfiguration")
    def to_put_configuration(self) -> "Servicecatalog":
        '''(experimental) Grants permission to assign AppRegistry configurations.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_PutConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toPutConfiguration", []))

    @jsii.member(jsii_name="toRejectPortfolioShare")
    def to_reject_portfolio_share(self) -> "Servicecatalog":
        '''(experimental) Grants permission to reject a portfolio that has been shared with you that you previously accepted.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_RejectPortfolioShare.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toRejectPortfolioShare", []))

    @jsii.member(jsii_name="toScanProvisionedProducts")
    def to_scan_provisioned_products(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list all the provisioned products in your account.

        Access Level: List

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_ScanProvisionedProducts.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toScanProvisionedProducts", []))

    @jsii.member(jsii_name="toSearchProducts")
    def to_search_products(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list the products available to you as an end-user.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_SearchProducts.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toSearchProducts", []))

    @jsii.member(jsii_name="toSearchProductsAsAdmin")
    def to_search_products_as_admin(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list all the products in your account or all the products associated with a given portfolio.

        Access Level: List

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_SearchProductsAsAdmin.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toSearchProductsAsAdmin", []))

    @jsii.member(jsii_name="toSearchProvisionedProducts")
    def to_search_provisioned_products(self) -> "Servicecatalog":
        '''(experimental) Grants permission to list all the provisioned products in your account.

        Access Level: List

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_SearchProvisionedProducts.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toSearchProvisionedProducts", []))

    @jsii.member(jsii_name="toSyncResource")
    def to_sync_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to sync a resource with its current state in AppRegistry.

        Access Level: Write

        Dependent actions:

        - cloudformation:UpdateStack

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_SyncResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toSyncResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to tag a service catalog appregistry resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTerminateProvisionedProduct")
    def to_terminate_provisioned_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to terminate an existing provisioned product.

        Access Level: Write

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_TerminateProvisionedProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toTerminateProvisionedProduct", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Servicecatalog":
        '''(experimental) Grants permission to remove a tag from a service catalog appregistry resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "Servicecatalog":
        '''(experimental) Grants permission to update the attributes of an existing application.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdateApplication", []))

    @jsii.member(jsii_name="toUpdateAttributeGroup")
    def to_update_attribute_group(self) -> "Servicecatalog":
        '''(experimental) Grants permission to update the attributes of an existing attribute group.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_app-registry_UpdateAttributeGroup.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdateAttributeGroup", []))

    @jsii.member(jsii_name="toUpdateConstraint")
    def to_update_constraint(self) -> "Servicecatalog":
        '''(experimental) Grants permission to update the metadata fields of an existing constraint.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_UpdateConstraint.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdateConstraint", []))

    @jsii.member(jsii_name="toUpdatePortfolio")
    def to_update_portfolio(self) -> "Servicecatalog":
        '''(experimental) Grants permission to update the metadata fields and/or tags of an existing portfolio.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_UpdatePortfolio.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdatePortfolio", []))

    @jsii.member(jsii_name="toUpdatePortfolioShare")
    def to_update_portfolio_share(self) -> "Servicecatalog":
        '''(experimental) Grants permission to enable or disable resource sharing for an existing portfolio share.

        Access Level: Permissions management

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_UpdatePortfolioShare.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdatePortfolioShare", []))

    @jsii.member(jsii_name="toUpdateProduct")
    def to_update_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to update the metadata fields and/or tags of an existing product.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_UpdateProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdateProduct", []))

    @jsii.member(jsii_name="toUpdateProvisionedProduct")
    def to_update_provisioned_product(self) -> "Servicecatalog":
        '''(experimental) Grants permission to update an existing provisioned product.

        Access Level: Write

        Possible conditions:

        - .ifAccountLevel()
        - .ifRoleLevel()
        - .ifUserLevel()

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_UpdateProvisionedProduct.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdateProvisionedProduct", []))

    @jsii.member(jsii_name="toUpdateProvisionedProductProperties")
    def to_update_provisioned_product_properties(self) -> "Servicecatalog":
        '''(experimental) Grants permission to update the properties of an existing provisioned product.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_UpdateProvisionedProductProperties.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdateProvisionedProductProperties", []))

    @jsii.member(jsii_name="toUpdateProvisioningArtifact")
    def to_update_provisioning_artifact(self) -> "Servicecatalog":
        '''(experimental) Grants permission to update the metadata fields of an existing provisioning artifact.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_UpdateProvisioningArtifact.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdateProvisioningArtifact", []))

    @jsii.member(jsii_name="toUpdateServiceAction")
    def to_update_service_action(self) -> "Servicecatalog":
        '''(experimental) Grants permission to update a self-service action.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_UpdateServiceAction.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdateServiceAction", []))

    @jsii.member(jsii_name="toUpdateTagOption")
    def to_update_tag_option(self) -> "Servicecatalog":
        '''(experimental) Grants permission to update the specified TagOption.

        Access Level: Write

        https://docs.aws.amazon.com/servicecatalog/latest/dg/API_UpdateTagOption.html

        :stability: experimental
        '''
        return typing.cast("Servicecatalog", jsii.invoke(self, "toUpdateTagOption", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__76793c047df69b845ba625d61ab284f4050037279da49b10889e333bd20ba069)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__94b3817a35535d5911e0468ee94fc38d4b925eb5f31a131d4b3479a07a09e7e4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Servicediscovery(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Servicediscovery",
):
    '''(experimental) Statement provider for service `servicediscovery <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudmap.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `servicediscovery <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudmap.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__166ea47261e77afa84d5f8d15522762d2e83e67e0b117add923234dd9ee3a107)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifNamespaceArn")
    def if_namespace_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Servicediscovery":
        '''(experimental) Filters access by specifying the Amazon Resource Name (ARN) for the related namespace.

        https://docs.aws.amazon.com/cloud-map/latest/dg/access-control-overview.html#specifying-conditions

        Applies to actions:

        - .toCreateService()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9f9926fe0d419c4a9cecd73d14d98dedd71c01cbfcb354db2bef1e255542f2f0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Servicediscovery", jsii.invoke(self, "ifNamespaceArn", [value, operator]))

    @jsii.member(jsii_name="ifNamespaceName")
    def if_namespace_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Servicediscovery":
        '''(experimental) Filters access by specifying the name of the related namespace.

        https://docs.aws.amazon.com/cloud-map/latest/dg/access-control-overview.html#specifying-conditions

        Applies to actions:

        - .toDiscoverInstances()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7d56e1a6aa2c4cd4f386ffcb730c1180c03b2b2da854e7c35cf7f92d8f6bc41a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Servicediscovery", jsii.invoke(self, "ifNamespaceName", [value, operator]))

    @jsii.member(jsii_name="ifServiceArn")
    def if_service_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Servicediscovery":
        '''(experimental) Filters access by specifying the Amazon Resource Name (ARN) for the related service.

        https://docs.aws.amazon.com/cloud-map/latest/dg/access-control-overview.html#specifying-conditions

        Applies to actions:

        - .toDeregisterInstance()
        - .toGetInstance()
        - .toGetInstancesHealthStatus()
        - .toListInstances()
        - .toRegisterInstance()
        - .toUpdateInstanceCustomHealthStatus()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__30ff5b200e689437b8ad5a3c1433fb419139251ddf6f85ffff1bf4d457640c3c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Servicediscovery", jsii.invoke(self, "ifServiceArn", [value, operator]))

    @jsii.member(jsii_name="ifServiceName")
    def if_service_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Servicediscovery":
        '''(experimental) Filters access by specifying the name of the related service.

        https://docs.aws.amazon.com/cloud-map/latest/dg/access-control-overview.html#specifying-conditions

        Applies to actions:

        - .toDiscoverInstances()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f5ed3ca966534014f7e065297f5dc4f4ef81ae21dfbe79df651c5ae55b8b93a1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Servicediscovery", jsii.invoke(self, "ifServiceName", [value, operator]))

    @jsii.member(jsii_name="onNamespace")
    def on_namespace(
        self,
        namespace_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Servicediscovery":
        '''(experimental) Adds a resource of type namespace to the statement.

        https://docs.aws.amazon.com/cloud-map/latest/dg/API_Namespace.html

        :param namespace_id: - Identifier for the namespaceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__13b3ade9ac9e0dabe4e74805db6dc9a59aa60596d9010c2573e14f5a414111a6)
            check_type(argname="argument namespace_id", value=namespace_id, expected_type=type_hints["namespace_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Servicediscovery", jsii.invoke(self, "onNamespace", [namespace_id, account, region, partition]))

    @jsii.member(jsii_name="onService")
    def on_service(
        self,
        service_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Servicediscovery":
        '''(experimental) Adds a resource of type service to the statement.

        https://docs.aws.amazon.com/cloud-map/latest/dg/API_Service.html

        :param service_id: - Identifier for the serviceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f9e840f2bfc641b49daa51da4d07d84cbfa9550a127d9151dbb1073249f18dd2)
            check_type(argname="argument service_id", value=service_id, expected_type=type_hints["service_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Servicediscovery", jsii.invoke(self, "onService", [service_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateHttpNamespace")
    def to_create_http_namespace(self) -> "Servicediscovery":
        '''(experimental) Grants permission to create an HTTP namespace.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_CreateHttpNamespace.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toCreateHttpNamespace", []))

    @jsii.member(jsii_name="toCreatePrivateDnsNamespace")
    def to_create_private_dns_namespace(self) -> "Servicediscovery":
        '''(experimental) Grants permission to create a private namespace based on DNS, which will be visible only inside a specified Amazon VPC.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_CreatePrivateDnsNamespace.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toCreatePrivateDnsNamespace", []))

    @jsii.member(jsii_name="toCreatePublicDnsNamespace")
    def to_create_public_dns_namespace(self) -> "Servicediscovery":
        '''(experimental) Grants permission to create a public namespace based on DNS, which will be visible on the internet.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_CreatePublicDnsNamespace.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toCreatePublicDnsNamespace", []))

    @jsii.member(jsii_name="toCreateService")
    def to_create_service(self) -> "Servicediscovery":
        '''(experimental) Grants permission to create a service.

        Access Level: Write

        Possible conditions:

        - .ifNamespaceArn()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_CreateService.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toCreateService", []))

    @jsii.member(jsii_name="toDeleteNamespace")
    def to_delete_namespace(self) -> "Servicediscovery":
        '''(experimental) Grants permission to delete a specified namespace.

        Access Level: Write

        https://docs.aws.amazon.com/cloud-map/latest/api/API_DeleteNamespace.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toDeleteNamespace", []))

    @jsii.member(jsii_name="toDeleteService")
    def to_delete_service(self) -> "Servicediscovery":
        '''(experimental) Grants permission to delete a specified service.

        Access Level: Write

        https://docs.aws.amazon.com/cloud-map/latest/api/API_DeleteService.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toDeleteService", []))

    @jsii.member(jsii_name="toDeregisterInstance")
    def to_deregister_instance(self) -> "Servicediscovery":
        '''(experimental) Grants permission to delete the records and the health check, if any, that Amazon Route 53 created for the specified instance.

        Access Level: Write

        Possible conditions:

        - .ifServiceArn()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_DeregisterInstance.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toDeregisterInstance", []))

    @jsii.member(jsii_name="toDiscoverInstances")
    def to_discover_instances(self) -> "Servicediscovery":
        '''(experimental) Grants permission to discover registered instances for a specified namespace and service.

        Access Level: Read

        Possible conditions:

        - .ifNamespaceName()
        - .ifServiceName()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_DiscoverInstances.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toDiscoverInstances", []))

    @jsii.member(jsii_name="toGetInstance")
    def to_get_instance(self) -> "Servicediscovery":
        '''(experimental) Grants permission to get information about a specified instance.

        Access Level: Read

        Possible conditions:

        - .ifServiceArn()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_GetInstance.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toGetInstance", []))

    @jsii.member(jsii_name="toGetInstancesHealthStatus")
    def to_get_instances_health_status(self) -> "Servicediscovery":
        '''(experimental) Grants permission to get the current health status (Healthy, Unhealthy, or Unknown) of one or more instances.

        Access Level: Read

        Possible conditions:

        - .ifServiceArn()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_GetInstancesHealthStatus.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toGetInstancesHealthStatus", []))

    @jsii.member(jsii_name="toGetNamespace")
    def to_get_namespace(self) -> "Servicediscovery":
        '''(experimental) Grants permission to get information about a namespace.

        Access Level: Read

        https://docs.aws.amazon.com/cloud-map/latest/api/API_GetNamespace.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toGetNamespace", []))

    @jsii.member(jsii_name="toGetOperation")
    def to_get_operation(self) -> "Servicediscovery":
        '''(experimental) Grants permission to get information about a specific operation.

        Access Level: Read

        https://docs.aws.amazon.com/cloud-map/latest/api/API_GetOperation.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toGetOperation", []))

    @jsii.member(jsii_name="toGetService")
    def to_get_service(self) -> "Servicediscovery":
        '''(experimental) Grants permission to get the settings for a specified service.

        Access Level: Read

        https://docs.aws.amazon.com/cloud-map/latest/api/API_GetService.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toGetService", []))

    @jsii.member(jsii_name="toListInstances")
    def to_list_instances(self) -> "Servicediscovery":
        '''(experimental) Grants permission to get summary information about the instances that were registered with a specified service.

        Access Level: Read

        Possible conditions:

        - .ifServiceArn()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_ListInstances.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toListInstances", []))

    @jsii.member(jsii_name="toListNamespaces")
    def to_list_namespaces(self) -> "Servicediscovery":
        '''(experimental) Grants permission to get information about the namespaces.

        Access Level: Read

        https://docs.aws.amazon.com/cloud-map/latest/api/API_ListNamespaces.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toListNamespaces", []))

    @jsii.member(jsii_name="toListOperations")
    def to_list_operations(self) -> "Servicediscovery":
        '''(experimental) Grants permission to list operations that match the criteria that you specify.

        Access Level: List

        https://docs.aws.amazon.com/cloud-map/latest/api/API_ListOperations.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toListOperations", []))

    @jsii.member(jsii_name="toListServices")
    def to_list_services(self) -> "Servicediscovery":
        '''(experimental) Grants permission to get settings for all the services that match specified filters.

        Access Level: Read

        https://docs.aws.amazon.com/cloud-map/latest/api/API_ListServices.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toListServices", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Servicediscovery":
        '''(experimental) Grants permission to lists tags for the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/cloud-map/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRegisterInstance")
    def to_register_instance(self) -> "Servicediscovery":
        '''(experimental) Grants permission to register an instance based on the settings in a specified service.

        Access Level: Write

        Possible conditions:

        - .ifServiceArn()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_RegisterInstance.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toRegisterInstance", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Servicediscovery":
        '''(experimental) Grants permission to add one or more tags to the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Servicediscovery":
        '''(experimental) Grants permission to remove one or more tags from the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateHttpNamespace")
    def to_update_http_namespace(self) -> "Servicediscovery":
        '''(experimental) Grants permission to update the settings for a HTTP namespace.

        Access Level: Write

        https://docs.aws.amazon.com/cloud-map/latest/api/API_UpdateHttpNamespace.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toUpdateHttpNamespace", []))

    @jsii.member(jsii_name="toUpdateInstanceCustomHealthStatus")
    def to_update_instance_custom_health_status(self) -> "Servicediscovery":
        '''(experimental) Grants permission to update the current health status for an instance that has a custom health check.

        Access Level: Write

        Possible conditions:

        - .ifServiceArn()

        https://docs.aws.amazon.com/cloud-map/latest/api/API_UpdateInstanceCustomHealthStatus.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toUpdateInstanceCustomHealthStatus", []))

    @jsii.member(jsii_name="toUpdatePrivateDnsNamespace")
    def to_update_private_dns_namespace(self) -> "Servicediscovery":
        '''(experimental) Grants permission to update the settings for a private DNS namespace.

        Access Level: Write

        https://docs.aws.amazon.com/cloud-map/latest/api/API_UpdatePrivateDnsNamespace.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toUpdatePrivateDnsNamespace", []))

    @jsii.member(jsii_name="toUpdatePublicDnsNamespace")
    def to_update_public_dns_namespace(self) -> "Servicediscovery":
        '''(experimental) Grants permission to update the settings for a public DNS namespace.

        Access Level: Write

        https://docs.aws.amazon.com/cloud-map/latest/api/API_UpdatePublicDnsNamespace.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toUpdatePublicDnsNamespace", []))

    @jsii.member(jsii_name="toUpdateService")
    def to_update_service(self) -> "Servicediscovery":
        '''(experimental) Grants permission to update the settings in a specified service.

        Access Level: Write

        https://docs.aws.amazon.com/cloud-map/latest/api/API_UpdateService.html

        :stability: experimental
        '''
        return typing.cast("Servicediscovery", jsii.invoke(self, "toUpdateService", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__00836319ac4c750d7251bce510777d284e2215cb997cfc2bfb25c89ac0dd4666)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ecaf5d197d18a9692dbc2e2f54085404a64b5c4974758b838b78840eff3c78b2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Serviceextract(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Serviceextract",
):
    '''(experimental) Statement provider for service `serviceextract <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmicroserviceextractorfor.net.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `serviceextract <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmicroserviceextractorfor.net.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ff698471aa7b0376982f8175033e69c6cc232794994792a000af70a1715d2c19)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toGetConfig")
    def to_get_config(self) -> "Serviceextract":
        '''(experimental) Grants permission to get required configuration for the AWS Microservice Extractor for .NET desktop client.

        Access Level: Read

        https://docs.aws.amazon.com/microservice-extractor/latest/userguide/what-is-microservice-extractor.html

        :stability: experimental
        '''
        return typing.cast("Serviceextract", jsii.invoke(self, "toGetConfig", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fd3c383d3ed1cce76472de045e92a6ab3b9b3d2ddfb00f251c031e48d8ebcb0c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c61598712824cea10232405eec7a81589dbac6305889d86067f0d0e9dafacf82)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Servicequotas(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Servicequotas",
):
    '''(experimental) Statement provider for service `servicequotas <https://docs.aws.amazon.com/service-authorization/latest/reference/list_servicequotas.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `servicequotas <https://docs.aws.amazon.com/service-authorization/latest/reference/list_servicequotas.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__586f09737757a3e9c53cae39a42eb69af52bec990e1b12efbcaeb37b1100a021)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifService")
    def if_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Servicequotas":
        '''(experimental) Filters access by the specified AWS service.

        https://docs.aws.amazon.com/servicequotas/latest/userguide/identity-access-management.html#condition-keys

        Applies to actions:

        - .toPutServiceQuotaIncreaseRequestIntoTemplate()
        - .toRequestServiceQuotaIncrease()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3807e4ae7adddac04a7cf30edb08c28ffd4c3aca24d323a6bad00ee5eda630ae)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Servicequotas", jsii.invoke(self, "ifService", [value, operator]))

    @jsii.member(jsii_name="onQuota")
    def on_quota(
        self,
        service_code: builtins.str,
        quota_code: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Servicequotas":
        '''(experimental) Adds a resource of type quota to the statement.

        https://docs.aws.amazon.com/servicequotas/latest/userguide/identity-access-management.html#resources

        :param service_code: - Identifier for the serviceCode.
        :param quota_code: - Identifier for the quotaCode.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__24175140b43ee1244e94b72a3c153e89c7e24ba37dca605cc3c15a9940ef1b84)
            check_type(argname="argument service_code", value=service_code, expected_type=type_hints["service_code"])
            check_type(argname="argument quota_code", value=quota_code, expected_type=type_hints["quota_code"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Servicequotas", jsii.invoke(self, "onQuota", [service_code, quota_code, account, region, partition]))

    @jsii.member(jsii_name="toAssociateServiceQuotaTemplate")
    def to_associate_service_quota_template(self) -> "Servicequotas":
        '''(experimental) Grants permission to associate the Service Quotas template with your organization.

        Access Level: Write

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_AssociateServiceQuotaTemplate.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toAssociateServiceQuotaTemplate", []))

    @jsii.member(jsii_name="toDeleteServiceQuotaIncreaseRequestFromTemplate")
    def to_delete_service_quota_increase_request_from_template(self) -> "Servicequotas":
        '''(experimental) Grants permission to remove the specified service quota from the service quota template.

        Access Level: Write

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_DeleteServiceQuotaIncreaseRequestFromTemplate.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toDeleteServiceQuotaIncreaseRequestFromTemplate", []))

    @jsii.member(jsii_name="toDisassociateServiceQuotaTemplate")
    def to_disassociate_service_quota_template(self) -> "Servicequotas":
        '''(experimental) Grants permission to disassociate the Service Quotas template from your organization.

        Access Level: Write

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_DisassociateServiceQuotaTemplate.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toDisassociateServiceQuotaTemplate", []))

    @jsii.member(jsii_name="toGetAssociationForServiceQuotaTemplate")
    def to_get_association_for_service_quota_template(self) -> "Servicequotas":
        '''(experimental) Grants permission to retrieve the ServiceQuotaTemplateAssociationStatus value, which tells you if the Service Quotas template is associated with an organization.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_GetAssociationForServiceQuotaTemplate.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toGetAssociationForServiceQuotaTemplate", []))

    @jsii.member(jsii_name="toGetAWSDefaultServiceQuota")
    def to_get_aws_default_service_quota(self) -> "Servicequotas":
        '''(experimental) Grants permission to return the details for the specified service quota, including the AWS default value.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_GetAWSDefaultServiceQuota.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toGetAWSDefaultServiceQuota", []))

    @jsii.member(jsii_name="toGetRequestedServiceQuotaChange")
    def to_get_requested_service_quota_change(self) -> "Servicequotas":
        '''(experimental) Grants permission to retrieve the details for a particular service quota increase request.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_GetRequestedServiceQuotaChange.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toGetRequestedServiceQuotaChange", []))

    @jsii.member(jsii_name="toGetServiceQuota")
    def to_get_service_quota(self) -> "Servicequotas":
        '''(experimental) Grants permission to return the details for the specified service quota, including the applied value.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_GetServiceQuota.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toGetServiceQuota", []))

    @jsii.member(jsii_name="toGetServiceQuotaIncreaseRequestFromTemplate")
    def to_get_service_quota_increase_request_from_template(self) -> "Servicequotas":
        '''(experimental) Grants permission to retrieve the details for a service quota increase request from the service quota template.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_GetServiceQuotaIncreaseRequestFromTemplate.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toGetServiceQuotaIncreaseRequestFromTemplate", []))

    @jsii.member(jsii_name="toListAWSDefaultServiceQuotas")
    def to_list_aws_default_service_quotas(self) -> "Servicequotas":
        '''(experimental) Grants permission to list all default service quotas for the specified AWS service.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_ListAWSDefaultServiceQuotas.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toListAWSDefaultServiceQuotas", []))

    @jsii.member(jsii_name="toListRequestedServiceQuotaChangeHistory")
    def to_list_requested_service_quota_change_history(self) -> "Servicequotas":
        '''(experimental) Grants permission to request a list of the changes to quotas for a service.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_ListRequestedServiceQuotaChangeHistory.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toListRequestedServiceQuotaChangeHistory", []))

    @jsii.member(jsii_name="toListRequestedServiceQuotaChangeHistoryByQuota")
    def to_list_requested_service_quota_change_history_by_quota(
        self,
    ) -> "Servicequotas":
        '''(experimental) Grants permission to request a list of the changes to specific service quotas.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_ListRequestedServiceQuotaChangeHistoryByQuota.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toListRequestedServiceQuotaChangeHistoryByQuota", []))

    @jsii.member(jsii_name="toListServiceQuotaIncreaseRequestsInTemplate")
    def to_list_service_quota_increase_requests_in_template(self) -> "Servicequotas":
        '''(experimental) Grants permission to return a list of the service quota increase requests from the service quota template.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_ListServiceQuotaIncreaseRequestsInTemplate

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toListServiceQuotaIncreaseRequestsInTemplate", []))

    @jsii.member(jsii_name="toListServiceQuotas")
    def to_list_service_quotas(self) -> "Servicequotas":
        '''(experimental) Grants permission to list all service quotas for the specified AWS service, in that account, in that Region.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_ListServiceQuotas.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toListServiceQuotas", []))

    @jsii.member(jsii_name="toListServices")
    def to_list_services(self) -> "Servicequotas":
        '''(experimental) Grants permission to list the AWS services available in Service Quotas.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_ListServices.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toListServices", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Servicequotas":
        '''(experimental) Grants permission to view the existing tags on a SQ resource.

        Access Level: Read

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_ListTagsForResource

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutServiceQuotaIncreaseRequestIntoTemplate")
    def to_put_service_quota_increase_request_into_template(self) -> "Servicequotas":
        '''(experimental) Grants permission to define and add a quota to the service quota template.

        Access Level: Write

        Possible conditions:

        - .ifService()

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_PutServiceQuotaIncreaseRequestIntoTemplate.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toPutServiceQuotaIncreaseRequestIntoTemplate", []))

    @jsii.member(jsii_name="toRequestServiceQuotaIncrease")
    def to_request_service_quota_increase(self) -> "Servicequotas":
        '''(experimental) Grants permission to submit the request for a service quota increase.

        Access Level: Write

        Possible conditions:

        - .ifService()

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_RequestServiceQuotaIncrease.html

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toRequestServiceQuotaIncrease", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Servicequotas":
        '''(experimental) Grants permission to associate a set of tags with an existing SQ resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_TagResource

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Servicequotas":
        '''(experimental) Grants permission to remove a set of tags from a SQ resource, where tags to be removed match a set of customer-supplied tag keys.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_UntagResource

        :stability: experimental
        '''
        return typing.cast("Servicequotas", jsii.invoke(self, "toUntagResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5417bc76d8960997df5965f7a7d26e133fa0c55fd6113bc53e64ac32aff76de3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bc06f97eb0228245cafe9e469c15b7af500f45ee80eb5a6fa6e24066f6a2f272)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Ses(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ses"):
    '''(experimental) Statement provider for service `ses <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonses.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ses <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonses.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5b0611a71f985969a0147417e9b8e38b511cc72bdb06526ea42db2ca1ed452f0)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifApiVersion")
    def if_api_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ses":
        '''(experimental) Filters actions based on the SES API version.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toCloneReceiptRuleSet()
        - .toCreateConfigurationSet()
        - .toCreateConfigurationSetEventDestination()
        - .toCreateConfigurationSetTrackingOptions()
        - .toCreateCustomVerificationEmailTemplate()
        - .toCreateReceiptFilter()
        - .toCreateReceiptRule()
        - .toCreateReceiptRuleSet()
        - .toCreateTemplate()
        - .toDeleteConfigurationSet()
        - .toDeleteConfigurationSetEventDestination()
        - .toDeleteConfigurationSetTrackingOptions()
        - .toDeleteCustomVerificationEmailTemplate()
        - .toDeleteIdentity()
        - .toDeleteIdentityPolicy()
        - .toDeleteReceiptFilter()
        - .toDeleteReceiptRule()
        - .toDeleteReceiptRuleSet()
        - .toDeleteTemplate()
        - .toDeleteVerifiedEmailAddress()
        - .toDescribeActiveReceiptRuleSet()
        - .toDescribeConfigurationSet()
        - .toDescribeReceiptRule()
        - .toDescribeReceiptRuleSet()
        - .toGetAccountSendingEnabled()
        - .toGetCustomVerificationEmailTemplate()
        - .toGetIdentityDkimAttributes()
        - .toGetIdentityMailFromDomainAttributes()
        - .toGetIdentityNotificationAttributes()
        - .toGetIdentityPolicies()
        - .toGetIdentityVerificationAttributes()
        - .toGetSendQuota()
        - .toGetSendStatistics()
        - .toGetTemplate()
        - .toListConfigurationSets()
        - .toListCustomVerificationEmailTemplates()
        - .toListIdentities()
        - .toListIdentityPolicies()
        - .toListReceiptFilters()
        - .toListReceiptRuleSets()
        - .toListTemplates()
        - .toListVerifiedEmailAddresses()
        - .toPutConfigurationSetDeliveryOptions()
        - .toPutIdentityPolicy()
        - .toReorderReceiptRuleSet()
        - .toSendBounce()
        - .toSendBulkTemplatedEmail()
        - .toSendCustomVerificationEmail()
        - .toSendEmail()
        - .toSendRawEmail()
        - .toSendTemplatedEmail()
        - .toSetActiveReceiptRuleSet()
        - .toSetIdentityDkimEnabled()
        - .toSetIdentityFeedbackForwardingEnabled()
        - .toSetIdentityHeadersInNotificationsEnabled()
        - .toSetIdentityMailFromDomain()
        - .toSetIdentityNotificationTopic()
        - .toSetReceiptRulePosition()
        - .toTestRenderTemplate()
        - .toUpdateAccountSendingEnabled()
        - .toUpdateConfigurationSetEventDestination()
        - .toUpdateConfigurationSetReputationMetricsEnabled()
        - .toUpdateConfigurationSetSendingEnabled()
        - .toUpdateConfigurationSetTrackingOptions()
        - .toUpdateCustomVerificationEmailTemplate()
        - .toUpdateReceiptRule()
        - .toUpdateTemplate()
        - .toVerifyDomainDkim()
        - .toVerifyDomainIdentity()
        - .toVerifyEmailAddress()
        - .toVerifyEmailIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5a144f1c39f4441a1335ec83eb31648b863010f936e390121f49e1bf37de2a26)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ses", jsii.invoke(self, "ifApiVersion", [value, operator]))

    @jsii.member(jsii_name="ifFeedbackAddress")
    def if_feedback_address(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ses":
        '''(experimental) Filters actions based on the "Return-Path" address, which specifies where bounces and complaints are sent by email feedback forwarding.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendBulkTemplatedEmail()
        - .toSendCustomVerificationEmail()
        - .toSendEmail()
        - .toSendRawEmail()
        - .toSendTemplatedEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2d61c7a0c046b1fcb1ae9210dc3c2c1d0ed4329816a8d96934fc240ba84aab0b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ses", jsii.invoke(self, "ifFeedbackAddress", [value, operator]))

    @jsii.member(jsii_name="ifFromAddress")
    def if_from_address(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ses":
        '''(experimental) Filters actions based on the "From" address of a message.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendBounce()
        - .toSendBulkTemplatedEmail()
        - .toSendCustomVerificationEmail()
        - .toSendEmail()
        - .toSendRawEmail()
        - .toSendTemplatedEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7f05f0c612489fbc449a65141e5368321b6c3a3422ba1a4552d7e72ce175e66b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ses", jsii.invoke(self, "ifFromAddress", [value, operator]))

    @jsii.member(jsii_name="ifFromDisplayName")
    def if_from_display_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ses":
        '''(experimental) Filters actions based on the "From" address that is used as the display name of a message.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendBulkTemplatedEmail()
        - .toSendCustomVerificationEmail()
        - .toSendEmail()
        - .toSendRawEmail()
        - .toSendTemplatedEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__74e4d70ba2ffc2b77fc295091ec8243da09af403833dcf3e494f0892ddf6e1f3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ses", jsii.invoke(self, "ifFromDisplayName", [value, operator]))

    @jsii.member(jsii_name="ifRecipients")
    def if_recipients(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ses":
        '''(experimental) Filters actions based on the recipient addresses of a message, which include the "To", "CC", and "BCC" addresses.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendBulkTemplatedEmail()
        - .toSendCustomVerificationEmail()
        - .toSendEmail()
        - .toSendRawEmail()
        - .toSendTemplatedEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5f5b32a557ee89d998ce82dab58a978899ca982878e02f9f402d145645eab92a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ses", jsii.invoke(self, "ifRecipients", [value, operator]))

    @jsii.member(jsii_name="onConfigurationSet")
    def on_configuration_set(
        self,
        configuration_set_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ses":
        '''(experimental) Adds a resource of type configuration-set to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ConfigurationSet.html

        :param configuration_set_name: - Identifier for the configurationSetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__40efa58fcb305428fe4bb6557b45d1a1288121d2cc1b7295d17ef08a2892e11c)
            check_type(argname="argument configuration_set_name", value=configuration_set_name, expected_type=type_hints["configuration_set_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ses", jsii.invoke(self, "onConfigurationSet", [configuration_set_name, account, region, partition]))

    @jsii.member(jsii_name="onCustomVerificationEmailTemplate")
    def on_custom_verification_email_template(
        self,
        template_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ses":
        '''(experimental) Adds a resource of type custom-verification-email-template to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference/API_CustomVerificationEmailTemplate.html

        :param template_name: - Identifier for the templateName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0d09c11ee0d98d8ab9b4d755621a0cee1f96dc4e156bc5d7bd0ac7eea7b40dff)
            check_type(argname="argument template_name", value=template_name, expected_type=type_hints["template_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ses", jsii.invoke(self, "onCustomVerificationEmailTemplate", [template_name, account, region, partition]))

    @jsii.member(jsii_name="onIdentity")
    def on_identity(
        self,
        identity_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ses":
        '''(experimental) Adds a resource of type identity to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_IdentityInfo.html

        :param identity_name: - Identifier for the identityName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f7e690f7c1a682e1c822912ebb381f08a7e009f22a2883e5fadd5c3860c386f5)
            check_type(argname="argument identity_name", value=identity_name, expected_type=type_hints["identity_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ses", jsii.invoke(self, "onIdentity", [identity_name, account, region, partition]))

    @jsii.member(jsii_name="onTemplate")
    def on_template(
        self,
        template_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ses":
        '''(experimental) Adds a resource of type template to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference/API_Template.html

        :param template_name: - Identifier for the templateName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8516eeb0ee2bee19ca1f0f288f4c5b54288d2e7a627fcd9385daf179c9a72bde)
            check_type(argname="argument template_name", value=template_name, expected_type=type_hints["template_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ses", jsii.invoke(self, "onTemplate", [template_name, account, region, partition]))

    @jsii.member(jsii_name="toCloneReceiptRuleSet")
    def to_clone_receipt_rule_set(self) -> "Ses":
        '''(experimental) Grants permission to create a receipt rule set by cloning an existing one.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_CloneReceiptRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toCloneReceiptRuleSet", []))

    @jsii.member(jsii_name="toCreateConfigurationSet")
    def to_create_configuration_set(self) -> "Ses":
        '''(experimental) Grants permission to create a new configuration set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_CreateConfigurationSet.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toCreateConfigurationSet", []))

    @jsii.member(jsii_name="toCreateConfigurationSetEventDestination")
    def to_create_configuration_set_event_destination(self) -> "Ses":
        '''(experimental) Grants permission to create a configuration set event destination.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_CreateConfigurationSetEventDestination.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toCreateConfigurationSetEventDestination", []))

    @jsii.member(jsii_name="toCreateConfigurationSetTrackingOptions")
    def to_create_configuration_set_tracking_options(self) -> "Ses":
        '''(experimental) Grants permission to creates an association between a configuration set and a custom domain for open and click event tracking.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_CreateConfigurationSetTrackingOptions.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toCreateConfigurationSetTrackingOptions", []))

    @jsii.member(jsii_name="toCreateCustomVerificationEmailTemplate")
    def to_create_custom_verification_email_template(self) -> "Ses":
        '''(experimental) Grants permission to create a new custom verification email template.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_CreateCustomVerificationEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toCreateCustomVerificationEmailTemplate", []))

    @jsii.member(jsii_name="toCreateReceiptFilter")
    def to_create_receipt_filter(self) -> "Ses":
        '''(experimental) Grants permission to create a new IP address filter.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_CreateReceiptFilter.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toCreateReceiptFilter", []))

    @jsii.member(jsii_name="toCreateReceiptRule")
    def to_create_receipt_rule(self) -> "Ses":
        '''(experimental) Grants permission to create a receipt rule.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_CreateReceiptRule.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toCreateReceiptRule", []))

    @jsii.member(jsii_name="toCreateReceiptRuleSet")
    def to_create_receipt_rule_set(self) -> "Ses":
        '''(experimental) Grants permission to create an empty receipt rule set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_CreateReceiptRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toCreateReceiptRuleSet", []))

    @jsii.member(jsii_name="toCreateTemplate")
    def to_create_template(self) -> "Ses":
        '''(experimental) Grants permission to creates an email template.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_CreateTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toCreateTemplate", []))

    @jsii.member(jsii_name="toDeleteConfigurationSet")
    def to_delete_configuration_set(self) -> "Ses":
        '''(experimental) Grants permission to delete an existing configuration set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteConfigurationSet.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteConfigurationSet", []))

    @jsii.member(jsii_name="toDeleteConfigurationSetEventDestination")
    def to_delete_configuration_set_event_destination(self) -> "Ses":
        '''(experimental) Grants permission to delete an event destination.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteConfigurationSetEventDestination.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteConfigurationSetEventDestination", []))

    @jsii.member(jsii_name="toDeleteConfigurationSetTrackingOptions")
    def to_delete_configuration_set_tracking_options(self) -> "Ses":
        '''(experimental) Grants permission to delete an association between a configuration set and a custom domain for open and click event tracking.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteConfigurationSetTrackingOptions.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteConfigurationSetTrackingOptions", []))

    @jsii.member(jsii_name="toDeleteCustomVerificationEmailTemplate")
    def to_delete_custom_verification_email_template(self) -> "Ses":
        '''(experimental) Grants permission to delete an existing custom verification email template.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteCustomVerificationEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteCustomVerificationEmailTemplate", []))

    @jsii.member(jsii_name="toDeleteIdentity")
    def to_delete_identity(self) -> "Ses":
        '''(experimental) Grants permission to delete the specified identity.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteIdentity.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteIdentity", []))

    @jsii.member(jsii_name="toDeleteIdentityPolicy")
    def to_delete_identity_policy(self) -> "Ses":
        '''(experimental) Grants permission to delete the specified sending authorization policy for the given identity (an email address or a domain).

        Access Level: Permissions management

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteIdentityPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteIdentityPolicy", []))

    @jsii.member(jsii_name="toDeleteReceiptFilter")
    def to_delete_receipt_filter(self) -> "Ses":
        '''(experimental) Grants permission to delete the specified IP address filter.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteReceiptFilter.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteReceiptFilter", []))

    @jsii.member(jsii_name="toDeleteReceiptRule")
    def to_delete_receipt_rule(self) -> "Ses":
        '''(experimental) Grants permission to delete the specified receipt rule.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteReceiptRule.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteReceiptRule", []))

    @jsii.member(jsii_name="toDeleteReceiptRuleSet")
    def to_delete_receipt_rule_set(self) -> "Ses":
        '''(experimental) Grants permission to delete the specified receipt rule set and all of the receipt rules it contains.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteReceiptRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteReceiptRuleSet", []))

    @jsii.member(jsii_name="toDeleteTemplate")
    def to_delete_template(self) -> "Ses":
        '''(experimental) Grants permission to delete an email template.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteTemplate", []))

    @jsii.member(jsii_name="toDeleteVerifiedEmailAddress")
    def to_delete_verified_email_address(self) -> "Ses":
        '''(experimental) Grants permission to delete the specified email address from the list of verified addresses.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DeleteVerifiedEmailAddress.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDeleteVerifiedEmailAddress", []))

    @jsii.member(jsii_name="toDescribeActiveReceiptRuleSet")
    def to_describe_active_receipt_rule_set(self) -> "Ses":
        '''(experimental) Grants permission to return the metadata and receipt rules for the receipt rule set that is currently active.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DescribeActiveReceiptRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDescribeActiveReceiptRuleSet", []))

    @jsii.member(jsii_name="toDescribeConfigurationSet")
    def to_describe_configuration_set(self) -> "Ses":
        '''(experimental) Grants permission to return the details of the specified configuration set.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DescribeConfigurationSet.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDescribeConfigurationSet", []))

    @jsii.member(jsii_name="toDescribeReceiptRule")
    def to_describe_receipt_rule(self) -> "Ses":
        '''(experimental) Grants permission to return the details of the specified receipt rule.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DescribeReceiptRule.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDescribeReceiptRule", []))

    @jsii.member(jsii_name="toDescribeReceiptRuleSet")
    def to_describe_receipt_rule_set(self) -> "Ses":
        '''(experimental) Grants permission to return the details of the specified receipt rule set.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_DescribeReceiptRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toDescribeReceiptRuleSet", []))

    @jsii.member(jsii_name="toGetAccountSendingEnabled")
    def to_get_account_sending_enabled(self) -> "Ses":
        '''(experimental) Grants permission to return the email sending status of your account.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_GetAccountSendingEnabled.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toGetAccountSendingEnabled", []))

    @jsii.member(jsii_name="toGetCustomVerificationEmailTemplate")
    def to_get_custom_verification_email_template(self) -> "Ses":
        '''(experimental) Grants permission to return the custom email verification template for the template name you specify.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_GetCustomVerificationEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toGetCustomVerificationEmailTemplate", []))

    @jsii.member(jsii_name="toGetIdentityDkimAttributes")
    def to_get_identity_dkim_attributes(self) -> "Ses":
        '''(experimental) Grants permission to return the current status of Easy DKIM signing for an entity.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_GetIdentityDkimAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toGetIdentityDkimAttributes", []))

    @jsii.member(jsii_name="toGetIdentityMailFromDomainAttributes")
    def to_get_identity_mail_from_domain_attributes(self) -> "Ses":
        '''(experimental) Grants permission to return the custom MAIL FROM attributes for a list of identities (email addresses and/or domains).

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_GetIdentityMailFromDomainAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toGetIdentityMailFromDomainAttributes", []))

    @jsii.member(jsii_name="toGetIdentityNotificationAttributes")
    def to_get_identity_notification_attributes(self) -> "Ses":
        '''(experimental) Grants permission to return a structure describing identity notification attributes for a list of verified identities (email addresses and/or domains),.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_GetIdentityNotificationAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toGetIdentityNotificationAttributes", []))

    @jsii.member(jsii_name="toGetIdentityPolicies")
    def to_get_identity_policies(self) -> "Ses":
        '''(experimental) Grants permission to return the requested sending authorization policies for the given identity (an email address or a domain).

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_GetIdentityPolicies.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toGetIdentityPolicies", []))

    @jsii.member(jsii_name="toGetIdentityVerificationAttributes")
    def to_get_identity_verification_attributes(self) -> "Ses":
        '''(experimental) Grants permission to return the verification status and (for domain identities) the verification token for a list of identities.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_GetIdentityVerificationAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toGetIdentityVerificationAttributes", []))

    @jsii.member(jsii_name="toGetSendQuota")
    def to_get_send_quota(self) -> "Ses":
        '''(experimental) Grants permission to return the user's current sending limits.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_GetSendQuota.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toGetSendQuota", []))

    @jsii.member(jsii_name="toGetSendStatistics")
    def to_get_send_statistics(self) -> "Ses":
        '''(experimental) Grants permission to returns the user's sending statistics.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_GetSendStatistics.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toGetSendStatistics", []))

    @jsii.member(jsii_name="toGetTemplate")
    def to_get_template(self) -> "Ses":
        '''(experimental) Grants permission to return the template object, which includes the subject line, HTML par, and text part for the template you specify.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_GetTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toGetTemplate", []))

    @jsii.member(jsii_name="toListConfigurationSets")
    def to_list_configuration_sets(self) -> "Ses":
        '''(experimental) Grants permission to list all of the configuration sets for your account.

        Access Level: List

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ListConfigurationSets.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toListConfigurationSets", []))

    @jsii.member(jsii_name="toListCustomVerificationEmailTemplates")
    def to_list_custom_verification_email_templates(self) -> "Ses":
        '''(experimental) Grants permission to list all of the existing custom verification email templates for your account.

        Access Level: List

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ListCustomVerificationEmailTemplates.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toListCustomVerificationEmailTemplates", []))

    @jsii.member(jsii_name="toListIdentities")
    def to_list_identities(self) -> "Ses":
        '''(experimental) Grants permission to list the email identities for your account.

        Access Level: List

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ListIdentities.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toListIdentities", []))

    @jsii.member(jsii_name="toListIdentityPolicies")
    def to_list_identity_policies(self) -> "Ses":
        '''(experimental) Grants permission to list all of the email templates for your account.

        Access Level: List

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ListIdentityPolicies.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toListIdentityPolicies", []))

    @jsii.member(jsii_name="toListReceiptFilters")
    def to_list_receipt_filters(self) -> "Ses":
        '''(experimental) Grants permission to list the IP address filters associated with your account.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ListReceiptFilters.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toListReceiptFilters", []))

    @jsii.member(jsii_name="toListReceiptRuleSets")
    def to_list_receipt_rule_sets(self) -> "Ses":
        '''(experimental) Grants permission to list the receipt rule sets that exist under your account.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ListReceiptRuleSets.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toListReceiptRuleSets", []))

    @jsii.member(jsii_name="toListTemplates")
    def to_list_templates(self) -> "Ses":
        '''(experimental) Grants permission to list the email templates present in your account.

        Access Level: List

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ListTemplates.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toListTemplates", []))

    @jsii.member(jsii_name="toListVerifiedEmailAddresses")
    def to_list_verified_email_addresses(self) -> "Ses":
        '''(experimental) Grants permission to list all of the email addresses that have been verified in your account.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ListVerifiedEmailAddresses.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toListVerifiedEmailAddresses", []))

    @jsii.member(jsii_name="toPutConfigurationSetDeliveryOptions")
    def to_put_configuration_set_delivery_options(self) -> "Ses":
        '''(experimental) Grants permission to add or update the delivery options for a configuration set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_PutConfigurationSetDeliveryOptions.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toPutConfigurationSetDeliveryOptions", []))

    @jsii.member(jsii_name="toPutIdentityPolicy")
    def to_put_identity_policy(self) -> "Ses":
        '''(experimental) Grants permission to add or update a sending authorization policy for the specified identity (an email address or a domain).

        Access Level: Permissions management

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_PutIdentityPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toPutIdentityPolicy", []))

    @jsii.member(jsii_name="toReorderReceiptRuleSet")
    def to_reorder_receipt_rule_set(self) -> "Ses":
        '''(experimental) Grants permission to reorder the receipt rules within a receipt rule set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ReorderReceiptRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toReorderReceiptRuleSet", []))

    @jsii.member(jsii_name="toSendBounce")
    def to_send_bounce(self) -> "Ses":
        '''(experimental) Grants permission to generate and send a bounce message to the sender of an email you received through Amazon SES.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifFromAddress()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SendBounce.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSendBounce", []))

    @jsii.member(jsii_name="toSendBulkTemplatedEmail")
    def to_send_bulk_templated_email(self) -> "Ses":
        '''(experimental) Grants permission to compose an email message to multiple destinations.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifFeedbackAddress()
        - .ifFromAddress()
        - .ifFromDisplayName()
        - .ifRecipients()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SendBulkTemplatedEmail.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSendBulkTemplatedEmail", []))

    @jsii.member(jsii_name="toSendCustomVerificationEmail")
    def to_send_custom_verification_email(self) -> "Ses":
        '''(experimental) Grants permission to add an email address to the list of identities and attempts to verify it for your account.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifFeedbackAddress()
        - .ifFromAddress()
        - .ifFromDisplayName()
        - .ifRecipients()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SendCustomVerificationEmail.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSendCustomVerificationEmail", []))

    @jsii.member(jsii_name="toSendEmail")
    def to_send_email(self) -> "Ses":
        '''(experimental) Grants permission to send an email message.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifFeedbackAddress()
        - .ifFromAddress()
        - .ifFromDisplayName()
        - .ifRecipients()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SendEmail.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSendEmail", []))

    @jsii.member(jsii_name="toSendRawEmail")
    def to_send_raw_email(self) -> "Ses":
        '''(experimental) Grants permission to send an email message, with header and content specified by the client.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifFeedbackAddress()
        - .ifFromAddress()
        - .ifFromDisplayName()
        - .ifRecipients()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SendRawEmail.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSendRawEmail", []))

    @jsii.member(jsii_name="toSendTemplatedEmail")
    def to_send_templated_email(self) -> "Ses":
        '''(experimental) Grants permission to compose an email message using an email template.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifFeedbackAddress()
        - .ifFromAddress()
        - .ifFromDisplayName()
        - .ifRecipients()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SendTemplatedEmail.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSendTemplatedEmail", []))

    @jsii.member(jsii_name="toSetActiveReceiptRuleSet")
    def to_set_active_receipt_rule_set(self) -> "Ses":
        '''(experimental) Grants permission to set the specified receipt rule set as the active receipt rule set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SetActiveReceiptRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSetActiveReceiptRuleSet", []))

    @jsii.member(jsii_name="toSetIdentityDkimEnabled")
    def to_set_identity_dkim_enabled(self) -> "Ses":
        '''(experimental) Grants permission to enable or disable Easy DKIM signing of email sent from an identity.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SetIdentityDkimEnabled.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSetIdentityDkimEnabled", []))

    @jsii.member(jsii_name="toSetIdentityFeedbackForwardingEnabled")
    def to_set_identity_feedback_forwarding_enabled(self) -> "Ses":
        '''(experimental) Grants permission to enable or disable whether Amazon SES forwards bounce and complaint notifications for an identity (an email address or a domain).

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SetIdentityFeedbackForwardingEnabled.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSetIdentityFeedbackForwardingEnabled", []))

    @jsii.member(jsii_name="toSetIdentityHeadersInNotificationsEnabled")
    def to_set_identity_headers_in_notifications_enabled(self) -> "Ses":
        '''(experimental) Grants permission to set whether Amazon SES includes the original email headers in the Amazon Simple Notification Service (Amazon SNS) notifications of a specified type for a given identity (an email address or a domain).

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SetIdentityHeadersInNotificationsEnabled.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSetIdentityHeadersInNotificationsEnabled", []))

    @jsii.member(jsii_name="toSetIdentityMailFromDomain")
    def to_set_identity_mail_from_domain(self) -> "Ses":
        '''(experimental) Grants permission to enable or disable the custom MAIL FROM domain setup for a verified identity.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SetIdentityMailFromDomain.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSetIdentityMailFromDomain", []))

    @jsii.member(jsii_name="toSetIdentityNotificationTopic")
    def to_set_identity_notification_topic(self) -> "Ses":
        '''(experimental) Grants permission to set an Amazon Simple Notification Service (Amazon SNS) topic to use when delivering notifications for a verified identity.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SetIdentityNotificationTopic.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSetIdentityNotificationTopic", []))

    @jsii.member(jsii_name="toSetReceiptRulePosition")
    def to_set_receipt_rule_position(self) -> "Ses":
        '''(experimental) Grants permission to set the position of the specified receipt rule in the receipt rule set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_SetReceiptRulePosition.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toSetReceiptRulePosition", []))

    @jsii.member(jsii_name="toTestRenderTemplate")
    def to_test_render_template(self) -> "Ses":
        '''(experimental) Grants permission to create a preview of the MIME content of an email when provided with a template and a set of replacement data.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_TestRenderTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toTestRenderTemplate", []))

    @jsii.member(jsii_name="toUpdateAccountSendingEnabled")
    def to_update_account_sending_enabled(self) -> "Ses":
        '''(experimental) Grants permission to enable or disable email sending for your account.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_UpdateAccountSendingEnabled.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toUpdateAccountSendingEnabled", []))

    @jsii.member(jsii_name="toUpdateConfigurationSetEventDestination")
    def to_update_configuration_set_event_destination(self) -> "Ses":
        '''(experimental) Grants permission to update the event destination of a configuration set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_UpdateConfigurationSetEventDestination.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toUpdateConfigurationSetEventDestination", []))

    @jsii.member(jsii_name="toUpdateConfigurationSetReputationMetricsEnabled")
    def to_update_configuration_set_reputation_metrics_enabled(self) -> "Ses":
        '''(experimental) Grants permission to enable or disable the publishing of reputation metrics for emails sent using a specific configuration set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_UpdateConfigurationSetReputationMetricsEnabled.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toUpdateConfigurationSetReputationMetricsEnabled", []))

    @jsii.member(jsii_name="toUpdateConfigurationSetSendingEnabled")
    def to_update_configuration_set_sending_enabled(self) -> "Ses":
        '''(experimental) Grants permission to enable or disable email sending for messages sent using a specific configuration set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_UpdateConfigurationSetSendingEnabled.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toUpdateConfigurationSetSendingEnabled", []))

    @jsii.member(jsii_name="toUpdateConfigurationSetTrackingOptions")
    def to_update_configuration_set_tracking_options(self) -> "Ses":
        '''(experimental) Grants permission to modify an association between a configuration set and a custom domain for open and click event tracking.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_UpdateConfigurationSetTrackingOptions.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toUpdateConfigurationSetTrackingOptions", []))

    @jsii.member(jsii_name="toUpdateCustomVerificationEmailTemplate")
    def to_update_custom_verification_email_template(self) -> "Ses":
        '''(experimental) Grants permission to update an existing custom verification email template.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_UpdateCustomVerificationEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toUpdateCustomVerificationEmailTemplate", []))

    @jsii.member(jsii_name="toUpdateReceiptRule")
    def to_update_receipt_rule(self) -> "Ses":
        '''(experimental) Grants permission to update a receipt rule.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_UpdateReceiptRule.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toUpdateReceiptRule", []))

    @jsii.member(jsii_name="toUpdateTemplate")
    def to_update_template(self) -> "Ses":
        '''(experimental) Grants permission to update an email template.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_UpdateTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toUpdateTemplate", []))

    @jsii.member(jsii_name="toVerifyDomainDkim")
    def to_verify_domain_dkim(self) -> "Ses":
        '''(experimental) Grants permission to return a set of DKIM tokens for a domain.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_VerifyDomainDkim.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toVerifyDomainDkim", []))

    @jsii.member(jsii_name="toVerifyDomainIdentity")
    def to_verify_domain_identity(self) -> "Ses":
        '''(experimental) Grants permission to verify a domain.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_VerifyDomainIdentity.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toVerifyDomainIdentity", []))

    @jsii.member(jsii_name="toVerifyEmailAddress")
    def to_verify_email_address(self) -> "Ses":
        '''(experimental) Grants permission to verify an email address.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_VerifyEmailAddress.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toVerifyEmailAddress", []))

    @jsii.member(jsii_name="toVerifyEmailIdentity")
    def to_verify_email_identity(self) -> "Ses":
        '''(experimental) Grants permission to verify an email identity.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference/API_VerifyEmailIdentity.html

        :stability: experimental
        '''
        return typing.cast("Ses", jsii.invoke(self, "toVerifyEmailIdentity", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b3efa9734e4a54847296acd6e77b84562d14c895b83f5432f2bb1de3d8ff42cc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__192f1e6bbc1f67730875d1bb6061f75d327960b096c30c4df123f37568bd6eff)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class SesPinpoint(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.SesPinpoint",
):
    '''(experimental) Statement provider for service `ses-pinpoint <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpinpointemailservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ses-pinpoint <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpinpointemailservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__34ca7ea8adcdbf366d86ea2fd1b5525d4e73a74d99fb0e4f4708f5358f855600)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifApiVersion")
    def if_api_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "SesPinpoint":
        '''(experimental) Filters actions based on the SES API version.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toCreateConfigurationSet()
        - .toCreateConfigurationSetEventDestination()
        - .toCreateDedicatedIpPool()
        - .toCreateDeliverabilityTestReport()
        - .toCreateEmailIdentity()
        - .toDeleteConfigurationSet()
        - .toDeleteConfigurationSetEventDestination()
        - .toDeleteDedicatedIpPool()
        - .toDeleteEmailIdentity()
        - .toGetAccount()
        - .toGetBlacklistReports()
        - .toGetConfigurationSet()
        - .toGetConfigurationSetEventDestinations()
        - .toGetDedicatedIp()
        - .toGetDedicatedIps()
        - .toGetDeliverabilityDashboardOptions()
        - .toGetDeliverabilityTestReport()
        - .toGetDomainDeliverabilityCampaign()
        - .toGetDomainStatisticsReport()
        - .toGetEmailIdentity()
        - .toListConfigurationSets()
        - .toListDedicatedIpPools()
        - .toListDeliverabilityTestReports()
        - .toListDomainDeliverabilityCampaigns()
        - .toListEmailIdentities()
        - .toListTagsForResource()
        - .toPutAccountDedicatedIpWarmupAttributes()
        - .toPutAccountSendingAttributes()
        - .toPutConfigurationSetDeliveryOptions()
        - .toPutConfigurationSetReputationOptions()
        - .toPutConfigurationSetSendingOptions()
        - .toPutConfigurationSetTrackingOptions()
        - .toPutDedicatedIpInPool()
        - .toPutDedicatedIpWarmupAttributes()
        - .toPutDeliverabilityDashboardOption()
        - .toPutEmailIdentityDkimAttributes()
        - .toPutEmailIdentityFeedbackAttributes()
        - .toPutEmailIdentityMailFromAttributes()
        - .toSendEmail()
        - .toTagResource()
        - .toUntagResource()
        - .toUpdateConfigurationSetEventDestination()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5b6cc86ded288bb8fef8521a582c6c26d82e6c861296de716aef0533e70679e6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("SesPinpoint", jsii.invoke(self, "ifApiVersion", [value, operator]))

    @jsii.member(jsii_name="ifFeedbackAddress")
    def if_feedback_address(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "SesPinpoint":
        '''(experimental) Filters actions based on the "Return-Path" address, which specifies where bounces and complaints are sent by email feedback forwarding.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__367e8a29c6f15b28f934bd47d32b3d667c01c273f4df98345ee8a73f59c8b0e3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("SesPinpoint", jsii.invoke(self, "ifFeedbackAddress", [value, operator]))

    @jsii.member(jsii_name="ifFromAddress")
    def if_from_address(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "SesPinpoint":
        '''(experimental) Filters actions based on the "From" address of a message.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a87f61cfea30cea3f57671597179400cf9edbdf7be59ba51f0ba06fddae5bd38)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("SesPinpoint", jsii.invoke(self, "ifFromAddress", [value, operator]))

    @jsii.member(jsii_name="ifFromDisplayName")
    def if_from_display_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "SesPinpoint":
        '''(experimental) Filters actions based on the "From" address that is used as the display name of a message.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ee37059d2f950354d1e371d52a2df67feb9183c36b31c3baf64f0e6f7cb60a7b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("SesPinpoint", jsii.invoke(self, "ifFromDisplayName", [value, operator]))

    @jsii.member(jsii_name="ifRecipients")
    def if_recipients(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "SesPinpoint":
        '''(experimental) Filters actions based on the recipient addresses of a message, which include the "To", "CC", and "BCC" addresses.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7761fe07d1b24a44dba875ac883be9976008c517a586e349be0fde4274db8a6d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("SesPinpoint", jsii.invoke(self, "ifRecipients", [value, operator]))

    @jsii.member(jsii_name="onConfigurationSet")
    def on_configuration_set(
        self,
        configuration_set_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesPinpoint":
        '''(experimental) Adds a resource of type configuration-set to the statement.

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_CreateConfigurationSet.html

        :param configuration_set_name: - Identifier for the configurationSetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d18f4659705187489addbb6e6dcccae8691f79c0f381181cbaf35c8b32e39f23)
            check_type(argname="argument configuration_set_name", value=configuration_set_name, expected_type=type_hints["configuration_set_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SesPinpoint", jsii.invoke(self, "onConfigurationSet", [configuration_set_name, account, region, partition]))

    @jsii.member(jsii_name="onDedicatedIpPool")
    def on_dedicated_ip_pool(
        self,
        dedicated_ip_pool: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesPinpoint":
        '''(experimental) Adds a resource of type dedicated-ip-pool to the statement.

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_DedicatedIp.html

        :param dedicated_ip_pool: - Identifier for the dedicatedIPPool.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1455153690bed9033480c259a4f9d7674bf20e9b2398cfe3967ef2bdaf08071a)
            check_type(argname="argument dedicated_ip_pool", value=dedicated_ip_pool, expected_type=type_hints["dedicated_ip_pool"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SesPinpoint", jsii.invoke(self, "onDedicatedIpPool", [dedicated_ip_pool, account, region, partition]))

    @jsii.member(jsii_name="onDeliverabilityTestReport")
    def on_deliverability_test_report(
        self,
        report_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesPinpoint":
        '''(experimental) Adds a resource of type deliverability-test-report to the statement.

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_DeliverabilityTestReport.html

        :param report_id: - Identifier for the reportId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__01c34ab46bf7d272b95170a1fd6c1d082431345cf97c0abb61e473538dda3768)
            check_type(argname="argument report_id", value=report_id, expected_type=type_hints["report_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SesPinpoint", jsii.invoke(self, "onDeliverabilityTestReport", [report_id, account, region, partition]))

    @jsii.member(jsii_name="onIdentity")
    def on_identity(
        self,
        identity_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesPinpoint":
        '''(experimental) Adds a resource of type identity to the statement.

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_IdentityInfo.html

        :param identity_name: - Identifier for the identityName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ea7bbe50aad0d5cdac55a3d8670bbd304e00bdf356951f9902cf3ee6f31f01c3)
            check_type(argname="argument identity_name", value=identity_name, expected_type=type_hints["identity_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SesPinpoint", jsii.invoke(self, "onIdentity", [identity_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateConfigurationSet")
    def to_create_configuration_set(self) -> "SesPinpoint":
        '''(experimental) Grants permission to create a configuration set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_CreateConfigurationSet.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toCreateConfigurationSet", []))

    @jsii.member(jsii_name="toCreateConfigurationSetEventDestination")
    def to_create_configuration_set_event_destination(self) -> "SesPinpoint":
        '''(experimental) Grants permission to create a configuration set event destination.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_CreateConfigurationSetEventDestination.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toCreateConfigurationSetEventDestination", []))

    @jsii.member(jsii_name="toCreateDedicatedIpPool")
    def to_create_dedicated_ip_pool(self) -> "SesPinpoint":
        '''(experimental) Grants permission to create a new pool of dedicated IP addresses.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_CreateDedicatedIpPool.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toCreateDedicatedIpPool", []))

    @jsii.member(jsii_name="toCreateDeliverabilityTestReport")
    def to_create_deliverability_test_report(self) -> "SesPinpoint":
        '''(experimental) Grants permission to create a new predictive inbox placement test.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_CreateDeliverabilityTestReport.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toCreateDeliverabilityTestReport", []))

    @jsii.member(jsii_name="toCreateEmailIdentity")
    def to_create_email_identity(self) -> "SesPinpoint":
        '''(experimental) Grants permission to start the process of verifying an email identity.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_CreateEmailIdentity.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toCreateEmailIdentity", []))

    @jsii.member(jsii_name="toDeleteConfigurationSet")
    def to_delete_configuration_set(self) -> "SesPinpoint":
        '''(experimental) Grants permission to delete an existing configuration set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_DeleteConfigurationSet.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toDeleteConfigurationSet", []))

    @jsii.member(jsii_name="toDeleteConfigurationSetEventDestination")
    def to_delete_configuration_set_event_destination(self) -> "SesPinpoint":
        '''(experimental) Grants permission to delete an event destination.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_DeleteConfigurationSetEventDestination.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toDeleteConfigurationSetEventDestination", []))

    @jsii.member(jsii_name="toDeleteDedicatedIpPool")
    def to_delete_dedicated_ip_pool(self) -> "SesPinpoint":
        '''(experimental) Grants permission to delete a dedicated IP pool.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_DeleteDedicatedIpPool.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toDeleteDedicatedIpPool", []))

    @jsii.member(jsii_name="toDeleteEmailIdentity")
    def to_delete_email_identity(self) -> "SesPinpoint":
        '''(experimental) Grants permission to delete an email identity that you previously verified.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_DeleteEmailIdentity.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toDeleteEmailIdentity", []))

    @jsii.member(jsii_name="toGetAccount")
    def to_get_account(self) -> "SesPinpoint":
        '''(experimental) Grants permission to get information about the email-sending status and capabilities.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetAccount.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetAccount", []))

    @jsii.member(jsii_name="toGetBlacklistReports")
    def to_get_blacklist_reports(self) -> "SesPinpoint":
        '''(experimental) Grants permission to retrieve a list of the deny lists on which your dedicated IP addresses appear.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetBlacklistReports.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetBlacklistReports", []))

    @jsii.member(jsii_name="toGetConfigurationSet")
    def to_get_configuration_set(self) -> "SesPinpoint":
        '''(experimental) Grants permission to get information about an existing configuration set.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetConfigurationSet.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetConfigurationSet", []))

    @jsii.member(jsii_name="toGetConfigurationSetEventDestinations")
    def to_get_configuration_set_event_destinations(self) -> "SesPinpoint":
        '''(experimental) Grants permission to retrieve a list of event destinations that are associated with a configuration set.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetConfigurationSetEventDestinations.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetConfigurationSetEventDestinations", []))

    @jsii.member(jsii_name="toGetDedicatedIp")
    def to_get_dedicated_ip(self) -> "SesPinpoint":
        '''(experimental) Grants permission to get information about a dedicated IP address.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetDedicatedIp.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetDedicatedIp", []))

    @jsii.member(jsii_name="toGetDedicatedIps")
    def to_get_dedicated_ips(self) -> "SesPinpoint":
        '''(experimental) Grants permission to list the dedicated IP addresses that are associated with your account.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetDedicatedIps.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetDedicatedIps", []))

    @jsii.member(jsii_name="toGetDeliverabilityDashboardOptions")
    def to_get_deliverability_dashboard_options(self) -> "SesPinpoint":
        '''(experimental) Grants permission to get the status of the Deliverability dashboard.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetDeliverabilityDashboardOptions.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetDeliverabilityDashboardOptions", []))

    @jsii.member(jsii_name="toGetDeliverabilityTestReport")
    def to_get_deliverability_test_report(self) -> "SesPinpoint":
        '''(experimental) Grants permission to retrieve the results of a predictive inbox placement test.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetDeliverabilityTestReport.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetDeliverabilityTestReport", []))

    @jsii.member(jsii_name="toGetDomainDeliverabilityCampaign")
    def to_get_domain_deliverability_campaign(self) -> "SesPinpoint":
        '''(experimental) Grants permission to retrieve all the deliverability data for a specific campaign.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetDomainDeliverabilityCampaign.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetDomainDeliverabilityCampaign", []))

    @jsii.member(jsii_name="toGetDomainStatisticsReport")
    def to_get_domain_statistics_report(self) -> "SesPinpoint":
        '''(experimental) Grants permission to retrieve inbox placement and engagement rates for the domains that you use to send email.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetDomainStatisticsReport.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetDomainStatisticsReport", []))

    @jsii.member(jsii_name="toGetEmailIdentity")
    def to_get_email_identity(self) -> "SesPinpoint":
        '''(experimental) Grants permission to get information about a specific identity associated with your account.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_GetEmailIdentity.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toGetEmailIdentity", []))

    @jsii.member(jsii_name="toListConfigurationSets")
    def to_list_configuration_sets(self) -> "SesPinpoint":
        '''(experimental) Grants permission to list all of the configuration sets associated with your account.

        Access Level: List

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_ListConfigurationSets.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toListConfigurationSets", []))

    @jsii.member(jsii_name="toListDedicatedIpPools")
    def to_list_dedicated_ip_pools(self) -> "SesPinpoint":
        '''(experimental) Grants permission to list all of the dedicated IP pools that exist in your account.

        Access Level: List

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_ListDedicatedIpPools.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toListDedicatedIpPools", []))

    @jsii.member(jsii_name="toListDeliverabilityTestReports")
    def to_list_deliverability_test_reports(self) -> "SesPinpoint":
        '''(experimental) Grants permission to retrieve a list of the predictive inbox placement tests that you've performed, regardless of their statuses.

        Access Level: List

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_ListDeliverabilityTestReports.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toListDeliverabilityTestReports", []))

    @jsii.member(jsii_name="toListDomainDeliverabilityCampaigns")
    def to_list_domain_deliverability_campaigns(self) -> "SesPinpoint":
        '''(experimental) Grants permission to retrieve deliverability data for all the campaigns that used a specific domain to send email during a specified time range.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_ListDomainDeliverabilityCampaigns.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toListDomainDeliverabilityCampaigns", []))

    @jsii.member(jsii_name="toListEmailIdentities")
    def to_list_email_identities(self) -> "SesPinpoint":
        '''(experimental) Grants permission to list all of the email identities that are associated with your account.

        Access Level: List

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_ListEmailIdentities.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toListEmailIdentities", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "SesPinpoint":
        '''(experimental) Grants permission to retrieve a list of the tags (keys and values) that are associated with a specific resource.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutAccountDedicatedIpWarmupAttributes")
    def to_put_account_dedicated_ip_warmup_attributes(self) -> "SesPinpoint":
        '''(experimental) Grants permission to enable or disable the automatic warm-up feature for dedicated IP addresses.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutAccountDedicatedIpWarmupAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutAccountDedicatedIpWarmupAttributes", []))

    @jsii.member(jsii_name="toPutAccountSendingAttributes")
    def to_put_account_sending_attributes(self) -> "SesPinpoint":
        '''(experimental) Grants permission to enable or disable the ability of your account to send email.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutAccountSendingAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutAccountSendingAttributes", []))

    @jsii.member(jsii_name="toPutConfigurationSetDeliveryOptions")
    def to_put_configuration_set_delivery_options(self) -> "SesPinpoint":
        '''(experimental) Grants permission to associate a configuration set with a dedicated IP pool.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutConfigurationSetDeliveryOptions.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutConfigurationSetDeliveryOptions", []))

    @jsii.member(jsii_name="toPutConfigurationSetReputationOptions")
    def to_put_configuration_set_reputation_options(self) -> "SesPinpoint":
        '''(experimental) Grants permission to enable or disable collection of reputation metrics for emails that you send using a particular configuration set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutConfigurationSetReputationOptions.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutConfigurationSetReputationOptions", []))

    @jsii.member(jsii_name="toPutConfigurationSetSendingOptions")
    def to_put_configuration_set_sending_options(self) -> "SesPinpoint":
        '''(experimental) Grants permission to enable or disable email sending for messages that use a particular configuration set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutConfigurationSetSendingOptions.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutConfigurationSetSendingOptions", []))

    @jsii.member(jsii_name="toPutConfigurationSetTrackingOptions")
    def to_put_configuration_set_tracking_options(self) -> "SesPinpoint":
        '''(experimental) Grants permission to specify a custom domain to use for open and click tracking elements in email that you send using a particular configuration set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutConfigurationSetTrackingOptions.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutConfigurationSetTrackingOptions", []))

    @jsii.member(jsii_name="toPutDedicatedIpInPool")
    def to_put_dedicated_ip_in_pool(self) -> "SesPinpoint":
        '''(experimental) Grants permission to move a dedicated IP address to an existing dedicated IP pool.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutDedicatedIpInPool.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutDedicatedIpInPool", []))

    @jsii.member(jsii_name="toPutDedicatedIpWarmupAttributes")
    def to_put_dedicated_ip_warmup_attributes(self) -> "SesPinpoint":
        '''(experimental) Grants permission to enable dedicated IP warm up attributes.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutDedicatedIpWarmupAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutDedicatedIpWarmupAttributes", []))

    @jsii.member(jsii_name="toPutDeliverabilityDashboardOption")
    def to_put_deliverability_dashboard_option(self) -> "SesPinpoint":
        '''(experimental) Grants permission to enable or disable the Deliverability dashboard.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutDeliverabilityDashboardOption.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutDeliverabilityDashboardOption", []))

    @jsii.member(jsii_name="toPutEmailIdentityDkimAttributes")
    def to_put_email_identity_dkim_attributes(self) -> "SesPinpoint":
        '''(experimental) Grants permission to enable or disable DKIM authentication for an email identity.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutEmailIdentityDkimAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutEmailIdentityDkimAttributes", []))

    @jsii.member(jsii_name="toPutEmailIdentityFeedbackAttributes")
    def to_put_email_identity_feedback_attributes(self) -> "SesPinpoint":
        '''(experimental) Grants permission to enable or disable feedback forwarding for an identity.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutEmailIdentityFeedbackAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutEmailIdentityFeedbackAttributes", []))

    @jsii.member(jsii_name="toPutEmailIdentityMailFromAttributes")
    def to_put_email_identity_mail_from_attributes(self) -> "SesPinpoint":
        '''(experimental) Grants permission to enable or disable the custom MAIL FROM domain configuration for an email identity.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_PutEmailIdentityMailFromAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toPutEmailIdentityMailFromAttributes", []))

    @jsii.member(jsii_name="toSendEmail")
    def to_send_email(self) -> "SesPinpoint":
        '''(experimental) Grants permission to send an email message.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifFeedbackAddress()
        - .ifFromAddress()
        - .ifFromDisplayName()
        - .ifRecipients()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_SendEmail.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toSendEmail", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "SesPinpoint":
        '''(experimental) Grants permission to add one or more tags (keys and values) to a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "SesPinpoint":
        '''(experimental) Grants permission to remove one or more tags (keys and values) from a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateConfigurationSetEventDestination")
    def to_update_configuration_set_event_destination(self) -> "SesPinpoint":
        '''(experimental) Grants permission to update the configuration of an event destination for a configuration set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint-email/latest/APIReference/API_UpdateConfigurationSetEventDestination.html

        :stability: experimental
        '''
        return typing.cast("SesPinpoint", jsii.invoke(self, "toUpdateConfigurationSetEventDestination", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0edff633f91f072458d04e80b93f3affa8dd4ae7c4ef8a0c9669bfab10c97f96)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__aad92e8685b9852b6e1a9a57daf8ec28908bdd99910de40a6fc46e0f054eb266)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class SesV2(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.SesV2"):
    '''(experimental) Statement provider for service `ses-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsimpleemailservicev2.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ses-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsimpleemailservicev2.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__aebc1bf352e14a6a45590dac33fb4f7b4c2158aa3d25f1cb14e4bc4502453296)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifApiVersion")
    def if_api_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "SesV2":
        '''(experimental) Filters actions based on the SES API version.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toBatchGetMetricData()
        - .toCreateConfigurationSet()
        - .toCreateConfigurationSetEventDestination()
        - .toCreateContact()
        - .toCreateContactList()
        - .toCreateCustomVerificationEmailTemplate()
        - .toCreateDedicatedIpPool()
        - .toCreateDeliverabilityTestReport()
        - .toCreateEmailIdentity()
        - .toCreateEmailIdentityPolicy()
        - .toCreateEmailTemplate()
        - .toCreateImportJob()
        - .toDeleteConfigurationSet()
        - .toDeleteConfigurationSetEventDestination()
        - .toDeleteContact()
        - .toDeleteContactList()
        - .toDeleteCustomVerificationEmailTemplate()
        - .toDeleteDedicatedIpPool()
        - .toDeleteEmailIdentity()
        - .toDeleteEmailIdentityPolicy()
        - .toDeleteEmailTemplate()
        - .toDeleteSuppressedDestination()
        - .toGetAccount()
        - .toGetBlacklistReports()
        - .toGetConfigurationSet()
        - .toGetConfigurationSetEventDestinations()
        - .toGetContact()
        - .toGetContactList()
        - .toGetCustomVerificationEmailTemplate()
        - .toGetDedicatedIp()
        - .toGetDedicatedIpPool()
        - .toGetDedicatedIps()
        - .toGetDeliverabilityDashboardOptions()
        - .toGetDeliverabilityTestReport()
        - .toGetDomainDeliverabilityCampaign()
        - .toGetDomainStatisticsReport()
        - .toGetEmailIdentity()
        - .toGetEmailIdentityPolicies()
        - .toGetEmailTemplate()
        - .toGetImportJob()
        - .toGetSuppressedDestination()
        - .toListConfigurationSets()
        - .toListContactLists()
        - .toListContacts()
        - .toListCustomVerificationEmailTemplates()
        - .toListDedicatedIpPools()
        - .toListDeliverabilityTestReports()
        - .toListDomainDeliverabilityCampaigns()
        - .toListEmailIdentities()
        - .toListEmailTemplates()
        - .toListImportJobs()
        - .toListRecommendations()
        - .toListSuppressedDestinations()
        - .toListTagsForResource()
        - .toPutAccountDedicatedIpWarmupAttributes()
        - .toPutAccountDetails()
        - .toPutAccountSendingAttributes()
        - .toPutAccountSuppressionAttributes()
        - .toPutAccountVdmAttributes()
        - .toPutConfigurationSetDeliveryOptions()
        - .toPutConfigurationSetReputationOptions()
        - .toPutConfigurationSetSendingOptions()
        - .toPutConfigurationSetSuppressionOptions()
        - .toPutConfigurationSetTrackingOptions()
        - .toPutConfigurationSetVdmOptions()
        - .toPutDedicatedIpInPool()
        - .toPutDedicatedIpWarmupAttributes()
        - .toPutDeliverabilityDashboardOption()
        - .toPutEmailIdentityConfigurationSetAttributes()
        - .toPutEmailIdentityDkimAttributes()
        - .toPutEmailIdentityDkimSigningAttributes()
        - .toPutEmailIdentityFeedbackAttributes()
        - .toPutEmailIdentityMailFromAttributes()
        - .toPutSuppressedDestination()
        - .toSendBulkEmail()
        - .toSendCustomVerificationEmail()
        - .toSendEmail()
        - .toTagResource()
        - .toTestRenderEmailTemplate()
        - .toUntagResource()
        - .toUpdateConfigurationSetEventDestination()
        - .toUpdateContact()
        - .toUpdateContactList()
        - .toUpdateCustomVerificationEmailTemplate()
        - .toUpdateEmailIdentityPolicy()
        - .toUpdateEmailTemplate()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__939b4c47d72d1d86d986f4d6b130dcc157396b9356de260530716a26a3a68ea1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("SesV2", jsii.invoke(self, "ifApiVersion", [value, operator]))

    @jsii.member(jsii_name="ifFeedbackAddress")
    def if_feedback_address(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "SesV2":
        '''(experimental) Filters actions based on the "Return-Path" address, which specifies where bounces and complaints are sent by email feedback forwarding.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b037c9e033d5f5a573cb3677058ad0109af3e23ed5732c7cd75ee4e583417c27)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("SesV2", jsii.invoke(self, "ifFeedbackAddress", [value, operator]))

    @jsii.member(jsii_name="ifFromAddress")
    def if_from_address(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "SesV2":
        '''(experimental) Filters actions based on the "From" address of a message.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__92d0659dc748d7997ac19f3319c27b59d6c599475325dc2fca922946ba53787e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("SesV2", jsii.invoke(self, "ifFromAddress", [value, operator]))

    @jsii.member(jsii_name="ifFromDisplayName")
    def if_from_display_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "SesV2":
        '''(experimental) Filters actions based on the "From" address that is used as the display name of a message.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5877ced29aa8058dabdfccc2d8a8e0eb076153110a65e865884ef3f13a48024d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("SesV2", jsii.invoke(self, "ifFromDisplayName", [value, operator]))

    @jsii.member(jsii_name="ifRecipients")
    def if_recipients(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "SesV2":
        '''(experimental) Filters actions based on the recipient addresses of a message, which include the "To", "CC", and "BCC" addresses.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonses.html#amazonses-policy-keys

        Applies to actions:

        - .toSendEmail()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1e319a4d1bc0661c173b10e56bf1a1ed531c236311379cb35c5cd65e053aa2f0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("SesV2", jsii.invoke(self, "ifRecipients", [value, operator]))

    @jsii.member(jsii_name="onConfigurationSet")
    def on_configuration_set(
        self,
        configuration_set_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesV2":
        '''(experimental) Adds a resource of type configuration-set to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference/API_ConfigurationSet.html

        :param configuration_set_name: - Identifier for the configurationSetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__75deed51736a745188e5abde2c7e44508772b495fc27d98568012f8dc0403848)
            check_type(argname="argument configuration_set_name", value=configuration_set_name, expected_type=type_hints["configuration_set_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SesV2", jsii.invoke(self, "onConfigurationSet", [configuration_set_name, account, region, partition]))

    @jsii.member(jsii_name="onContactList")
    def on_contact_list(
        self,
        contact_list_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesV2":
        '''(experimental) Adds a resource of type contact-list to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ContactList.html

        :param contact_list_name: - Identifier for the contactListName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b4f0496a0413816e2008d92ef22742a61f4c5e3cedbdbf374afdd1e4ad8babb2)
            check_type(argname="argument contact_list_name", value=contact_list_name, expected_type=type_hints["contact_list_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SesV2", jsii.invoke(self, "onContactList", [contact_list_name, account, region, partition]))

    @jsii.member(jsii_name="onCustomVerificationEmailTemplate")
    def on_custom_verification_email_template(
        self,
        template_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesV2":
        '''(experimental) Adds a resource of type custom-verification-email-template to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CustomVerificationEmailTemplateMetadata.html

        :param template_name: - Identifier for the templateName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4a7b03c8b6368809daa7eaec12e66e109a64d0d4ef86c8b9b4448c46d6f1454f)
            check_type(argname="argument template_name", value=template_name, expected_type=type_hints["template_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SesV2", jsii.invoke(self, "onCustomVerificationEmailTemplate", [template_name, account, region, partition]))

    @jsii.member(jsii_name="onDedicatedIpPool")
    def on_dedicated_ip_pool(
        self,
        dedicated_ip_pool: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesV2":
        '''(experimental) Adds a resource of type dedicated-ip-pool to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DedicatedIp.html

        :param dedicated_ip_pool: - Identifier for the dedicatedIPPool.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3a45bcdf45ecceecc0b1dc8f14b60c0524f4e3f2025e87dac7961e5035cb7f8f)
            check_type(argname="argument dedicated_ip_pool", value=dedicated_ip_pool, expected_type=type_hints["dedicated_ip_pool"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SesV2", jsii.invoke(self, "onDedicatedIpPool", [dedicated_ip_pool, account, region, partition]))

    @jsii.member(jsii_name="onDeliverabilityTestReport")
    def on_deliverability_test_report(
        self,
        report_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesV2":
        '''(experimental) Adds a resource of type deliverability-test-report to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeliverabilityTestReport.html

        :param report_id: - Identifier for the reportId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8a0b1ba541d8c5ff25538dcb9d4cb9a0774cc38997239aa92c22aad393aec427)
            check_type(argname="argument report_id", value=report_id, expected_type=type_hints["report_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SesV2", jsii.invoke(self, "onDeliverabilityTestReport", [report_id, account, region, partition]))

    @jsii.member(jsii_name="onIdentity")
    def on_identity(
        self,
        identity_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesV2":
        '''(experimental) Adds a resource of type identity to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_IdentityInfo.html

        :param identity_name: - Identifier for the identityName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__12a16f666a99e8de55b24fd39aef36d1f8c311bf5aba32cc949b61ea9b831b2b)
            check_type(argname="argument identity_name", value=identity_name, expected_type=type_hints["identity_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SesV2", jsii.invoke(self, "onIdentity", [identity_name, account, region, partition]))

    @jsii.member(jsii_name="onImportJob")
    def on_import_job(
        self,
        import_job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesV2":
        '''(experimental) Adds a resource of type import-job to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ImportJobSummary.html

        :param import_job_id: - Identifier for the importJobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2bf136e0afdf29a3eef64d4e0b6383f81b04c0e7e6b3d907dae454663a6df7be)
            check_type(argname="argument import_job_id", value=import_job_id, expected_type=type_hints["import_job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SesV2", jsii.invoke(self, "onImportJob", [import_job_id, account, region, partition]))

    @jsii.member(jsii_name="onTemplate")
    def on_template(
        self,
        template_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SesV2":
        '''(experimental) Adds a resource of type template to the statement.

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_Template.html

        :param template_name: - Identifier for the templateName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7c628c4243c208a6be09c8175a97e2b318991072889f93bbf7d7616925aba3af)
            check_type(argname="argument template_name", value=template_name, expected_type=type_hints["template_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SesV2", jsii.invoke(self, "onTemplate", [template_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchGetMetricData")
    def to_batch_get_metric_data(self) -> "SesV2":
        '''(experimental) Grants permission to get metric data on your activity.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_BatchGetMetricData.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toBatchGetMetricData", []))

    @jsii.member(jsii_name="toCreateConfigurationSet")
    def to_create_configuration_set(self) -> "SesV2":
        '''(experimental) Grants permission to create a new configuration set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateConfigurationSet.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateConfigurationSet", []))

    @jsii.member(jsii_name="toCreateConfigurationSetEventDestination")
    def to_create_configuration_set_event_destination(self) -> "SesV2":
        '''(experimental) Grants permission to create a configuration set event destination.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateConfigurationSetEventDestination.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateConfigurationSetEventDestination", []))

    @jsii.member(jsii_name="toCreateContact")
    def to_create_contact(self) -> "SesV2":
        '''(experimental) Grants permission to create a contact.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateContact.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateContact", []))

    @jsii.member(jsii_name="toCreateContactList")
    def to_create_contact_list(self) -> "SesV2":
        '''(experimental) Grants permission to create a contact list.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateContactList.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateContactList", []))

    @jsii.member(jsii_name="toCreateCustomVerificationEmailTemplate")
    def to_create_custom_verification_email_template(self) -> "SesV2":
        '''(experimental) Grants permission to create a new custom verification email template.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateCustomVerificationEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateCustomVerificationEmailTemplate", []))

    @jsii.member(jsii_name="toCreateDedicatedIpPool")
    def to_create_dedicated_ip_pool(self) -> "SesV2":
        '''(experimental) Grants permission to create a new pool of dedicated IP addresses.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateDedicatedIpPool.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateDedicatedIpPool", []))

    @jsii.member(jsii_name="toCreateDeliverabilityTestReport")
    def to_create_deliverability_test_report(self) -> "SesV2":
        '''(experimental) Grants permission to create a new predictive inbox placement test.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateDeliverabilityTestReport.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateDeliverabilityTestReport", []))

    @jsii.member(jsii_name="toCreateEmailIdentity")
    def to_create_email_identity(self) -> "SesV2":
        '''(experimental) Grants permission to start the process of verifying an email identity.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateEmailIdentity.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateEmailIdentity", []))

    @jsii.member(jsii_name="toCreateEmailIdentityPolicy")
    def to_create_email_identity_policy(self) -> "SesV2":
        '''(experimental) Grants permission to create the specified sending authorization policy for the given identity.

        Access Level: Permissions management

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateEmailIdentityPolicy.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateEmailIdentityPolicy", []))

    @jsii.member(jsii_name="toCreateEmailTemplate")
    def to_create_email_template(self) -> "SesV2":
        '''(experimental) Grants permission to create an email template.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateEmailTemplate", []))

    @jsii.member(jsii_name="toCreateImportJob")
    def to_create_import_job(self) -> "SesV2":
        '''(experimental) Grants permission to creates an import job for a data destination.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_CreateImportJob.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toCreateImportJob", []))

    @jsii.member(jsii_name="toDeleteConfigurationSet")
    def to_delete_configuration_set(self) -> "SesV2":
        '''(experimental) Grants permission to delete an existing configuration set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeleteConfigurationSet.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toDeleteConfigurationSet", []))

    @jsii.member(jsii_name="toDeleteConfigurationSetEventDestination")
    def to_delete_configuration_set_event_destination(self) -> "SesV2":
        '''(experimental) Grants permission to delete an event destination.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeleteConfigurationSetEventDestination.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toDeleteConfigurationSetEventDestination", []))

    @jsii.member(jsii_name="toDeleteContact")
    def to_delete_contact(self) -> "SesV2":
        '''(experimental) Grants permission to delete a contact from a contact list.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeleteContact.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toDeleteContact", []))

    @jsii.member(jsii_name="toDeleteContactList")
    def to_delete_contact_list(self) -> "SesV2":
        '''(experimental) Grants permission to delete a contact list with all of its contacts.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeleteContactList.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toDeleteContactList", []))

    @jsii.member(jsii_name="toDeleteCustomVerificationEmailTemplate")
    def to_delete_custom_verification_email_template(self) -> "SesV2":
        '''(experimental) Grants permission to delete an existing custom verification email template.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeleteCustomVerificationEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toDeleteCustomVerificationEmailTemplate", []))

    @jsii.member(jsii_name="toDeleteDedicatedIpPool")
    def to_delete_dedicated_ip_pool(self) -> "SesV2":
        '''(experimental) Grants permission to delete a dedicated IP pool.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeleteDedicatedIpPool.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toDeleteDedicatedIpPool", []))

    @jsii.member(jsii_name="toDeleteEmailIdentity")
    def to_delete_email_identity(self) -> "SesV2":
        '''(experimental) Grants permission to delete an email identity.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeleteEmailIdentity.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toDeleteEmailIdentity", []))

    @jsii.member(jsii_name="toDeleteEmailIdentityPolicy")
    def to_delete_email_identity_policy(self) -> "SesV2":
        '''(experimental) Grants permission to delete the specified sending authorization policy for the given identity (an email address or a domain).

        Access Level: Permissions management

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeleteEmailIdentityPolicy.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toDeleteEmailIdentityPolicy", []))

    @jsii.member(jsii_name="toDeleteEmailTemplate")
    def to_delete_email_template(self) -> "SesV2":
        '''(experimental) Grants permission to delete an email template.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeleteEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toDeleteEmailTemplate", []))

    @jsii.member(jsii_name="toDeleteSuppressedDestination")
    def to_delete_suppressed_destination(self) -> "SesV2":
        '''(experimental) Grants permission to remove an email address from the suppression list for your account.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_DeleteSuppressedDestination.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toDeleteSuppressedDestination", []))

    @jsii.member(jsii_name="toGetAccount")
    def to_get_account(self) -> "SesV2":
        '''(experimental) Grants permission to get information about the email-sending status and capabilities for your account.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetAccount.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetAccount", []))

    @jsii.member(jsii_name="toGetBlacklistReports")
    def to_get_blacklist_reports(self) -> "SesV2":
        '''(experimental) Grants permission to retrieve a list of the deny lists on which your dedicated IP addresses or tracked domains appear.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetBlacklistReports.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetBlacklistReports", []))

    @jsii.member(jsii_name="toGetConfigurationSet")
    def to_get_configuration_set(self) -> "SesV2":
        '''(experimental) Grants permission to get information about an existing configuration set.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetConfigurationSet.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetConfigurationSet", []))

    @jsii.member(jsii_name="toGetConfigurationSetEventDestinations")
    def to_get_configuration_set_event_destinations(self) -> "SesV2":
        '''(experimental) Grants permission to retrieve a list of event destinations that are associated with a configuration set.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetConfigurationSetEventDestinations.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetConfigurationSetEventDestinations", []))

    @jsii.member(jsii_name="toGetContact")
    def to_get_contact(self) -> "SesV2":
        '''(experimental) Grants permission to return a contact from a contact list.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetContact.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetContact", []))

    @jsii.member(jsii_name="toGetContactList")
    def to_get_contact_list(self) -> "SesV2":
        '''(experimental) Grants permission to return contact list metadata.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetContactList.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetContactList", []))

    @jsii.member(jsii_name="toGetCustomVerificationEmailTemplate")
    def to_get_custom_verification_email_template(self) -> "SesV2":
        '''(experimental) Grants permission to return the custom email verification template for the template name you specify.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetCustomVerificationEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetCustomVerificationEmailTemplate", []))

    @jsii.member(jsii_name="toGetDedicatedIp")
    def to_get_dedicated_ip(self) -> "SesV2":
        '''(experimental) Grants permission to get information about a dedicated IP address.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetDedicatedIp.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetDedicatedIp", []))

    @jsii.member(jsii_name="toGetDedicatedIpPool")
    def to_get_dedicated_ip_pool(self) -> "SesV2":
        '''(experimental) Grants permission to get information about a dedicated IP pool.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetDedicatedIpPool.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetDedicatedIpPool", []))

    @jsii.member(jsii_name="toGetDedicatedIps")
    def to_get_dedicated_ips(self) -> "SesV2":
        '''(experimental) Grants permission to list the dedicated IP addresses a dedicated IP pool.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetDedicatedIps.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetDedicatedIps", []))

    @jsii.member(jsii_name="toGetDeliverabilityDashboardOptions")
    def to_get_deliverability_dashboard_options(self) -> "SesV2":
        '''(experimental) Grants permission to get the status of the Deliverability dashboard.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetDeliverabilityDashboardOptions.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetDeliverabilityDashboardOptions", []))

    @jsii.member(jsii_name="toGetDeliverabilityTestReport")
    def to_get_deliverability_test_report(self) -> "SesV2":
        '''(experimental) Grants permission to retrieve the results of a predictive inbox placement test.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetDeliverabilityTestReport.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetDeliverabilityTestReport", []))

    @jsii.member(jsii_name="toGetDomainDeliverabilityCampaign")
    def to_get_domain_deliverability_campaign(self) -> "SesV2":
        '''(experimental) Grants permission to retrieve all the deliverability data for a specific campaign.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetDomainDeliverabilityCampaign.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetDomainDeliverabilityCampaign", []))

    @jsii.member(jsii_name="toGetDomainStatisticsReport")
    def to_get_domain_statistics_report(self) -> "SesV2":
        '''(experimental) Grants permission to retrieve inbox placement and engagement rates for the domains that you use to send email.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetDomainStatisticsReport.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetDomainStatisticsReport", []))

    @jsii.member(jsii_name="toGetEmailIdentity")
    def to_get_email_identity(self) -> "SesV2":
        '''(experimental) Grants permission to get information about a specific identity.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetEmailIdentity.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetEmailIdentity", []))

    @jsii.member(jsii_name="toGetEmailIdentityPolicies")
    def to_get_email_identity_policies(self) -> "SesV2":
        '''(experimental) Grants permission to return the requested sending authorization policies for the given identity (an email address or a domain).

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetEmailIdentityPolicies.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetEmailIdentityPolicies", []))

    @jsii.member(jsii_name="toGetEmailTemplate")
    def to_get_email_template(self) -> "SesV2":
        '''(experimental) Grants permission to return the template object, which includes the subject line, HTML part, and text part for the template you specify.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetEmailTemplate", []))

    @jsii.member(jsii_name="toGetImportJob")
    def to_get_import_job(self) -> "SesV2":
        '''(experimental) Grants permission to provide information about an import job.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetImportJob.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetImportJob", []))

    @jsii.member(jsii_name="toGetSuppressedDestination")
    def to_get_suppressed_destination(self) -> "SesV2":
        '''(experimental) Grants permission to retrieve information about a specific email address that's on the suppression list for your account.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetSuppressedDestination.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toGetSuppressedDestination", []))

    @jsii.member(jsii_name="toListConfigurationSets")
    def to_list_configuration_sets(self) -> "SesV2":
        '''(experimental) Grants permission to list all of the configuration sets for your account.

        Access Level: List

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListConfigurationSets.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListConfigurationSets", []))

    @jsii.member(jsii_name="toListContactLists")
    def to_list_contact_lists(self) -> "SesV2":
        '''(experimental) Grants permission to list all of the contact lists available for your account.

        Access Level: List

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListContactLists.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListContactLists", []))

    @jsii.member(jsii_name="toListContacts")
    def to_list_contacts(self) -> "SesV2":
        '''(experimental) Grants permission to list the contacts present in a specific contact list.

        Access Level: List

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListContacts.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListContacts", []))

    @jsii.member(jsii_name="toListCustomVerificationEmailTemplates")
    def to_list_custom_verification_email_templates(self) -> "SesV2":
        '''(experimental) Grants permission to list all of the existing custom verification email templates for your account.

        Access Level: List

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListCustomVerificationEmailTemplates.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListCustomVerificationEmailTemplates", []))

    @jsii.member(jsii_name="toListDedicatedIpPools")
    def to_list_dedicated_ip_pools(self) -> "SesV2":
        '''(experimental) Grants permission to list all of the dedicated IP pools for your account.

        Access Level: List

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListDedicatedIpPools.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListDedicatedIpPools", []))

    @jsii.member(jsii_name="toListDeliverabilityTestReports")
    def to_list_deliverability_test_reports(self) -> "SesV2":
        '''(experimental) Grants permission to retrieve the list of the predictive inbox placement tests that you've performed, regardless of their statuses, for your account.

        Access Level: List

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListDeliverabilityTestReports.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListDeliverabilityTestReports", []))

    @jsii.member(jsii_name="toListDomainDeliverabilityCampaigns")
    def to_list_domain_deliverability_campaigns(self) -> "SesV2":
        '''(experimental) Grants permission to list deliverability data for campaigns that used a specific domain to send email during a specified time range.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListDomainDeliverabilityCampaigns.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListDomainDeliverabilityCampaigns", []))

    @jsii.member(jsii_name="toListEmailIdentities")
    def to_list_email_identities(self) -> "SesV2":
        '''(experimental) Grants permission to list the email identities for your account.

        Access Level: List

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListEmailIdentities.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListEmailIdentities", []))

    @jsii.member(jsii_name="toListEmailTemplates")
    def to_list_email_templates(self) -> "SesV2":
        '''(experimental) Grants permission to list all of the email templates for your account.

        Access Level: List

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListEmailTemplates.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListEmailTemplates", []))

    @jsii.member(jsii_name="toListImportJobs")
    def to_list_import_jobs(self) -> "SesV2":
        '''(experimental) Grants permission to list all of the import jobs for your account.

        Access Level: List

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListImportJobs.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListImportJobs", []))

    @jsii.member(jsii_name="toListRecommendations")
    def to_list_recommendations(self) -> "SesV2":
        '''(experimental) Grants permission to list recommendations for your account.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListRecommendations.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListRecommendations", []))

    @jsii.member(jsii_name="toListSuppressedDestinations")
    def to_list_suppressed_destinations(self) -> "SesV2":
        '''(experimental) Grants permission to list email addresses that are on the suppression list for your account.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListSuppressedDestinations.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListSuppressedDestinations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "SesV2":
        '''(experimental) Grants permission to retrieve a list of the tags (keys and values) that are associated with a specific resource for your account.

        Access Level: Read

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutAccountDedicatedIpWarmupAttributes")
    def to_put_account_dedicated_ip_warmup_attributes(self) -> "SesV2":
        '''(experimental) Grants permission to enable or disable the automatic warm-up feature for dedicated IP addresses.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutAccountDedicatedIpWarmupAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutAccountDedicatedIpWarmupAttributes", []))

    @jsii.member(jsii_name="toPutAccountDetails")
    def to_put_account_details(self) -> "SesV2":
        '''(experimental) Grants permission to update your account details.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutAccountDetails.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutAccountDetails", []))

    @jsii.member(jsii_name="toPutAccountSendingAttributes")
    def to_put_account_sending_attributes(self) -> "SesV2":
        '''(experimental) Grants permission to enable or disable the ability to send email for your account.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutAccountSendingAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutAccountSendingAttributes", []))

    @jsii.member(jsii_name="toPutAccountSuppressionAttributes")
    def to_put_account_suppression_attributes(self) -> "SesV2":
        '''(experimental) Grants permission to change the settings for the account-level suppression list.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutAccountSuppressionAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutAccountSuppressionAttributes", []))

    @jsii.member(jsii_name="toPutAccountVdmAttributes")
    def to_put_account_vdm_attributes(self) -> "SesV2":
        '''(experimental) Grants permission to change the settings for VDM for your account.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutAccountVdmAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutAccountVdmAttributes", []))

    @jsii.member(jsii_name="toPutConfigurationSetDeliveryOptions")
    def to_put_configuration_set_delivery_options(self) -> "SesV2":
        '''(experimental) Grants permission to associate a configuration set with a dedicated IP pool.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutConfigurationSetDeliveryOptions.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutConfigurationSetDeliveryOptions", []))

    @jsii.member(jsii_name="toPutConfigurationSetReputationOptions")
    def to_put_configuration_set_reputation_options(self) -> "SesV2":
        '''(experimental) Grants permission to enable or disable collection of reputation metrics for emails that you send using a particular configuration set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutConfigurationSetReputationOptions.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutConfigurationSetReputationOptions", []))

    @jsii.member(jsii_name="toPutConfigurationSetSendingOptions")
    def to_put_configuration_set_sending_options(self) -> "SesV2":
        '''(experimental) Grants permission to enable or disable email sending for messages that use a particular configuration set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutConfigurationSetSendingOptions.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutConfigurationSetSendingOptions", []))

    @jsii.member(jsii_name="toPutConfigurationSetSuppressionOptions")
    def to_put_configuration_set_suppression_options(self) -> "SesV2":
        '''(experimental) Grants permission to specify the account suppression list preferences for a particular configuration set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutConfigurationSetSuppressionOptions.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutConfigurationSetSuppressionOptions", []))

    @jsii.member(jsii_name="toPutConfigurationSetTrackingOptions")
    def to_put_configuration_set_tracking_options(self) -> "SesV2":
        '''(experimental) Grants permission to specify a custom domain to use for open and click tracking elements in email that you send for a particular configuration set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutConfigurationSetTrackingOptions.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutConfigurationSetTrackingOptions", []))

    @jsii.member(jsii_name="toPutConfigurationSetVdmOptions")
    def to_put_configuration_set_vdm_options(self) -> "SesV2":
        '''(experimental) Grants permission to override account-level VDM settings for a particular configuration set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutConfigurationSetVdmOptions.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutConfigurationSetVdmOptions", []))

    @jsii.member(jsii_name="toPutDedicatedIpInPool")
    def to_put_dedicated_ip_in_pool(self) -> "SesV2":
        '''(experimental) Grants permission to move a dedicated IP address to an existing dedicated IP pool.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutDedicatedIpInPool.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutDedicatedIpInPool", []))

    @jsii.member(jsii_name="toPutDedicatedIpWarmupAttributes")
    def to_put_dedicated_ip_warmup_attributes(self) -> "SesV2":
        '''(experimental) Grants permission to put Dedicated IP warm up attributes.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutDedicatedIpWarmupAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutDedicatedIpWarmupAttributes", []))

    @jsii.member(jsii_name="toPutDeliverabilityDashboardOption")
    def to_put_deliverability_dashboard_option(self) -> "SesV2":
        '''(experimental) Grants permission to enable or disable the Deliverability dashboard.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutDeliverabilityDashboardOption.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutDeliverabilityDashboardOption", []))

    @jsii.member(jsii_name="toPutEmailIdentityConfigurationSetAttributes")
    def to_put_email_identity_configuration_set_attributes(self) -> "SesV2":
        '''(experimental) Grants permission to associate a configuration set with an email identity.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutEmailIdentityConfigurationSetAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutEmailIdentityConfigurationSetAttributes", []))

    @jsii.member(jsii_name="toPutEmailIdentityDkimAttributes")
    def to_put_email_identity_dkim_attributes(self) -> "SesV2":
        '''(experimental) Grants permission to enable or disable DKIM authentication for an email identity.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutEmailIdentityDkimAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutEmailIdentityDkimAttributes", []))

    @jsii.member(jsii_name="toPutEmailIdentityDkimSigningAttributes")
    def to_put_email_identity_dkim_signing_attributes(self) -> "SesV2":
        '''(experimental) Grants permission to configure or change the DKIM authentication settings for an email domain identity.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutEmailIdentityDkimSigningAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutEmailIdentityDkimSigningAttributes", []))

    @jsii.member(jsii_name="toPutEmailIdentityFeedbackAttributes")
    def to_put_email_identity_feedback_attributes(self) -> "SesV2":
        '''(experimental) Grants permission to enable or disable feedback forwarding for an email identity.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutEmailIdentityFeedbackAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutEmailIdentityFeedbackAttributes", []))

    @jsii.member(jsii_name="toPutEmailIdentityMailFromAttributes")
    def to_put_email_identity_mail_from_attributes(self) -> "SesV2":
        '''(experimental) Grants permission to enable or disable the custom MAIL FROM domain configuration for an email identity.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutEmailIdentityMailFromAttributes.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutEmailIdentityMailFromAttributes", []))

    @jsii.member(jsii_name="toPutSuppressedDestination")
    def to_put_suppressed_destination(self) -> "SesV2":
        '''(experimental) Grants permission to add an email address to the suppression list.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_PutSuppressedDestination.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toPutSuppressedDestination", []))

    @jsii.member(jsii_name="toSendBulkEmail")
    def to_send_bulk_email(self) -> "SesV2":
        '''(experimental) Grants permission to compose an email message to multiple destinations.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_SendBulkEmail.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toSendBulkEmail", []))

    @jsii.member(jsii_name="toSendCustomVerificationEmail")
    def to_send_custom_verification_email(self) -> "SesV2":
        '''(experimental) Grants permission to add an email address to the list of identities and attempts to verify it.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_SendCustomVerificationEmail.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toSendCustomVerificationEmail", []))

    @jsii.member(jsii_name="toSendEmail")
    def to_send_email(self) -> "SesV2":
        '''(experimental) Grants permission to send an email message.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifFeedbackAddress()
        - .ifFromAddress()
        - .ifFromDisplayName()
        - .ifRecipients()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_SendEmail.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toSendEmail", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "SesV2":
        '''(experimental) Grants permission to add one or more tags (keys and values) to a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestRenderEmailTemplate")
    def to_test_render_email_template(self) -> "SesV2":
        '''(experimental) Grants permission to create a preview of the MIME content of an email when provided with a template and a set of replacement data.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_TestRenderEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toTestRenderEmailTemplate", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "SesV2":
        '''(experimental) Grants permission to remove one or more tags (keys and values) from a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateConfigurationSetEventDestination")
    def to_update_configuration_set_event_destination(self) -> "SesV2":
        '''(experimental) Grants permission to update the configuration of an event destination for a configuration set.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_UpdateConfigurationSetEventDestination.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toUpdateConfigurationSetEventDestination", []))

    @jsii.member(jsii_name="toUpdateContact")
    def to_update_contact(self) -> "SesV2":
        '''(experimental) Grants permission to update a contact's preferences for a list.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_UpdateContact.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toUpdateContact", []))

    @jsii.member(jsii_name="toUpdateContactList")
    def to_update_contact_list(self) -> "SesV2":
        '''(experimental) Grants permission to update contact list metadata.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_UpdateContactList.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toUpdateContactList", []))

    @jsii.member(jsii_name="toUpdateCustomVerificationEmailTemplate")
    def to_update_custom_verification_email_template(self) -> "SesV2":
        '''(experimental) Grants permission to update an existing custom verification email template.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_UpdateCustomVerificationEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toUpdateCustomVerificationEmailTemplate", []))

    @jsii.member(jsii_name="toUpdateEmailIdentityPolicy")
    def to_update_email_identity_policy(self) -> "SesV2":
        '''(experimental) Grants permission to update the specified sending authorization policy for the given identity (an email address or a domain).

        Access Level: Permissions management

        Possible conditions:

        - .ifApiVersion()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_UpdateEmailIdentityPolicy.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toUpdateEmailIdentityPolicy", []))

    @jsii.member(jsii_name="toUpdateEmailTemplate")
    def to_update_email_template(self) -> "SesV2":
        '''(experimental) Grants permission to update an email template.

        Access Level: Write

        Possible conditions:

        - .ifApiVersion()

        https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_UpdateEmailTemplate.html

        :stability: experimental
        '''
        return typing.cast("SesV2", jsii.invoke(self, "toUpdateEmailTemplate", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__672d896d229630d5445a80343a0e1527cd296ed2219135e78154417168190b83)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ebeee6f37ae5b8253b97bf49de897cf9b4afd3d52cd3e4f068f2d1d19b8883bb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Shield(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Shield"):
    '''(experimental) Statement provider for service `shield <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsshield.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `shield <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsshield.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7b4feae8832287c5ea0116aa537a50d03f466e019802ac0f48ab8f3698cc390c)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAttack")
    def on_attack(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Shield":
        '''(experimental) Adds a resource of type attack to the statement.

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_AttackDetail.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c7110de9eeaada351e5bdd1762070d0241fc3413c9c4b59c3c8c2f6c76c45018)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Shield", jsii.invoke(self, "onAttack", [id, account, partition]))

    @jsii.member(jsii_name="onProtection")
    def on_protection(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Shield":
        '''(experimental) Adds a resource of type protection to the statement.

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_Protection.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f6dcca718b7a58e2b1c04174ea401da2965718cb8b36a2121ab80c434a1d9692)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Shield", jsii.invoke(self, "onProtection", [id, account, partition]))

    @jsii.member(jsii_name="onProtectionGroup")
    def on_protection_group(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Shield":
        '''(experimental) Adds a resource of type protection-group to the statement.

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_ProtectionGroup.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bffbd26642a3c2c730ffcf9bf45caa2adf08982eb7fcaaa1897b18cab285b4ba)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Shield", jsii.invoke(self, "onProtectionGroup", [id, account, partition]))

    @jsii.member(jsii_name="toAssociateDRTLogBucket")
    def to_associate_drt_log_bucket(self) -> "Shield":
        '''(experimental) Grants permission to authorize the DDoS Response team to access the specified Amazon S3 bucket containing your flow logs.

        Access Level: Write

        Dependent actions:

        - s3:GetBucketPolicy
        - s3:PutBucketPolicy

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_AssociateDRTLogBucket.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toAssociateDRTLogBucket", []))

    @jsii.member(jsii_name="toAssociateDRTRole")
    def to_associate_drt_role(self) -> "Shield":
        '''(experimental) Grants permission to authorize the DDoS Response team using the specified role, to access your AWS account to assist with DDoS attack mitigation during potential attacks.

        Access Level: Write

        Dependent actions:

        - iam:GetRole
        - iam:ListAttachedRolePolicies
        - iam:PassRole

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_AssociateDRTRole.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toAssociateDRTRole", []))

    @jsii.member(jsii_name="toAssociateHealthCheck")
    def to_associate_health_check(self) -> "Shield":
        '''(experimental) Grants permission to add health-based detection to the Shield Advanced protection for a resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - route53:GetHealthCheck

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_AssociateHealthCheck.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toAssociateHealthCheck", []))

    @jsii.member(jsii_name="toAssociateProactiveEngagementDetails")
    def to_associate_proactive_engagement_details(self) -> "Shield":
        '''(experimental) Grants permission to initialize proactive engagement and set the list of contacts for the DDoS Response Team (DRT) to use.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_AssociateProactiveEngagementDetails.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toAssociateProactiveEngagementDetails", []))

    @jsii.member(jsii_name="toCreateProtection")
    def to_create_protection(self) -> "Shield":
        '''(experimental) Grants permission to activate DDoS protection service for a given resource ARN.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_CreateProtection.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toCreateProtection", []))

    @jsii.member(jsii_name="toCreateProtectionGroup")
    def to_create_protection_group(self) -> "Shield":
        '''(experimental) Grants permission to create a grouping of protected resources so they can be handled as a collective.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_CreateProtectionGroup.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toCreateProtectionGroup", []))

    @jsii.member(jsii_name="toCreateSubscription")
    def to_create_subscription(self) -> "Shield":
        '''(experimental) Grants permission to activate subscription.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_CreateSubscription.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toCreateSubscription", []))

    @jsii.member(jsii_name="toDeleteProtection")
    def to_delete_protection(self) -> "Shield":
        '''(experimental) Grants permission to delete an existing protection.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DeleteProtection.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDeleteProtection", []))

    @jsii.member(jsii_name="toDeleteProtectionGroup")
    def to_delete_protection_group(self) -> "Shield":
        '''(experimental) Grants permission to remove the specified protection group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DeleteProtectionGroup.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDeleteProtectionGroup", []))

    @jsii.member(jsii_name="toDeleteSubscription")
    def to_delete_subscription(self) -> "Shield":
        '''(experimental) Grants permission to deactivate subscription.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DeleteSubscription.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDeleteSubscription", []))

    @jsii.member(jsii_name="toDescribeAttack")
    def to_describe_attack(self) -> "Shield":
        '''(experimental) Grants permission to get attack details.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DescribeAttack.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDescribeAttack", []))

    @jsii.member(jsii_name="toDescribeAttackStatistics")
    def to_describe_attack_statistics(self) -> "Shield":
        '''(experimental) Grants permission to describe information about the number and type of attacks AWS Shield has detected in the last year.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DescribeAttackStatistics.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDescribeAttackStatistics", []))

    @jsii.member(jsii_name="toDescribeDRTAccess")
    def to_describe_drt_access(self) -> "Shield":
        '''(experimental) Grants permission to describe the current role and list of Amazon S3 log buckets used by the DDoS Response team to access your AWS account while assisting with attack mitigation.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DescribeDRTAccess.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDescribeDRTAccess", []))

    @jsii.member(jsii_name="toDescribeEmergencyContactSettings")
    def to_describe_emergency_contact_settings(self) -> "Shield":
        '''(experimental) Grants permission to list the email addresses that the DRT can use to contact you during a suspected attack.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DescribeEmergencyContactSettings.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDescribeEmergencyContactSettings", []))

    @jsii.member(jsii_name="toDescribeProtection")
    def to_describe_protection(self) -> "Shield":
        '''(experimental) Grants permission to get protection details.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DescribeProtection.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDescribeProtection", []))

    @jsii.member(jsii_name="toDescribeProtectionGroup")
    def to_describe_protection_group(self) -> "Shield":
        '''(experimental) Grants permission to describe the specification for the specified protection group.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DescribeProtectionGroup.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDescribeProtectionGroup", []))

    @jsii.member(jsii_name="toDescribeSubscription")
    def to_describe_subscription(self) -> "Shield":
        '''(experimental) Grants permission to get subscription details, such as start time.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DescribeSubscription.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDescribeSubscription", []))

    @jsii.member(jsii_name="toDisableApplicationLayerAutomaticResponse")
    def to_disable_application_layer_automatic_response(self) -> "Shield":
        '''(experimental) Grants permission to disable application layer automatic response for Shield Advanced protection for a resource.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DisableApplicationLayerAutomaticResponse.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDisableApplicationLayerAutomaticResponse", []))

    @jsii.member(jsii_name="toDisableProactiveEngagement")
    def to_disable_proactive_engagement(self) -> "Shield":
        '''(experimental) Grants permission to remove authorization from the DDoS Response Team (DRT) to notify contacts about escalations.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DisableProactiveEngagement.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDisableProactiveEngagement", []))

    @jsii.member(jsii_name="toDisassociateDRTLogBucket")
    def to_disassociate_drt_log_bucket(self) -> "Shield":
        '''(experimental) Grants permission to remove the DDoS Response team's access to the specified Amazon S3 bucket containing your flow logs.

        Access Level: Write

        Dependent actions:

        - s3:DeleteBucketPolicy
        - s3:GetBucketPolicy
        - s3:PutBucketPolicy

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DisassociateDRTLogBucket.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDisassociateDRTLogBucket", []))

    @jsii.member(jsii_name="toDisassociateDRTRole")
    def to_disassociate_drt_role(self) -> "Shield":
        '''(experimental) Grants permission to remove the DDoS Response team's access to your AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DisassociateDRTRole.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDisassociateDRTRole", []))

    @jsii.member(jsii_name="toDisassociateHealthCheck")
    def to_disassociate_health_check(self) -> "Shield":
        '''(experimental) Grants permission to remove health-based detection from the Shield Advanced protection for a resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_DisassociateHealthCheck.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toDisassociateHealthCheck", []))

    @jsii.member(jsii_name="toEnableApplicationLayerAutomaticResponse")
    def to_enable_application_layer_automatic_response(self) -> "Shield":
        '''(experimental) Grants permission to enable application layer automatic response for Shield Advanced protection for a resource.

        Access Level: Write

        Dependent actions:

        - cloudfront:GetDistribution
        - iam:CreateServiceLinkedRole
        - iam:GetRole

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_EnableApplicationLayerAutomaticResponse.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toEnableApplicationLayerAutomaticResponse", []))

    @jsii.member(jsii_name="toEnableProactiveEngagement")
    def to_enable_proactive_engagement(self) -> "Shield":
        '''(experimental) Grants permission to authorize the DDoS Response Team (DRT) to use email and phone to notify contacts about escalations.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_EnableProactiveEngagement.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toEnableProactiveEngagement", []))

    @jsii.member(jsii_name="toGetSubscriptionState")
    def to_get_subscription_state(self) -> "Shield":
        '''(experimental) Grants permission to get subscription state.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_GetSubscriptionState.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toGetSubscriptionState", []))

    @jsii.member(jsii_name="toListAttacks")
    def to_list_attacks(self) -> "Shield":
        '''(experimental) Grants permission to list all existing attacks.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_ListAttacks.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toListAttacks", []))

    @jsii.member(jsii_name="toListProtectionGroups")
    def to_list_protection_groups(self) -> "Shield":
        '''(experimental) Grants permission to retrieve the protection groups for the account.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_ListProtectionGroups.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toListProtectionGroups", []))

    @jsii.member(jsii_name="toListProtections")
    def to_list_protections(self) -> "Shield":
        '''(experimental) Grants permission to list all existing protections.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_ListProtections.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toListProtections", []))

    @jsii.member(jsii_name="toListResourcesInProtectionGroup")
    def to_list_resources_in_protection_group(self) -> "Shield":
        '''(experimental) Grants permission to retrieve the resources that are included in the protection group.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_ListResourcesInProtectionGroup.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toListResourcesInProtectionGroup", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Shield":
        '''(experimental) Grants permission to get information about AWS tags for a specified Amazon Resource Name (ARN) in AWS Shield.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Shield":
        '''(experimental) Grants permission to add or updates tags for a resource in AWS Shield.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Shield":
        '''(experimental) Grants permission to remove tags from a resource in AWS Shield.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplicationLayerAutomaticResponse")
    def to_update_application_layer_automatic_response(self) -> "Shield":
        '''(experimental) Grants permission to update application layer automatic response for Shield Advanced protection for a resource.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_UpdateApplicationLayerAutomaticResponse.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toUpdateApplicationLayerAutomaticResponse", []))

    @jsii.member(jsii_name="toUpdateEmergencyContactSettings")
    def to_update_emergency_contact_settings(self) -> "Shield":
        '''(experimental) Grants permission to update the details of the list of email addresses that the DRT can use to contact you during a suspected attack.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_UpdateEmergencyContactSettings.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toUpdateEmergencyContactSettings", []))

    @jsii.member(jsii_name="toUpdateProtectionGroup")
    def to_update_protection_group(self) -> "Shield":
        '''(experimental) Grants permission to update an existing protection group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_UpdateProtectionGroup.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toUpdateProtectionGroup", []))

    @jsii.member(jsii_name="toUpdateSubscription")
    def to_update_subscription(self) -> "Shield":
        '''(experimental) Grants permission to update the details of an existing subscription.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_UpdateSubscription.html

        :stability: experimental
        '''
        return typing.cast("Shield", jsii.invoke(self, "toUpdateSubscription", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__86c6790a89658ec0c74b1d5ef784c8b3a0d6777f0b1d8b0012adaaa1f5037a3d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9ee13293f6ec62f60e28528ea1d3c57cde3a5d09c3d3f26d4e071a2709313a2d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Signer(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Signer"):
    '''(experimental) Statement provider for service `signer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssigner.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `signer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssigner.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2319dbe72568d9252172ebd922a5ddb9727c54f57b7b3c9a522f838f0d28e6f7)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifProfileVersion")
    def if_profile_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Signer":
        '''(experimental) Filters access by version of the Signing Profile.

        https://docs.aws.amazon.com/signer/latest/developerguide/authen-apipermissions.html

        Applies to actions:

        - .toAddProfilePermission()
        - .toCancelSigningProfile()
        - .toGetSigningProfile()
        - .toRemoveProfilePermission()
        - .toRevokeSignature()
        - .toRevokeSigningProfile()
        - .toStartSigningJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b7ef7ebc5e0aeaaffe8370c2576f3e24b55d2fd98b13c5c0e2af373f32ab3cab)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Signer", jsii.invoke(self, "ifProfileVersion", [value, operator]))

    @jsii.member(jsii_name="onSigningJob")
    def on_signing_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Signer":
        '''(experimental) Adds a resource of type signing-job to the statement.

        https://docs.aws.amazon.com/signer/latest/developerguide/gs-job.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__167d9464c65a4ade9d01dbc7998c5252526a399dea326a0b95bc5f5c824653d4)
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Signer", jsii.invoke(self, "onSigningJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onSigningProfile")
    def on_signing_profile(
        self,
        profile_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Signer":
        '''(experimental) Adds a resource of type signing-profile to the statement.

        https://docs.aws.amazon.com/signer/latest/developerguide/gs-profile.html

        :param profile_name: - Identifier for the profileName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fb603d50503b24e030a2f8ca638694d11d50fe4b649c7ada5f085674a2d614e7)
            check_type(argname="argument profile_name", value=profile_name, expected_type=type_hints["profile_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Signer", jsii.invoke(self, "onSigningProfile", [profile_name, account, region, partition]))

    @jsii.member(jsii_name="toAddProfilePermission")
    def to_add_profile_permission(self) -> "Signer":
        '''(experimental) Grants permission to add cross-account permissions to a Signing Profile.

        Access Level: Permissions management

        Possible conditions:

        - .ifProfileVersion()

        https://docs.aws.amazon.com/signer/latest/api/API_AddProfilePermission.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toAddProfilePermission", []))

    @jsii.member(jsii_name="toCancelSigningProfile")
    def to_cancel_signing_profile(self) -> "Signer":
        '''(experimental) Grants permission to change the state of a Signing Profile to CANCELED.

        Access Level: Write

        Possible conditions:

        - .ifProfileVersion()

        https://docs.aws.amazon.com/signer/latest/api/API_CancelSigningProfile.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toCancelSigningProfile", []))

    @jsii.member(jsii_name="toDescribeSigningJob")
    def to_describe_signing_job(self) -> "Signer":
        '''(experimental) Grants permission to return information about a specific Signing Job.

        Access Level: Read

        https://docs.aws.amazon.com/signer/latest/api/API_DescribeSigningJob.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toDescribeSigningJob", []))

    @jsii.member(jsii_name="toGetSigningPlatform")
    def to_get_signing_platform(self) -> "Signer":
        '''(experimental) Grants permission to return information about a specific Signing Platform.

        Access Level: Read

        https://docs.aws.amazon.com/signer/latest/api/API_GetSigningPlatform.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toGetSigningPlatform", []))

    @jsii.member(jsii_name="toGetSigningProfile")
    def to_get_signing_profile(self) -> "Signer":
        '''(experimental) Grants permission to return information about a specific Signing Profile.

        Access Level: Read

        Possible conditions:

        - .ifProfileVersion()

        https://docs.aws.amazon.com/signer/latest/api/API_GetSigningProfile.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toGetSigningProfile", []))

    @jsii.member(jsii_name="toListProfilePermissions")
    def to_list_profile_permissions(self) -> "Signer":
        '''(experimental) Grants permission to list the cross-account permissions associated with a Signing Profile.

        Access Level: Read

        https://docs.aws.amazon.com/signer/latest/api/API_ListProfilePermissions.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toListProfilePermissions", []))

    @jsii.member(jsii_name="toListSigningJobs")
    def to_list_signing_jobs(self) -> "Signer":
        '''(experimental) Grants permission to list all Signing Jobs in your account.

        Access Level: List

        https://docs.aws.amazon.com/signer/latest/api/API_ListSigningJobs.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toListSigningJobs", []))

    @jsii.member(jsii_name="toListSigningPlatforms")
    def to_list_signing_platforms(self) -> "Signer":
        '''(experimental) Grants permission to list all available Signing Platforms.

        Access Level: List

        https://docs.aws.amazon.com/signer/latest/api/API_ListSigningPlatforms.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toListSigningPlatforms", []))

    @jsii.member(jsii_name="toListSigningProfiles")
    def to_list_signing_profiles(self) -> "Signer":
        '''(experimental) Grants permission to list all Signing Profiles in your account.

        Access Level: List

        https://docs.aws.amazon.com/signer/latest/api/API_ListSigningProfiles.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toListSigningProfiles", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Signer":
        '''(experimental) Grants permission to list the tags associated with a Signing Profile.

        Access Level: Read

        https://docs.aws.amazon.com/signer/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutSigningProfile")
    def to_put_signing_profile(self) -> "Signer":
        '''(experimental) Grants permission to create a new Signing Profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/signer/latest/api/API_PutSigningProfile.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toPutSigningProfile", []))

    @jsii.member(jsii_name="toRemoveProfilePermission")
    def to_remove_profile_permission(self) -> "Signer":
        '''(experimental) Grants permission to remove cross-account permissions from a Signing Profile.

        Access Level: Permissions management

        Possible conditions:

        - .ifProfileVersion()

        https://docs.aws.amazon.com/signer/latest/api/API_RemoveProfilePermission.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toRemoveProfilePermission", []))

    @jsii.member(jsii_name="toRevokeSignature")
    def to_revoke_signature(self) -> "Signer":
        '''(experimental) Grants permission to change the state of a Signing Job to REVOKED.

        Access Level: Write

        Possible conditions:

        - .ifProfileVersion()

        https://docs.aws.amazon.com/signer/latest/api/API_RevokeSignature.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toRevokeSignature", []))

    @jsii.member(jsii_name="toRevokeSigningProfile")
    def to_revoke_signing_profile(self) -> "Signer":
        '''(experimental) Grants permission to change the state of a Signing Profile to REVOKED.

        Access Level: Write

        Possible conditions:

        - .ifProfileVersion()

        https://docs.aws.amazon.com/signer/latest/api/API_RevokeSigningProfile.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toRevokeSigningProfile", []))

    @jsii.member(jsii_name="toStartSigningJob")
    def to_start_signing_job(self) -> "Signer":
        '''(experimental) Grants permission to initiate a Signing Job on the provided code.

        Access Level: Write

        Possible conditions:

        - .ifProfileVersion()

        https://docs.aws.amazon.com/signer/latest/api/API_StartSigningJob.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toStartSigningJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Signer":
        '''(experimental) Grants permission to add one or more tags to a Signing Profile.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/signer/latest/api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Signer":
        '''(experimental) Grants permission to remove one or more tags from a Signing Profile.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/signer/latest/api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Signer", jsii.invoke(self, "toUntagResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cff38f64cb76e3f9599cc3d01ddd8523ff0cb673050eed13406c48dd07e6a97f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__15fbd5d238ce6bc3eb73d9f9de67e6c6d47dcc10e50251a46f498bc3ceace2c4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Simspaceweaver(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Simspaceweaver",
):
    '''(experimental) Statement provider for service `simspaceweaver <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssimspaceweaver.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `simspaceweaver <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssimspaceweaver.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c8d1f3adcd66b64402df8829a108a004d6b57be0466940b633aaa9ba26856ff9)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onSimulation")
    def on_simulation(
        self,
        simulation_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Simspaceweaver":
        '''(experimental) Adds a resource of type Simulation to the statement.

        https://docs.aws.amazon.com/simspaceweaver/latest/userguide/working-with_configuring-simulation.html

        :param simulation_name: - Identifier for the simulationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__013cab7ab4b7cfa94f2b18e769a0af8c110fe4aa8634159807a9ffdfa27e3cbe)
            check_type(argname="argument simulation_name", value=simulation_name, expected_type=type_hints["simulation_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Simspaceweaver", jsii.invoke(self, "onSimulation", [simulation_name, account, region, partition]))

    @jsii.member(jsii_name="toDeleteApp")
    def to_delete_app(self) -> "Simspaceweaver":
        '''(experimental) Grants permission to delete an app.

        Access Level: Write

        https://docs.aws.amazon.com/simspaceweaver/latest/APIReference/API_DeleteApp.html

        :stability: experimental
        '''
        return typing.cast("Simspaceweaver", jsii.invoke(self, "toDeleteApp", []))

    @jsii.member(jsii_name="toDeleteSimulation")
    def to_delete_simulation(self) -> "Simspaceweaver":
        '''(experimental) Grants permission to delete a simulation.

        Access Level: Write

        https://docs.aws.amazon.com/simspaceweaver/latest/APIReference/API_DeleteSimulation.html

        :stability: experimental
        '''
        return typing.cast("Simspaceweaver", jsii.invoke(self, "toDeleteSimulation", []))

    @jsii.member(jsii_name="toDescribeApp")
    def to_describe_app(self) -> "Simspaceweaver":
        '''(experimental) Grants permission to describe an app.

        Access Level: Read

        https://docs.aws.amazon.com/simspaceweaver/latest/APIReference/API_DescribeApp.html

        :stability: experimental
        '''
        return typing.cast("Simspaceweaver", jsii.invoke(self, "toDescribeApp", []))

    @jsii.member(jsii_name="toDescribeSimulation")
    def to_describe_simulation(self) -> "Simspaceweaver":
        '''(experimental) Grants permission to describe a simulation.

        Access Level: Read

        https://docs.aws.amazon.com/simspaceweaver/latest/APIReference/API_DescribeSimulation.html

        :stability: experimental
        '''
        return typing.cast("Simspaceweaver", jsii.invoke(self, "toDescribeSimulation", []))

    @jsii.member(jsii_name="toListApps")
    def to_list_apps(self) -> "Simspaceweaver":
        '''(experimental) Grants permission to list apps.

        Access Level: Read

        https://docs.aws.amazon.com/simspaceweaver/latest/APIReference/API_ListApps.html

        :stability: experimental
        '''
        return typing.cast("Simspaceweaver", jsii.invoke(self, "toListApps", []))

    @jsii.member(jsii_name="toListSimulations")
    def to_list_simulations(self) -> "Simspaceweaver":
        '''(experimental) Grants permission to list simulations.

        Access Level: List

        https://docs.aws.amazon.com/simspaceweaver/latest/APIReference/API_ListSimulations.html

        :stability: experimental
        '''
        return typing.cast("Simspaceweaver", jsii.invoke(self, "toListSimulations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Simspaceweaver":
        '''(experimental) Grants permission to list the tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/simspaceweaver/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Simspaceweaver", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartApp")
    def to_start_app(self) -> "Simspaceweaver":
        '''(experimental) Grants permission to start an app.

        Access Level: Write

        https://docs.aws.amazon.com/simspaceweaver/latest/APIReference/API_StartApp.html

        :stability: experimental
        '''
        return typing.cast("Simspaceweaver", jsii.invoke(self, "toStartApp", []))

    @jsii.member(jsii_name="toStartClock")
    def to_start_clock(self) -> "Simspaceweaver":
        '''(experimental) Grants permission to start a simulation clock.

        Access Level: Write

        https://docs.aws.amazon.com/simspaceweaver/latest/APIReference/API_StartClock.html

        :stability: experimental
        '''
        return typing.cast("Simspaceweaver", jsii.invoke(self, "toStartClock", []))

    @jsii.member(jsii_name="toStartSimulation")
    def to_start_simulation(self) -> "Simspaceweaver":
        '''(experimental) Grants permission to start a simulation.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/simspaceweaver/latest/APIReference/API_StartSimulation.html

        :stability: experimental
        '''
        return typing.cast("Simspaceweaver", jsii.invoke(self, "toStartSimulation", []))

    @jsii.member(jsii_name="toStopApp")
    def to_stop_app(self) -> "Simspaceweaver":
        '''(experimental) Grants permission to stop an app.

        Access Level: Write

        https://docs.aws.amazon.com/simspaceweaver/latest/APIReference/API_StopApp.html

        :stability: experimental
        '''
        return typing.cast("Simspaceweaver", jsii.invoke(self, "toStopApp", []))

    @jsii.member(jsii_name="toStopClock")
    def to_stop_clock(self) -> "Simspaceweaver":
        '''(experimental) Grants permission to stop a simulation clock.

        Access Level: Write

        https://docs.aws.amazon.com/simspaceweaver/latest/APIReference/API_StopClock.html

        :stability: experimental
        '''
        return typing.cast("Simspaceweaver", jsii.invoke(self, "toStopClock", []))

    @jsii.member(jsii_name="toStopSimulation")
    def to_stop_simulation(self) -> "Simspaceweaver":
        '''(experimental) Grants permission to stop a simulation.

        Access Level: Write

        https://docs.aws.amazon.com/simspaceweaver/latest/APIReference/API_StopSimulation.html

        :stability: experimental
        '''
        return typing.cast("Simspaceweaver", jsii.invoke(self, "toStopSimulation", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Simspaceweaver":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/simspaceweaver/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Simspaceweaver", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Simspaceweaver":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/simspaceweaver/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Simspaceweaver", jsii.invoke(self, "toUntagResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__981ea21ed8a0fee712143fbdc94206fdd27575851b6f52a7c2d6db7275fc201f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__10b6ee64e96dc867880e2702619545c39b09b919a0f41a5e433a1fe32b934eb7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Sms(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Sms"):
    '''(experimental) Statement provider for service `sms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsservermigrationservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsservermigrationservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4638f1d357bdcaeb2d149b26eb0014e5e0e2d677ab9eab03b66503bf0c3e67fb)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toCreateApp")
    def to_create_app(self) -> "Sms":
        '''(experimental) Grants permission to create an application configuration to migrate on-premise application onto AWS.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_CreateApp.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toCreateApp", []))

    @jsii.member(jsii_name="toCreateReplicationJob")
    def to_create_replication_job(self) -> "Sms":
        '''(experimental) Grants permission to create a job to migrate on-premise server onto AWS.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_CreateReplicationJob.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toCreateReplicationJob", []))

    @jsii.member(jsii_name="toDeleteApp")
    def to_delete_app(self) -> "Sms":
        '''(experimental) Grants permission to delete an existing application configuration.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_DeleteApp.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toDeleteApp", []))

    @jsii.member(jsii_name="toDeleteAppLaunchConfiguration")
    def to_delete_app_launch_configuration(self) -> "Sms":
        '''(experimental) Grants permission to delete launch configuration for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_DeleteAppLaunchConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toDeleteAppLaunchConfiguration", []))

    @jsii.member(jsii_name="toDeleteAppReplicationConfiguration")
    def to_delete_app_replication_configuration(self) -> "Sms":
        '''(experimental) Grants permission to delete replication configuration for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_DeleteAppReplicationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toDeleteAppReplicationConfiguration", []))

    @jsii.member(jsii_name="toDeleteAppValidationConfiguration")
    def to_delete_app_validation_configuration(self) -> "Sms":
        '''(experimental) Grants permission to delete validation configuration for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_DeleteAppValidationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toDeleteAppValidationConfiguration", []))

    @jsii.member(jsii_name="toDeleteReplicationJob")
    def to_delete_replication_job(self) -> "Sms":
        '''(experimental) Grants permission to delete an existing job to migrate on-premise server onto AWS.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_DeleteReplicationJob.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toDeleteReplicationJob", []))

    @jsii.member(jsii_name="toDeleteServerCatalog")
    def to_delete_server_catalog(self) -> "Sms":
        '''(experimental) Grants permission to delete the complete list of on-premise servers gathered into AWS.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_DeleteServerCatalog.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toDeleteServerCatalog", []))

    @jsii.member(jsii_name="toDisassociateConnector")
    def to_disassociate_connector(self) -> "Sms":
        '''(experimental) Grants permission to disassociate a connector that has been associated.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_DisassociateConnector.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toDisassociateConnector", []))

    @jsii.member(jsii_name="toGenerateChangeSet")
    def to_generate_change_set(self) -> "Sms":
        '''(experimental) Grants permission to generate a changeSet for the CloudFormation stack of an application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GenerateChangeSet.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGenerateChangeSet", []))

    @jsii.member(jsii_name="toGenerateTemplate")
    def to_generate_template(self) -> "Sms":
        '''(experimental) Grants permission to generate a CloudFormation template for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GenerateTemplate.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGenerateTemplate", []))

    @jsii.member(jsii_name="toGetApp")
    def to_get_app(self) -> "Sms":
        '''(experimental) Grants permission to get the configuration and statuses for an existing application.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GetApp.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGetApp", []))

    @jsii.member(jsii_name="toGetAppLaunchConfiguration")
    def to_get_app_launch_configuration(self) -> "Sms":
        '''(experimental) Grants permission to get launch configuration for an existing application.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GetAppLaunchConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGetAppLaunchConfiguration", []))

    @jsii.member(jsii_name="toGetAppReplicationConfiguration")
    def to_get_app_replication_configuration(self) -> "Sms":
        '''(experimental) Grants permission to get replication configuration for an existing application.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GetAppReplicationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGetAppReplicationConfiguration", []))

    @jsii.member(jsii_name="toGetAppValidationConfiguration")
    def to_get_app_validation_configuration(self) -> "Sms":
        '''(experimental) Grants permission to get validation configuration for an existing application.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GetAppValidationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGetAppValidationConfiguration", []))

    @jsii.member(jsii_name="toGetAppValidationOutput")
    def to_get_app_validation_output(self) -> "Sms":
        '''(experimental) Grants permission to get notification sent from application validation script.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GetAppValidationOutput.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGetAppValidationOutput", []))

    @jsii.member(jsii_name="toGetConnectors")
    def to_get_connectors(self) -> "Sms":
        '''(experimental) Grants permission to get all connectors that have been associated.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GetConnectors.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGetConnectors", []))

    @jsii.member(jsii_name="toGetMessages")
    def to_get_messages(self) -> "Sms":
        '''(experimental) Grants permission to gets messages from AWS Server Migration Service to Server Migration Connector.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGetMessages", []))

    @jsii.member(jsii_name="toGetReplicationJobs")
    def to_get_replication_jobs(self) -> "Sms":
        '''(experimental) Grants permission to get all existing jobs to migrate on-premise servers onto AWS.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GetReplicationJobs.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGetReplicationJobs", []))

    @jsii.member(jsii_name="toGetReplicationRuns")
    def to_get_replication_runs(self) -> "Sms":
        '''(experimental) Grants permission to get all runs for an existing job.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GetReplicationRuns.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGetReplicationRuns", []))

    @jsii.member(jsii_name="toGetServers")
    def to_get_servers(self) -> "Sms":
        '''(experimental) Grants permission to get all servers that have been imported.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_GetServers.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toGetServers", []))

    @jsii.member(jsii_name="toImportAppCatalog")
    def to_import_app_catalog(self) -> "Sms":
        '''(experimental) Grants permission to import application catalog from AWS Application Discovery Service.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_ImportAppCatalog.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toImportAppCatalog", []))

    @jsii.member(jsii_name="toImportServerCatalog")
    def to_import_server_catalog(self) -> "Sms":
        '''(experimental) Grants permission to gather a complete list of on-premise servers.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_ImportServerCatalog.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toImportServerCatalog", []))

    @jsii.member(jsii_name="toLaunchApp")
    def to_launch_app(self) -> "Sms":
        '''(experimental) Grants permission to create and launch a CloudFormation stack for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_LaunchApp.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toLaunchApp", []))

    @jsii.member(jsii_name="toListApps")
    def to_list_apps(self) -> "Sms":
        '''(experimental) Grants permission to get a list of summaries for existing applications.

        Access Level: List

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_ListAppss.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toListApps", []))

    @jsii.member(jsii_name="toNotifyAppValidationOutput")
    def to_notify_app_validation_output(self) -> "Sms":
        '''(experimental) Grants permission to send notification for application validation script.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_NotifyAppValidationOutput.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toNotifyAppValidationOutput", []))

    @jsii.member(jsii_name="toPutAppLaunchConfiguration")
    def to_put_app_launch_configuration(self) -> "Sms":
        '''(experimental) Grants permission to create or update launch configuration for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_PutAppLaunchConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toPutAppLaunchConfiguration", []))

    @jsii.member(jsii_name="toPutAppReplicationConfiguration")
    def to_put_app_replication_configuration(self) -> "Sms":
        '''(experimental) Grants permission to create or update replication configuration for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_PutAppReplicationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toPutAppReplicationConfiguration", []))

    @jsii.member(jsii_name="toPutAppValidationConfiguration")
    def to_put_app_validation_configuration(self) -> "Sms":
        '''(experimental) Grants permission to put validation configuration for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_PutAppValidationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toPutAppValidationConfiguration", []))

    @jsii.member(jsii_name="toSendMessage")
    def to_send_message(self) -> "Sms":
        '''(experimental) Grants permission to send message from Server Migration Connector to AWS Server Migration Service.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toSendMessage", []))

    @jsii.member(jsii_name="toStartAppReplication")
    def to_start_app_replication(self) -> "Sms":
        '''(experimental) Grants permission to create and start replication jobs for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_StartAppReplication.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toStartAppReplication", []))

    @jsii.member(jsii_name="toStartOnDemandAppReplication")
    def to_start_on_demand_app_replication(self) -> "Sms":
        '''(experimental) Grants permission to start a replication run for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_StartOnDemandAppReplication.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toStartOnDemandAppReplication", []))

    @jsii.member(jsii_name="toStartOnDemandReplicationRun")
    def to_start_on_demand_replication_run(self) -> "Sms":
        '''(experimental) Grants permission to start a replication run for an existing replication job.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_StartOnDemandReplicationRun.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toStartOnDemandReplicationRun", []))

    @jsii.member(jsii_name="toStopAppReplication")
    def to_stop_app_replication(self) -> "Sms":
        '''(experimental) Grants permission to stop and delete replication jobs for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_StopAppReplication.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toStopAppReplication", []))

    @jsii.member(jsii_name="toTerminateApp")
    def to_terminate_app(self) -> "Sms":
        '''(experimental) Grants permission to terminate the CloudFormation stack for an existing application.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_TerminateApp.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toTerminateApp", []))

    @jsii.member(jsii_name="toUpdateApp")
    def to_update_app(self) -> "Sms":
        '''(experimental) Grants permission to update an existing application configuration.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_UpdateApp.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toUpdateApp", []))

    @jsii.member(jsii_name="toUpdateReplicationJob")
    def to_update_replication_job(self) -> "Sms":
        '''(experimental) Grants permission to update an existing job to migrate on-premise server onto AWS.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/APIReference/API_UpdateReplicationJob.html

        :stability: experimental
        '''
        return typing.cast("Sms", jsii.invoke(self, "toUpdateReplicationJob", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ed4c15494244e09b22241aa1df6cff7d10e7f725ca0307a797deceb9d869332e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2924c37dde393ff3567947435013caa81d0426679bb59c389cfd180b004df2b2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class SmsVoice(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.SmsVoice",
):
    '''(experimental) Statement provider for service `sms-voice <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpinpointsmsandvoiceservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sms-voice <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpinpointsmsandvoiceservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__906735803afb3ebccfd860f24580649e4aa945350620e13da4a7b7a89d8170ab)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toCreateConfigurationSet")
    def to_create_configuration_set(self) -> "SmsVoice":
        '''(experimental) Create a new configuration set.

        After you create the configuration set, you can add one or more event destinations to it.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint-sms-voice/latest/APIReference/v1-sms-voice-configuration-sets.html

        :stability: experimental
        '''
        return typing.cast("SmsVoice", jsii.invoke(self, "toCreateConfigurationSet", []))

    @jsii.member(jsii_name="toCreateConfigurationSetEventDestination")
    def to_create_configuration_set_event_destination(self) -> "SmsVoice":
        '''(experimental) Create a new event destination in a configuration set.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/pinpoint-sms-voice/latest/APIReference/v1-sms-voice-configuration-sets-configurationsetname-event-destinations.html

        :stability: experimental
        '''
        return typing.cast("SmsVoice", jsii.invoke(self, "toCreateConfigurationSetEventDestination", []))

    @jsii.member(jsii_name="toDeleteConfigurationSet")
    def to_delete_configuration_set(self) -> "SmsVoice":
        '''(experimental) Deletes an existing configuration set.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint-sms-voice/latest/APIReference/v1-sms-voice-configuration-sets-configurationsetname.html

        :stability: experimental
        '''
        return typing.cast("SmsVoice", jsii.invoke(self, "toDeleteConfigurationSet", []))

    @jsii.member(jsii_name="toDeleteConfigurationSetEventDestination")
    def to_delete_configuration_set_event_destination(self) -> "SmsVoice":
        '''(experimental) Deletes an event destination in a configuration set.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint-sms-voice/latest/APIReference/v1-sms-voice-configuration-sets-configurationsetname-event-destinations-eventdestinationname.html

        :stability: experimental
        '''
        return typing.cast("SmsVoice", jsii.invoke(self, "toDeleteConfigurationSetEventDestination", []))

    @jsii.member(jsii_name="toGetConfigurationSetEventDestinations")
    def to_get_configuration_set_event_destinations(self) -> "SmsVoice":
        '''(experimental) Obtain information about an event destination, including the types of events it reports, the Amazon Resource Name (ARN) of the destination, and the name of the event destination.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint-sms-voice/latest/APIReference/v1-sms-voice-configuration-sets-configurationsetname-event-destinations.html

        :stability: experimental
        '''
        return typing.cast("SmsVoice", jsii.invoke(self, "toGetConfigurationSetEventDestinations", []))

    @jsii.member(jsii_name="toListConfigurationSets")
    def to_list_configuration_sets(self) -> "SmsVoice":
        '''(experimental) Return a list of configuration sets.

        This operation only returns the configuration sets that are associated with your account in the current AWS Region.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint-sms-voice/latest/APIReference/v1-sms-voice-configuration-sets.html

        :stability: experimental
        '''
        return typing.cast("SmsVoice", jsii.invoke(self, "toListConfigurationSets", []))

    @jsii.member(jsii_name="toSendVoiceMessage")
    def to_send_voice_message(self) -> "SmsVoice":
        '''(experimental) Create a new voice message and send it to a recipient's phone number.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint-sms-voice/latest/APIReference/v1-sms-voice-voice-message.html

        :stability: experimental
        '''
        return typing.cast("SmsVoice", jsii.invoke(self, "toSendVoiceMessage", []))

    @jsii.member(jsii_name="toUpdateConfigurationSetEventDestination")
    def to_update_configuration_set_event_destination(self) -> "SmsVoice":
        '''(experimental) Update an event destination in a configuration set.

        An event destination is a location that you publish information about your voice calls to. For example, you can log an event to an Amazon CloudWatch destination when a call fails.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/pinpoint-sms-voice/latest/APIReference/v1-sms-voice-configuration-sets-configurationsetname-event-destinations-eventdestinationname.html

        :stability: experimental
        '''
        return typing.cast("SmsVoice", jsii.invoke(self, "toUpdateConfigurationSetEventDestination", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0a8572826a01039491aaea677ccb01c822878dd99b0f4f50adcf3d51742bb1d1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9ca86626df5945ff63e17c8a4b36d9b5d8f9d7722347b1a126e6483686a51102)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class SmsVoiceV2(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.SmsVoiceV2",
):
    '''(experimental) Statement provider for service `sms-voice-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpinpointsmsvoicev2.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sms-voice-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpinpointsmsvoicev2.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e09917c5358a03f13df7c760a0e400f8408bf2bdcb2ddd7c562ecf7d6dbb62dd)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onConfigurationSet")
    def on_configuration_set(
        self,
        configuration_set_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SmsVoiceV2":
        '''(experimental) Adds a resource of type ConfigurationSet to the statement.

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_CreateConfigurationSet.html

        :param configuration_set_name: - Identifier for the configurationSetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7d3238f8e5eaa87f8f858c51b5bfed45252482637aecd1a0abf16bce3eee6b14)
            check_type(argname="argument configuration_set_name", value=configuration_set_name, expected_type=type_hints["configuration_set_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "onConfigurationSet", [configuration_set_name, account, region, partition]))

    @jsii.member(jsii_name="onOptOutList")
    def on_opt_out_list(
        self,
        opt_out_list_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SmsVoiceV2":
        '''(experimental) Adds a resource of type OptOutList to the statement.

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_CreateOptOutList.html

        :param opt_out_list_name: - Identifier for the optOutListName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1d763ffea5165d438e9bb1881cd6a0e582e167f214080de4174b98b336db0634)
            check_type(argname="argument opt_out_list_name", value=opt_out_list_name, expected_type=type_hints["opt_out_list_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "onOptOutList", [opt_out_list_name, account, region, partition]))

    @jsii.member(jsii_name="onPhoneNumber")
    def on_phone_number(
        self,
        phone_number_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SmsVoiceV2":
        '''(experimental) Adds a resource of type PhoneNumber to the statement.

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_RequestPhoneNumber.html

        :param phone_number_id: - Identifier for the phoneNumberId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__77bec5694223178ca7b8629286b5c37b86e3d32cc2f8468b25bc4cc1d0a22c6e)
            check_type(argname="argument phone_number_id", value=phone_number_id, expected_type=type_hints["phone_number_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "onPhoneNumber", [phone_number_id, account, region, partition]))

    @jsii.member(jsii_name="onPool")
    def on_pool(
        self,
        pool_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SmsVoiceV2":
        '''(experimental) Adds a resource of type Pool to the statement.

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_CreatePool.html

        :param pool_id: - Identifier for the poolId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8fce59308e8114486b81cd95d1264188e218443a318ea941662983bbef15c01f)
            check_type(argname="argument pool_id", value=pool_id, expected_type=type_hints["pool_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "onPool", [pool_id, account, region, partition]))

    @jsii.member(jsii_name="onSenderId")
    def on_sender_id(
        self,
        sender_id: builtins.str,
        iso_country_code: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SmsVoiceV2":
        '''(experimental) Adds a resource of type SenderId to the statement.

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DescribeSenderIds.html

        :param sender_id: - Identifier for the senderId.
        :param iso_country_code: - Identifier for the isoCountryCode.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__27ef0c2458938e0c91b016f929bf03b029676da95f6670b49b2ccc3752f447d9)
            check_type(argname="argument sender_id", value=sender_id, expected_type=type_hints["sender_id"])
            check_type(argname="argument iso_country_code", value=iso_country_code, expected_type=type_hints["iso_country_code"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "onSenderId", [sender_id, iso_country_code, account, region, partition]))

    @jsii.member(jsii_name="toAssociateOriginationIdentity")
    def to_associate_origination_identity(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to associate an origination phone number or sender ID to a pool.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_AssociateOriginationIdentity.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toAssociateOriginationIdentity", []))

    @jsii.member(jsii_name="toCreateConfigurationSet")
    def to_create_configuration_set(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to create a configuration set.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sms-voice:TagResource

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_CreateConfigurationSet.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toCreateConfigurationSet", []))

    @jsii.member(jsii_name="toCreateEventDestination")
    def to_create_event_destination(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to create an event destination within a configuration set.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_CreateEventDestination.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toCreateEventDestination", []))

    @jsii.member(jsii_name="toCreateOptOutList")
    def to_create_opt_out_list(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to create an opt-out list.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sms-voice:TagResource

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_CreateOptOutList.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toCreateOptOutList", []))

    @jsii.member(jsii_name="toCreatePool")
    def to_create_pool(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to create a pool.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sms-voice:TagResource

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_CreatePool.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toCreatePool", []))

    @jsii.member(jsii_name="toDeleteConfigurationSet")
    def to_delete_configuration_set(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to delete a configuration set.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DeleteConfigurationSet.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDeleteConfigurationSet", []))

    @jsii.member(jsii_name="toDeleteDefaultMessageType")
    def to_delete_default_message_type(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to delete the default message type for a configuration set.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DeleteDefaultMessageType.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDeleteDefaultMessageType", []))

    @jsii.member(jsii_name="toDeleteDefaultSenderId")
    def to_delete_default_sender_id(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to delete the default sender ID for a configuration set.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DeleteDefaultSenderId.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDeleteDefaultSenderId", []))

    @jsii.member(jsii_name="toDeleteEventDestination")
    def to_delete_event_destination(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to delete an event destination within a configuration set.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DeleteEventDestination.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDeleteEventDestination", []))

    @jsii.member(jsii_name="toDeleteKeyword")
    def to_delete_keyword(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to delete a keyword for a pool or origination phone number.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DeleteKeyword.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDeleteKeyword", []))

    @jsii.member(jsii_name="toDeleteOptedOutNumber")
    def to_delete_opted_out_number(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to delete a destination phone number from an opt-out list.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DeleteOptedOutNumber.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDeleteOptedOutNumber", []))

    @jsii.member(jsii_name="toDeleteOptOutList")
    def to_delete_opt_out_list(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to delete an opt-out list.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DeleteOptOutList.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDeleteOptOutList", []))

    @jsii.member(jsii_name="toDeletePool")
    def to_delete_pool(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to delete a pool.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DeletePool.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDeletePool", []))

    @jsii.member(jsii_name="toDeleteTextMessageSpendLimitOverride")
    def to_delete_text_message_spend_limit_override(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to delete an override for your account's text messaging monthly spend limit.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DeleteTextMessageSpendLimitOverride.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDeleteTextMessageSpendLimitOverride", []))

    @jsii.member(jsii_name="toDeleteVoiceMessageSpendLimitOverride")
    def to_delete_voice_message_spend_limit_override(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to delete an override for your account's voice messaging monthly spend limit.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DeleteVoiceMessageSpendLimitOverride.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDeleteVoiceMessageSpendLimitOverride", []))

    @jsii.member(jsii_name="toDescribeAccountAttributes")
    def to_describe_account_attributes(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to describe the attributes of your account.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DescribeAccountAttributes.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDescribeAccountAttributes", []))

    @jsii.member(jsii_name="toDescribeAccountLimits")
    def to_describe_account_limits(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to describe the service quotas for your account.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DescribeAccountLimits.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDescribeAccountLimits", []))

    @jsii.member(jsii_name="toDescribeConfigurationSets")
    def to_describe_configuration_sets(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to describe the configuration sets in your account.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DescribeConfigurationSets.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDescribeConfigurationSets", []))

    @jsii.member(jsii_name="toDescribeKeywords")
    def to_describe_keywords(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to describe the keywords for a pool or origination phone number.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DescribeKeywords.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDescribeKeywords", []))

    @jsii.member(jsii_name="toDescribeOptedOutNumbers")
    def to_describe_opted_out_numbers(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to describe the destination phone numbers in an opt-out list.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DescribeOptedOutNumbers.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDescribeOptedOutNumbers", []))

    @jsii.member(jsii_name="toDescribeOptOutLists")
    def to_describe_opt_out_lists(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to describe the opt-out lists in your account.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DescribeOptOutLists.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDescribeOptOutLists", []))

    @jsii.member(jsii_name="toDescribePhoneNumbers")
    def to_describe_phone_numbers(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to describe the origination phone numbers in your account.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DescribePhoneNumbers.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDescribePhoneNumbers", []))

    @jsii.member(jsii_name="toDescribePools")
    def to_describe_pools(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to describe the pools in your account.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DescribePools.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDescribePools", []))

    @jsii.member(jsii_name="toDescribeSenderIds")
    def to_describe_sender_ids(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to describe the sender IDs in your account.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DescribeSenderIds.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDescribeSenderIds", []))

    @jsii.member(jsii_name="toDescribeSpendLimits")
    def to_describe_spend_limits(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to describe the monthly spend limits for your account.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DescribeSpendLimits.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDescribeSpendLimits", []))

    @jsii.member(jsii_name="toDisassociateOriginationIdentity")
    def to_disassociate_origination_identity(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to disassociate an origination phone number or sender ID from a pool.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_DisassociateOriginationIdentity.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toDisassociateOriginationIdentity", []))

    @jsii.member(jsii_name="toListPoolOriginationIdentities")
    def to_list_pool_origination_identities(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to list all origination phone numbers and sender IDs associated to a pool.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_ListPoolOriginationIdentities.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toListPoolOriginationIdentities", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to list the tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutKeyword")
    def to_put_keyword(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to create or update a keyword for a pool or origination phone number.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_PutKeyword.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toPutKeyword", []))

    @jsii.member(jsii_name="toPutOptedOutNumber")
    def to_put_opted_out_number(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to put a destination phone number into an opt-out list.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_PutOptedOutNumber.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toPutOptedOutNumber", []))

    @jsii.member(jsii_name="toReleasePhoneNumber")
    def to_release_phone_number(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to release an origination phone number.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_ReleasePhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toReleasePhoneNumber", []))

    @jsii.member(jsii_name="toRequestPhoneNumber")
    def to_request_phone_number(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to request an origination phone number.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sms-voice:AssociateOriginationIdentity
        - sms-voice:TagResource

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_RequestPhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toRequestPhoneNumber", []))

    @jsii.member(jsii_name="toSendTextMessage")
    def to_send_text_message(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to send a text message to a destination phone number.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_SendTextMessage.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toSendTextMessage", []))

    @jsii.member(jsii_name="toSendVoiceMessage")
    def to_send_voice_message(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to send a voice message to a destination phone number.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_SendVoiceMessage.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toSendVoiceMessage", []))

    @jsii.member(jsii_name="toSetDefaultMessageType")
    def to_set_default_message_type(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to set the default message type for a configuration set.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_SetDefaultMessageType.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toSetDefaultMessageType", []))

    @jsii.member(jsii_name="toSetDefaultSenderId")
    def to_set_default_sender_id(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to set the default sender ID for a configuration set.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_SetDefaultSenderId.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toSetDefaultSenderId", []))

    @jsii.member(jsii_name="toSetTextMessageSpendLimitOverride")
    def to_set_text_message_spend_limit_override(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to set an override for your account's text messaging monthly spend limit.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_SetTextMessageSpendLimitOverride.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toSetTextMessageSpendLimitOverride", []))

    @jsii.member(jsii_name="toSetVoiceMessageSpendLimitOverride")
    def to_set_voice_message_spend_limit_override(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to set an override for your account's voice messaging monthly spend limit.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_SetVoiceMessageSpendLimitOverride.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toSetVoiceMessageSpendLimitOverride", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to add tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateEventDestination")
    def to_update_event_destination(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to update an event destination within a configuration set.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_UpdateEventDestination.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toUpdateEventDestination", []))

    @jsii.member(jsii_name="toUpdatePhoneNumber")
    def to_update_phone_number(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to update an origination phone number's configuration.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_UpdatePhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toUpdatePhoneNumber", []))

    @jsii.member(jsii_name="toUpdatePool")
    def to_update_pool(self) -> "SmsVoiceV2":
        '''(experimental) Grants permission to update a pool's configuration.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference_smsvoicev2/API_UpdatePool.html

        :stability: experimental
        '''
        return typing.cast("SmsVoiceV2", jsii.invoke(self, "toUpdatePool", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c9b10b150085c0184b0f0ad1cd0df5dd6deec75985ec5550bbdef4680b031fc8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__504dc41a13c5db43524d41fadfdcad33ab037ae1cde01ced8d8786fdebd4413d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class SnowDeviceManagement(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.SnowDeviceManagement",
):
    '''(experimental) Statement provider for service `snow-device-management <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssnowdevicemanagement.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `snow-device-management <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssnowdevicemanagement.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3c9c893433e56788b954446939d04f0c2e6062b00cfbdd45ec4fc38f7bd37738)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onManagedDevice")
    def on_managed_device(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SnowDeviceManagement":
        '''(experimental) Adds a resource of type managed-device to the statement.

        https://docs.aws.amazon.com/snowball/latest/snowcone-guide/aws-sdms.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1bc7df8adec6f6bc0db69afa2e85c82203fa5542c91c79eee3ce5a97006ccf8c)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SnowDeviceManagement", jsii.invoke(self, "onManagedDevice", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onTask")
    def on_task(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SnowDeviceManagement":
        '''(experimental) Adds a resource of type task to the statement.

        https://docs.aws.amazon.com/snowball/latest/snowcone-guide/aws-sdms.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e0fefe778747a8ae54bf92028d9cc8949dccea8293ad0c1535b334a3249bf8fe)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SnowDeviceManagement", jsii.invoke(self, "onTask", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelTask")
    def to_cancel_task(self) -> "SnowDeviceManagement":
        '''(experimental) Grants permission to cancel tasks on remote devices.

        Access Level: Write

        https://docs.aws.amazon.com/snowball/latest/snowcone-guide/sdms-cli-cancel-task.html

        :stability: experimental
        '''
        return typing.cast("SnowDeviceManagement", jsii.invoke(self, "toCancelTask", []))

    @jsii.member(jsii_name="toCreateTask")
    def to_create_task(self) -> "SnowDeviceManagement":
        '''(experimental) Grants permission to create tasks on remote devices.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/snowball/latest/snowcone-guide/sdms-cli-create-task.html

        :stability: experimental
        '''
        return typing.cast("SnowDeviceManagement", jsii.invoke(self, "toCreateTask", []))

    @jsii.member(jsii_name="toDescribeDevice")
    def to_describe_device(self) -> "SnowDeviceManagement":
        '''(experimental) Grants permission to describe a remotely-managed device.

        Access Level: Read

        https://docs.aws.amazon.com/snowball/latest/snowcone-guide/sdms-cli-describe-device.html

        :stability: experimental
        '''
        return typing.cast("SnowDeviceManagement", jsii.invoke(self, "toDescribeDevice", []))

    @jsii.member(jsii_name="toDescribeDeviceEc2Instances")
    def to_describe_device_ec2_instances(self) -> "SnowDeviceManagement":
        '''(experimental) Grants permission to describe a remotely-managed device's EC2 instances.

        Access Level: Read

        https://docs.aws.amazon.com/snowball/latest/snowcone-guide/sdms-cli-describe-ec2-instances.html

        :stability: experimental
        '''
        return typing.cast("SnowDeviceManagement", jsii.invoke(self, "toDescribeDeviceEc2Instances", []))

    @jsii.member(jsii_name="toDescribeExecution")
    def to_describe_execution(self) -> "SnowDeviceManagement":
        '''(experimental) Grants permission to describe task executions.

        Access Level: Read

        https://docs.aws.amazon.com/snowball/latest/snowcone-guide/sdms-cli-describe-execution.html

        :stability: experimental
        '''
        return typing.cast("SnowDeviceManagement", jsii.invoke(self, "toDescribeExecution", []))

    @jsii.member(jsii_name="toDescribeTask")
    def to_describe_task(self) -> "SnowDeviceManagement":
        '''(experimental) Grants permission to describe a task.

        Access Level: Read

        https://docs.aws.amazon.com/snowball/latest/snowcone-guide/sdms-cli-describe-task.html

        :stability: experimental
        '''
        return typing.cast("SnowDeviceManagement", jsii.invoke(self, "toDescribeTask", []))

    @jsii.member(jsii_name="toListDeviceResources")
    def to_list_device_resources(self) -> "SnowDeviceManagement":
        '''(experimental) Grants permission to list a remotely-managed device's resources.

        Access Level: List

        https://docs.aws.amazon.com/snowball/latest/snowcone-guide/sdms-cli-list-device-resources.html

        :stability: experimental
        '''
        return typing.cast("SnowDeviceManagement", jsii.invoke(self, "toListDeviceResources", []))

    @jsii.member(jsii_name="toListDevices")
    def to_list_devices(self) -> "SnowDeviceManagement":
        '''(experimental) Grants permission to list remotely-managed devices.

        Access Level: List

        https://docs.aws.amazon.com/snowball/latest/snowcone-guide/sdms-cli-list-devices.html

        :stability: experimental
        '''
        return typing.cast("SnowDeviceManagement", jsii.invoke(self, "toListDevices", []))

    @jsii.member(jsii_name="toListExecutions")
    def to_list_executions(self) -> "SnowDeviceManagement":
        '''(experimental) Grants permission to list task executions.

        Access Level: List

        https://docs.aws.amazon.com/snowball/latest/snowcone-guide/sdms-cli-list-executions.html

        :stability: experimental
        '''
        return typing.cast("SnowDeviceManagement", jsii.invoke(self, "toListExecutions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "SnowDeviceManagement":
        '''(experimental) Grants permission to list the tags for a resource (device or task).

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/snowball/latest/snowcone-guide/sdms-cli-list-tags-for-resource.html

        :stability: experimental
        '''
        return typing.cast("SnowDeviceManagement", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTasks")
    def to_list_tasks(self) -> "SnowDeviceManagement":
        '''(experimental) Grants permission to list tasks.

        Access Level: List

        https://docs.aws.amazon.com/snowball/latest/snowcone-guide/sdms-cli-list-tasks.html

        :stability: experimental
        '''
        return typing.cast("SnowDeviceManagement", jsii.invoke(self, "toListTasks", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "SnowDeviceManagement":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/snowball/latest/snowcone-guide/sdms-cli-tag-resource.html

        :stability: experimental
        '''
        return typing.cast("SnowDeviceManagement", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "SnowDeviceManagement":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/snowball/latest/snowcone-guide/sdms-cli-untag-resources.html

        :stability: experimental
        '''
        return typing.cast("SnowDeviceManagement", jsii.invoke(self, "toUntagResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__654e3e880ec3edcd0d3a7fa04d7c33033ea18372c43a37ea861138ba6b3bc717)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__51fb6010c9656901e011f0880972afbd15c7e05bb20fb741d9bcda0c50519faa)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Snowball(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Snowball",
):
    '''(experimental) Statement provider for service `snowball <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssnowball.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `snowball <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssnowball.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1917470060469422d915d151b1e71453304f40bc3230ff54508b3b44ceac7d5a)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toCancelCluster")
    def to_cancel_cluster(self) -> "Snowball":
        '''(experimental) Grants permission to cancel a cluster job.

        Access Level: Write

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_CancelCluster.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toCancelCluster", []))

    @jsii.member(jsii_name="toCancelJob")
    def to_cancel_job(self) -> "Snowball":
        '''(experimental) Grants permission to cancel the specified job.

        Access Level: Write

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_CancelJob.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toCancelJob", []))

    @jsii.member(jsii_name="toCreateAddress")
    def to_create_address(self) -> "Snowball":
        '''(experimental) Grants permission to create an address for a Snowball to be shipped to.

        Access Level: Write

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_CreateAddress.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toCreateAddress", []))

    @jsii.member(jsii_name="toCreateCluster")
    def to_create_cluster(self) -> "Snowball":
        '''(experimental) Grants permission to create an empty cluster.

        Access Level: Write

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_CreateCluster.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toCreateCluster", []))

    @jsii.member(jsii_name="toCreateJob")
    def to_create_job(self) -> "Snowball":
        '''(experimental) Grants permission to creates a job to import or export data between Amazon S3 and your on-premises data center.

        Access Level: Write

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_CreateJob.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toCreateJob", []))

    @jsii.member(jsii_name="toCreateLongTermPricing")
    def to_create_long_term_pricing(self) -> "Snowball":
        '''(experimental) Grants permission to creates a LongTermPricingListEntry for allowing customers to add an upfront billing contract for a job.

        Access Level: Write

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_CreateLongTermPricing.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toCreateLongTermPricing", []))

    @jsii.member(jsii_name="toCreateReturnShippingLabel")
    def to_create_return_shipping_label(self) -> "Snowball":
        '''(experimental) Grants permission to create a shipping label that will be used to return the Snow device to AWS.

        Access Level: Write

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_CreateReturnShippingLabel.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toCreateReturnShippingLabel", []))

    @jsii.member(jsii_name="toDescribeAddress")
    def to_describe_address(self) -> "Snowball":
        '''(experimental) Grants permission to get specific details about that address in the form of an Address object.

        Access Level: Read

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_DescribeAddress.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toDescribeAddress", []))

    @jsii.member(jsii_name="toDescribeAddresses")
    def to_describe_addresses(self) -> "Snowball":
        '''(experimental) Grants permission to describe a specified number of ADDRESS objects.

        Access Level: List

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_DescribeAddresses.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toDescribeAddresses", []))

    @jsii.member(jsii_name="toDescribeCluster")
    def to_describe_cluster(self) -> "Snowball":
        '''(experimental) Grants permission to describe information about a specific cluster including shipping information, cluster status, and other important metadata.

        Access Level: Read

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_DescribeCluster.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toDescribeCluster", []))

    @jsii.member(jsii_name="toDescribeJob")
    def to_describe_job(self) -> "Snowball":
        '''(experimental) Grants permission to describe information about a specific job including shipping information, job status, and other important metadata.

        Access Level: Read

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_DescribeJob.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toDescribeJob", []))

    @jsii.member(jsii_name="toDescribeReturnShippingLabel")
    def to_describe_return_shipping_label(self) -> "Snowball":
        '''(experimental) Grants permission to describe information on the shipping label of a Snow device that is being returned to AWS.

        Access Level: Read

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_DescribeReturnShippingLabel.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toDescribeReturnShippingLabel", []))

    @jsii.member(jsii_name="toGetJobManifest")
    def to_get_job_manifest(self) -> "Snowball":
        '''(experimental) Grants permission to get a link to an Amazon S3 presigned URL for the manifest file associated with the specified JobId value.

        Access Level: Read

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_GetJobManifest.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toGetJobManifest", []))

    @jsii.member(jsii_name="toGetJobUnlockCode")
    def to_get_job_unlock_code(self) -> "Snowball":
        '''(experimental) Grants permission to get the UnlockCode code value for the specified job.

        Access Level: Read

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_GetJobUnlockCode.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toGetJobUnlockCode", []))

    @jsii.member(jsii_name="toGetSnowballUsage")
    def to_get_snowball_usage(self) -> "Snowball":
        '''(experimental) Grants permission to get information about the Snowball service limit for your account, and also the number of Snowballs your account has in use.

        Access Level: Read

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_GetSnowballUsage.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toGetSnowballUsage", []))

    @jsii.member(jsii_name="toGetSoftwareUpdates")
    def to_get_software_updates(self) -> "Snowball":
        '''(experimental) Grants permission to return an Amazon S3 presigned URL for an update file associated with a specified JobId.

        Access Level: Read

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_GetSoftwareUpdates.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toGetSoftwareUpdates", []))

    @jsii.member(jsii_name="toListClusterJobs")
    def to_list_cluster_jobs(self) -> "Snowball":
        '''(experimental) Grants permission to list JobListEntry objects of the specified length.

        Access Level: List

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_ListClusterJobs.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toListClusterJobs", []))

    @jsii.member(jsii_name="toListClusters")
    def to_list_clusters(self) -> "Snowball":
        '''(experimental) Grants permission to list ClusterListEntry objects of the specified length.

        Access Level: List

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_ListClusters.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toListClusters", []))

    @jsii.member(jsii_name="toListCompatibleImages")
    def to_list_compatible_images(self) -> "Snowball":
        '''(experimental) Grants permission to return a list of the different Amazon EC2 Amazon Machine Images (AMIs) that are owned by your AWS account that would be supported for use on a Snow device.

        Access Level: List

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_ListCompatibleImages.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toListCompatibleImages", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Snowball":
        '''(experimental) Grants permission to list JobListEntry objects of the specified length.

        Access Level: List

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_ListJobs.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListLongTermPricing")
    def to_list_long_term_pricing(self) -> "Snowball":
        '''(experimental) Grants permission to list LongTermPricingListEntry objects for the account making the request.

        Access Level: Read

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_ListLongTermPricing.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toListLongTermPricing", []))

    @jsii.member(jsii_name="toListServiceVersions")
    def to_list_service_versions(self) -> "Snowball":
        '''(experimental) Grants permission to list all supported versions for Snow on-device services.

        Access Level: List

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_ListServiceVersions.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toListServiceVersions", []))

    @jsii.member(jsii_name="toUpdateCluster")
    def to_update_cluster(self) -> "Snowball":
        '''(experimental) Grants permission to update while a cluster's ClusterState value is in the AwaitingQuorum state, you can update some of the information associated with a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_UpdateCluster.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toUpdateCluster", []))

    @jsii.member(jsii_name="toUpdateJob")
    def to_update_job(self) -> "Snowball":
        '''(experimental) Grants permission to update while a job's JobState value is New, you can update some of the information associated with a job.

        Access Level: Write

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_UpdateJob.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toUpdateJob", []))

    @jsii.member(jsii_name="toUpdateJobShipmentState")
    def to_update_job_shipment_state(self) -> "Snowball":
        '''(experimental) Grants permission to update the state when a the shipment states changes to a different state.

        Access Level: Write

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_UpdateJobShipmentState.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toUpdateJobShipmentState", []))

    @jsii.member(jsii_name="toUpdateLongTermPricing")
    def to_update_long_term_pricing(self) -> "Snowball":
        '''(experimental) Grants permission to update a specific upfront billing contract for a job.

        Access Level: Write

        https://docs.aws.amazon.com/snowball/latest/api-reference/API_UpdateLongTermPricing.html

        :stability: experimental
        '''
        return typing.cast("Snowball", jsii.invoke(self, "toUpdateLongTermPricing", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e4efaaba4a23d245cd7bd848de6bc9c9cc9836d65574f3ab63d93b9a2cca2e5e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ca34d63acb82872a5178f6e1fce0b5325acbd97f14e590979163dabae9eeaa9b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Sns(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Sns"):
    '''(experimental) Statement provider for service `sns <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsns.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sns <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsns.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1a0911fbb141bdf8997a04c87bb4a2faee0ab48f67b652ca0e9678b8bf734716)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifEndpoint")
    def if_endpoint(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sns":
        '''(experimental) Filters access by the URL, email address, or ARN from a Subscribe request or a previously confirmed subscription.

        https://docs.aws.amazon.com/sns/latest/dg/UsingIAMwithSNS.html#w2ab1c11c23c19

        Applies to actions:

        - .toSubscribe()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f40efdc1c39aad1295daa4c28d0986e9f68bc2268e1d8eb6cbb605803b54349d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sns", jsii.invoke(self, "ifEndpoint", [value, operator]))

    @jsii.member(jsii_name="ifProtocol")
    def if_protocol(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sns":
        '''(experimental) Filters access by the protocol value from a Subscribe request or a previously confirmed subscription.

        https://docs.aws.amazon.com/sns/latest/dg/UsingIAMwithSNS.html#w2ab1c11c23c19

        Applies to actions:

        - .toSubscribe()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6d0f09ce247bb145bb0ddd167165dfa18d4b14666357772999dd99107c296c1f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sns", jsii.invoke(self, "ifProtocol", [value, operator]))

    @jsii.member(jsii_name="onTopic")
    def on_topic(
        self,
        topic_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sns":
        '''(experimental) Adds a resource of type topic to the statement.

        https://docs.aws.amazon.com/sns/latest/dg/CreateTopic.html

        :param topic_name: - Identifier for the topicName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a9de08845c19af73e116617284a2ea7f864166f700984f9746396ff5eb211a6a)
            check_type(argname="argument topic_name", value=topic_name, expected_type=type_hints["topic_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sns", jsii.invoke(self, "onTopic", [topic_name, account, region, partition]))

    @jsii.member(jsii_name="toAddPermission")
    def to_add_permission(self) -> "Sns":
        '''(experimental) Grants permission to add a statement to a topic's access control policy, granting access for the specified AWS accounts to the specified actions.

        Access Level: Permissions management

        https://docs.aws.amazon.com/sns/latest/api/API_AddPermission.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toAddPermission", []))

    @jsii.member(jsii_name="toCheckIfPhoneNumberIsOptedOut")
    def to_check_if_phone_number_is_opted_out(self) -> "Sns":
        '''(experimental) Grants permission to accept a phone number and indicate whether the phone holder has opted out of receiving SMS messages from your account.

        Access Level: Read

        https://docs.aws.amazon.com/sns/latest/api/API_CheckIfPhoneNumberIsOptedOut.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toCheckIfPhoneNumberIsOptedOut", []))

    @jsii.member(jsii_name="toConfirmSubscription")
    def to_confirm_subscription(self) -> "Sns":
        '''(experimental) Grants permission to verify an endpoint owner's intent to receive messages by validating the token sent to the endpoint by an earlier Subscribe action.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_ConfirmSubscription.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toConfirmSubscription", []))

    @jsii.member(jsii_name="toCreatePlatformApplication")
    def to_create_platform_application(self) -> "Sns":
        '''(experimental) Grants permission to create a platform application object for one of the supported push notification services, such as APNS and GCM, to which devices and mobile apps may register.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sns/latest/api/API_CreatePlatformApplication.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toCreatePlatformApplication", []))

    @jsii.member(jsii_name="toCreatePlatformEndpoint")
    def to_create_platform_endpoint(self) -> "Sns":
        '''(experimental) Grants permission to create an endpoint for a device and mobile app on one of the supported push notification services, such as GCM and APNS.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_CreatePlatformEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toCreatePlatformEndpoint", []))

    @jsii.member(jsii_name="toCreateSMSSandboxPhoneNumber")
    def to_create_sms_sandbox_phone_number(self) -> "Sns":
        '''(experimental) Grants permission to add a destination phone number and send a one-time password (OTP) to that phone number for an AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_CreateSMSSandboxPhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toCreateSMSSandboxPhoneNumber", []))

    @jsii.member(jsii_name="toCreateTopic")
    def to_create_topic(self) -> "Sns":
        '''(experimental) Grants permission to create a topic to which notifications can be published.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sns/latest/api/API_CreateTopic.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toCreateTopic", []))

    @jsii.member(jsii_name="toDeleteEndpoint")
    def to_delete_endpoint(self) -> "Sns":
        '''(experimental) Grants permission to delete the endpoint for a device and mobile app from Amazon SNS.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_DeleteEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toDeleteEndpoint", []))

    @jsii.member(jsii_name="toDeletePlatformApplication")
    def to_delete_platform_application(self) -> "Sns":
        '''(experimental) Grants permission to delete a platform application object for one of the supported push notification services, such as APNS and GCM.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_DeletePlatformApplication.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toDeletePlatformApplication", []))

    @jsii.member(jsii_name="toDeleteSMSSandboxPhoneNumber")
    def to_delete_sms_sandbox_phone_number(self) -> "Sns":
        '''(experimental) Grants permission to delete an AWS account's verified or pending phone number.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_DeleteSMSSandboxPhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toDeleteSMSSandboxPhoneNumber", []))

    @jsii.member(jsii_name="toDeleteTopic")
    def to_delete_topic(self) -> "Sns":
        '''(experimental) Grants permission to delete a topic and all its subscriptions.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_DeleteTopic.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toDeleteTopic", []))

    @jsii.member(jsii_name="toGetDataProtectionPolicy")
    def to_get_data_protection_policy(self) -> "Sns":
        '''(experimental) Grants permission to return the data protection policy of the topic.

        Access Level: Read

        https://docs.aws.amazon.com/sns/latest/api/API_GetDataProtectionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toGetDataProtectionPolicy", []))

    @jsii.member(jsii_name="toGetEndpointAttributes")
    def to_get_endpoint_attributes(self) -> "Sns":
        '''(experimental) Grants permission to retrieve the endpoint attributes for a device on one of the supported push notification services, such as GCM and APNS.

        Access Level: Read

        https://docs.aws.amazon.com/sns/latest/api/API_GetEndpointAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toGetEndpointAttributes", []))

    @jsii.member(jsii_name="toGetPlatformApplicationAttributes")
    def to_get_platform_application_attributes(self) -> "Sns":
        '''(experimental) Grants permission to retrieve the attributes of the platform application object for the supported push notification services, such as APNS and GCM.

        Access Level: Read

        https://docs.aws.amazon.com/sns/latest/api/API_GetPlatformApplicationAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toGetPlatformApplicationAttributes", []))

    @jsii.member(jsii_name="toGetSMSAttributes")
    def to_get_sms_attributes(self) -> "Sns":
        '''(experimental) Grants permission to return the settings for sending SMS messages from your account.

        Access Level: Read

        https://docs.aws.amazon.com/sns/latest/api/API_GetSMSAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toGetSMSAttributes", []))

    @jsii.member(jsii_name="toGetSMSSandboxAccountStatus")
    def to_get_sms_sandbox_account_status(self) -> "Sns":
        '''(experimental) Grants permission to retrieve the sandbox status for the calling account in the target region.

        Access Level: Read

        https://docs.aws.amazon.com/sns/latest/api/API_GetSMSSandboxAccountStatus.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toGetSMSSandboxAccountStatus", []))

    @jsii.member(jsii_name="toGetSubscriptionAttributes")
    def to_get_subscription_attributes(self) -> "Sns":
        '''(experimental) Grants permission to return all of the properties of a subscription.

        Access Level: Read

        https://docs.aws.amazon.com/sns/latest/api/API_GetSubscriptionAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toGetSubscriptionAttributes", []))

    @jsii.member(jsii_name="toGetTopicAttributes")
    def to_get_topic_attributes(self) -> "Sns":
        '''(experimental) Grants permission to return all of the properties of a topic.

        Access Level: Read

        https://docs.aws.amazon.com/sns/latest/api/API_GetTopicAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toGetTopicAttributes", []))

    @jsii.member(jsii_name="toListEndpointsByPlatformApplication")
    def to_list_endpoints_by_platform_application(self) -> "Sns":
        '''(experimental) Grants permission to list the endpoints and endpoint attributes for devices in a supported push notification service, such as GCM and APNS.

        Access Level: List

        https://docs.aws.amazon.com/sns/latest/api/API_ListEndpointsByPlatformApplication.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toListEndpointsByPlatformApplication", []))

    @jsii.member(jsii_name="toListOriginationNumbers")
    def to_list_origination_numbers(self) -> "Sns":
        '''(experimental) Grants permission to list all origination numbers, and their metadata.

        Access Level: List

        https://docs.aws.amazon.com/sns/latest/api/API_ListOriginationNumbers.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toListOriginationNumbers", []))

    @jsii.member(jsii_name="toListPhoneNumbersOptedOut")
    def to_list_phone_numbers_opted_out(self) -> "Sns":
        '''(experimental) Grants permission to return a list of phone numbers that are opted out, meaning you cannot send SMS messages to them.

        Access Level: Read

        https://docs.aws.amazon.com/sns/latest/api/API_ListPhoneNumbersOptedOut.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toListPhoneNumbersOptedOut", []))

    @jsii.member(jsii_name="toListPlatformApplications")
    def to_list_platform_applications(self) -> "Sns":
        '''(experimental) Grants permission to list the platform application objects for the supported push notification services, such as APNS and GCM.

        Access Level: List

        https://docs.aws.amazon.com/sns/latest/api/API_ListPlatformApplications.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toListPlatformApplications", []))

    @jsii.member(jsii_name="toListSMSSandboxPhoneNumbers")
    def to_list_sms_sandbox_phone_numbers(self) -> "Sns":
        '''(experimental) Grants permission to list the calling account's current pending and verified destination phone numbers.

        Access Level: List

        https://docs.aws.amazon.com/sns/latest/api/API_ListSMSSandboxPhoneNumbers.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toListSMSSandboxPhoneNumbers", []))

    @jsii.member(jsii_name="toListSubscriptions")
    def to_list_subscriptions(self) -> "Sns":
        '''(experimental) Grants permission to return a list of the requester's subscriptions.

        Access Level: List

        https://docs.aws.amazon.com/sns/latest/api/API_ListSubscriptions.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toListSubscriptions", []))

    @jsii.member(jsii_name="toListSubscriptionsByTopic")
    def to_list_subscriptions_by_topic(self) -> "Sns":
        '''(experimental) Grants permission to return a list of the subscriptions to a specific topic.

        Access Level: List

        https://docs.aws.amazon.com/sns/latest/api/API_ListSubscriptionsByTopic.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toListSubscriptionsByTopic", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Sns":
        '''(experimental) Grants permission to list all tags added to the specified Amazon SNS topic.

        Access Level: Read

        https://docs.aws.amazon.com/sns/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTopics")
    def to_list_topics(self) -> "Sns":
        '''(experimental) Grants permission to return a list of the requester's topics.

        Access Level: List

        https://docs.aws.amazon.com/sns/latest/api/API_ListTopics.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toListTopics", []))

    @jsii.member(jsii_name="toOptInPhoneNumber")
    def to_opt_in_phone_number(self) -> "Sns":
        '''(experimental) Grants permission to opt in a phone number that is currently opted out, which enables you to resume sending SMS messages to the number.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_OptInPhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toOptInPhoneNumber", []))

    @jsii.member(jsii_name="toPublish")
    def to_publish(self) -> "Sns":
        '''(experimental) Grants permission to send a message to all of a topic's subscribed endpoints.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_Publish.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toPublish", []))

    @jsii.member(jsii_name="toPutDataProtectionPolicy")
    def to_put_data_protection_policy(self) -> "Sns":
        '''(experimental) Grants permission to allow a topic owner to set the data protection policy.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_PutDataProtectionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toPutDataProtectionPolicy", []))

    @jsii.member(jsii_name="toRemovePermission")
    def to_remove_permission(self) -> "Sns":
        '''(experimental) Grants permission to remove a statement from a topic's access control policy.

        Access Level: Permissions management

        https://docs.aws.amazon.com/sns/latest/api/API_RemovePermission.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toRemovePermission", []))

    @jsii.member(jsii_name="toSetEndpointAttributes")
    def to_set_endpoint_attributes(self) -> "Sns":
        '''(experimental) Grants permission to set the attributes for an endpoint for a device on one of the supported push notification services, such as GCM and APNS.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_SetEndpointAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toSetEndpointAttributes", []))

    @jsii.member(jsii_name="toSetPlatformApplicationAttributes")
    def to_set_platform_application_attributes(self) -> "Sns":
        '''(experimental) Grants permission to set the attributes of the platform application object for the supported push notification services, such as APNS and GCM.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sns/latest/api/API_SetPlatformApplicationAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toSetPlatformApplicationAttributes", []))

    @jsii.member(jsii_name="toSetSMSAttributes")
    def to_set_sms_attributes(self) -> "Sns":
        '''(experimental) Grants permission to set the default settings for sending SMS messages and receiving daily SMS usage reports.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_SetSMSAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toSetSMSAttributes", []))

    @jsii.member(jsii_name="toSetSubscriptionAttributes")
    def to_set_subscription_attributes(self) -> "Sns":
        '''(experimental) Grants permission to allow a subscription owner to set an attribute of the topic to a new value.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_SetSubscriptionAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toSetSubscriptionAttributes", []))

    @jsii.member(jsii_name="toSetTopicAttributes")
    def to_set_topic_attributes(self) -> "Sns":
        '''(experimental) Grants permission to allow a topic owner to set an attribute of the topic to a new value.

        Access Level: Permissions management

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/sns/latest/api/API_SetTopicAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toSetTopicAttributes", []))

    @jsii.member(jsii_name="toSubscribe")
    def to_subscribe(self) -> "Sns":
        '''(experimental) Grants permission to prepare to subscribe an endpoint by sending the endpoint a confirmation message.

        Access Level: Write

        Possible conditions:

        - .ifEndpoint()
        - .ifProtocol()

        https://docs.aws.amazon.com/sns/latest/api/API_Subscribe.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toSubscribe", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Sns":
        '''(experimental) Grants permission to add tags to the specified Amazon SNS topic.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sns/latest/api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUnsubscribe")
    def to_unsubscribe(self) -> "Sns":
        '''(experimental) Grants permission to delete a subscription.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_Unsubscribe.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toUnsubscribe", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Sns":
        '''(experimental) Grants permission to remove tags from the specified Amazon SNS topic.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/sns/latest/api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toVerifySMSSandboxPhoneNumber")
    def to_verify_sms_sandbox_phone_number(self) -> "Sns":
        '''(experimental) Grants permission to verify a destination phone number with a one-time password (OTP) for an AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/sns/latest/api/API_VerifySMSSandboxPhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Sns", jsii.invoke(self, "toVerifySMSSandboxPhoneNumber", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e122912a6ba4b5a92d9723934aaf83598892a66b104db1b372e4c9f7ba99a4bf)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__70937720a021a3a9b519c417a1c98f34dd488d7e3674d2aa35e32a67efb8c459)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Sqlworkbench(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Sqlworkbench",
):
    '''(experimental) Statement provider for service `sqlworkbench <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssqlworkbench.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sqlworkbench <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssqlworkbench.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8de3055aa368b7f7649396294aaab8f9a8b6a3ac9e51366c322b159b5f3068dd)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onChart")
    def on_chart(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sqlworkbench":
        '''(experimental) Adds a resource of type chart to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/query-editor-v2.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8961e70f71fbdb23521b0d32af61687775d762332ee7020fb6814735e9057866)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sqlworkbench", jsii.invoke(self, "onChart", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onConnection")
    def on_connection(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sqlworkbench":
        '''(experimental) Adds a resource of type connection to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/query-editor-v2.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f1e72e9c3a6f36fa0f76efd7ec1d89343c27644c56b5ab4130cb63a666da01f0)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sqlworkbench", jsii.invoke(self, "onConnection", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onNotebook")
    def on_notebook(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sqlworkbench":
        '''(experimental) Adds a resource of type notebook to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/query-editor-v2.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__773d8e365ae1799f54d8bb5aba23b7c227bd4b973859e25b3ecaf810117a592d)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sqlworkbench", jsii.invoke(self, "onNotebook", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onQuery")
    def on_query(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sqlworkbench":
        '''(experimental) Adds a resource of type query to the statement.

        https://docs.aws.amazon.com/redshift/latest/mgmt/query-editor-v2.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__490fb1e78924745c47469014ebec6c4561b5ceb019b00633f98b4324662ab086)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sqlworkbench", jsii.invoke(self, "onQuery", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateConnectionWithChart")
    def to_associate_connection_with_chart(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to associate connection to a chart.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toAssociateConnectionWithChart", []))

    @jsii.member(jsii_name="toAssociateConnectionWithTab")
    def to_associate_connection_with_tab(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to associate connection to a tab.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toAssociateConnectionWithTab", []))

    @jsii.member(jsii_name="toAssociateNotebookWithTab")
    def to_associate_notebook_with_tab(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to associate notebook to a tab.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toAssociateNotebookWithTab", []))

    @jsii.member(jsii_name="toAssociateQueryWithTab")
    def to_associate_query_with_tab(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to associate query to a tab.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toAssociateQueryWithTab", []))

    @jsii.member(jsii_name="toBatchDeleteFolder")
    def to_batch_delete_folder(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to delete folders on your account.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toBatchDeleteFolder", []))

    @jsii.member(jsii_name="toBatchGetNotebookCell")
    def to_batch_get_notebook_cell(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to get notebook cells content on your account.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toBatchGetNotebookCell", []))

    @jsii.member(jsii_name="toCreateAccount")
    def to_create_account(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to create SQLWorkbench account.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toCreateAccount", []))

    @jsii.member(jsii_name="toCreateChart")
    def to_create_chart(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to create new saved chart on your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toCreateChart", []))

    @jsii.member(jsii_name="toCreateConnection")
    def to_create_connection(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to create a new connection on your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toCreateConnection", []))

    @jsii.member(jsii_name="toCreateFolder")
    def to_create_folder(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to create folder on your account.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toCreateFolder", []))

    @jsii.member(jsii_name="toCreateNotebook")
    def to_create_notebook(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to create a new notebook on your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toCreateNotebook", []))

    @jsii.member(jsii_name="toCreateNotebookCell")
    def to_create_notebook_cell(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to create a notebook cell on your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toCreateNotebookCell", []))

    @jsii.member(jsii_name="toCreateNotebookFromVersion")
    def to_create_notebook_from_version(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to create a new notebook from a notebook version on your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toCreateNotebookFromVersion", []))

    @jsii.member(jsii_name="toCreateNotebookVersion")
    def to_create_notebook_version(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to create a notebook version on your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toCreateNotebookVersion", []))

    @jsii.member(jsii_name="toCreateSavedQuery")
    def to_create_saved_query(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to create a new saved query on your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toCreateSavedQuery", []))

    @jsii.member(jsii_name="toDeleteChart")
    def to_delete_chart(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to remove charts on your account.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toDeleteChart", []))

    @jsii.member(jsii_name="toDeleteConnection")
    def to_delete_connection(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to remove connections on your account.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toDeleteConnection", []))

    @jsii.member(jsii_name="toDeleteNotebook")
    def to_delete_notebook(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to remove notebooks on your account.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toDeleteNotebook", []))

    @jsii.member(jsii_name="toDeleteNotebookCell")
    def to_delete_notebook_cell(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to remove notebooks cells on your account.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toDeleteNotebookCell", []))

    @jsii.member(jsii_name="toDeleteNotebookVersion")
    def to_delete_notebook_version(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to remove notebooks cells on your account.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toDeleteNotebookVersion", []))

    @jsii.member(jsii_name="toDeleteSavedQuery")
    def to_delete_saved_query(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to remove saved queries on your account.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toDeleteSavedQuery", []))

    @jsii.member(jsii_name="toDeleteTab")
    def to_delete_tab(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to remove a tab on your account.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toDeleteTab", []))

    @jsii.member(jsii_name="toDriverExecute")
    def to_driver_execute(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to execute a query in your redshift cluster.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toDriverExecute", []))

    @jsii.member(jsii_name="toDuplicateNotebook")
    def to_duplicate_notebook(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to create a new notebook by duplicating an existing one on your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toDuplicateNotebook", []))

    @jsii.member(jsii_name="toExportNotebook")
    def to_export_notebook(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to export a notebook on your account.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toExportNotebook", []))

    @jsii.member(jsii_name="toGenerateSession")
    def to_generate_session(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to generate a new session on your account.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toGenerateSession", []))

    @jsii.member(jsii_name="toGetAccountInfo")
    def to_get_account_info(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to get account info.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toGetAccountInfo", []))

    @jsii.member(jsii_name="toGetAccountSettings")
    def to_get_account_settings(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to get account settings.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toGetAccountSettings", []))

    @jsii.member(jsii_name="toGetChart")
    def to_get_chart(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to get charts on your account.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toGetChart", []))

    @jsii.member(jsii_name="toGetConnection")
    def to_get_connection(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to get connections on your account.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toGetConnection", []))

    @jsii.member(jsii_name="toGetNotebook")
    def to_get_notebook(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to get notebook metadata on your account.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toGetNotebook", []))

    @jsii.member(jsii_name="toGetNotebookVersion")
    def to_get_notebook_version(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to get the content of a notebook version on your account.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toGetNotebookVersion", []))

    @jsii.member(jsii_name="toGetQueryExecutionHistory")
    def to_get_query_execution_history(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to get the query execution history on your account.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toGetQueryExecutionHistory", []))

    @jsii.member(jsii_name="toGetSavedQuery")
    def to_get_saved_query(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to get saved query on your account.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toGetSavedQuery", []))

    @jsii.member(jsii_name="toGetSchemaInference")
    def to_get_schema_inference(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to get the columns and data types inferred from a file.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toGetSchemaInference", []))

    @jsii.member(jsii_name="toGetUserInfo")
    def to_get_user_info(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to get user info.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toGetUserInfo", []))

    @jsii.member(jsii_name="toGetUserWorkspaceSettings")
    def to_get_user_workspace_settings(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to get workspace settings on your account.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toGetUserWorkspaceSettings", []))

    @jsii.member(jsii_name="toImportNotebook")
    def to_import_notebook(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to import a notebook on your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toImportNotebook", []))

    @jsii.member(jsii_name="toListConnections")
    def to_list_connections(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to list the connections on your account.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toListConnections", []))

    @jsii.member(jsii_name="toListDatabases")
    def to_list_databases(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to list databases of your redshift cluster.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toListDatabases", []))

    @jsii.member(jsii_name="toListFiles")
    def to_list_files(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to list files and folders.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toListFiles", []))

    @jsii.member(jsii_name="toListNotebooks")
    def to_list_notebooks(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to list the notebooks on your account.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toListNotebooks", []))

    @jsii.member(jsii_name="toListNotebookVersions")
    def to_list_notebook_versions(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to get notebook versions metadata on your account.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toListNotebookVersions", []))

    @jsii.member(jsii_name="toListQueryExecutionHistory")
    def to_list_query_execution_history(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to list the query execution history on your account.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toListQueryExecutionHistory", []))

    @jsii.member(jsii_name="toListRedshiftClusters")
    def to_list_redshift_clusters(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to list redshift clusters on your account.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toListRedshiftClusters", []))

    @jsii.member(jsii_name="toListSampleDatabases")
    def to_list_sample_databases(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to list sample databases.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toListSampleDatabases", []))

    @jsii.member(jsii_name="toListSavedQueryVersions")
    def to_list_saved_query_versions(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to list versions of saved query on your account.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toListSavedQueryVersions", []))

    @jsii.member(jsii_name="toListTabs")
    def to_list_tabs(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to list tabs on your account.

        Access Level: List

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toListTabs", []))

    @jsii.member(jsii_name="toListTaggedResources")
    def to_list_tagged_resources(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to list tagged resources.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toListTaggedResources", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to list the tags of an sqlworkbench resource.

        Access Level: Read

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutTab")
    def to_put_tab(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to create or update a tab on your account.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toPutTab", []))

    @jsii.member(jsii_name="toPutUserWorkspaceSettings")
    def to_put_user_workspace_settings(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to update workspace settings on your account.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toPutUserWorkspaceSettings", []))

    @jsii.member(jsii_name="toRestoreNotebookVersion")
    def to_restore_notebook_version(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to restore a notebook on your account to a version.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toRestoreNotebookVersion", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to tag an sqlworkbench resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to untag an sqlworkbench resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAccountConnectionSettings")
    def to_update_account_connection_settings(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to update account-wide connection settings.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toUpdateAccountConnectionSettings", []))

    @jsii.member(jsii_name="toUpdateAccountExportSettings")
    def to_update_account_export_settings(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to update account-wide export settings.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toUpdateAccountExportSettings", []))

    @jsii.member(jsii_name="toUpdateAccountGeneralSettings")
    def to_update_account_general_settings(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to update account-wide general settings.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toUpdateAccountGeneralSettings", []))

    @jsii.member(jsii_name="toUpdateChart")
    def to_update_chart(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to update a chart on your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toUpdateChart", []))

    @jsii.member(jsii_name="toUpdateConnection")
    def to_update_connection(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to update a connection on your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toUpdateConnection", []))

    @jsii.member(jsii_name="toUpdateFileFolder")
    def to_update_file_folder(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to move files on your account.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toUpdateFileFolder", []))

    @jsii.member(jsii_name="toUpdateFolder")
    def to_update_folder(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to update a folder's name and details on your account.

        Access Level: Write

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toUpdateFolder", []))

    @jsii.member(jsii_name="toUpdateNotebook")
    def to_update_notebook(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to update a notebook metadata on your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toUpdateNotebook", []))

    @jsii.member(jsii_name="toUpdateNotebookCellContent")
    def to_update_notebook_cell_content(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to update a notebook cell content on your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toUpdateNotebookCellContent", []))

    @jsii.member(jsii_name="toUpdateNotebookCellLayout")
    def to_update_notebook_cell_layout(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to update a notebook cell layout on your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toUpdateNotebookCellLayout", []))

    @jsii.member(jsii_name="toUpdateSavedQuery")
    def to_update_saved_query(self) -> "Sqlworkbench":
        '''(experimental) Grants permission to update a saved query on your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-policy-resources.resource-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sqlworkbench", jsii.invoke(self, "toUpdateSavedQuery", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__23b846b087ab5348468a8f1438409aa110c059a72f56583064c74de62b134062)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9ea22e497308ff3f8e9445b0c4b6ce88a0e1a63d8edc1d366adbf5776c041ed9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Sqs(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Sqs"):
    '''(experimental) Statement provider for service `sqs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsqs.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sqs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsqs.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fccd9fc39e93f80f77296767e0d60aa02992ca1bed806a4d3eabb8d90ab921ee)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onQueue")
    def on_queue(
        self,
        queue_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sqs":
        '''(experimental) Adds a resource of type queue to the statement.

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-queue-types.html

        :param queue_name: - Identifier for the queueName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__51e1daeda696c8932ee675101e23a053ead15338af6140ef7d5e2f94e8ef2cd2)
            check_type(argname="argument queue_name", value=queue_name, expected_type=type_hints["queue_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sqs", jsii.invoke(self, "onQueue", [queue_name, account, region, partition]))

    @jsii.member(jsii_name="toAddPermission")
    def to_add_permission(self) -> "Sqs":
        '''(experimental) Grants permission to a queue for a specific principal.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_AddPermission.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toAddPermission", []))

    @jsii.member(jsii_name="toChangeMessageVisibility")
    def to_change_message_visibility(self) -> "Sqs":
        '''(experimental) Grants permission to change the visibility timeout of a specified message in a queue to a new value.

        Access Level: Write

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_ChangeMessageVisibility.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toChangeMessageVisibility", []))

    @jsii.member(jsii_name="toCreateQueue")
    def to_create_queue(self) -> "Sqs":
        '''(experimental) Grants permission to create a new queue, or returns the URL of an existing one.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_CreateQueue.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toCreateQueue", []))

    @jsii.member(jsii_name="toDeleteMessage")
    def to_delete_message(self) -> "Sqs":
        '''(experimental) Grants permission to delete the specified message from the specified queue.

        Access Level: Write

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_DeleteMessage.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toDeleteMessage", []))

    @jsii.member(jsii_name="toDeleteQueue")
    def to_delete_queue(self) -> "Sqs":
        '''(experimental) Grants permission to delete the queue specified by the queue URL, regardless of whether the queue is empty.

        Access Level: Write

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_DeleteQueue.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toDeleteQueue", []))

    @jsii.member(jsii_name="toGetQueueAttributes")
    def to_get_queue_attributes(self) -> "Sqs":
        '''(experimental) Grants permission to get attributes for the specified queue.

        Access Level: Read

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_GetQueueAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toGetQueueAttributes", []))

    @jsii.member(jsii_name="toGetQueueUrl")
    def to_get_queue_url(self) -> "Sqs":
        '''(experimental) Grants permission to return the URL of an existing queue.

        Access Level: Read

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_GetQueueUrl.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toGetQueueUrl", []))

    @jsii.member(jsii_name="toListDeadLetterSourceQueues")
    def to_list_dead_letter_source_queues(self) -> "Sqs":
        '''(experimental) Grants permission to return a list of your queues that have the RedrivePolicy queue attribute configured with a dead letter queue.

        Access Level: Read

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_ListDeadLetterSourceQueues.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toListDeadLetterSourceQueues", []))

    @jsii.member(jsii_name="toListQueues")
    def to_list_queues(self) -> "Sqs":
        '''(experimental) Grants permission to return a list of your queues.

        Access Level: Read

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_ListQueues.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toListQueues", []))

    @jsii.member(jsii_name="toListQueueTags")
    def to_list_queue_tags(self) -> "Sqs":
        '''(experimental) Grants permission to list tags added to an SQS queue.

        Access Level: Read

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_ListQueueTags.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toListQueueTags", []))

    @jsii.member(jsii_name="toPurgeQueue")
    def to_purge_queue(self) -> "Sqs":
        '''(experimental) Grants permission to delete the messages in a queue specified by the queue URL.

        Access Level: Write

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_PurgeQueue.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toPurgeQueue", []))

    @jsii.member(jsii_name="toReceiveMessage")
    def to_receive_message(self) -> "Sqs":
        '''(experimental) Grants permission to retrieve one or more messages, with a maximum limit of 10 messages, from the specified queue.

        Access Level: Read

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_ReceiveMessage.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toReceiveMessage", []))

    @jsii.member(jsii_name="toRemovePermission")
    def to_remove_permission(self) -> "Sqs":
        '''(experimental) Grants permission to revoke any permissions in the queue policy that matches the specified Label parameter.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_RemovePermission.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toRemovePermission", []))

    @jsii.member(jsii_name="toSendMessage")
    def to_send_message(self) -> "Sqs":
        '''(experimental) Grants permission to deliver a message to the specified queue.

        Access Level: Write

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_SendMessage.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toSendMessage", []))

    @jsii.member(jsii_name="toSetQueueAttributes")
    def to_set_queue_attributes(self) -> "Sqs":
        '''(experimental) Grants permission to set the value of one or more queue attributes.

        Access Level: Write

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_SetQueueAttributes.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toSetQueueAttributes", []))

    @jsii.member(jsii_name="toTagQueue")
    def to_tag_queue(self) -> "Sqs":
        '''(experimental) Grants permission to add tags to the specified SQS queue.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_TagQueue.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toTagQueue", []))

    @jsii.member(jsii_name="toUntagQueue")
    def to_untag_queue(self) -> "Sqs":
        '''(experimental) Grants permission to remove tags from the specified SQS queue.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_UntagQueue.html

        :stability: experimental
        '''
        return typing.cast("Sqs", jsii.invoke(self, "toUntagQueue", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e272461768414eb0ec3967df4dba3057b72c8c54f036f51d22e65c9ec243c41e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__db192eae69bfbf21c201d69f35158fe23a69da9681df05af1c48156b1eff2491)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Ssm(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ssm"):
    '''(experimental) Statement provider for service `ssm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssystemsmanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ssm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssystemsmanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0ad998b19f58b64e9262fe0a0b6fa1c923f9e53915da72f6af4f46f207e0cefd)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAutoApprove")
    def if_auto_approve(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ssm":
        '''(experimental) Filters access by verifying that a user has permission to start Change Manager workflows without a review step (with the exception of change freeze events).

        https://docs.aws.amazon.com/systems-manager/latest/userguide/change-manager-auto-approval-access.html

        Applies to actions:

        - .toStartChangeRequestExecution()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d21d4780faecef7937f8b13481b61ce9ff1d9e874f25d9f4bfa0822119433144)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ssm", jsii.invoke(self, "ifAutoApprove", [value, operator]))

    @jsii.member(jsii_name="ifDocumentCategories")
    def if_document_categories(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ssm":
        '''(experimental) Filters access by verifying that a user has permission to access a document belonging to a specific category enum.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#policy-conditions

        Applies to actions:

        - .toGetDocument()

        Applies to resource types:

        - document

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6368fc3f0f6e02902d81e09304b263b2b6a17373ac3c68ad62fd425253acb88b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ssm", jsii.invoke(self, "ifDocumentCategories", [value, operator]))

    @jsii.member(jsii_name="ifOverwrite")
    def if_overwrite(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ssm":
        '''(experimental) Filters access by allowing Systems Manager parameters to be overwritten.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#policy-conditions

        Applies to actions:

        - .toPutParameter()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a5d344accd91c4bc0d9fb62199901673bca733e7737156d6fc55ff634d5fba71)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ssm", jsii.invoke(self, "ifOverwrite", [value, operator]))

    @jsii.member(jsii_name="ifRecursive")
    def if_recursive(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ssm":
        '''(experimental) Filters access by allowing traversing hierarchical structure of the Systems Manager parameters.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#policy-conditions

        Applies to actions:

        - .toGetParametersByPath()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fdeba58250f33179a26d13118f45e6845eca131494ddaa82e59cf4867f767031)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ssm", jsii.invoke(self, "ifRecursive", [value, operator]))

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ssm":
        '''(experimental) Filters access by allowing access based on a tag key-value pair assigned to the Systems Manager resource.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#policy-conditions

        Applies to actions:

        - .toDeregisterManagedInstance()
        - .toGetConnectionStatus()
        - .toSendCommand()
        - .toStartSession()
        - .toUpdateManagedInstanceRole()

        Applies to resource types:

        - automation-execution
        - instance
        - maintenancewindow
        - managed-instance
        - opsmetadata
        - parameter
        - patchbaseline

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__47e56a396519fa21988aeadc34f3e2ee48928ab667a3d78a375b49d8554b9ae5)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ssm", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifSessionDocumentAccessCheck")
    def if_session_document_access_check(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Ssm":
        '''(experimental) Filters access by verifying that a user has permission to access either the default Session Manager configuration document or the custom configuration document specified in a request.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-sessiondocumentaccesscheck.html

        Applies to actions:

        - .toStartSession()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b731304a3f289d36bcf30999f1a54b7c0e03ab148ce050f5750b69dc7ff54042)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Ssm", jsii.invoke(self, "ifSessionDocumentAccessCheck", [value]))

    @jsii.member(jsii_name="ifSourceInstanceARN")
    def if_source_instance_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ssm":
        '''(experimental) Filters access by verifying the Amazon Resource Name (ARN) of the AWS Systems Manager's managed instance from which the request is made.

        This key is not present when the request comes from the managed instance authenticated with an IAM role associated with EC2 instance profile

        https://docs.aws.amazon.com/systems-manager/latest/userguide/service-authorization/latest/reference/list_awssystemsmanager.html#awssystemsmanager-policy-keys

        Applies to actions:

        - .toUpdateAssociationStatus()
        - .toUpdateInstanceAssociationStatus()
        - .toUpdateInstanceInformation()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__73995f777b648b0d5520ae18d48d2db71cc906fd4d2c851c8fa4527a0b12708a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ssm", jsii.invoke(self, "ifSourceInstanceARN", [value, operator]))

    @jsii.member(jsii_name="ifSyncType")
    def if_sync_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ssm":
        '''(experimental) Filters access by verifying that a user also has access to the ResourceDataSync SyncType specified in the request.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#policy-conditions

        Applies to actions:

        - .toCreateResourceDataSync()
        - .toDeleteResourceDataSync()
        - .toListResourceDataSync()
        - .toUpdateResourceDataSync()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__723e9848902d7aa95d07abe1ce1946fac3d6be7d9b22071fb017f01c93c4148f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ssm", jsii.invoke(self, "ifSyncType", [value, operator]))

    @jsii.member(jsii_name="onAssociation")
    def on_association(
        self,
        association_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type association to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-associations.html

        :param association_id: - Identifier for the associationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3a690b2e7212dffe57321e819b0cc554abff0949b8a337133dd5faf5331ce306)
            check_type(argname="argument association_id", value=association_id, expected_type=type_hints["association_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ssm", jsii.invoke(self, "onAssociation", [association_id, account, region, partition]))

    @jsii.member(jsii_name="onAutomationDefinition")
    def on_automation_definition(
        self,
        automation_definition_name: builtins.str,
        version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type automation-definition to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-documents.html

        :param automation_definition_name: - Identifier for the automationDefinitionName.
        :param version_id: - Identifier for the versionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0b7c87b26fe3a829e99a8fde3f9a342e89666955068f9ee3666f8d48df7f63f4)
            check_type(argname="argument automation_definition_name", value=automation_definition_name, expected_type=type_hints["automation_definition_name"])
            check_type(argname="argument version_id", value=version_id, expected_type=type_hints["version_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ssm", jsii.invoke(self, "onAutomationDefinition", [automation_definition_name, version_id, account, region, partition]))

    @jsii.member(jsii_name="onAutomationExecution")
    def on_automation_execution(
        self,
        automation_execution_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type automation-execution to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-working.html

        :param automation_execution_id: - Identifier for the automationExecutionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ce9c6b9e0e7c6c0db227b0c4449f71fdff22c7bdf14bfb3603782bcb1cd87df4)
            check_type(argname="argument automation_execution_id", value=automation_execution_id, expected_type=type_hints["automation_execution_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ssm", jsii.invoke(self, "onAutomationExecution", [automation_execution_id, account, region, partition]))

    @jsii.member(jsii_name="onBucket")
    def on_bucket(
        self,
        bucket_name: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type bucket to the statement.

        https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingBucket.html

        :param bucket_name: - Identifier for the bucketName.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__93bdc703883db78fd3066ce97e86a791e3161cfd15134686c66792af3d2c8538)
            check_type(argname="argument bucket_name", value=bucket_name, expected_type=type_hints["bucket_name"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ssm", jsii.invoke(self, "onBucket", [bucket_name, partition]))

    @jsii.member(jsii_name="onDocument")
    def on_document(
        self,
        document_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type document to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-ssm-docs.html

        :param document_name: - Identifier for the documentName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifDocumentCategories()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8831332cc87dc66f659de4d73ef21ad89457ded5ad9513aa5e545940a7b1986b)
            check_type(argname="argument document_name", value=document_name, expected_type=type_hints["document_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ssm", jsii.invoke(self, "onDocument", [document_name, account, region, partition]))

    @jsii.member(jsii_name="onInstance")
    def on_instance(
        self,
        instance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type instance to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param instance_id: - Identifier for the instanceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__60f7f3607269202710f649a183cba792709972775e32dc65fb2ca2dd52c586c9)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ssm", jsii.invoke(self, "onInstance", [instance_id, account, region, partition]))

    @jsii.member(jsii_name="onMaintenancewindow")
    def on_maintenancewindow(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type maintenancewindow to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-maintenance.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2dae4ed88e159631d79293a79cec2ecea7dc40f51321224d4a5e4e56815d1428)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ssm", jsii.invoke(self, "onMaintenancewindow", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onManagedInstance")
    def on_managed_instance(
        self,
        instance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type managed-instance to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/what-is-systems-manager.html

        :param instance_id: - Identifier for the instanceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7b5d8647d7a2f1c5c3d0bb6885d642d439d647d5f66f7453fe4345bab2de1818)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ssm", jsii.invoke(self, "onManagedInstance", [instance_id, account, region, partition]))

    @jsii.member(jsii_name="onManagedInstanceInventory")
    def on_managed_instance_inventory(
        self,
        instance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type managed-instance-inventory to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-inventory-configuring.html

        :param instance_id: - Identifier for the instanceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ceaafbd0ad6b1bb40725ab4fe8941dbb37516cff23c325e67311ff64b28bc2fc)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ssm", jsii.invoke(self, "onManagedInstanceInventory", [instance_id, account, region, partition]))

    @jsii.member(jsii_name="onOpsitem")
    def on_opsitem(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type opsitem to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/OpsCenter-working-with-OpsItems.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__40d0e87526570dfb7d5517b587dc3535379f754ca0d32f5d68703ae712b446ee)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ssm", jsii.invoke(self, "onOpsitem", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onOpsmetadata")
    def on_opsmetadata(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type opsmetadata to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/application-manager.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__01902bc286564c45dc9cd7d427d29ad5ae3e5d06bb74beae2766ad0005a29e2d)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ssm", jsii.invoke(self, "onOpsmetadata", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onParameter")
    def on_parameter(
        self,
        parameter_name_without_leading_slash: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type parameter to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html

        :param parameter_name_without_leading_slash: - Identifier for the parameterNameWithoutLeadingSlash.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__744056e81ef89f4d59306e8a9ea9bf6d7da09d3f68fe51d95e888e1cd46aaaee)
            check_type(argname="argument parameter_name_without_leading_slash", value=parameter_name_without_leading_slash, expected_type=type_hints["parameter_name_without_leading_slash"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ssm", jsii.invoke(self, "onParameter", [parameter_name_without_leading_slash, account, region, partition]))

    @jsii.member(jsii_name="onPatchbaseline")
    def on_patchbaseline(
        self,
        patch_baseline_id_resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type patchbaseline to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-patch.html

        :param patch_baseline_id_resource_id: - Identifier for the patchBaselineIdResourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0034e20d5babf1c3e8cbb2ef63d5d68affe53e5803c8a972ce4080a2998ec672)
            check_type(argname="argument patch_baseline_id_resource_id", value=patch_baseline_id_resource_id, expected_type=type_hints["patch_baseline_id_resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ssm", jsii.invoke(self, "onPatchbaseline", [patch_baseline_id_resource_id, account, region, partition]))

    @jsii.member(jsii_name="onResourcedatasync")
    def on_resourcedatasync(
        self,
        sync_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type resourcedatasync to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-inventory-datasync.html

        :param sync_name: - Identifier for the syncName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__376c05b04d5b57766995569b6dfc6fb1fc6e4b960c48e2e49202b15cadf09dcf)
            check_type(argname="argument sync_name", value=sync_name, expected_type=type_hints["sync_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ssm", jsii.invoke(self, "onResourcedatasync", [sync_name, account, region, partition]))

    @jsii.member(jsii_name="onServicesetting")
    def on_servicesetting(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type servicesetting to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/API_ServiceSetting.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e28c5e04fd85884e07b599bb134ca39ab8bd18d44b7d7a55fd5bef0688074fdd)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ssm", jsii.invoke(self, "onServicesetting", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onSession")
    def on_session(
        self,
        session_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type session to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html

        :param session_id: - Identifier for the sessionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__67233b376bd08a19fa97a0d65a3c875c96d5af84d9eda51b8626962d4addedd4)
            check_type(argname="argument session_id", value=session_id, expected_type=type_hints["session_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ssm", jsii.invoke(self, "onSession", [session_id, account, region, partition]))

    @jsii.member(jsii_name="onTask")
    def on_task(
        self,
        task_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type task to the statement.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/scheduling_tasks.html

        :param task_id: - Identifier for the taskId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__00fa255a9579b572a472d43df2f78b789d2325f94e12a28b74f1b61e3c1d9ec0)
            check_type(argname="argument task_id", value=task_id, expected_type=type_hints["task_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ssm", jsii.invoke(self, "onTask", [task_id, account, region, partition]))

    @jsii.member(jsii_name="onWindowtarget")
    def on_windowtarget(
        self,
        window_target_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type windowtarget to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-maintenance-assign-targets.html

        :param window_target_id: - Identifier for the windowTargetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__97d5a3ab36abacbe640fb1f617a1ce5bc625fbcebe3662afae7cc0c8deac2781)
            check_type(argname="argument window_target_id", value=window_target_id, expected_type=type_hints["window_target_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ssm", jsii.invoke(self, "onWindowtarget", [window_target_id, account, region, partition]))

    @jsii.member(jsii_name="onWindowtask")
    def on_windowtask(
        self,
        window_task_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ssm":
        '''(experimental) Adds a resource of type windowtask to the statement.

        https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-maintenance-assign-tasks.html

        :param window_task_id: - Identifier for the windowTaskId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f4506cae2860b90df0d35e04d061047be854ef7f8cb3bf7607eb4a9e0304a51f)
            check_type(argname="argument window_task_id", value=window_task_id, expected_type=type_hints["window_task_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ssm", jsii.invoke(self, "onWindowtask", [window_task_id, account, region, partition]))

    @jsii.member(jsii_name="toAddTagsToResource")
    def to_add_tags_to_resource(self) -> "Ssm":
        '''(experimental) Grants permission to add or overwrite one or more tags for a specified AWS resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_AddTagsToResource.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toAddTagsToResource", []))

    @jsii.member(jsii_name="toAssociateOpsItemRelatedItem")
    def to_associate_ops_item_related_item(self) -> "Ssm":
        '''(experimental) Grants permission to associate RelatedItem to an OpsItem.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_AssociateOpsItemRelatedItem.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toAssociateOpsItemRelatedItem", []))

    @jsii.member(jsii_name="toCancelCommand")
    def to_cancel_command(self) -> "Ssm":
        '''(experimental) Grants permission to cancel a specified Run Command command.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CancelCommand.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCancelCommand", []))

    @jsii.member(jsii_name="toCancelMaintenanceWindowExecution")
    def to_cancel_maintenance_window_execution(self) -> "Ssm":
        '''(experimental) Grants permission to cancel an in-progress maintenance window execution.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CancelMaintenanceWindowExecution.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCancelMaintenanceWindowExecution", []))

    @jsii.member(jsii_name="toCreateActivation")
    def to_create_activation(self) -> "Ssm":
        '''(experimental) Grants permission to create an activation that is used to register on-premises servers and virtual machines (VMs) with Systems Manager.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateActivation.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCreateActivation", []))

    @jsii.member(jsii_name="toCreateAssociation")
    def to_create_association(self) -> "Ssm":
        '''(experimental) Grants permission to associate a specified Systems Manager document with specified instances or other targets.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateAssociation.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCreateAssociation", []))

    @jsii.member(jsii_name="toCreateAssociationBatch")
    def to_create_association_batch(self) -> "Ssm":
        '''(experimental) Grants permission to combine entries for multiple CreateAssociation operations in a single command.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateAssociationBatch.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCreateAssociationBatch", []))

    @jsii.member(jsii_name="toCreateDocument")
    def to_create_document(self) -> "Ssm":
        '''(experimental) Grants permission to create a Systems Manager SSM document.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateDocument.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCreateDocument", []))

    @jsii.member(jsii_name="toCreateMaintenanceWindow")
    def to_create_maintenance_window(self) -> "Ssm":
        '''(experimental) Grants permission to create a maintenance window.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateMaintenanceWindow.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCreateMaintenanceWindow", []))

    @jsii.member(jsii_name="toCreateOpsItem")
    def to_create_ops_item(self) -> "Ssm":
        '''(experimental) Grants permission to create an OpsItem in OpsCenter.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateOpsItem.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCreateOpsItem", []))

    @jsii.member(jsii_name="toCreateOpsMetadata")
    def to_create_ops_metadata(self) -> "Ssm":
        '''(experimental) Grants permission to create an OpsMetadata object for an AWS resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateOpsMetadata.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCreateOpsMetadata", []))

    @jsii.member(jsii_name="toCreatePatchBaseline")
    def to_create_patch_baseline(self) -> "Ssm":
        '''(experimental) Grants permission to create a patch baseline.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreatePatchBaseline.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCreatePatchBaseline", []))

    @jsii.member(jsii_name="toCreateResourceDataSync")
    def to_create_resource_data_sync(self) -> "Ssm":
        '''(experimental) Grants permission to create a resource data sync configuration, which regularly collects inventory data from managed instances and updates the data in an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifSyncType()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateResourceDataSync.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toCreateResourceDataSync", []))

    @jsii.member(jsii_name="toDeleteActivation")
    def to_delete_activation(self) -> "Ssm":
        '''(experimental) Grants permission to delete a specified activation for managed instances.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteActivation.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeleteActivation", []))

    @jsii.member(jsii_name="toDeleteAssociation")
    def to_delete_association(self) -> "Ssm":
        '''(experimental) Grants permission to disassociate a specified SSM document from a specified instance.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteAssociation.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeleteAssociation", []))

    @jsii.member(jsii_name="toDeleteDocument")
    def to_delete_document(self) -> "Ssm":
        '''(experimental) Grants permission to delete a specified SSM document and its instance associations.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteDocument.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeleteDocument", []))

    @jsii.member(jsii_name="toDeleteInventory")
    def to_delete_inventory(self) -> "Ssm":
        '''(experimental) Grants permission to delete a specified custom inventory type, or the data associated with a custom inventory type.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteInventory.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeleteInventory", []))

    @jsii.member(jsii_name="toDeleteMaintenanceWindow")
    def to_delete_maintenance_window(self) -> "Ssm":
        '''(experimental) Grants permission to delete a specified maintenance window.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteMaintenanceWindow.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeleteMaintenanceWindow", []))

    @jsii.member(jsii_name="toDeleteOpsMetadata")
    def to_delete_ops_metadata(self) -> "Ssm":
        '''(experimental) Grants permission to delete an OpsMetadata object.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteOpsMetadata.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeleteOpsMetadata", []))

    @jsii.member(jsii_name="toDeleteParameter")
    def to_delete_parameter(self) -> "Ssm":
        '''(experimental) Grants permission to delete a specified SSM parameter.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteParameter.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeleteParameter", []))

    @jsii.member(jsii_name="toDeleteParameters")
    def to_delete_parameters(self) -> "Ssm":
        '''(experimental) Grants permission to delete multiple specified SSM parameters.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteParameters.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeleteParameters", []))

    @jsii.member(jsii_name="toDeletePatchBaseline")
    def to_delete_patch_baseline(self) -> "Ssm":
        '''(experimental) Grants permission to delete a specified patch baseline.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeletePatchBaseline.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeletePatchBaseline", []))

    @jsii.member(jsii_name="toDeleteResourceDataSync")
    def to_delete_resource_data_sync(self) -> "Ssm":
        '''(experimental) Grants permission to delete a specified resource data sync.

        Access Level: Write

        Possible conditions:

        - .ifSyncType()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeleteResourceDataSync.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeleteResourceDataSync", []))

    @jsii.member(jsii_name="toDeregisterManagedInstance")
    def to_deregister_managed_instance(self) -> "Ssm":
        '''(experimental) Grants permission to deregister a specified on-premises server or virtual machine (VM) from Systems Manager.

        Access Level: Write

        Possible conditions:

        - .ifResourceTag()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeregisterManagedInstance.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeregisterManagedInstance", []))

    @jsii.member(jsii_name="toDeregisterPatchBaselineForPatchGroup")
    def to_deregister_patch_baseline_for_patch_group(self) -> "Ssm":
        '''(experimental) Grants permission to deregister a specified patch baseline from being the default patch baseline for a specified patch group.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeregisterPatchBaselineForPatchGroup.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeregisterPatchBaselineForPatchGroup", []))

    @jsii.member(jsii_name="toDeregisterTargetFromMaintenanceWindow")
    def to_deregister_target_from_maintenance_window(self) -> "Ssm":
        '''(experimental) Grants permission to deregister a specified target from a maintenance window.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeregisterTargetFromMaintenanceWindow.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeregisterTargetFromMaintenanceWindow", []))

    @jsii.member(jsii_name="toDeregisterTaskFromMaintenanceWindow")
    def to_deregister_task_from_maintenance_window(self) -> "Ssm":
        '''(experimental) Grants permission to deregister a specified task from a maintenance window.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DeregisterTaskFromMaintenanceWindow.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDeregisterTaskFromMaintenanceWindow", []))

    @jsii.member(jsii_name="toDescribeActivations")
    def to_describe_activations(self) -> "Ssm":
        '''(experimental) Grants permission to view details about a specified managed instance activation, such as when it was created and the number of instances registered using the activation.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeActivations.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeActivations", []))

    @jsii.member(jsii_name="toDescribeAssociation")
    def to_describe_association(self) -> "Ssm":
        '''(experimental) Grants permission to view details about the specified association for a specified instance or target.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeAssociation.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeAssociation", []))

    @jsii.member(jsii_name="toDescribeAssociationExecutions")
    def to_describe_association_executions(self) -> "Ssm":
        '''(experimental) Grants permission to view all executions for a specified association.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeAssociationExecutions.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeAssociationExecutions", []))

    @jsii.member(jsii_name="toDescribeAssociationExecutionTargets")
    def to_describe_association_execution_targets(self) -> "Ssm":
        '''(experimental) Grants permission to view information about a specified association execution.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeAssociationExecutionTargets.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeAssociationExecutionTargets", []))

    @jsii.member(jsii_name="toDescribeAutomationExecutions")
    def to_describe_automation_executions(self) -> "Ssm":
        '''(experimental) Grants permission to view details about all active and terminated Automation executions.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeAutomationExecutions.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeAutomationExecutions", []))

    @jsii.member(jsii_name="toDescribeAutomationStepExecutions")
    def to_describe_automation_step_executions(self) -> "Ssm":
        '''(experimental) Grants permission to view information about all active and terminated step executions in an Automation workflow.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeAutomationStepExecutions.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeAutomationStepExecutions", []))

    @jsii.member(jsii_name="toDescribeAvailablePatches")
    def to_describe_available_patches(self) -> "Ssm":
        '''(experimental) Grants permission to view all patches eligible to include in a patch baseline.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeAvailablePatches.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeAvailablePatches", []))

    @jsii.member(jsii_name="toDescribeDocument")
    def to_describe_document(self) -> "Ssm":
        '''(experimental) Grants permission to view details about a specified SSM document.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeDocument.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeDocument", []))

    @jsii.member(jsii_name="toDescribeDocumentParameters")
    def to_describe_document_parameters(self) -> "Ssm":
        '''(experimental) Grants permission to display information about SSM document parameters in the Systems Manager console (internal Systems Manager action).

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeDocumentParameters", []))

    @jsii.member(jsii_name="toDescribeDocumentPermission")
    def to_describe_document_permission(self) -> "Ssm":
        '''(experimental) Grants permission to view the permissions for a specified SSM document.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeDocumentPermission.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeDocumentPermission", []))

    @jsii.member(jsii_name="toDescribeEffectiveInstanceAssociations")
    def to_describe_effective_instance_associations(self) -> "Ssm":
        '''(experimental) Grants permission to view all current associations for a specified instance.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeEffectiveInstanceAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeEffectiveInstanceAssociations", []))

    @jsii.member(jsii_name="toDescribeEffectivePatchesForPatchBaseline")
    def to_describe_effective_patches_for_patch_baseline(self) -> "Ssm":
        '''(experimental) Grants permission to view details about the patches currently associated with the specified patch baseline (Windows only).

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeEffectivePatchesForPatchBaseline.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeEffectivePatchesForPatchBaseline", []))

    @jsii.member(jsii_name="toDescribeInstanceAssociationsStatus")
    def to_describe_instance_associations_status(self) -> "Ssm":
        '''(experimental) Grants permission to view the status of the associations for a specified instance.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeInstanceAssociationsStatus.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeInstanceAssociationsStatus", []))

    @jsii.member(jsii_name="toDescribeInstanceInformation")
    def to_describe_instance_information(self) -> "Ssm":
        '''(experimental) Grants permission to view details about a specified instance.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeInstanceInformation.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeInstanceInformation", []))

    @jsii.member(jsii_name="toDescribeInstancePatches")
    def to_describe_instance_patches(self) -> "Ssm":
        '''(experimental) Grants permission to view general details about the patches on a specified instance.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeInstancePatches.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeInstancePatches", []))

    @jsii.member(jsii_name="toDescribeInstancePatchStates")
    def to_describe_instance_patch_states(self) -> "Ssm":
        '''(experimental) Grants permission to view status details about patches on a specified instance.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeInstancePatchStates.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeInstancePatchStates", []))

    @jsii.member(jsii_name="toDescribeInstancePatchStatesForPatchGroup")
    def to_describe_instance_patch_states_for_patch_group(self) -> "Ssm":
        '''(experimental) Grants permission to describe the high-level patch state for the instances in the specified patch group.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeInstancePatchStatesForPatchGroup.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeInstancePatchStatesForPatchGroup", []))

    @jsii.member(jsii_name="toDescribeInstanceProperties")
    def to_describe_instance_properties(self) -> "Ssm":
        '''(experimental) Grants permission to user's Amazon EC2 console to render managed instances' nodes.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeInstanceProperties", []))

    @jsii.member(jsii_name="toDescribeInventoryDeletions")
    def to_describe_inventory_deletions(self) -> "Ssm":
        '''(experimental) Grants permission to view details about a specified inventory deletion.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeInventoryDeletions.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeInventoryDeletions", []))

    @jsii.member(jsii_name="toDescribeMaintenanceWindowExecutions")
    def to_describe_maintenance_window_executions(self) -> "Ssm":
        '''(experimental) Grants permission to view the executions of a specified maintenance window.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeMaintenanceWindowExecutions.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeMaintenanceWindowExecutions", []))

    @jsii.member(jsii_name="toDescribeMaintenanceWindowExecutionTaskInvocations")
    def to_describe_maintenance_window_execution_task_invocations(self) -> "Ssm":
        '''(experimental) Grants permission to view details of a specified task execution for a maintenance window.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeMaintenanceWindowExecutionTaskInvocations.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeMaintenanceWindowExecutionTaskInvocations", []))

    @jsii.member(jsii_name="toDescribeMaintenanceWindowExecutionTasks")
    def to_describe_maintenance_window_execution_tasks(self) -> "Ssm":
        '''(experimental) Grants permission to view details about the tasks that ran during a specified maintenance window execution.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeMaintenanceWindowExecutionTasks.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeMaintenanceWindowExecutionTasks", []))

    @jsii.member(jsii_name="toDescribeMaintenanceWindows")
    def to_describe_maintenance_windows(self) -> "Ssm":
        '''(experimental) Grants permission to view information about all or specified maintenance windows.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeMaintenanceWindows.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeMaintenanceWindows", []))

    @jsii.member(jsii_name="toDescribeMaintenanceWindowSchedule")
    def to_describe_maintenance_window_schedule(self) -> "Ssm":
        '''(experimental) Grants permission to view details about upcoming executions of a specified maintenance window.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeMaintenanceWindowSchedule.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeMaintenanceWindowSchedule", []))

    @jsii.member(jsii_name="toDescribeMaintenanceWindowsForTarget")
    def to_describe_maintenance_windows_for_target(self) -> "Ssm":
        '''(experimental) Grants permission to view information about the maintenance window targets and tasks associated with a specified instance.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeMaintenanceWindowsForTarget.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeMaintenanceWindowsForTarget", []))

    @jsii.member(jsii_name="toDescribeMaintenanceWindowTargets")
    def to_describe_maintenance_window_targets(self) -> "Ssm":
        '''(experimental) Grants permission to view a list of the targets associated with a specified maintenance window.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeMaintenanceWindowTargets.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeMaintenanceWindowTargets", []))

    @jsii.member(jsii_name="toDescribeMaintenanceWindowTasks")
    def to_describe_maintenance_window_tasks(self) -> "Ssm":
        '''(experimental) Grants permission to view a list of the tasks associated with a specified maintenance window.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeMaintenanceWindowTasks.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeMaintenanceWindowTasks", []))

    @jsii.member(jsii_name="toDescribeOpsItems")
    def to_describe_ops_items(self) -> "Ssm":
        '''(experimental) Grants permission to view details about specified OpsItems.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeOpsItems.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeOpsItems", []))

    @jsii.member(jsii_name="toDescribeParameters")
    def to_describe_parameters(self) -> "Ssm":
        '''(experimental) Grants permission to view details about a specified SSM parameter.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeParameters.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeParameters", []))

    @jsii.member(jsii_name="toDescribePatchBaselines")
    def to_describe_patch_baselines(self) -> "Ssm":
        '''(experimental) Grants permission to view information about patch baselines that meet the specified criteria.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribePatchBaselines.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribePatchBaselines", []))

    @jsii.member(jsii_name="toDescribePatchGroups")
    def to_describe_patch_groups(self) -> "Ssm":
        '''(experimental) Grants permission to view information about the patch baseline for a specified patch group.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribePatchGroups.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribePatchGroups", []))

    @jsii.member(jsii_name="toDescribePatchGroupState")
    def to_describe_patch_group_state(self) -> "Ssm":
        '''(experimental) Grants permission to view aggregated status details for patches for a specified patch group.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribePatchGroupState.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribePatchGroupState", []))

    @jsii.member(jsii_name="toDescribePatchProperties")
    def to_describe_patch_properties(self) -> "Ssm":
        '''(experimental) Grants permission to view details of available patches for a specified operating system and patch property.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribePatchProperties.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribePatchProperties", []))

    @jsii.member(jsii_name="toDescribeSessions")
    def to_describe_sessions(self) -> "Ssm":
        '''(experimental) Grants permission to view a list of recent Session Manager sessions that meet the specified search criteria.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribeSessions.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDescribeSessions", []))

    @jsii.member(jsii_name="toDisassociateOpsItemRelatedItem")
    def to_disassociate_ops_item_related_item(self) -> "Ssm":
        '''(experimental) Grants permission to disassociate RelatedItem from an OpsItem.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DisassociateOpsItemRelatedItem.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toDisassociateOpsItemRelatedItem", []))

    @jsii.member(jsii_name="toGetAutomationExecution")
    def to_get_automation_execution(self) -> "Ssm":
        '''(experimental) Grants permission to view details of a specified Automation execution.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_AutomationExecution.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetAutomationExecution", []))

    @jsii.member(jsii_name="toGetCalendar")
    def to_get_calendar(self) -> "Ssm":
        '''(experimental) Grants permission to view details of a specific calendar.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetCalendar", []))

    @jsii.member(jsii_name="toGetCalendarState")
    def to_get_calendar_state(self) -> "Ssm":
        '''(experimental) Grants permission to view the calendar state for a change calendar or a list of change calendars.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetCalendarState.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetCalendarState", []))

    @jsii.member(jsii_name="toGetCommandInvocation")
    def to_get_command_invocation(self) -> "Ssm":
        '''(experimental) Grants permission to view details about the command execution of a specified invocation or plugin.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetCommandInvocation.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetCommandInvocation", []))

    @jsii.member(jsii_name="toGetConnectionStatus")
    def to_get_connection_status(self) -> "Ssm":
        '''(experimental) Grants permission to view the Session Manager connection status for a specified managed instance.

        Access Level: Read

        Possible conditions:

        - .ifResourceTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetConnectionStatus.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetConnectionStatus", []))

    @jsii.member(jsii_name="toGetDefaultPatchBaseline")
    def to_get_default_patch_baseline(self) -> "Ssm":
        '''(experimental) Grants permission to view the current default patch baseline for a specified operating system type.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetDefaultPatchBaseline.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetDefaultPatchBaseline", []))

    @jsii.member(jsii_name="toGetDeployablePatchSnapshotForInstance")
    def to_get_deployable_patch_snapshot_for_instance(self) -> "Ssm":
        '''(experimental) Grants permission to retrieve the current patch baseline snapshot for a specified instance.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetDeployablePatchSnapshotForInstance.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetDeployablePatchSnapshotForInstance", []))

    @jsii.member(jsii_name="toGetDocument")
    def to_get_document(self) -> "Ssm":
        '''(experimental) Grants permission to view the contents of a specified SSM document.

        Access Level: Read

        Possible conditions:

        - .ifDocumentCategories()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetDocument.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetDocument", []))

    @jsii.member(jsii_name="toGetInventory")
    def to_get_inventory(self) -> "Ssm":
        '''(experimental) Grants permission to view instance inventory details per the specified criteria.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetInventory.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetInventory", []))

    @jsii.member(jsii_name="toGetInventorySchema")
    def to_get_inventory_schema(self) -> "Ssm":
        '''(experimental) Grants permission to view a list of inventory types or attribute names for a specified inventory item type.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetInventorySchema.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetInventorySchema", []))

    @jsii.member(jsii_name="toGetMaintenanceWindow")
    def to_get_maintenance_window(self) -> "Ssm":
        '''(experimental) Grants permission to view details about a specified maintenance window.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetMaintenanceWindow.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetMaintenanceWindow", []))

    @jsii.member(jsii_name="toGetMaintenanceWindowExecution")
    def to_get_maintenance_window_execution(self) -> "Ssm":
        '''(experimental) Grants permission to view details about a specified maintenance window execution.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetMaintenanceWindowExecution.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetMaintenanceWindowExecution", []))

    @jsii.member(jsii_name="toGetMaintenanceWindowExecutionTask")
    def to_get_maintenance_window_execution_task(self) -> "Ssm":
        '''(experimental) Grants permission to view details about a specified maintenance window execution task.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetMaintenanceWindowExecutionTask.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetMaintenanceWindowExecutionTask", []))

    @jsii.member(jsii_name="toGetMaintenanceWindowExecutionTaskInvocation")
    def to_get_maintenance_window_execution_task_invocation(self) -> "Ssm":
        '''(experimental) Grants permission to view details about a specific maintenance window task running on a specific target.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetMaintenanceWindowExecutionTaskInvocation.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetMaintenanceWindowExecutionTaskInvocation", []))

    @jsii.member(jsii_name="toGetMaintenanceWindowTask")
    def to_get_maintenance_window_task(self) -> "Ssm":
        '''(experimental) Grants permission to view details about tasks registered with a specified maintenance window.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetMaintenanceWindowTask.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetMaintenanceWindowTask", []))

    @jsii.member(jsii_name="toGetManifest")
    def to_get_manifest(self) -> "Ssm":
        '''(experimental) Grants permission to Systems Manager and SSM Agent to determine package installation requirements for an instance (internal Systems Manager call).

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetManifest", []))

    @jsii.member(jsii_name="toGetOpsItem")
    def to_get_ops_item(self) -> "Ssm":
        '''(experimental) Grants permission to view information about a specified OpsItem.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetOpsItem.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetOpsItem", []))

    @jsii.member(jsii_name="toGetOpsMetadata")
    def to_get_ops_metadata(self) -> "Ssm":
        '''(experimental) Grants permission to retrieve an OpsMetadata object.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetOpsMetadata.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetOpsMetadata", []))

    @jsii.member(jsii_name="toGetOpsSummary")
    def to_get_ops_summary(self) -> "Ssm":
        '''(experimental) Grants permission to view summary information about OpsItems based on specified filters and aggregators.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetOpsSummary.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetOpsSummary", []))

    @jsii.member(jsii_name="toGetParameter")
    def to_get_parameter(self) -> "Ssm":
        '''(experimental) Grants permission to view information about a specified parameter.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetParameter.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetParameter", []))

    @jsii.member(jsii_name="toGetParameterHistory")
    def to_get_parameter_history(self) -> "Ssm":
        '''(experimental) Grants permission to view details and changes for a specified parameter.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetParameterHistory.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetParameterHistory", []))

    @jsii.member(jsii_name="toGetParameters")
    def to_get_parameters(self) -> "Ssm":
        '''(experimental) Grants permission to view information about multiple specified parameters.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetParameters.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetParameters", []))

    @jsii.member(jsii_name="toGetParametersByPath")
    def to_get_parameters_by_path(self) -> "Ssm":
        '''(experimental) Grants permission to view information about parameters in a specified hierarchy.

        Access Level: Read

        Possible conditions:

        - .ifRecursive()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetParametersByPath.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetParametersByPath", []))

    @jsii.member(jsii_name="toGetPatchBaseline")
    def to_get_patch_baseline(self) -> "Ssm":
        '''(experimental) Grants permission to view information about a specified patch baseline.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetPatchBaseline.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetPatchBaseline", []))

    @jsii.member(jsii_name="toGetPatchBaselineForPatchGroup")
    def to_get_patch_baseline_for_patch_group(self) -> "Ssm":
        '''(experimental) Grants permission to view the ID of the current patch baseline for a specified patch group.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetPatchBaselineForPatchGroup.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetPatchBaselineForPatchGroup", []))

    @jsii.member(jsii_name="toGetServiceSetting")
    def to_get_service_setting(self) -> "Ssm":
        '''(experimental) Grants permission to view the account-level setting for an AWS service.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetServiceSetting.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toGetServiceSetting", []))

    @jsii.member(jsii_name="toLabelParameterVersion")
    def to_label_parameter_version(self) -> "Ssm":
        '''(experimental) Grants permission to apply an identifying label to a specified version of a parameter.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_LabelParameterVersion.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toLabelParameterVersion", []))

    @jsii.member(jsii_name="toListAssociations")
    def to_list_associations(self) -> "Ssm":
        '''(experimental) Grants permission to list the associations for a specified SSM document or managed instance.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListAssociations", []))

    @jsii.member(jsii_name="toListAssociationVersions")
    def to_list_association_versions(self) -> "Ssm":
        '''(experimental) Grants permission to list versions of the specified association.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListAssociationVersions.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListAssociationVersions", []))

    @jsii.member(jsii_name="toListCommandInvocations")
    def to_list_command_invocations(self) -> "Ssm":
        '''(experimental) Grants permission to list information about command invocations sent to a specified instance.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListCommandInvocations.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListCommandInvocations", []))

    @jsii.member(jsii_name="toListCommands")
    def to_list_commands(self) -> "Ssm":
        '''(experimental) Grants permission to list the commands sent to a specified instance.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListCommands.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListCommands", []))

    @jsii.member(jsii_name="toListComplianceItems")
    def to_list_compliance_items(self) -> "Ssm":
        '''(experimental) Grants permission to list compliance status for specified resource types on a specified resource.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListComplianceItems.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListComplianceItems", []))

    @jsii.member(jsii_name="toListComplianceSummaries")
    def to_list_compliance_summaries(self) -> "Ssm":
        '''(experimental) Grants permission to list a summary count of compliant and noncompliant resources for a specified compliance type.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListComplianceSummaries.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListComplianceSummaries", []))

    @jsii.member(jsii_name="toListDocumentMetadataHistory")
    def to_list_document_metadata_history(self) -> "Ssm":
        '''(experimental) Grants permission to view metadata history about a specified SSM document.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListDocumentMetadataHistory.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListDocumentMetadataHistory", []))

    @jsii.member(jsii_name="toListDocuments")
    def to_list_documents(self) -> "Ssm":
        '''(experimental) Grants permission to view information about a specified SSM document.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListDocuments.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListDocuments", []))

    @jsii.member(jsii_name="toListDocumentVersions")
    def to_list_document_versions(self) -> "Ssm":
        '''(experimental) Grants permission to list all versions of a specified document.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListDocumentVersions.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListDocumentVersions", []))

    @jsii.member(jsii_name="toListInstanceAssociations")
    def to_list_instance_associations(self) -> "Ssm":
        '''(experimental) Grants permission to SSM Agent to check for new State Manager associations (internal Systems Manager call).

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListInstanceAssociations", []))

    @jsii.member(jsii_name="toListInventoryEntries")
    def to_list_inventory_entries(self) -> "Ssm":
        '''(experimental) Grants permission to view a list of specified inventory types for a specified instance.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListInventoryEntries.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListInventoryEntries", []))

    @jsii.member(jsii_name="toListOpsItemEvents")
    def to_list_ops_item_events(self) -> "Ssm":
        '''(experimental) Grants permission to view details about OpsItemEvents.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListOpsItemEvents.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListOpsItemEvents", []))

    @jsii.member(jsii_name="toListOpsItemRelatedItems")
    def to_list_ops_item_related_items(self) -> "Ssm":
        '''(experimental) Grants permission to view details about OpsItem RelatedItems.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListOpsItemRelatedItems.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListOpsItemRelatedItems", []))

    @jsii.member(jsii_name="toListOpsMetadata")
    def to_list_ops_metadata(self) -> "Ssm":
        '''(experimental) Grants permission to view a list of OpsMetadata objects.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListOpsMetadata.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListOpsMetadata", []))

    @jsii.member(jsii_name="toListResourceComplianceSummaries")
    def to_list_resource_compliance_summaries(self) -> "Ssm":
        '''(experimental) Grants permission to list resource-level summary count.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListResourceComplianceSummaries.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListResourceComplianceSummaries", []))

    @jsii.member(jsii_name="toListResourceDataSync")
    def to_list_resource_data_sync(self) -> "Ssm":
        '''(experimental) Grants permission to list information about resource data sync configurations in an account.

        Access Level: List

        Possible conditions:

        - .ifSyncType()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListResourceDataSync.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListResourceDataSync", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Ssm":
        '''(experimental) Grants permission to view a list of resource tags for a specified resource.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toModifyDocumentPermission")
    def to_modify_document_permission(self) -> "Ssm":
        '''(experimental) Grants permission to share a custom SSM document publicly or privately with specified AWS accounts.

        Access Level: Permissions management

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ModifyDocumentPermission.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toModifyDocumentPermission", []))

    @jsii.member(jsii_name="toPutCalendar")
    def to_put_calendar(self) -> "Ssm":
        '''(experimental) Grants permission to create/edit a specific calendar.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toPutCalendar", []))

    @jsii.member(jsii_name="toPutComplianceItems")
    def to_put_compliance_items(self) -> "Ssm":
        '''(experimental) Grants permission to register a compliance type and other compliance details on a specified resource.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PutComplianceItems.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toPutComplianceItems", []))

    @jsii.member(jsii_name="toPutConfigurePackageResult")
    def to_put_configure_package_result(self) -> "Ssm":
        '''(experimental) Grants permission to SSM Agent to generate a report of the results of specific agent requests (internal Systems Manager call).

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toPutConfigurePackageResult", []))

    @jsii.member(jsii_name="toPutInventory")
    def to_put_inventory(self) -> "Ssm":
        '''(experimental) Grants permission to add or update inventory items on multiple specified managed instances.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PutInventory.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toPutInventory", []))

    @jsii.member(jsii_name="toPutParameter")
    def to_put_parameter(self) -> "Ssm":
        '''(experimental) Grants permission to create an SSM parameter.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifOverwrite()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PutParameter.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toPutParameter", []))

    @jsii.member(jsii_name="toRegisterDefaultPatchBaseline")
    def to_register_default_patch_baseline(self) -> "Ssm":
        '''(experimental) Grants permission to specify the default patch baseline for an operating system type.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_RegisterDefaultPatchBaseline.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toRegisterDefaultPatchBaseline", []))

    @jsii.member(jsii_name="toRegisterManagedInstance")
    def to_register_managed_instance(self) -> "Ssm":
        '''(experimental) Grants permission to register a Systems Manager Agent.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toRegisterManagedInstance", []))

    @jsii.member(jsii_name="toRegisterPatchBaselineForPatchGroup")
    def to_register_patch_baseline_for_patch_group(self) -> "Ssm":
        '''(experimental) Grants permission to specify the default patch baseline for a specified patch group.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_RegisterPatchBaselineForPatchGroup.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toRegisterPatchBaselineForPatchGroup", []))

    @jsii.member(jsii_name="toRegisterTargetWithMaintenanceWindow")
    def to_register_target_with_maintenance_window(self) -> "Ssm":
        '''(experimental) Grants permission to register a target with a specified maintenance window.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_RegisterTargetWithMaintenanceWindow.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toRegisterTargetWithMaintenanceWindow", []))

    @jsii.member(jsii_name="toRegisterTaskWithMaintenanceWindow")
    def to_register_task_with_maintenance_window(self) -> "Ssm":
        '''(experimental) Grants permission to register a task with a specified maintenance window.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_RegisterTaskWithMaintenanceWindow.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toRegisterTaskWithMaintenanceWindow", []))

    @jsii.member(jsii_name="toRemoveTagsFromResource")
    def to_remove_tags_from_resource(self) -> "Ssm":
        '''(experimental) Grants permission to remove a specified tag key from a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_RemoveTagsFromResource.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toRemoveTagsFromResource", []))

    @jsii.member(jsii_name="toResetServiceSetting")
    def to_reset_service_setting(self) -> "Ssm":
        '''(experimental) Grants permission to reset the service setting for an AWS account to the default value.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ResetServiceSetting.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toResetServiceSetting", []))

    @jsii.member(jsii_name="toResumeSession")
    def to_resume_session(self) -> "Ssm":
        '''(experimental) Grants permission to reconnect a Session Manager session to a managed instance.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ResumeSession.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toResumeSession", []))

    @jsii.member(jsii_name="toSendAutomationSignal")
    def to_send_automation_signal(self) -> "Ssm":
        '''(experimental) Grants permission to send a signal to change the current behavior or status of a specified Automation execution.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_SendAutomationSignal.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toSendAutomationSignal", []))

    @jsii.member(jsii_name="toSendCommand")
    def to_send_command(self) -> "Ssm":
        '''(experimental) Grants permission to run commands on one or more specified managed instances.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifResourceTag()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_SendCommand.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toSendCommand", []))

    @jsii.member(jsii_name="toStartAssociationsOnce")
    def to_start_associations_once(self) -> "Ssm":
        '''(experimental) Grants permission to run a specified association manually.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_StartAssociationsOnce.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toStartAssociationsOnce", []))

    @jsii.member(jsii_name="toStartAutomationExecution")
    def to_start_automation_execution(self) -> "Ssm":
        '''(experimental) Grants permission to initiate the execution of an Automation document.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_StartAutomationExecution.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toStartAutomationExecution", []))

    @jsii.member(jsii_name="toStartChangeRequestExecution")
    def to_start_change_request_execution(self) -> "Ssm":
        '''(experimental) Grants permission to initiate the execution of an Automation Change Template document.

        Access Level: Write

        Possible conditions:

        - .ifAutoApprove()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_StartChangeRequestExecution.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toStartChangeRequestExecution", []))

    @jsii.member(jsii_name="toStartSession")
    def to_start_session(self) -> "Ssm":
        '''(experimental) Grants permission to initiate a connection to a specified target for a Session Manager session.

        Access Level: Write

        Possible conditions:

        - .ifSessionDocumentAccessCheck()
        - .ifResourceTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_StartSession.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toStartSession", []))

    @jsii.member(jsii_name="toStopAutomationExecution")
    def to_stop_automation_execution(self) -> "Ssm":
        '''(experimental) Grants permission to stop a specified Automation execution that is already in progress.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_StopAutomationExecution.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toStopAutomationExecution", []))

    @jsii.member(jsii_name="toTerminateSession")
    def to_terminate_session(self) -> "Ssm":
        '''(experimental) Grants permission to permanently end a Session Manager connection to an instance.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_TerminateSession.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toTerminateSession", []))

    @jsii.member(jsii_name="toUnlabelParameterVersion")
    def to_unlabel_parameter_version(self) -> "Ssm":
        '''(experimental) Grants permission to remove an identifying label from a specified version of a parameter.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UnlabelParameterVersion.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUnlabelParameterVersion", []))

    @jsii.member(jsii_name="toUpdateAssociation")
    def to_update_association(self) -> "Ssm":
        '''(experimental) Grants permission to update an association and immediately run the association on the specified targets.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateAssociation.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateAssociation", []))

    @jsii.member(jsii_name="toUpdateAssociationStatus")
    def to_update_association_status(self) -> "Ssm":
        '''(experimental) Grants permission to update the status of the SSM document associated with a specified instance.

        Access Level: Write

        Possible conditions:

        - .ifSourceInstanceARN()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateAssociationStatus.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateAssociationStatus", []))

    @jsii.member(jsii_name="toUpdateDocument")
    def to_update_document(self) -> "Ssm":
        '''(experimental) Grants permission to update one or more values for an SSM document.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateDocument.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateDocument", []))

    @jsii.member(jsii_name="toUpdateDocumentDefaultVersion")
    def to_update_document_default_version(self) -> "Ssm":
        '''(experimental) Grants permission to change the default version of an SSM document.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateDocumentDefaultVersion.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateDocumentDefaultVersion", []))

    @jsii.member(jsii_name="toUpdateDocumentMetadata")
    def to_update_document_metadata(self) -> "Ssm":
        '''(experimental) Grants permission to update the metadata of an SSM document.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateDocumentMetadata.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateDocumentMetadata", []))

    @jsii.member(jsii_name="toUpdateInstanceAssociationStatus")
    def to_update_instance_association_status(self) -> "Ssm":
        '''(experimental) Grants permission to SSM Agent to update the status of the association that it is currently running (internal Systems Manager call).

        Access Level: Write

        Possible conditions:

        - .ifSourceInstanceARN()

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateInstanceAssociationStatus", []))

    @jsii.member(jsii_name="toUpdateInstanceInformation")
    def to_update_instance_information(self) -> "Ssm":
        '''(experimental) Grants permission to SSM Agent to send a heartbeat signal to the Systems Manager service in the cloud.

        Access Level: Write

        Possible conditions:

        - .ifSourceInstanceARN()

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateInstanceInformation", []))

    @jsii.member(jsii_name="toUpdateMaintenanceWindow")
    def to_update_maintenance_window(self) -> "Ssm":
        '''(experimental) Grants permission to update a specified maintenance window.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateMaintenanceWindow.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateMaintenanceWindow", []))

    @jsii.member(jsii_name="toUpdateMaintenanceWindowTarget")
    def to_update_maintenance_window_target(self) -> "Ssm":
        '''(experimental) Grants permission to update a specified maintenance window target.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateMaintenanceWindowTarget.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateMaintenanceWindowTarget", []))

    @jsii.member(jsii_name="toUpdateMaintenanceWindowTask")
    def to_update_maintenance_window_task(self) -> "Ssm":
        '''(experimental) Grants permission to update a specified maintenance window task.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateMaintenanceWindowTask.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateMaintenanceWindowTask", []))

    @jsii.member(jsii_name="toUpdateManagedInstanceRole")
    def to_update_managed_instance_role(self) -> "Ssm":
        '''(experimental) Grants permission to assign or change the IAM role assigned to a specified managed instance.

        Access Level: Write

        Possible conditions:

        - .ifResourceTag()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateManagedInstanceRole.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateManagedInstanceRole", []))

    @jsii.member(jsii_name="toUpdateOpsItem")
    def to_update_ops_item(self) -> "Ssm":
        '''(experimental) Grants permission to edit or change an OpsItem.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateOpsItem.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateOpsItem", []))

    @jsii.member(jsii_name="toUpdateOpsMetadata")
    def to_update_ops_metadata(self) -> "Ssm":
        '''(experimental) Grants permission to update an OpsMetadata object.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateOpsMetadata.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateOpsMetadata", []))

    @jsii.member(jsii_name="toUpdatePatchBaseline")
    def to_update_patch_baseline(self) -> "Ssm":
        '''(experimental) Grants permission to update a specified patch baseline.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdatePatchBaseline.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdatePatchBaseline", []))

    @jsii.member(jsii_name="toUpdateResourceDataSync")
    def to_update_resource_data_sync(self) -> "Ssm":
        '''(experimental) Grants permission to update a resource data sync.

        Access Level: Write

        Possible conditions:

        - .ifSyncType()

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateResourceDataSync.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateResourceDataSync", []))

    @jsii.member(jsii_name="toUpdateServiceSetting")
    def to_update_service_setting(self) -> "Ssm":
        '''(experimental) Grants permission to update the service setting for an AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateServiceSetting.html

        :stability: experimental
        '''
        return typing.cast("Ssm", jsii.invoke(self, "toUpdateServiceSetting", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6ce1d5b64b818d34eb9fa5a9cef692922506a7cde7dbecccaff02508d92557e5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__34d20de9249ac4fe9453fc8d0c34075c2f0f60f9bac0a768feb56c6aab2fa700)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class SsmContacts(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.SsmContacts",
):
    '''(experimental) Statement provider for service `ssm-contacts <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssystemsmanagerincidentmanagercontacts.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ssm-contacts <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssystemsmanagerincidentmanagercontacts.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b97a269b85fb988a2ce94394ec2fbcb1e0249487b8d9118a2642929022cd1457)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onContact")
    def on_contact(
        self,
        contact_alias: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SsmContacts":
        '''(experimental) Adds a resource of type contact to the statement.

        https://docs.aws.amazon.com/incident-manager/latest/userguide/contacts.html

        :param contact_alias: - Identifier for the contactAlias.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e07296ecf68d77ad0520f7c8a42711492e67e7decfe7955ac4356b8953a7d722)
            check_type(argname="argument contact_alias", value=contact_alias, expected_type=type_hints["contact_alias"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SsmContacts", jsii.invoke(self, "onContact", [contact_alias, account, region, partition]))

    @jsii.member(jsii_name="onContactchannel")
    def on_contactchannel(
        self,
        contact_alias: builtins.str,
        contact_channel_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SsmContacts":
        '''(experimental) Adds a resource of type contactchannel to the statement.

        https://docs.aws.amazon.com/incident-manager/latest/userguide/contacts.html

        :param contact_alias: - Identifier for the contactAlias.
        :param contact_channel_id: - Identifier for the contactChannelId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ac36c6957ce6f6d5fdbd11be227074c2039919277373651eb22cd1628fe97b32)
            check_type(argname="argument contact_alias", value=contact_alias, expected_type=type_hints["contact_alias"])
            check_type(argname="argument contact_channel_id", value=contact_channel_id, expected_type=type_hints["contact_channel_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SsmContacts", jsii.invoke(self, "onContactchannel", [contact_alias, contact_channel_id, account, region, partition]))

    @jsii.member(jsii_name="onEngagement")
    def on_engagement(
        self,
        contact_alias: builtins.str,
        engagement_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SsmContacts":
        '''(experimental) Adds a resource of type engagement to the statement.

        https://docs.aws.amazon.com/incident-manager/latest/userguide/escalation.html

        :param contact_alias: - Identifier for the contactAlias.
        :param engagement_id: - Identifier for the engagementId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d005bb4fbf936d5c009e068331f304f1cd95fbf2b033d7aa3f5096c42299bdf6)
            check_type(argname="argument contact_alias", value=contact_alias, expected_type=type_hints["contact_alias"])
            check_type(argname="argument engagement_id", value=engagement_id, expected_type=type_hints["engagement_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SsmContacts", jsii.invoke(self, "onEngagement", [contact_alias, engagement_id, account, region, partition]))

    @jsii.member(jsii_name="onPage")
    def on_page(
        self,
        contact_alias: builtins.str,
        page_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SsmContacts":
        '''(experimental) Adds a resource of type page to the statement.

        https://docs.aws.amazon.com/incident-manager/latest/userguide/escalation.html

        :param contact_alias: - Identifier for the contactAlias.
        :param page_id: - Identifier for the pageId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4dbd26ae66aec629596db0825730025631a434a4577144de6da6c3517cf6b630)
            check_type(argname="argument contact_alias", value=contact_alias, expected_type=type_hints["contact_alias"])
            check_type(argname="argument page_id", value=page_id, expected_type=type_hints["page_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SsmContacts", jsii.invoke(self, "onPage", [contact_alias, page_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptPage")
    def to_accept_page(self) -> "SsmContacts":
        '''(experimental) Grants permission to accept a page.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_AcceptPage.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toAcceptPage", []))

    @jsii.member(jsii_name="toActivateContactChannel")
    def to_activate_contact_channel(self) -> "SsmContacts":
        '''(experimental) Grants permission to activate a contact's contact channel.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_ActivateContactChannel.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toActivateContactChannel", []))

    @jsii.member(jsii_name="toAssociateContact")
    def to_associate_contact(self) -> "SsmContacts":
        '''(experimental) Grants permission to use a contact in an escalation plan.

        Access Level: Permissions management

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_AssociateContact.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toAssociateContact", []))

    @jsii.member(jsii_name="toCreateContact")
    def to_create_contact(self) -> "SsmContacts":
        '''(experimental) Grants permission to create a contact.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - ssm-contacts:AssociateContact

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_CreateContact.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toCreateContact", []))

    @jsii.member(jsii_name="toCreateContactChannel")
    def to_create_contact_channel(self) -> "SsmContacts":
        '''(experimental) Grants permission to create a contact channel for a contact.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_CreateContactChannel.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toCreateContactChannel", []))

    @jsii.member(jsii_name="toDeactivateContactChannel")
    def to_deactivate_contact_channel(self) -> "SsmContacts":
        '''(experimental) Grants permission to deactivate a contact's contact channel.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_DeactivateContactChannel.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toDeactivateContactChannel", []))

    @jsii.member(jsii_name="toDeleteContact")
    def to_delete_contact(self) -> "SsmContacts":
        '''(experimental) Grants permission to delete a contact.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_DeleteContact.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toDeleteContact", []))

    @jsii.member(jsii_name="toDeleteContactChannel")
    def to_delete_contact_channel(self) -> "SsmContacts":
        '''(experimental) Grants permission to delete a contact's contact channel.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_DeleteContactChannel.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toDeleteContactChannel", []))

    @jsii.member(jsii_name="toDescribeEngagement")
    def to_describe_engagement(self) -> "SsmContacts":
        '''(experimental) Grants permission to describe an engagement.

        Access Level: Read

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_DescribeEngagement.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toDescribeEngagement", []))

    @jsii.member(jsii_name="toDescribePage")
    def to_describe_page(self) -> "SsmContacts":
        '''(experimental) Grants permission to describe a page.

        Access Level: Read

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_DescribePage.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toDescribePage", []))

    @jsii.member(jsii_name="toGetContact")
    def to_get_contact(self) -> "SsmContacts":
        '''(experimental) Grants permission to get a contact.

        Access Level: Read

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_GetContact.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toGetContact", []))

    @jsii.member(jsii_name="toGetContactChannel")
    def to_get_contact_channel(self) -> "SsmContacts":
        '''(experimental) Grants permission to get a contact's contact channel.

        Access Level: Read

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_GetContactChannel.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toGetContactChannel", []))

    @jsii.member(jsii_name="toGetContactPolicy")
    def to_get_contact_policy(self) -> "SsmContacts":
        '''(experimental) Grants permission to get a contact's resource policy.

        Access Level: Read

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_GetContactPolicy.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toGetContactPolicy", []))

    @jsii.member(jsii_name="toListContactChannels")
    def to_list_contact_channels(self) -> "SsmContacts":
        '''(experimental) Grants permission to list all of a contact's contact channels.

        Access Level: List

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_ListContactChannels.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toListContactChannels", []))

    @jsii.member(jsii_name="toListContacts")
    def to_list_contacts(self) -> "SsmContacts":
        '''(experimental) Grants permission to list all contacts.

        Access Level: List

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_ListContacts.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toListContacts", []))

    @jsii.member(jsii_name="toListEngagements")
    def to_list_engagements(self) -> "SsmContacts":
        '''(experimental) Grants permission to list all engagements.

        Access Level: List

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_ListEngagements.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toListEngagements", []))

    @jsii.member(jsii_name="toListPageReceipts")
    def to_list_page_receipts(self) -> "SsmContacts":
        '''(experimental) Grants permission to list all receipts of a page.

        Access Level: List

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_ListPageReceipts.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toListPageReceipts", []))

    @jsii.member(jsii_name="toListPagesByContact")
    def to_list_pages_by_contact(self) -> "SsmContacts":
        '''(experimental) Grants permission to list all pages sent to a contact.

        Access Level: List

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_ListPagesByContact.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toListPagesByContact", []))

    @jsii.member(jsii_name="toListPagesByEngagement")
    def to_list_pages_by_engagement(self) -> "SsmContacts":
        '''(experimental) Grants permission to list all pages created in an engagement.

        Access Level: List

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_ListPagesByEngagement.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toListPagesByEngagement", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "SsmContacts":
        '''(experimental) Grants permission to view a list of resource tags for a specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutContactPolicy")
    def to_put_contact_policy(self) -> "SsmContacts":
        '''(experimental) Grants permission to add a resource policy to a contact.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_PutContactPolicy.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toPutContactPolicy", []))

    @jsii.member(jsii_name="toSendActivationCode")
    def to_send_activation_code(self) -> "SsmContacts":
        '''(experimental) Grants permission to send the activation code of a contact's contact channel.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_SendActivationCode.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toSendActivationCode", []))

    @jsii.member(jsii_name="toStartEngagement")
    def to_start_engagement(self) -> "SsmContacts":
        '''(experimental) Grants permission to start an engagement.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_StartEngagement.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toStartEngagement", []))

    @jsii.member(jsii_name="toStopEngagement")
    def to_stop_engagement(self) -> "SsmContacts":
        '''(experimental) Grants permission to stop an engagement.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_StopEngagement.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toStopEngagement", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "SsmContacts":
        '''(experimental) Grants permission to add tags to a response plan.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_TagResource.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "SsmContacts":
        '''(experimental) Grants permission to remove tags from a response plan.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateContact")
    def to_update_contact(self) -> "SsmContacts":
        '''(experimental) Grants permission to update a contact.

        Access Level: Write

        Dependent actions:

        - ssm-contacts:AssociateContact

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_UpdateContact.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toUpdateContact", []))

    @jsii.member(jsii_name="toUpdateContactChannel")
    def to_update_contact_channel(self) -> "SsmContacts":
        '''(experimental) Grants permission to update a contact's contact channel.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_SSMContacts_UpdateContactChannel.html

        :stability: experimental
        '''
        return typing.cast("SsmContacts", jsii.invoke(self, "toUpdateContactChannel", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2290442744ee4a6c7b21f3a73365f280a540c7cef8b9e3da9bbd248be27403b6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3871e3e1558ba0436a8022415cf9e7843c90893522ef77c2089d3cdc19528843)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class SsmGuiconnect(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.SsmGuiconnect",
):
    '''(experimental) Statement provider for service `ssm-guiconnect <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssystemsmanagerguiconnect.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ssm-guiconnect <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssystemsmanagerguiconnect.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__62f60a6407d30858fcc35b15ffb0ebecacee19839b130dd757d3be587e955f6d)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toCancelConnection")
    def to_cancel_connection(self) -> "SsmGuiconnect":
        '''(experimental) Grants permission to terminate a GUI Connect session.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/userguide/fleet-rdp.html

        :stability: experimental
        '''
        return typing.cast("SsmGuiconnect", jsii.invoke(self, "toCancelConnection", []))

    @jsii.member(jsii_name="toGetConnection")
    def to_get_connection(self) -> "SsmGuiconnect":
        '''(experimental) Grants permission to get the metadata for a GUI Connect session.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/userguide/fleet-rdp.html

        :stability: experimental
        '''
        return typing.cast("SsmGuiconnect", jsii.invoke(self, "toGetConnection", []))

    @jsii.member(jsii_name="toStartConnection")
    def to_start_connection(self) -> "SsmGuiconnect":
        '''(experimental) Grants permission to start a GUI Connect session.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/userguide/fleet-rdp.html

        :stability: experimental
        '''
        return typing.cast("SsmGuiconnect", jsii.invoke(self, "toStartConnection", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d21621d14d1dacd99903eb5025c11e18b9240fccf2cfb4d66629ef2e470f41f0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d64ff359575fc154f9664b6630223476b64ea9b439b6b43da0a4f01062cea74a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class SsmIncidents(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.SsmIncidents",
):
    '''(experimental) Statement provider for service `ssm-incidents <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssystemsmanagerincidentmanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ssm-incidents <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssystemsmanagerincidentmanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__34af6c06c3863e3d9f37aeb060ccb85b1d1c654143d874b2878968bd55a22ca8)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onIncidentRecord")
    def on_incident_record(
        self,
        response_plan: builtins.str,
        incident_record: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SsmIncidents":
        '''(experimental) Adds a resource of type incident-record to the statement.

        https://docs.aws.amazon.com/incident-manager/latest/userguide/tracking-details.html

        :param response_plan: - Identifier for the responsePlan.
        :param incident_record: - Identifier for the incidentRecord.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__26cd2c5f407d7b40a87482dfc83811cd15a9c06cc21f367870519197dac276ce)
            check_type(argname="argument response_plan", value=response_plan, expected_type=type_hints["response_plan"])
            check_type(argname="argument incident_record", value=incident_record, expected_type=type_hints["incident_record"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SsmIncidents", jsii.invoke(self, "onIncidentRecord", [response_plan, incident_record, account, partition]))

    @jsii.member(jsii_name="onReplicationSet")
    def on_replication_set(
        self,
        replication_set: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SsmIncidents":
        '''(experimental) Adds a resource of type replication-set to the statement.

        https://docs.aws.amazon.com/incident-manager/latest/userguide/disaster-recovery-resiliency.html#replication

        :param replication_set: - Identifier for the replicationSet.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__75fe15c4788f7999fe2a1bb3a75e97e42fb3aa7897c39442f0ebedaa48731098)
            check_type(argname="argument replication_set", value=replication_set, expected_type=type_hints["replication_set"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SsmIncidents", jsii.invoke(self, "onReplicationSet", [replication_set, account, partition]))

    @jsii.member(jsii_name="onResponsePlan")
    def on_response_plan(
        self,
        response_plan: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SsmIncidents":
        '''(experimental) Adds a resource of type response-plan to the statement.

        https://docs.aws.amazon.com/incident-manager/latest/userguide/response-plans.html

        :param response_plan: - Identifier for the responsePlan.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0c5626431eb7a73aa9d7cbc925ed3a3aad14b3a6a64d99bc2c74d883c4570b9a)
            check_type(argname="argument response_plan", value=response_plan, expected_type=type_hints["response_plan"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SsmIncidents", jsii.invoke(self, "onResponsePlan", [response_plan, account, partition]))

    @jsii.member(jsii_name="toCreateReplicationSet")
    def to_create_replication_set(self) -> "SsmIncidents":
        '''(experimental) Grants permission to create a replication set.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - ssm-incidents:TagResource

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_CreateReplicationSet.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toCreateReplicationSet", []))

    @jsii.member(jsii_name="toCreateResponsePlan")
    def to_create_response_plan(self) -> "SsmIncidents":
        '''(experimental) Grants permission to create a response plan.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:PassRole
        - ssm-incidents:TagResource

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_CreateResponsePlan.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toCreateResponsePlan", []))

    @jsii.member(jsii_name="toCreateTimelineEvent")
    def to_create_timeline_event(self) -> "SsmIncidents":
        '''(experimental) Grants permission to create a timeline event for an incident record.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_CreateTimelineEvent.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toCreateTimelineEvent", []))

    @jsii.member(jsii_name="toDeleteIncidentRecord")
    def to_delete_incident_record(self) -> "SsmIncidents":
        '''(experimental) Grants permission to delete an incident record.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_DeleteIncidentRecord.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toDeleteIncidentRecord", []))

    @jsii.member(jsii_name="toDeleteReplicationSet")
    def to_delete_replication_set(self) -> "SsmIncidents":
        '''(experimental) Grants permission to delete a replication set.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_DeleteReplicationSet.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toDeleteReplicationSet", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "SsmIncidents":
        '''(experimental) Grants permission to delete resource policy from a response plan.

        Access Level: Permissions management

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_DeleteResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteResponsePlan")
    def to_delete_response_plan(self) -> "SsmIncidents":
        '''(experimental) Grants permission to delete a response plan.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_DeleteResponsePlan.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toDeleteResponsePlan", []))

    @jsii.member(jsii_name="toDeleteTimelineEvent")
    def to_delete_timeline_event(self) -> "SsmIncidents":
        '''(experimental) Grants permission to delete a timeline event.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_DeleteTimelineEvent.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toDeleteTimelineEvent", []))

    @jsii.member(jsii_name="toGetIncidentRecord")
    def to_get_incident_record(self) -> "SsmIncidents":
        '''(experimental) Grants permission to view the contents of an incident record.

        Access Level: Read

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_GetIncidentRecord.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toGetIncidentRecord", []))

    @jsii.member(jsii_name="toGetReplicationSet")
    def to_get_replication_set(self) -> "SsmIncidents":
        '''(experimental) Grants permission to view the replication set.

        Access Level: Read

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_GetReplicationSet.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toGetReplicationSet", []))

    @jsii.member(jsii_name="toGetResourcePolicies")
    def to_get_resource_policies(self) -> "SsmIncidents":
        '''(experimental) Grants permission to view resource policies of a response plan.

        Access Level: Read

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_GetResourcePolicies.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toGetResourcePolicies", []))

    @jsii.member(jsii_name="toGetResponsePlan")
    def to_get_response_plan(self) -> "SsmIncidents":
        '''(experimental) Grants permission to view the contents of a specified response plan.

        Access Level: Read

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_GetResponsePlan.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toGetResponsePlan", []))

    @jsii.member(jsii_name="toGetTimelineEvent")
    def to_get_timeline_event(self) -> "SsmIncidents":
        '''(experimental) Grants permission to view a timeline event.

        Access Level: Read

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_GetTimelineEvent.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toGetTimelineEvent", []))

    @jsii.member(jsii_name="toListIncidentRecords")
    def to_list_incident_records(self) -> "SsmIncidents":
        '''(experimental) Grants permission to list the contents of all incident records.

        Access Level: List

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_ListIncidentRecords.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toListIncidentRecords", []))

    @jsii.member(jsii_name="toListRelatedItems")
    def to_list_related_items(self) -> "SsmIncidents":
        '''(experimental) Grants permission to list related items of an incident records.

        Access Level: List

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_ListRelatedItems.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toListRelatedItems", []))

    @jsii.member(jsii_name="toListReplicationSets")
    def to_list_replication_sets(self) -> "SsmIncidents":
        '''(experimental) Grants permission to list all replication sets.

        Access Level: List

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_ListReplicationSets.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toListReplicationSets", []))

    @jsii.member(jsii_name="toListResponsePlans")
    def to_list_response_plans(self) -> "SsmIncidents":
        '''(experimental) Grants permission to list all response plans.

        Access Level: List

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_ListResponsePlans.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toListResponsePlans", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "SsmIncidents":
        '''(experimental) Grants permission to view a list of resource tags for a specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTimelineEvents")
    def to_list_timeline_events(self) -> "SsmIncidents":
        '''(experimental) Grants permission to list all timeline events for an incident record.

        Access Level: List

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_ListTimelineEvents.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toListTimelineEvents", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "SsmIncidents":
        '''(experimental) Grants permission to put resource policy on a response plan.

        Access Level: Permissions management

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_PutResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toStartIncident")
    def to_start_incident(self) -> "SsmIncidents":
        '''(experimental) Grants permission to start a new incident using a response plan.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_StartIncident.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toStartIncident", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "SsmIncidents":
        '''(experimental) Grants permission to add tags to a response plan.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "SsmIncidents":
        '''(experimental) Grants permission to remove tags from a response plan.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDeletionProtection")
    def to_update_deletion_protection(self) -> "SsmIncidents":
        '''(experimental) Grants permission to update replication set deletion protection.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_UpdateDeletionProtection.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toUpdateDeletionProtection", []))

    @jsii.member(jsii_name="toUpdateIncidentRecord")
    def to_update_incident_record(self) -> "SsmIncidents":
        '''(experimental) Grants permission to update the contents of an incident record.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_UpdateIncidentRecord.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toUpdateIncidentRecord", []))

    @jsii.member(jsii_name="toUpdateRelatedItems")
    def to_update_related_items(self) -> "SsmIncidents":
        '''(experimental) Grants permission to update related items of an incident record.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_UpdateRelatedItems.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toUpdateRelatedItems", []))

    @jsii.member(jsii_name="toUpdateReplicationSet")
    def to_update_replication_set(self) -> "SsmIncidents":
        '''(experimental) Grants permission to update a replication set.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_UpdateReplicationSet.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toUpdateReplicationSet", []))

    @jsii.member(jsii_name="toUpdateResponsePlan")
    def to_update_response_plan(self) -> "SsmIncidents":
        '''(experimental) Grants permission to update the contents of a response plan.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:PassRole
        - ssm-incidents:TagResource

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_UpdateResponsePlan.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toUpdateResponsePlan", []))

    @jsii.member(jsii_name="toUpdateTimelineEvent")
    def to_update_timeline_event(self) -> "SsmIncidents":
        '''(experimental) Grants permission to update a timeline event.

        Access Level: Write

        https://docs.aws.amazon.com/incident-manager/latest/APIReference/API_UpdateTimelineEvent.html

        :stability: experimental
        '''
        return typing.cast("SsmIncidents", jsii.invoke(self, "toUpdateTimelineEvent", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e82f33ca7ddabbab3e011de103bd0fc268b12c2a7e77a76e5376f59859a350dc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9a3015fb513bb07a72bee00f6cd06fbfd33184bd3d49eca61e60f3f200f4711e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class SsmSap(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.SsmSap"):
    '''(experimental) Statement provider for service `ssm-sap <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssystemsmanagerforsap.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ssm-sap <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssystemsmanagerforsap.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8e1f3c37c8d8f52f2f9fd199e1cd6d6bd3fff929890029b3d7ffb48cdfa1f801)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        application_type: builtins.str,
        application_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SsmSap":
        '''(experimental) Adds a resource of type application to the statement.

        https://docs.aws.amazon.com/systems-manager/index.html

        :param application_type: - Identifier for the applicationType.
        :param application_id: - Identifier for the applicationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cbb4850102aacdfd95276abeacf8fddc6f79e2147dc3b48b41be078932b55983)
            check_type(argname="argument application_type", value=application_type, expected_type=type_hints["application_type"])
            check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SsmSap", jsii.invoke(self, "onApplication", [application_type, application_id, account, region, partition]))

    @jsii.member(jsii_name="onDatabase")
    def on_database(
        self,
        application_type: builtins.str,
        application_id: builtins.str,
        database_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "SsmSap":
        '''(experimental) Adds a resource of type database to the statement.

        https://docs.aws.amazon.com/systems-manager/index.html

        :param application_type: - Identifier for the applicationType.
        :param application_id: - Identifier for the applicationId.
        :param database_id: - Identifier for the databaseId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a9cb9d67a9bea3626033eb6d8fd231be02240f647e602b9ae266cafefbf3f5a3)
            check_type(argname="argument application_type", value=application_type, expected_type=type_hints["application_type"])
            check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
            check_type(argname="argument database_id", value=database_id, expected_type=type_hints["database_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("SsmSap", jsii.invoke(self, "onDatabase", [application_type, application_id, database_id, account, region, partition]))

    @jsii.member(jsii_name="toBackupDatabase")
    def to_backup_database(self) -> "SsmSap":
        '''(experimental) Grants permission to perform backup operation on a specified database.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/index.html

        :stability: experimental
        '''
        return typing.cast("SsmSap", jsii.invoke(self, "toBackupDatabase", []))

    @jsii.member(jsii_name="toDeleteResourcePermission")
    def to_delete_resource_permission(self) -> "SsmSap":
        '''(experimental) Grants permission to delete the SSM for SAP level resource permissions associated with a SSM for SAP database resource.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/index.html

        :stability: experimental
        '''
        return typing.cast("SsmSap", jsii.invoke(self, "toDeleteResourcePermission", []))

    @jsii.member(jsii_name="toDeregisterApplication")
    def to_deregister_application(self) -> "SsmSap":
        '''(experimental) Grants permission to deregister an SAP application with SSM for SAP.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/index.html

        :stability: experimental
        '''
        return typing.cast("SsmSap", jsii.invoke(self, "toDeregisterApplication", []))

    @jsii.member(jsii_name="toGetApplication")
    def to_get_application(self) -> "SsmSap":
        '''(experimental) Grants permission to access information about an application registered with SSM for SAP by providing the application ID or application ARN.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/index.html

        :stability: experimental
        '''
        return typing.cast("SsmSap", jsii.invoke(self, "toGetApplication", []))

    @jsii.member(jsii_name="toGetComponent")
    def to_get_component(self) -> "SsmSap":
        '''(experimental) Grants permission to access information about a component registered with SSM for SAP by providing the application ID and component ID.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/index.html

        :stability: experimental
        '''
        return typing.cast("SsmSap", jsii.invoke(self, "toGetComponent", []))

    @jsii.member(jsii_name="toGetDatabase")
    def to_get_database(self) -> "SsmSap":
        '''(experimental) Grants permission to access information about a database registered with SSM for SAP by providing the application ID, component ID, and database ID.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/index.html

        :stability: experimental
        '''
        return typing.cast("SsmSap", jsii.invoke(self, "toGetDatabase", []))

    @jsii.member(jsii_name="toGetOperation")
    def to_get_operation(self) -> "SsmSap":
        '''(experimental) Grants permission to access information about an operation by providing its operation ID.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/index.html

        :stability: experimental
        '''
        return typing.cast("SsmSap", jsii.invoke(self, "toGetOperation", []))

    @jsii.member(jsii_name="toGetResourcePermission")
    def to_get_resource_permission(self) -> "SsmSap":
        '''(experimental) Grants permission to get the SSM for SAP level resource permissions associated with a SSM for SAP database resource.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/index.html

        :stability: experimental
        '''
        return typing.cast("SsmSap", jsii.invoke(self, "toGetResourcePermission", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "SsmSap":
        '''(experimental) Grants permission to retrieve a list of all applications registered with SSM for SAP under the customer AWS account.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/index.html

        :stability: experimental
        '''
        return typing.cast("SsmSap", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListComponents")
    def to_list_components(self) -> "SsmSap":
        '''(experimental) Grants permission to retrieve a list of all components in the account of customer, or a specific application.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/index.html

        :stability: experimental
        '''
        return typing.cast("SsmSap", jsii.invoke(self, "toListComponents", []))

    @jsii.member(jsii_name="toListDatabases")
    def to_list_databases(self) -> "SsmSap":
        '''(experimental) Grants permission to retrieve a list of all databases in the account of customer, or a specific application.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/index.html

        :stability: experimental
        '''
        return typing.cast("SsmSap", jsii.invoke(self, "toListDatabases", []))

    @jsii.member(jsii_name="toListOperations")
    def to_list_operations(self) -> "SsmSap":
        '''(experimental) Grants permission to retrieve a list of all operations in the account of customer, additional filters can be applied.

        Access Level: List

        https://docs.aws.amazon.com/systems-manager/index.html

        :stability: experimental
        '''
        return typing.cast("SsmSap", jsii.invoke(self, "toListOperations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "SsmSap":
        '''(experimental) Grants permission to list the tags on a specified resource ARN.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/index.html

        :stability: experimental
        '''
        return typing.cast("SsmSap", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutResourcePermission")
    def to_put_resource_permission(self) -> "SsmSap":
        '''(experimental) Grants permission to add the SSM for SAP level resource permissions associated with a SSM for SAP database resource.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/index.html

        :stability: experimental
        '''
        return typing.cast("SsmSap", jsii.invoke(self, "toPutResourcePermission", []))

    @jsii.member(jsii_name="toRegisterApplication")
    def to_register_application(self) -> "SsmSap":
        '''(experimental) Grants permission to registers an SAP application with SSM for SAP.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/systems-manager/index.html

        :stability: experimental
        '''
        return typing.cast("SsmSap", jsii.invoke(self, "toRegisterApplication", []))

    @jsii.member(jsii_name="toRestoreDatabase")
    def to_restore_database(self) -> "SsmSap":
        '''(experimental) Grants permission to restore a database from another database.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/index.html

        :stability: experimental
        '''
        return typing.cast("SsmSap", jsii.invoke(self, "toRestoreDatabase", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "SsmSap":
        '''(experimental) Grants permission to tag a specified resource ARN.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/systems-manager/index.html

        :stability: experimental
        '''
        return typing.cast("SsmSap", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "SsmSap":
        '''(experimental) Grants permission to remove tags from a specified resource ARN.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/systems-manager/index.html

        :stability: experimental
        '''
        return typing.cast("SsmSap", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplicationSettings")
    def to_update_application_settings(self) -> "SsmSap":
        '''(experimental) Grants permission to update settings of a registered SSM for SAP application.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/index.html

        :stability: experimental
        '''
        return typing.cast("SsmSap", jsii.invoke(self, "toUpdateApplicationSettings", []))

    @jsii.member(jsii_name="toUpdateHANABackupSettings")
    def to_update_hana_backup_settings(self) -> "SsmSap":
        '''(experimental) Grants permission to update the HANA backup settings of a specified database.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/index.html

        :stability: experimental
        '''
        return typing.cast("SsmSap", jsii.invoke(self, "toUpdateHANABackupSettings", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__71068862c1238d56139f055258b2bc9b507fe2cd665845a2baa72793829763fb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__77842f52ae99b69674c800be95d62b47c7b8a6284c1d6df618df60331527bb93)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Ssmmessages(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Ssmmessages",
):
    '''(experimental) Statement provider for service `ssmmessages <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsessionmanagermessagegatewayservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ssmmessages <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsessionmanagermessagegatewayservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7c47be7bfa792b19301b4cbc9e823dee415a54d1aa7c44817bb059b2f55ca5f1)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifSsmSourceInstanceARN")
    def if_ssm_source_instance_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ssmmessages":
        '''(experimental) Filters access by verifying the Amazon Resource Name (ARN) of the AWS Systems Manager's managed instance from which the request is made.

        This key is not present when the request comes from the managed instance authenticated with an IAM role associated with EC2 instance profile

        https://docs.aws.amazon.com/systems-manager/latest/userguide/security_iam_service-with-iam.html#policy-conditions

        Applies to actions:

        - .toCreateControlChannel()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__177593f239ff7cd7664dd659c9177f9fded3acb9eda1d3a1b6af4a4370ba0816)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ssmmessages", jsii.invoke(self, "ifSsmSourceInstanceARN", [value, operator]))

    @jsii.member(jsii_name="toCreateControlChannel")
    def to_create_control_channel(self) -> "Ssmmessages":
        '''(experimental) Grants permission to register a control channel for an instance to send control messages to Systems Manager service.

        Access Level: Write

        Possible conditions:

        - .ifSsmSourceInstanceARN()

        https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-create-iam-instance-profile.html

        :stability: experimental
        '''
        return typing.cast("Ssmmessages", jsii.invoke(self, "toCreateControlChannel", []))

    @jsii.member(jsii_name="toCreateDataChannel")
    def to_create_data_channel(self) -> "Ssmmessages":
        '''(experimental) Grants permission to register a data channel for an instance to send data messages to Systems Manager service.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-create-iam-instance-profile.html

        :stability: experimental
        '''
        return typing.cast("Ssmmessages", jsii.invoke(self, "toCreateDataChannel", []))

    @jsii.member(jsii_name="toOpenControlChannel")
    def to_open_control_channel(self) -> "Ssmmessages":
        '''(experimental) Grants permission to open a websocket connection for a registered control channel stream from an instance to Systems Manager service.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-create-iam-instance-profile.html

        :stability: experimental
        '''
        return typing.cast("Ssmmessages", jsii.invoke(self, "toOpenControlChannel", []))

    @jsii.member(jsii_name="toOpenDataChannel")
    def to_open_data_channel(self) -> "Ssmmessages":
        '''(experimental) Grants permission to open a websocket connection for a registered data channel stream from an instance to Systems Manager service.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-create-iam-instance-profile.html

        :stability: experimental
        '''
        return typing.cast("Ssmmessages", jsii.invoke(self, "toOpenDataChannel", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__46ae1a7e0027cf8835661744952d68d02d68d4d25396305479472938231c14e3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__69895cc4a897e97b8d0712803ab2fd2c95b1fcd55c21e96b8cdfe8c68c22a97a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Sso(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Sso"):
    '''(experimental) Statement provider for service `sso <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycentersuccessortoawssinglesign-on.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sso <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycentersuccessortoawssinglesign-on.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5f878961c46a0839dbcdf6b301b2c32f0cde1c3e515acf5f22aa53ecee02c938)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAccount")
    def on_account(
        self,
        account_id: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sso":
        '''(experimental) Adds a resource of type Account to the statement.

        https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-accounts.html

        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b6f5b6e3cf68d1cb0f4e7c35a8ad3ae7b2128dccac84cc208bc7a17c8bb9f47b)
            check_type(argname="argument account_id", value=account_id, expected_type=type_hints["account_id"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sso", jsii.invoke(self, "onAccount", [account_id, partition]))

    @jsii.member(jsii_name="onInstance")
    def on_instance(
        self,
        instance_id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sso":
        '''(experimental) Adds a resource of type Instance to the statement.

        https://docs.aws.amazon.com/singlesignon/latest/userguide/step1.html

        :param instance_id: - Identifier for the instanceId.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a1787d6c191a21966c5b0010f00f83a0b0a9f380c3a14cc9eb033ade897fea03)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sso", jsii.invoke(self, "onInstance", [instance_id, partition]))

    @jsii.member(jsii_name="onPermissionSet")
    def on_permission_set(
        self,
        instance_id: builtins.str,
        permission_set_id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sso":
        '''(experimental) Adds a resource of type PermissionSet to the statement.

        https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html

        :param instance_id: - Identifier for the instanceId.
        :param permission_set_id: - Identifier for the permissionSetId.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__63ade45b9bb87fef9cbb6f484172b4b507c024bb4d4db369dd7e4df78ad7105e)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument permission_set_id", value=permission_set_id, expected_type=type_hints["permission_set_id"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sso", jsii.invoke(self, "onPermissionSet", [instance_id, permission_set_id, partition]))

    @jsii.member(jsii_name="toAssociateDirectory")
    def to_associate_directory(self) -> "Sso":
        '''(experimental) Grants permission to connect a directory to be used by AWS IAM Identity Center.

        Access Level: Write

        Dependent actions:

        - ds:AuthorizeApplication

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toAssociateDirectory", []))

    @jsii.member(jsii_name="toAssociateProfile")
    def to_associate_profile(self) -> "Sso":
        '''(experimental) Grants permission to create an association between a directory user or group and a profile.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toAssociateProfile", []))

    @jsii.member(jsii_name="toAttachCustomerManagedPolicyReferenceToPermissionSet")
    def to_attach_customer_managed_policy_reference_to_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to attach a customer managed policy reference to a permission set.

        Access Level: Permissions management

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_AttachCustomerManagedPolicyReferenceToPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toAttachCustomerManagedPolicyReferenceToPermissionSet", []))

    @jsii.member(jsii_name="toAttachManagedPolicyToPermissionSet")
    def to_attach_managed_policy_to_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to attach an AWS managed policy to a permission set.

        Access Level: Permissions management

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_AttachManagedPolicyToPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toAttachManagedPolicyToPermissionSet", []))

    @jsii.member(jsii_name="toCreateAccountAssignment")
    def to_create_account_assignment(self) -> "Sso":
        '''(experimental) Grants permission to assign access to a Principal for a specified AWS account using a specified permission set.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_CreateAccountAssignment.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toCreateAccountAssignment", []))

    @jsii.member(jsii_name="toCreateApplicationInstance")
    def to_create_application_instance(self) -> "Sso":
        '''(experimental) Grants permission to add an application instance to AWS IAM Identity Center.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toCreateApplicationInstance", []))

    @jsii.member(jsii_name="toCreateApplicationInstanceCertificate")
    def to_create_application_instance_certificate(self) -> "Sso":
        '''(experimental) Grants permission to add a new certificate for an application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toCreateApplicationInstanceCertificate", []))

    @jsii.member(jsii_name="toCreateInstanceAccessControlAttributeConfiguration")
    def to_create_instance_access_control_attribute_configuration(self) -> "Sso":
        '''(experimental) Grants permission to enable the instance for ABAC and specify the attributes.

        Access Level: Write

        Dependent actions:

        - iam:AttachRolePolicy
        - iam:CreateRole
        - iam:DeleteRole
        - iam:DeleteRolePolicy
        - iam:DetachRolePolicy
        - iam:GetRole
        - iam:ListAttachedRolePolicies
        - iam:ListRolePolicies
        - iam:PutRolePolicy
        - iam:UpdateAssumeRolePolicy

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_CreateInstanceAccessControlAttributeConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toCreateInstanceAccessControlAttributeConfiguration", []))

    @jsii.member(jsii_name="toCreateManagedApplicationInstance")
    def to_create_managed_application_instance(self) -> "Sso":
        '''(experimental) Grants permission to add a managed application instance to AWS IAM Identity Center.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toCreateManagedApplicationInstance", []))

    @jsii.member(jsii_name="toCreatePermissionSet")
    def to_create_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to create a permission set.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_CreatePermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toCreatePermissionSet", []))

    @jsii.member(jsii_name="toCreateProfile")
    def to_create_profile(self) -> "Sso":
        '''(experimental) Grants permission to create a profile for an application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toCreateProfile", []))

    @jsii.member(jsii_name="toCreateTrust")
    def to_create_trust(self) -> "Sso":
        '''(experimental) Grants permission to create a federation trust in a target account.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toCreateTrust", []))

    @jsii.member(jsii_name="toDeleteAccountAssignment")
    def to_delete_account_assignment(self) -> "Sso":
        '''(experimental) Grants permission to delete a Principal's access from a specified AWS account using a specified permission set.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeleteAccountAssignment.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDeleteAccountAssignment", []))

    @jsii.member(jsii_name="toDeleteApplicationInstance")
    def to_delete_application_instance(self) -> "Sso":
        '''(experimental) Grants permission to delete the application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDeleteApplicationInstance", []))

    @jsii.member(jsii_name="toDeleteApplicationInstanceCertificate")
    def to_delete_application_instance_certificate(self) -> "Sso":
        '''(experimental) Grants permission to delete an inactive or expired certificate from the application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDeleteApplicationInstanceCertificate", []))

    @jsii.member(jsii_name="toDeleteInlinePolicyFromPermissionSet")
    def to_delete_inline_policy_from_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to delete the inline policy from a specified permission set.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeleteInlinePolicyFromPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDeleteInlinePolicyFromPermissionSet", []))

    @jsii.member(jsii_name="toDeleteInstanceAccessControlAttributeConfiguration")
    def to_delete_instance_access_control_attribute_configuration(self) -> "Sso":
        '''(experimental) Grants permission to disable ABAC and remove the attributes list for the instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeleteInstanceAccessControlAttributeConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDeleteInstanceAccessControlAttributeConfiguration", []))

    @jsii.member(jsii_name="toDeleteManagedApplicationInstance")
    def to_delete_managed_application_instance(self) -> "Sso":
        '''(experimental) Grants permission to delete the managed application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDeleteManagedApplicationInstance", []))

    @jsii.member(jsii_name="toDeletePermissionsBoundaryFromPermissionSet")
    def to_delete_permissions_boundary_from_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to remove permissions boundary from a permission set.

        Access Level: Permissions management

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeletePermissionsBoundaryFromPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDeletePermissionsBoundaryFromPermissionSet", []))

    @jsii.member(jsii_name="toDeletePermissionSet")
    def to_delete_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to delete a permission set.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDeletePermissionSet", []))

    @jsii.member(jsii_name="toDeletePermissionsPolicy")
    def to_delete_permissions_policy(self) -> "Sso":
        '''(experimental) Grants permission to delete the permission policy associated with a permission set.

        Access Level: Permissions management

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDeletePermissionsPolicy", []))

    @jsii.member(jsii_name="toDeleteProfile")
    def to_delete_profile(self) -> "Sso":
        '''(experimental) Grants permission to delete the profile for an application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDeleteProfile", []))

    @jsii.member(jsii_name="toDescribeAccountAssignmentCreationStatus")
    def to_describe_account_assignment_creation_status(self) -> "Sso":
        '''(experimental) Grants permission to describe the status of the assignment creation request.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribeAccountAssignmentCreationStatus.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDescribeAccountAssignmentCreationStatus", []))

    @jsii.member(jsii_name="toDescribeAccountAssignmentDeletionStatus")
    def to_describe_account_assignment_deletion_status(self) -> "Sso":
        '''(experimental) Grants permission to describe the status of an assignment deletion request.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribeAccountAssignmentDeletionStatus.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDescribeAccountAssignmentDeletionStatus", []))

    @jsii.member(jsii_name="toDescribeDirectories")
    def to_describe_directories(self) -> "Sso":
        '''(experimental) Grants permission to obtain information about the directories for this account.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDescribeDirectories", []))

    @jsii.member(jsii_name="toDescribeInstanceAccessControlAttributeConfiguration")
    def to_describe_instance_access_control_attribute_configuration(self) -> "Sso":
        '''(experimental) Grants permission to get the list of attributes used by the instance for ABAC.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribeInstanceAccessControlAttributeConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDescribeInstanceAccessControlAttributeConfiguration", []))

    @jsii.member(jsii_name="toDescribePermissionSet")
    def to_describe_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to describe a permission set.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribePermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDescribePermissionSet", []))

    @jsii.member(jsii_name="toDescribePermissionSetProvisioningStatus")
    def to_describe_permission_set_provisioning_status(self) -> "Sso":
        '''(experimental) Grants permission to describe the status for the given Permission Set Provisioning request.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribePermissionSetProvisioningStatus.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDescribePermissionSetProvisioningStatus", []))

    @jsii.member(jsii_name="toDescribePermissionsPolicies")
    def to_describe_permissions_policies(self) -> "Sso":
        '''(experimental) Grants permission to retrieve all the permissions policies associated with a permission set.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDescribePermissionsPolicies", []))

    @jsii.member(jsii_name="toDescribeRegisteredRegions")
    def to_describe_registered_regions(self) -> "Sso":
        '''(experimental) Grants permission to obtain the regions where your organization has enabled AWS IAM Identity Center.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDescribeRegisteredRegions", []))

    @jsii.member(jsii_name="toDescribeTrusts")
    def to_describe_trusts(self) -> "Sso":
        '''(experimental) Grants permission to obtain information about the trust relationships for this account.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDescribeTrusts", []))

    @jsii.member(jsii_name="toDetachCustomerManagedPolicyReferenceFromPermissionSet")
    def to_detach_customer_managed_policy_reference_from_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to detach a customer managed policy reference from a permission set.

        Access Level: Permissions management

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DetachCustomerManagedPolicyReferenceFromPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDetachCustomerManagedPolicyReferenceFromPermissionSet", []))

    @jsii.member(jsii_name="toDetachManagedPolicyFromPermissionSet")
    def to_detach_managed_policy_from_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to detach the attached AWS managed policy from the specified permission set.

        Access Level: Permissions management

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DetachManagedPolicyFromPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDetachManagedPolicyFromPermissionSet", []))

    @jsii.member(jsii_name="toDisassociateDirectory")
    def to_disassociate_directory(self) -> "Sso":
        '''(experimental) Grants permission to disassociate a directory to be used by AWS IAM Identity Center.

        Access Level: Write

        Dependent actions:

        - ds:UnauthorizeApplication

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDisassociateDirectory", []))

    @jsii.member(jsii_name="toDisassociateProfile")
    def to_disassociate_profile(self) -> "Sso":
        '''(experimental) Grants permission to disassociate a directory user or group from a profile.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toDisassociateProfile", []))

    @jsii.member(jsii_name="toGetApplicationInstance")
    def to_get_application_instance(self) -> "Sso":
        '''(experimental) Grants permission to retrieve details for an application instance.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetApplicationInstance", []))

    @jsii.member(jsii_name="toGetApplicationTemplate")
    def to_get_application_template(self) -> "Sso":
        '''(experimental) Grants permission to retrieve application template details.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetApplicationTemplate", []))

    @jsii.member(jsii_name="toGetInlinePolicyForPermissionSet")
    def to_get_inline_policy_for_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to obtain the inline policy assigned to the permission set.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_GetInlinePolicyForPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetInlinePolicyForPermissionSet", []))

    @jsii.member(jsii_name="toGetManagedApplicationInstance")
    def to_get_managed_application_instance(self) -> "Sso":
        '''(experimental) Grants permission to retrieve details for an application instance.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetManagedApplicationInstance", []))

    @jsii.member(jsii_name="toGetMfaDeviceManagementForDirectory")
    def to_get_mfa_device_management_for_directory(self) -> "Sso":
        '''(experimental) Grants permission to retrieve Mfa Device Management settings for the directory.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetMfaDeviceManagementForDirectory", []))

    @jsii.member(jsii_name="toGetPermissionsBoundaryForPermissionSet")
    def to_get_permissions_boundary_for_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to get permissions boundary for a permission set.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_GetPermissionsBoundaryForPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetPermissionsBoundaryForPermissionSet", []))

    @jsii.member(jsii_name="toGetPermissionSet")
    def to_get_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to retrieve details of a permission set.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetPermissionSet", []))

    @jsii.member(jsii_name="toGetPermissionsPolicy")
    def to_get_permissions_policy(self) -> "Sso":
        '''(experimental) Grants permission to retrieve all permission policies associated with a permission set.

        Access Level: Read

        Dependent actions:

        - sso:DescribePermissionsPolicies

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetPermissionsPolicy", []))

    @jsii.member(jsii_name="toGetProfile")
    def to_get_profile(self) -> "Sso":
        '''(experimental) Grants permission to retrieve a profile for an application instance.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetProfile", []))

    @jsii.member(jsii_name="toGetSharedSsoConfiguration")
    def to_get_shared_sso_configuration(self) -> "Sso":
        '''(experimental) Grants permission to retrieve shared configuration for the current SSO instance.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetSharedSsoConfiguration", []))

    @jsii.member(jsii_name="toGetSsoConfiguration")
    def to_get_sso_configuration(self) -> "Sso":
        '''(experimental) Grants permission to retrieve configuration for the current SSO instance.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetSsoConfiguration", []))

    @jsii.member(jsii_name="toGetSSOStatus")
    def to_get_sso_status(self) -> "Sso":
        '''(experimental) Grants permission to check if AWS IAM Identity Center is enabled.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetSSOStatus", []))

    @jsii.member(jsii_name="toGetTrust")
    def to_get_trust(self) -> "Sso":
        '''(experimental) Grants permission to retrieve the federation trust in a target account.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toGetTrust", []))

    @jsii.member(jsii_name="toImportApplicationInstanceServiceProviderMetadata")
    def to_import_application_instance_service_provider_metadata(self) -> "Sso":
        '''(experimental) Grants permission to update the application instance by uploading an application SAML metadata file provided by the service provider.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toImportApplicationInstanceServiceProviderMetadata", []))

    @jsii.member(jsii_name="toListAccountAssignmentCreationStatus")
    def to_list_account_assignment_creation_status(self) -> "Sso":
        '''(experimental) Grants permission to list the status of the AWS account assignment creation requests for a specified SSO instance.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListAccountAssignmentCreationStatus.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListAccountAssignmentCreationStatus", []))

    @jsii.member(jsii_name="toListAccountAssignmentDeletionStatus")
    def to_list_account_assignment_deletion_status(self) -> "Sso":
        '''(experimental) Grants permission to list the status of the AWS account assignment deletion requests for a specified SSO instance.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListAccountAssignmentDeletionStatus.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListAccountAssignmentDeletionStatus", []))

    @jsii.member(jsii_name="toListAccountAssignments")
    def to_list_account_assignments(self) -> "Sso":
        '''(experimental) Grants permission to list the assignee of the specified AWS account with the specified permission set.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListAccountAssignments.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListAccountAssignments", []))

    @jsii.member(jsii_name="toListAccountsForProvisionedPermissionSet")
    def to_list_accounts_for_provisioned_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to list all the AWS accounts where the specified permission set is provisioned.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListAccountsForProvisionedPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListAccountsForProvisionedPermissionSet", []))

    @jsii.member(jsii_name="toListApplicationInstanceCertificates")
    def to_list_application_instance_certificates(self) -> "Sso":
        '''(experimental) Grants permission to retrieve all of the certificates for a given application instance.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListApplicationInstanceCertificates", []))

    @jsii.member(jsii_name="toListApplicationInstances")
    def to_list_application_instances(self) -> "Sso":
        '''(experimental) Grants permission to retrieve all application instances.

        Access Level: List

        Dependent actions:

        - sso:GetApplicationInstance

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListApplicationInstances", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "Sso":
        '''(experimental) Grants permission to retrieve all supported applications.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListApplicationTemplates")
    def to_list_application_templates(self) -> "Sso":
        '''(experimental) Grants permission to retrieve all supported application templates.

        Access Level: List

        Dependent actions:

        - sso:GetApplicationTemplate

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListApplicationTemplates", []))

    @jsii.member(jsii_name="toListCustomerManagedPolicyReferencesInPermissionSet")
    def to_list_customer_managed_policy_references_in_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to list the customer managed policy references that are attached to a permission set.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListCustomerManagedPolicyReferencesInPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListCustomerManagedPolicyReferencesInPermissionSet", []))

    @jsii.member(jsii_name="toListDirectoryAssociations")
    def to_list_directory_associations(self) -> "Sso":
        '''(experimental) Grants permission to retrieve details about the directory connected to AWS IAM Identity Center.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListDirectoryAssociations", []))

    @jsii.member(jsii_name="toListInstances")
    def to_list_instances(self) -> "Sso":
        '''(experimental) Grants permission to list the SSO Instances that the caller has access to.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListInstances.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListInstances", []))

    @jsii.member(jsii_name="toListManagedPoliciesInPermissionSet")
    def to_list_managed_policies_in_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to list the AWS managed policies that are attached to a specified permission set.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListManagedPoliciesInPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListManagedPoliciesInPermissionSet", []))

    @jsii.member(jsii_name="toListPermissionSetProvisioningStatus")
    def to_list_permission_set_provisioning_status(self) -> "Sso":
        '''(experimental) Grants permission to list the status of the Permission Set Provisioning requests for a specified SSO instance.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListPermissionSetProvisioningStatus.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListPermissionSetProvisioningStatus", []))

    @jsii.member(jsii_name="toListPermissionSets")
    def to_list_permission_sets(self) -> "Sso":
        '''(experimental) Grants permission to retrieve all permission sets.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListPermissionSets", []))

    @jsii.member(jsii_name="toListPermissionSetsProvisionedToAccount")
    def to_list_permission_sets_provisioned_to_account(self) -> "Sso":
        '''(experimental) Grants permission to list all the permission sets that are provisioned to a specified AWS account.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListPermissionSetsProvisionedToAccount.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListPermissionSetsProvisionedToAccount", []))

    @jsii.member(jsii_name="toListProfileAssociations")
    def to_list_profile_associations(self) -> "Sso":
        '''(experimental) Grants permission to retrieve the directory user or group associated with the profile.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListProfileAssociations", []))

    @jsii.member(jsii_name="toListProfiles")
    def to_list_profiles(self) -> "Sso":
        '''(experimental) Grants permission to retrieve all profiles for an application instance.

        Access Level: List

        Dependent actions:

        - sso:GetProfile

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListProfiles", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Sso":
        '''(experimental) Grants permission to list the tags that are attached to a specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toProvisionPermissionSet")
    def to_provision_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to provision a specified permission set to the specified target.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ProvisionPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toProvisionPermissionSet", []))

    @jsii.member(jsii_name="toPutApplicationAssignmentConfiguration")
    def to_put_application_assignment_configuration(self) -> "Sso":
        '''(experimental) Grants permission to add assignment configurations to an application.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toPutApplicationAssignmentConfiguration", []))

    @jsii.member(jsii_name="toPutInlinePolicyToPermissionSet")
    def to_put_inline_policy_to_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to attach an IAM inline policy to a permission set.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_PutInlinePolicyToPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toPutInlinePolicyToPermissionSet", []))

    @jsii.member(jsii_name="toPutMfaDeviceManagementForDirectory")
    def to_put_mfa_device_management_for_directory(self) -> "Sso":
        '''(experimental) Grants permission to put Mfa Device Management settings for the directory.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toPutMfaDeviceManagementForDirectory", []))

    @jsii.member(jsii_name="toPutPermissionsBoundaryToPermissionSet")
    def to_put_permissions_boundary_to_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to add permissions boundary to a permission set.

        Access Level: Permissions management

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_PutPermissionsBoundaryToPermissionSet.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toPutPermissionsBoundaryToPermissionSet", []))

    @jsii.member(jsii_name="toPutPermissionsPolicy")
    def to_put_permissions_policy(self) -> "Sso":
        '''(experimental) Grants permission to add a policy to a permission set.

        Access Level: Permissions management

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toPutPermissionsPolicy", []))

    @jsii.member(jsii_name="toSearchGroups")
    def to_search_groups(self) -> "Sso":
        '''(experimental) Grants permission to search for groups within the associated directory.

        Access Level: Read

        Dependent actions:

        - ds:DescribeDirectories

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toSearchGroups", []))

    @jsii.member(jsii_name="toSearchUsers")
    def to_search_users(self) -> "Sso":
        '''(experimental) Grants permission to search for users within the associated directory.

        Access Level: Read

        Dependent actions:

        - ds:DescribeDirectories

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toSearchUsers", []))

    @jsii.member(jsii_name="toStartSSO")
    def to_start_sso(self) -> "Sso":
        '''(experimental) Grants permission to initialize AWS IAM Identity Center.

        Access Level: Write

        Dependent actions:

        - organizations:DescribeOrganization
        - organizations:EnableAWSServiceAccess

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toStartSSO", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Sso":
        '''(experimental) Grants permission to associate a set of tags with a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Sso":
        '''(experimental) Grants permission to disassociate a set of tags from a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplicationInstanceActiveCertificate")
    def to_update_application_instance_active_certificate(self) -> "Sso":
        '''(experimental) Grants permission to set a certificate as the active one for this application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateApplicationInstanceActiveCertificate", []))

    @jsii.member(jsii_name="toUpdateApplicationInstanceDisplayData")
    def to_update_application_instance_display_data(self) -> "Sso":
        '''(experimental) Grants permission to update display data of an application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateApplicationInstanceDisplayData", []))

    @jsii.member(jsii_name="toUpdateApplicationInstanceResponseConfiguration")
    def to_update_application_instance_response_configuration(self) -> "Sso":
        '''(experimental) Grants permission to update federation response configuration for the application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateApplicationInstanceResponseConfiguration", []))

    @jsii.member(jsii_name="toUpdateApplicationInstanceResponseSchemaConfiguration")
    def to_update_application_instance_response_schema_configuration(self) -> "Sso":
        '''(experimental) Grants permission to update federation response schema configuration for the application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateApplicationInstanceResponseSchemaConfiguration", []))

    @jsii.member(jsii_name="toUpdateApplicationInstanceSecurityConfiguration")
    def to_update_application_instance_security_configuration(self) -> "Sso":
        '''(experimental) Grants permission to update security details for the application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateApplicationInstanceSecurityConfiguration", []))

    @jsii.member(jsii_name="toUpdateApplicationInstanceServiceProviderConfiguration")
    def to_update_application_instance_service_provider_configuration(self) -> "Sso":
        '''(experimental) Grants permission to update service provider related configuration for the application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateApplicationInstanceServiceProviderConfiguration", []))

    @jsii.member(jsii_name="toUpdateApplicationInstanceStatus")
    def to_update_application_instance_status(self) -> "Sso":
        '''(experimental) Grants permission to update the status of an application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateApplicationInstanceStatus", []))

    @jsii.member(jsii_name="toUpdateDirectoryAssociation")
    def to_update_directory_association(self) -> "Sso":
        '''(experimental) Grants permission to update the user attribute mappings for your connected directory.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateDirectoryAssociation", []))

    @jsii.member(jsii_name="toUpdateInstanceAccessControlAttributeConfiguration")
    def to_update_instance_access_control_attribute_configuration(self) -> "Sso":
        '''(experimental) Grants permission to update the attributes to use with the instance for ABAC.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_UpdateInstanceAccessControlAttributeConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateInstanceAccessControlAttributeConfiguration", []))

    @jsii.member(jsii_name="toUpdateManagedApplicationInstanceStatus")
    def to_update_managed_application_instance_status(self) -> "Sso":
        '''(experimental) Grants permission to update the status of a managed application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateManagedApplicationInstanceStatus", []))

    @jsii.member(jsii_name="toUpdatePermissionSet")
    def to_update_permission_set(self) -> "Sso":
        '''(experimental) Grants permission to update the permission set.

        Access Level: Permissions management

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdatePermissionSet", []))

    @jsii.member(jsii_name="toUpdateProfile")
    def to_update_profile(self) -> "Sso":
        '''(experimental) Grants permission to update the profile for an application instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateProfile", []))

    @jsii.member(jsii_name="toUpdateSSOConfiguration")
    def to_update_sso_configuration(self) -> "Sso":
        '''(experimental) Grants permission to update the configuration for the current SSO instance.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateSSOConfiguration", []))

    @jsii.member(jsii_name="toUpdateTrust")
    def to_update_trust(self) -> "Sso":
        '''(experimental) Grants permission to update the federation trust in a target account.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("Sso", jsii.invoke(self, "toUpdateTrust", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c216bafa9a5b8047acb9936f27492a5f91b4392541ab5bf1ee47acf7c18f4085)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__537abb243bc9d940cf81d1fc94e8eba3e3b3edad6c88e6ab7813017ff3c66cc9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class SsoDirectory(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.SsoDirectory",
):
    '''(experimental) Statement provider for service `sso-directory <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycentersuccessortoawssinglesign-ondirectory.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sso-directory <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycentersuccessortoawssinglesign-ondirectory.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f024cc4b61981becd4f619604c9bdb338f2222157d5b405c64246d1fd54828fb)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toAddMemberToGroup")
    def to_add_member_to_group(self) -> "SsoDirectory":
        '''(experimental) Grants permission to add a member to a group in the directory that AWS IAM Identity Center provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toAddMemberToGroup", []))

    @jsii.member(jsii_name="toCompleteVirtualMfaDeviceRegistration")
    def to_complete_virtual_mfa_device_registration(self) -> "SsoDirectory":
        '''(experimental) Grants permission to complete the creation process of a virtual MFA device.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toCompleteVirtualMfaDeviceRegistration", []))

    @jsii.member(jsii_name="toCompleteWebAuthnDeviceRegistration")
    def to_complete_web_authn_device_registration(self) -> "SsoDirectory":
        '''(experimental) Grants permission to complete the registration process of a WebAuthn device.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toCompleteWebAuthnDeviceRegistration", []))

    @jsii.member(jsii_name="toCreateAlias")
    def to_create_alias(self) -> "SsoDirectory":
        '''(experimental) Grants permission to create an alias for the directory that AWS IAM Identity Center provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toCreateAlias", []))

    @jsii.member(jsii_name="toCreateBearerToken")
    def to_create_bearer_token(self) -> "SsoDirectory":
        '''(experimental) Grants permission to create a bearer token for a given provisioning tenant.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toCreateBearerToken", []))

    @jsii.member(jsii_name="toCreateExternalIdPConfigurationForDirectory")
    def to_create_external_id_p_configuration_for_directory(self) -> "SsoDirectory":
        '''(experimental) Grants permission to create an External Identity Provider configuration for the directory.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toCreateExternalIdPConfigurationForDirectory", []))

    @jsii.member(jsii_name="toCreateGroup")
    def to_create_group(self) -> "SsoDirectory":
        '''(experimental) Grants permission to create a group in the directory that AWS IAM Identity Center provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toCreateGroup", []))

    @jsii.member(jsii_name="toCreateProvisioningTenant")
    def to_create_provisioning_tenant(self) -> "SsoDirectory":
        '''(experimental) Grants permission to create a provisioning tenant for a given directory.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toCreateProvisioningTenant", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "SsoDirectory":
        '''(experimental) Grants permission to create a user in the directory that AWS IAM Identity Center provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toDeleteBearerToken")
    def to_delete_bearer_token(self) -> "SsoDirectory":
        '''(experimental) Grants permission to delete a bearer token.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDeleteBearerToken", []))

    @jsii.member(jsii_name="toDeleteExternalIdPCertificate")
    def to_delete_external_id_p_certificate(self) -> "SsoDirectory":
        '''(experimental) Grants permission to delete the given external IdP certificate.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDeleteExternalIdPCertificate", []))

    @jsii.member(jsii_name="toDeleteExternalIdPConfigurationForDirectory")
    def to_delete_external_id_p_configuration_for_directory(self) -> "SsoDirectory":
        '''(experimental) Grants permission to delete an External Identity Provider configuration associated with the directory.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDeleteExternalIdPConfigurationForDirectory", []))

    @jsii.member(jsii_name="toDeleteGroup")
    def to_delete_group(self) -> "SsoDirectory":
        '''(experimental) Grants permission to delete a group from the directory that AWS IAM Identity Center provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDeleteGroup", []))

    @jsii.member(jsii_name="toDeleteMfaDeviceForUser")
    def to_delete_mfa_device_for_user(self) -> "SsoDirectory":
        '''(experimental) Grants permission to delete a MFA device by device name for a given user.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDeleteMfaDeviceForUser", []))

    @jsii.member(jsii_name="toDeleteProvisioningTenant")
    def to_delete_provisioning_tenant(self) -> "SsoDirectory":
        '''(experimental) Grants permission to delete the provisioning tenant.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDeleteProvisioningTenant", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "SsoDirectory":
        '''(experimental) Grants permission to delete a user from the directory that AWS IAM Identity Center provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDescribeDirectory")
    def to_describe_directory(self) -> "SsoDirectory":
        '''(experimental) Grants permission to retrieve information about the directory that AWS IAM Identity Center provides by default.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDescribeDirectory", []))

    @jsii.member(jsii_name="toDescribeGroup")
    def to_describe_group(self) -> "SsoDirectory":
        '''(experimental) Grants permission to query the group data, not including user and group members.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDescribeGroup", []))

    @jsii.member(jsii_name="toDescribeGroups")
    def to_describe_groups(self) -> "SsoDirectory":
        '''(experimental) Grants permission to retrieve information about groups from the directory that AWS IAM Identity Center provides by default.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDescribeGroups", []))

    @jsii.member(jsii_name="toDescribeProvisioningTenant")
    def to_describe_provisioning_tenant(self) -> "SsoDirectory":
        '''(experimental) Grants permission to describes the provisioning tenant.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDescribeProvisioningTenant", []))

    @jsii.member(jsii_name="toDescribeUser")
    def to_describe_user(self) -> "SsoDirectory":
        '''(experimental) Grants permission to retrieve information about a user from the directory that AWS IAM Identity Center provides by default.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDescribeUser", []))

    @jsii.member(jsii_name="toDescribeUserByUniqueAttribute")
    def to_describe_user_by_unique_attribute(self) -> "SsoDirectory":
        '''(experimental) Grants permission to describe user with a valid unique attribute represented for the user.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDescribeUserByUniqueAttribute", []))

    @jsii.member(jsii_name="toDescribeUsers")
    def to_describe_users(self) -> "SsoDirectory":
        '''(experimental) Grants permission to retrieve information about user from the directory that AWS IAM Identity Center provides by default.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDescribeUsers", []))

    @jsii.member(jsii_name="toDisableExternalIdPConfigurationForDirectory")
    def to_disable_external_id_p_configuration_for_directory(self) -> "SsoDirectory":
        '''(experimental) Grants permission to disable authentication of end users with an External Identity Provider.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDisableExternalIdPConfigurationForDirectory", []))

    @jsii.member(jsii_name="toDisableUser")
    def to_disable_user(self) -> "SsoDirectory":
        '''(experimental) Grants permission to deactivate a user in the directory that AWS IAM Identity Center provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toDisableUser", []))

    @jsii.member(jsii_name="toEnableExternalIdPConfigurationForDirectory")
    def to_enable_external_id_p_configuration_for_directory(self) -> "SsoDirectory":
        '''(experimental) Grants permission to enable authentication of end users with an External Identity Provider.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toEnableExternalIdPConfigurationForDirectory", []))

    @jsii.member(jsii_name="toEnableUser")
    def to_enable_user(self) -> "SsoDirectory":
        '''(experimental) Grants permission to activate user in the directory that AWS IAM Identity Center provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toEnableUser", []))

    @jsii.member(jsii_name="toGetAWSSPConfigurationForDirectory")
    def to_get_awssp_configuration_for_directory(self) -> "SsoDirectory":
        '''(experimental) Grants permission to retrieve the AWS IAM Identity Center Service Provider configurations for the directory.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toGetAWSSPConfigurationForDirectory", []))

    @jsii.member(jsii_name="toGetUserPoolInfo")
    def to_get_user_pool_info(self) -> "SsoDirectory":
        '''(experimental) (Deprecated) Grants permission to get UserPool Info.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toGetUserPoolInfo", []))

    @jsii.member(jsii_name="toImportExternalIdPCertificate")
    def to_import_external_id_p_certificate(self) -> "SsoDirectory":
        '''(experimental) Grants permission to import the IdP certificate used for verifying external IdP responses.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toImportExternalIdPCertificate", []))

    @jsii.member(jsii_name="toIsMemberInGroup")
    def to_is_member_in_group(self) -> "SsoDirectory":
        '''(experimental) Grants permission to check if a member is a part of the group in the directory that AWS IAM Identity Center provides by default.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toIsMemberInGroup", []))

    @jsii.member(jsii_name="toListBearerTokens")
    def to_list_bearer_tokens(self) -> "SsoDirectory":
        '''(experimental) Grants permission to list bearer tokens for a given provisioning tenant.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toListBearerTokens", []))

    @jsii.member(jsii_name="toListExternalIdPCertificates")
    def to_list_external_id_p_certificates(self) -> "SsoDirectory":
        '''(experimental) Grants permission to list the external IdP certificates of a given directory and IdP.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toListExternalIdPCertificates", []))

    @jsii.member(jsii_name="toListExternalIdPConfigurationsForDirectory")
    def to_list_external_id_p_configurations_for_directory(self) -> "SsoDirectory":
        '''(experimental) Grants permission to list all the External Identity Provider configurations created for the directory.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toListExternalIdPConfigurationsForDirectory", []))

    @jsii.member(jsii_name="toListGroupsForMember")
    def to_list_groups_for_member(self) -> "SsoDirectory":
        '''(experimental) Grants permission to list groups of the target member.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toListGroupsForMember", []))

    @jsii.member(jsii_name="toListGroupsForUser")
    def to_list_groups_for_user(self) -> "SsoDirectory":
        '''(experimental) Grants permission to list groups for a user from the directory that AWS IAM Identity Center provides by default.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toListGroupsForUser", []))

    @jsii.member(jsii_name="toListMembersInGroup")
    def to_list_members_in_group(self) -> "SsoDirectory":
        '''(experimental) Grants permission to retrieve all members that are part of a group in the directory that AWS IAM Identity Center provides by default.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toListMembersInGroup", []))

    @jsii.member(jsii_name="toListMfaDevicesForUser")
    def to_list_mfa_devices_for_user(self) -> "SsoDirectory":
        '''(experimental) Grants permission to list all active MFA devices and their MFA device metadata for a user.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toListMfaDevicesForUser", []))

    @jsii.member(jsii_name="toListProvisioningTenants")
    def to_list_provisioning_tenants(self) -> "SsoDirectory":
        '''(experimental) Grants permission to list provisioning tenants for a given directory.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toListProvisioningTenants", []))

    @jsii.member(jsii_name="toRemoveMemberFromGroup")
    def to_remove_member_from_group(self) -> "SsoDirectory":
        '''(experimental) Grants permission to remove a member that is part of a group in the directory that AWS IAM Identity Center provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toRemoveMemberFromGroup", []))

    @jsii.member(jsii_name="toSearchGroups")
    def to_search_groups(self) -> "SsoDirectory":
        '''(experimental) Grants permission to search for groups within the associated directory.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toSearchGroups", []))

    @jsii.member(jsii_name="toSearchUsers")
    def to_search_users(self) -> "SsoDirectory":
        '''(experimental) Grants permission to search for users within the associated directory.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toSearchUsers", []))

    @jsii.member(jsii_name="toStartVirtualMfaDeviceRegistration")
    def to_start_virtual_mfa_device_registration(self) -> "SsoDirectory":
        '''(experimental) Grants permission to begin the creation process of virtual mfa device.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toStartVirtualMfaDeviceRegistration", []))

    @jsii.member(jsii_name="toStartWebAuthnDeviceRegistration")
    def to_start_web_authn_device_registration(self) -> "SsoDirectory":
        '''(experimental) Grants permission to begin the registration process of a WebAuthn device.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toStartWebAuthnDeviceRegistration", []))

    @jsii.member(jsii_name="toUpdateExternalIdPConfigurationForDirectory")
    def to_update_external_id_p_configuration_for_directory(self) -> "SsoDirectory":
        '''(experimental) Grants permission to update an External Identity Provider configuration associated with the directory.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toUpdateExternalIdPConfigurationForDirectory", []))

    @jsii.member(jsii_name="toUpdateGroup")
    def to_update_group(self) -> "SsoDirectory":
        '''(experimental) Grants permission to update information about a group in the directory that AWS IAM Identity Center provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toUpdateGroup", []))

    @jsii.member(jsii_name="toUpdateGroupDisplayName")
    def to_update_group_display_name(self) -> "SsoDirectory":
        '''(experimental) Grants permission to update group display name update group display name response.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toUpdateGroupDisplayName", []))

    @jsii.member(jsii_name="toUpdateMfaDeviceForUser")
    def to_update_mfa_device_for_user(self) -> "SsoDirectory":
        '''(experimental) Grants permission to update MFA device information.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toUpdateMfaDeviceForUser", []))

    @jsii.member(jsii_name="toUpdatePassword")
    def to_update_password(self) -> "SsoDirectory":
        '''(experimental) Grants permission to update a password by sending password reset link via email or generating one time password for a user in the directory that AWS IAM Identity Center provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toUpdatePassword", []))

    @jsii.member(jsii_name="toUpdateUser")
    def to_update_user(self) -> "SsoDirectory":
        '''(experimental) Grants permission to update user information in the directory that AWS IAM Identity Center provides by default.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toUpdateUser", []))

    @jsii.member(jsii_name="toUpdateUserName")
    def to_update_user_name(self) -> "SsoDirectory":
        '''(experimental) Grants permission to update user name update user name response.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toUpdateUserName", []))

    @jsii.member(jsii_name="toVerifyEmail")
    def to_verify_email(self) -> "SsoDirectory":
        '''(experimental) Grants permission to verify an email address of an User.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample

        :stability: experimental
        '''
        return typing.cast("SsoDirectory", jsii.invoke(self, "toVerifyEmail", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ed2eb7056d5245b4e2a809546003657b2e0385664c0ebf8434a8dfce7d95d759)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5eeca7f190ce58c4b30b106d7ea49a7ab1f5c90c06c3e713e151fd881b49f207)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class States(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.States"):
    '''(experimental) Statement provider for service `states <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsstepfunctions.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `states <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsstepfunctions.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ed0955020bbb0da6925ada301a6d65f2ad958b99dfcdfc3133dc1dd8306008a1)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onActivity")
    def on_activity(
        self,
        activity_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "States":
        '''(experimental) Adds a resource of type activity to the statement.

        https://docs.aws.amazon.com/step-functions/latest/dg/concepts-activities.html

        :param activity_name: - Identifier for the activityName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4e291cd11ec002cab3033624d9a3a12849e557550358a05191438b1ee1dae21a)
            check_type(argname="argument activity_name", value=activity_name, expected_type=type_hints["activity_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("States", jsii.invoke(self, "onActivity", [activity_name, account, region, partition]))

    @jsii.member(jsii_name="onExecution")
    def on_execution(
        self,
        state_machine_name: builtins.str,
        execution_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "States":
        '''(experimental) Adds a resource of type execution to the statement.

        https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-executions.html

        :param state_machine_name: - Identifier for the stateMachineName.
        :param execution_id: - Identifier for the executionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0191754f5a5c160fdcf9734a0daf21bd185f8f9080fcc2150ca8c921293870e7)
            check_type(argname="argument state_machine_name", value=state_machine_name, expected_type=type_hints["state_machine_name"])
            check_type(argname="argument execution_id", value=execution_id, expected_type=type_hints["execution_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("States", jsii.invoke(self, "onExecution", [state_machine_name, execution_id, account, region, partition]))

    @jsii.member(jsii_name="onExpress")
    def on_express(
        self,
        state_machine_name: builtins.str,
        execution_id: builtins.str,
        express_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "States":
        '''(experimental) Adds a resource of type express to the statement.

        https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-executions.html

        :param state_machine_name: - Identifier for the stateMachineName.
        :param execution_id: - Identifier for the executionId.
        :param express_id: - Identifier for the expressId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3a68d68c4888bd83a5602086eed88979b6b4d549998a3cb27ada82114af38f80)
            check_type(argname="argument state_machine_name", value=state_machine_name, expected_type=type_hints["state_machine_name"])
            check_type(argname="argument execution_id", value=execution_id, expected_type=type_hints["execution_id"])
            check_type(argname="argument express_id", value=express_id, expected_type=type_hints["express_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("States", jsii.invoke(self, "onExpress", [state_machine_name, execution_id, express_id, account, region, partition]))

    @jsii.member(jsii_name="onMaprun")
    def on_maprun(
        self,
        state_machine_name: builtins.str,
        map_run_label: builtins.str,
        map_run_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "States":
        '''(experimental) Adds a resource of type maprun to the statement.

        https://docs.aws.amazon.com/step-functions/latest/dg/concepts-examine-map-run.html

        :param state_machine_name: - Identifier for the stateMachineName.
        :param map_run_label: - Identifier for the mapRunLabel.
        :param map_run_id: - Identifier for the mapRunId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5df039604cc31381ad4caa6a7a15e7e1bf2343eedda532363cb6ed6c1ae48ed7)
            check_type(argname="argument state_machine_name", value=state_machine_name, expected_type=type_hints["state_machine_name"])
            check_type(argname="argument map_run_label", value=map_run_label, expected_type=type_hints["map_run_label"])
            check_type(argname="argument map_run_id", value=map_run_id, expected_type=type_hints["map_run_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("States", jsii.invoke(self, "onMaprun", [state_machine_name, map_run_label, map_run_id, account, region, partition]))

    @jsii.member(jsii_name="onStatemachine")
    def on_statemachine(
        self,
        state_machine_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "States":
        '''(experimental) Adds a resource of type statemachine to the statement.

        https://docs.aws.amazon.com/step-functions/latest/dg/concepts-amazon-states-language.html

        :param state_machine_name: - Identifier for the stateMachineName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ac41413fab9e2754ed12469f07af6b7945655f4eb8b18ca2e1c6a2cf4dd1e7fb)
            check_type(argname="argument state_machine_name", value=state_machine_name, expected_type=type_hints["state_machine_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("States", jsii.invoke(self, "onStatemachine", [state_machine_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateActivity")
    def to_create_activity(self) -> "States":
        '''(experimental) Grants permission to create an activity.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_CreateActivity.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toCreateActivity", []))

    @jsii.member(jsii_name="toCreateStateMachine")
    def to_create_state_machine(self) -> "States":
        '''(experimental) Grants permission to create a state machine.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_CreateStateMachine.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toCreateStateMachine", []))

    @jsii.member(jsii_name="toDeleteActivity")
    def to_delete_activity(self) -> "States":
        '''(experimental) Grants permission to delete an activity.

        Access Level: Write

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_DeleteActivity.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toDeleteActivity", []))

    @jsii.member(jsii_name="toDeleteStateMachine")
    def to_delete_state_machine(self) -> "States":
        '''(experimental) Grants permission to delete a state machine.

        Access Level: Write

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_DeleteStateMachine.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toDeleteStateMachine", []))

    @jsii.member(jsii_name="toDescribeActivity")
    def to_describe_activity(self) -> "States":
        '''(experimental) Grants permission to describe an activity.

        Access Level: Read

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeActivity.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toDescribeActivity", []))

    @jsii.member(jsii_name="toDescribeExecution")
    def to_describe_execution(self) -> "States":
        '''(experimental) Grants permission to describe an execution.

        Access Level: Read

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeExecution.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toDescribeExecution", []))

    @jsii.member(jsii_name="toDescribeMapRun")
    def to_describe_map_run(self) -> "States":
        '''(experimental) Grants permission to describe a map run.

        Access Level: Read

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeMapRun.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toDescribeMapRun", []))

    @jsii.member(jsii_name="toDescribeStateMachine")
    def to_describe_state_machine(self) -> "States":
        '''(experimental) Grants permission to describe a state machine.

        Access Level: Read

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeStateMachine.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toDescribeStateMachine", []))

    @jsii.member(jsii_name="toDescribeStateMachineForExecution")
    def to_describe_state_machine_for_execution(self) -> "States":
        '''(experimental) Grants permission to describe the state machine for an execution.

        Access Level: Read

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeStateMachineForExecution.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toDescribeStateMachineForExecution", []))

    @jsii.member(jsii_name="toGetActivityTask")
    def to_get_activity_task(self) -> "States":
        '''(experimental) Grants permission to be used by workers to retrieve a task (with the specified activity ARN) which has been scheduled for execution by a running state machine.

        Access Level: Write

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_GetActivityTask.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toGetActivityTask", []))

    @jsii.member(jsii_name="toGetExecutionHistory")
    def to_get_execution_history(self) -> "States":
        '''(experimental) Grants permission to return the history of the specified execution as a list of events.

        Access Level: Read

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_GetExecutionHistory.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toGetExecutionHistory", []))

    @jsii.member(jsii_name="toListActivities")
    def to_list_activities(self) -> "States":
        '''(experimental) Grants permission to list the existing activities.

        Access Level: List

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListActivities.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toListActivities", []))

    @jsii.member(jsii_name="toListExecutions")
    def to_list_executions(self) -> "States":
        '''(experimental) Grants permission to list the executions of a state machine.

        Access Level: Read

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListExecutions.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toListExecutions", []))

    @jsii.member(jsii_name="toListMapRuns")
    def to_list_map_runs(self) -> "States":
        '''(experimental) Grants permission to list the map runs of an execution.

        Access Level: List

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListMapRuns.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toListMapRuns", []))

    @jsii.member(jsii_name="toListStateMachines")
    def to_list_state_machines(self) -> "States":
        '''(experimental) Grants permission to lists the existing state machines.

        Access Level: List

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListStateMachines.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toListStateMachines", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "States":
        '''(experimental) Grants permission to list tags for an AWS Step Functions resource.

        Access Level: Read

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toSendTaskFailure")
    def to_send_task_failure(self) -> "States":
        '''(experimental) Grants permission to report that the task identified by the taskToken failed.

        Access Level: Write

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_SendTaskFailure.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toSendTaskFailure", []))

    @jsii.member(jsii_name="toSendTaskHeartbeat")
    def to_send_task_heartbeat(self) -> "States":
        '''(experimental) Grants permission to report to the service that the task represented by the specified taskToken is still making progress.

        Access Level: Write

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_SendTaskHeartbeat.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toSendTaskHeartbeat", []))

    @jsii.member(jsii_name="toSendTaskSuccess")
    def to_send_task_success(self) -> "States":
        '''(experimental) Grants permission to report that the task identified by the taskToken completed successfully.

        Access Level: Write

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_SendTaskSuccess.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toSendTaskSuccess", []))

    @jsii.member(jsii_name="toStartExecution")
    def to_start_execution(self) -> "States":
        '''(experimental) Grants permission to start a state machine execution.

        Access Level: Write

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_StartExecution.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toStartExecution", []))

    @jsii.member(jsii_name="toStartSyncExecution")
    def to_start_sync_execution(self) -> "States":
        '''(experimental) Grants permission to start a Synchronous Express state machine execution.

        Access Level: Write

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_StartSyncExecution.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toStartSyncExecution", []))

    @jsii.member(jsii_name="toStopExecution")
    def to_stop_execution(self) -> "States":
        '''(experimental) Grants permission to stop an execution.

        Access Level: Write

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_StopExecution.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toStopExecution", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "States":
        '''(experimental) Grants permission to tag an AWS Step Functions resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "States":
        '''(experimental) Grants permission to remove a tag from an AWS Step Functions resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateMapRun")
    def to_update_map_run(self) -> "States":
        '''(experimental) Grants permission to update a map run.

        Access Level: Write

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_UpdateMapRun.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toUpdateMapRun", []))

    @jsii.member(jsii_name="toUpdateStateMachine")
    def to_update_state_machine(self) -> "States":
        '''(experimental) Grants permission to update a state machine.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/step-functions/latest/apireference/API_UpdateStateMachine.html

        :stability: experimental
        '''
        return typing.cast("States", jsii.invoke(self, "toUpdateStateMachine", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__87d9873cfbdf85187facec46fa491a94618e5df6219afd37667a4da44bf4d449)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dfa48111a0b3465c2cec6f128e505ea5ac5d780b174020b528d42c745f86481c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Storagegateway(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Storagegateway",
):
    '''(experimental) Statement provider for service `storagegateway <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsstoragegateway.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `storagegateway <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsstoragegateway.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9c3aeca01d88b90536839a962bc6d4044b9ec9887b7133a9b13398339a6bca1c)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDevice")
    def on_device(
        self,
        gateway_id: builtins.str,
        vtldevice: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Storagegateway":
        '''(experimental) Adds a resource of type device to the statement.

        https://docs.aws.amazon.com/storagegateway/latest/userguide/resource_vtl-devices.html

        :param gateway_id: - Identifier for the gatewayId.
        :param vtldevice: - Identifier for the vtldevice.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f3705bec0b19a0cc8c873674f2c77166f84cc0f2fc0d7e632a1d004ef9801082)
            check_type(argname="argument gateway_id", value=gateway_id, expected_type=type_hints["gateway_id"])
            check_type(argname="argument vtldevice", value=vtldevice, expected_type=type_hints["vtldevice"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Storagegateway", jsii.invoke(self, "onDevice", [gateway_id, vtldevice, account, region, partition]))

    @jsii.member(jsii_name="onFsAssociation")
    def on_fs_association(
        self,
        fsa_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Storagegateway":
        '''(experimental) Adds a resource of type fs-association to the statement.

        https://docs.aws.amazon.com/storagegateway/latest/userguide/API_AssociateFileSystem.html

        :param fsa_id: - Identifier for the fsaId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4dd0165acad7fd54985f5dbfc80632719f692f6ce1acd4c4a8ff76800d4aae06)
            check_type(argname="argument fsa_id", value=fsa_id, expected_type=type_hints["fsa_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Storagegateway", jsii.invoke(self, "onFsAssociation", [fsa_id, account, region, partition]))

    @jsii.member(jsii_name="onGateway")
    def on_gateway(
        self,
        gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Storagegateway":
        '''(experimental) Adds a resource of type gateway to the statement.

        https://docs.aws.amazon.com/storagegateway/latest/userguide/StorageGatewayConcepts.html

        :param gateway_id: - Identifier for the gatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__754d09fd07f00c25ba0ca22a1cee1715244821de0986e91c2a33a49a5a1630cf)
            check_type(argname="argument gateway_id", value=gateway_id, expected_type=type_hints["gateway_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Storagegateway", jsii.invoke(self, "onGateway", [gateway_id, account, region, partition]))

    @jsii.member(jsii_name="onShare")
    def on_share(
        self,
        share_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Storagegateway":
        '''(experimental) Adds a resource of type share to the statement.

        https://docs.aws.amazon.com/storagegateway/latest/userguide/GettingStartedCreateFileShare.html

        :param share_id: - Identifier for the shareId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f6b4138bc0d492321ca31c010823d6ca2b72d2a39f919ed5db2c84840903f30c)
            check_type(argname="argument share_id", value=share_id, expected_type=type_hints["share_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Storagegateway", jsii.invoke(self, "onShare", [share_id, account, region, partition]))

    @jsii.member(jsii_name="onTape")
    def on_tape(
        self,
        tape_barcode: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Storagegateway":
        '''(experimental) Adds a resource of type tape to the statement.

        https://docs.aws.amazon.com/storagegateway/latest/userguide/StorageGatewayConcepts.html#storage-gateway-vtl-concepts

        :param tape_barcode: - Identifier for the tapeBarcode.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__290e6527445ba4129d396990bd1334b7c5a4657cfbffe347fcc7bd9f947eb4cf)
            check_type(argname="argument tape_barcode", value=tape_barcode, expected_type=type_hints["tape_barcode"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Storagegateway", jsii.invoke(self, "onTape", [tape_barcode, account, region, partition]))

    @jsii.member(jsii_name="onTapepool")
    def on_tapepool(
        self,
        pool_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Storagegateway":
        '''(experimental) Adds a resource of type tapepool to the statement.

        https://docs.aws.amazon.com/storagegateway/latest/userguide/CreatingCustomTapePool.html

        :param pool_id: - Identifier for the poolId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4f2ba424417053514176bd3e3b91bfa433331fb6f6da4105fc3b6625d83fe6ed)
            check_type(argname="argument pool_id", value=pool_id, expected_type=type_hints["pool_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Storagegateway", jsii.invoke(self, "onTapepool", [pool_id, account, region, partition]))

    @jsii.member(jsii_name="onTarget")
    def on_target(
        self,
        gateway_id: builtins.str,
        iscsi_target: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Storagegateway":
        '''(experimental) Adds a resource of type target to the statement.

        https://docs.aws.amazon.com/storagegateway/latest/userguide/GettingStartedCreateVolumes.html

        :param gateway_id: - Identifier for the gatewayId.
        :param iscsi_target: - Identifier for the iscsiTarget.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eed06797c7a772a537bacc5b19c09c1b312df7e8e411a9521abf0189c5f15b22)
            check_type(argname="argument gateway_id", value=gateway_id, expected_type=type_hints["gateway_id"])
            check_type(argname="argument iscsi_target", value=iscsi_target, expected_type=type_hints["iscsi_target"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Storagegateway", jsii.invoke(self, "onTarget", [gateway_id, iscsi_target, account, region, partition]))

    @jsii.member(jsii_name="onVolume")
    def on_volume(
        self,
        gateway_id: builtins.str,
        volume_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Storagegateway":
        '''(experimental) Adds a resource of type volume to the statement.

        https://docs.aws.amazon.com/storagegateway/latest/userguide/StorageGatewayConcepts.html#volume-gateway-concepts

        :param gateway_id: - Identifier for the gatewayId.
        :param volume_id: - Identifier for the volumeId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b939d883ada70bc93a034725420fc31325fc51d4bd9fdf4794bfcf6a385984d4)
            check_type(argname="argument gateway_id", value=gateway_id, expected_type=type_hints["gateway_id"])
            check_type(argname="argument volume_id", value=volume_id, expected_type=type_hints["volume_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Storagegateway", jsii.invoke(self, "onVolume", [gateway_id, volume_id, account, region, partition]))

    @jsii.member(jsii_name="toActivateGateway")
    def to_activate_gateway(self) -> "Storagegateway":
        '''(experimental) Grants permission to activate the gateway you previously deployed on your host.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ActivateGateway.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toActivateGateway", []))

    @jsii.member(jsii_name="toAddCache")
    def to_add_cache(self) -> "Storagegateway":
        '''(experimental) Grants permission to configure one or more gateway local disks as cache for a cached-volume gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_AddCache.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toAddCache", []))

    @jsii.member(jsii_name="toAddTagsToResource")
    def to_add_tags_to_resource(self) -> "Storagegateway":
        '''(experimental) Grants permission to add one or more tags to the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_AddTagsToResource.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toAddTagsToResource", []))

    @jsii.member(jsii_name="toAddUploadBuffer")
    def to_add_upload_buffer(self) -> "Storagegateway":
        '''(experimental) Grants permission to configure one or more gateway local disks as upload buffer for a specified gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_AddUploadBuffer.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toAddUploadBuffer", []))

    @jsii.member(jsii_name="toAddWorkingStorage")
    def to_add_working_storage(self) -> "Storagegateway":
        '''(experimental) Grants permission to configure one or more gateway local disks as working storage for a gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_AddWorkingStorage.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toAddWorkingStorage", []))

    @jsii.member(jsii_name="toAssignTapePool")
    def to_assign_tape_pool(self) -> "Storagegateway":
        '''(experimental) Grants permission to move a tape to the target pool specified.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_AssignTapePool.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toAssignTapePool", []))

    @jsii.member(jsii_name="toAssociateFileSystem")
    def to_associate_file_system(self) -> "Storagegateway":
        '''(experimental) Grants permission to associate an Amazon FSx file system with the Amazon FSx file gateway.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ds:DescribeDirectories
        - ec2:DescribeNetworkInterfaces
        - fsx:DescribeFileSystems
        - iam:CreateServiceLinkedRole
        - logs:CreateLogDelivery
        - logs:GetLogDelivery
        - logs:ListLogDeliveries
        - logs:UpdateLogDelivery

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_AssociateFileSystem.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toAssociateFileSystem", []))

    @jsii.member(jsii_name="toAttachVolume")
    def to_attach_volume(self) -> "Storagegateway":
        '''(experimental) Grants permission to connect a volume to an iSCSI connection and then attaches the volume to the specified gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_AttachVolume.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toAttachVolume", []))

    @jsii.member(jsii_name="toBypassGovernanceRetention")
    def to_bypass_governance_retention(self) -> "Storagegateway":
        '''(experimental) Grants permission to allow the governance retention lock on a pool to be bypassed.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/userguide/CreatingCustomTapePool.html#TapeRetentionLock

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toBypassGovernanceRetention", []))

    @jsii.member(jsii_name="toCancelArchival")
    def to_cancel_archival(self) -> "Storagegateway":
        '''(experimental) Grants permission to cancel archiving of a virtual tape to the virtual tape shelf (VTS) after the archiving process is initiated.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CancelArchival.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCancelArchival", []))

    @jsii.member(jsii_name="toCancelRetrieval")
    def to_cancel_retrieval(self) -> "Storagegateway":
        '''(experimental) Grants permission to cancel retrieval of a virtual tape from the virtual tape shelf (VTS) to a gateway after the retrieval process is initiated.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CancelRetrieval.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCancelRetrieval", []))

    @jsii.member(jsii_name="toCreateCachediSCSIVolume")
    def to_create_cachedi_scsi_volume(self) -> "Storagegateway":
        '''(experimental) Grants permission to create a cached volume on a specified cached gateway.

        This operation is supported only for the gateway-cached volume architecture

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateCachediSCSIVolume.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCreateCachediSCSIVolume", []))

    @jsii.member(jsii_name="toCreateNFSFileShare")
    def to_create_nfs_file_share(self) -> "Storagegateway":
        '''(experimental) Grants permission to create a NFS file share on an existing file gateway.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateNFSFileShare.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCreateNFSFileShare", []))

    @jsii.member(jsii_name="toCreateSMBFileShare")
    def to_create_smb_file_share(self) -> "Storagegateway":
        '''(experimental) Grants permission to create a SMB file share on an existing file gateway.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateSMBFileShare.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCreateSMBFileShare", []))

    @jsii.member(jsii_name="toCreateSnapshot")
    def to_create_snapshot(self) -> "Storagegateway":
        '''(experimental) Grants permission to initiate a snapshot of a volume.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCreateSnapshot", []))

    @jsii.member(jsii_name="toCreateSnapshotFromVolumeRecoveryPoint")
    def to_create_snapshot_from_volume_recovery_point(self) -> "Storagegateway":
        '''(experimental) Grants permission to initiate a snapshot of a gateway from a volume recovery point.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateSnapshotFromVolumeRecoveryPoint.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCreateSnapshotFromVolumeRecoveryPoint", []))

    @jsii.member(jsii_name="toCreateStorediSCSIVolume")
    def to_create_storedi_scsi_volume(self) -> "Storagegateway":
        '''(experimental) Grants permission to create a volume on a specified gateway.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateStorediSCSIVolume.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCreateStorediSCSIVolume", []))

    @jsii.member(jsii_name="toCreateTapePool")
    def to_create_tape_pool(self) -> "Storagegateway":
        '''(experimental) Grants permission to create a tape pool.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateTapePool.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCreateTapePool", []))

    @jsii.member(jsii_name="toCreateTapes")
    def to_create_tapes(self) -> "Storagegateway":
        '''(experimental) Grants permission to create one or more virtual tapes.

        You write data to the virtual tapes and then archive the tapes

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateTapes.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCreateTapes", []))

    @jsii.member(jsii_name="toCreateTapeWithBarcode")
    def to_create_tape_with_barcode(self) -> "Storagegateway":
        '''(experimental) Grants permission to create a virtual tape by using your own barcode.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_CreateTapeWithBarcode.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toCreateTapeWithBarcode", []))

    @jsii.member(jsii_name="toDeleteAutomaticTapeCreationPolicy")
    def to_delete_automatic_tape_creation_policy(self) -> "Storagegateway":
        '''(experimental) Grants permission to delete the automatic tape creation policy configured on a gateway-VTL.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DeleteAutomaticTapeCreationPolicy.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDeleteAutomaticTapeCreationPolicy", []))

    @jsii.member(jsii_name="toDeleteBandwidthRateLimit")
    def to_delete_bandwidth_rate_limit(self) -> "Storagegateway":
        '''(experimental) Grants permission to delete the bandwidth rate limits of a gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DeleteBandwidthRateLimit.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDeleteBandwidthRateLimit", []))

    @jsii.member(jsii_name="toDeleteChapCredentials")
    def to_delete_chap_credentials(self) -> "Storagegateway":
        '''(experimental) Grants permission to delete Challenge-Handshake Authentication Protocol (CHAP) credentials for a specified iSCSI target and initiator pair.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DeleteChapCredentials.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDeleteChapCredentials", []))

    @jsii.member(jsii_name="toDeleteFileShare")
    def to_delete_file_share(self) -> "Storagegateway":
        '''(experimental) Grants permission to delete a file share from a file gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DeleteFileShare.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDeleteFileShare", []))

    @jsii.member(jsii_name="toDeleteGateway")
    def to_delete_gateway(self) -> "Storagegateway":
        '''(experimental) Grants permission to delete a gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DeleteGateway.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDeleteGateway", []))

    @jsii.member(jsii_name="toDeleteSnapshotSchedule")
    def to_delete_snapshot_schedule(self) -> "Storagegateway":
        '''(experimental) Grants permission to delete a snapshot of a volume.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DeleteSnapshotSchedule.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDeleteSnapshotSchedule", []))

    @jsii.member(jsii_name="toDeleteTape")
    def to_delete_tape(self) -> "Storagegateway":
        '''(experimental) Grants permission to delete the specified virtual tape.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DeleteTape.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDeleteTape", []))

    @jsii.member(jsii_name="toDeleteTapeArchive")
    def to_delete_tape_archive(self) -> "Storagegateway":
        '''(experimental) Grants permission to delete the specified virtual tape from the virtual tape shelf (VTS).

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DeleteTapeArchive.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDeleteTapeArchive", []))

    @jsii.member(jsii_name="toDeleteTapePool")
    def to_delete_tape_pool(self) -> "Storagegateway":
        '''(experimental) Grants permission to delete the specified tape pool.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DeleteTapePool.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDeleteTapePool", []))

    @jsii.member(jsii_name="toDeleteVolume")
    def to_delete_volume(self) -> "Storagegateway":
        '''(experimental) Grants permission to delete the specified gateway volume that you previously created using the CreateCachediSCSIVolume or CreateStorediSCSIVolume API.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DeleteVolume.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDeleteVolume", []))

    @jsii.member(jsii_name="toDescribeAvailabilityMonitorTest")
    def to_describe_availability_monitor_test(self) -> "Storagegateway":
        '''(experimental) Grants permission to get the information about the most recent high availability monitoring test that was performed on the gateway.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeAvailabilityMonitorTest.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeAvailabilityMonitorTest", []))

    @jsii.member(jsii_name="toDescribeBandwidthRateLimit")
    def to_describe_bandwidth_rate_limit(self) -> "Storagegateway":
        '''(experimental) Grants permission to get the bandwidth rate limits of a gateway.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeBandwidthRateLimit.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeBandwidthRateLimit", []))

    @jsii.member(jsii_name="toDescribeBandwidthRateLimitSchedule")
    def to_describe_bandwidth_rate_limit_schedule(self) -> "Storagegateway":
        '''(experimental) Grants permission to get the bandwidth rate limit schedule of a gateway.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeBandwidthRateLimitSchedule.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeBandwidthRateLimitSchedule", []))

    @jsii.member(jsii_name="toDescribeCache")
    def to_describe_cache(self) -> "Storagegateway":
        '''(experimental) Grants permission to get information about the cache of a gateway.

        This operation is supported only for the gateway-cached volume architecture

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeCache.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeCache", []))

    @jsii.member(jsii_name="toDescribeCachediSCSIVolumes")
    def to_describe_cachedi_scsi_volumes(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a description of the gateway volumes specified in the request.

        This operation is supported only for the gateway-cached volume architecture

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeCachediSCSIVolumes.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeCachediSCSIVolumes", []))

    @jsii.member(jsii_name="toDescribeChapCredentials")
    def to_describe_chap_credentials(self) -> "Storagegateway":
        '''(experimental) Grants permission to get an array of Challenge-Handshake Authentication Protocol (CHAP) credentials information for a specified iSCSI target, one for each target-initiator pair.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeChapCredentials.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeChapCredentials", []))

    @jsii.member(jsii_name="toDescribeFileSystemAssociations")
    def to_describe_file_system_associations(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a description for one or more file system associations.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeFileSystemAssociations.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeFileSystemAssociations", []))

    @jsii.member(jsii_name="toDescribeGatewayInformation")
    def to_describe_gateway_information(self) -> "Storagegateway":
        '''(experimental) Grants permission to get metadata about a gateway such as its name, network interfaces, configured time zone, and the state (whether the gateway is running or not).

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeGatewayInformation.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeGatewayInformation", []))

    @jsii.member(jsii_name="toDescribeMaintenanceStartTime")
    def to_describe_maintenance_start_time(self) -> "Storagegateway":
        '''(experimental) Grants permission to get your gateway's weekly maintenance start time including the day and time of the week.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeMaintenanceStartTime.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeMaintenanceStartTime", []))

    @jsii.member(jsii_name="toDescribeNFSFileShares")
    def to_describe_nfs_file_shares(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a description for one or more file shares from a file gateway.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeNFSFileShares.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeNFSFileShares", []))

    @jsii.member(jsii_name="toDescribeSMBFileShares")
    def to_describe_smb_file_shares(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a description for one or more file shares from a file gateway.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeSMBFileShares.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeSMBFileShares", []))

    @jsii.member(jsii_name="toDescribeSMBSettings")
    def to_describe_smb_settings(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a description of a Server Message Block (SMB) file share settings from a file gateway.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeSMBSettings.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeSMBSettings", []))

    @jsii.member(jsii_name="toDescribeSnapshotSchedule")
    def to_describe_snapshot_schedule(self) -> "Storagegateway":
        '''(experimental) Grants permission to describe the snapshot schedule for the specified gateway volume.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeSnapshotSchedule.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeSnapshotSchedule", []))

    @jsii.member(jsii_name="toDescribeStorediSCSIVolumes")
    def to_describe_storedi_scsi_volumes(self) -> "Storagegateway":
        '''(experimental) Grants permission to get the description of the gateway volumes specified in the request.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeStorediSCSIVolumes.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeStorediSCSIVolumes", []))

    @jsii.member(jsii_name="toDescribeTapeArchives")
    def to_describe_tape_archives(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a description of specified virtual tapes in the virtual tape shelf (VTS).

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeTapeArchives.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeTapeArchives", []))

    @jsii.member(jsii_name="toDescribeTapeRecoveryPoints")
    def to_describe_tape_recovery_points(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a list of virtual tape recovery points that are available for the specified gateway-VTL.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeTapeRecoveryPoints.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeTapeRecoveryPoints", []))

    @jsii.member(jsii_name="toDescribeTapes")
    def to_describe_tapes(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a description of the specified Amazon Resource Name (ARN) of virtual tapes.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeTapes.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeTapes", []))

    @jsii.member(jsii_name="toDescribeUploadBuffer")
    def to_describe_upload_buffer(self) -> "Storagegateway":
        '''(experimental) Grants permission to get information about the upload buffer of a gateway.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeUploadBuffer.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeUploadBuffer", []))

    @jsii.member(jsii_name="toDescribeVTLDevices")
    def to_describe_vtl_devices(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a description of virtual tape library (VTL) devices for the specified gateway.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeVTLDevices.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeVTLDevices", []))

    @jsii.member(jsii_name="toDescribeWorkingStorage")
    def to_describe_working_storage(self) -> "Storagegateway":
        '''(experimental) Grants permission to get information about the working storage of a gateway.

        Access Level: Read

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DescribeWorkingStorage.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDescribeWorkingStorage", []))

    @jsii.member(jsii_name="toDetachVolume")
    def to_detach_volume(self) -> "Storagegateway":
        '''(experimental) Grants permission to disconnect a volume from an iSCSI connection and then detaches the volume from the specified gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DetachVolume.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDetachVolume", []))

    @jsii.member(jsii_name="toDisableGateway")
    def to_disable_gateway(self) -> "Storagegateway":
        '''(experimental) Grants permission to disable a gateway when the gateway is no longer functioning.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DisableGateway.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDisableGateway", []))

    @jsii.member(jsii_name="toDisassociateFileSystem")
    def to_disassociate_file_system(self) -> "Storagegateway":
        '''(experimental) Grants permission to disassociate an Amazon FSx file system from an Amazon FSx file gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_DisassociateFileSystem.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toDisassociateFileSystem", []))

    @jsii.member(jsii_name="toJoinDomain")
    def to_join_domain(self) -> "Storagegateway":
        '''(experimental) Grants permission to enable you to join an Active Directory Domain.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_JoinDomain.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toJoinDomain", []))

    @jsii.member(jsii_name="toListAutomaticTapeCreationPolicies")
    def to_list_automatic_tape_creation_policies(self) -> "Storagegateway":
        '''(experimental) Grants permission to list the automatic tape creation policies configured on the specified gateway-VTL or all gateway-VTLs owned by your account.

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListAutomaticTapeCreationPolicies.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListAutomaticTapeCreationPolicies", []))

    @jsii.member(jsii_name="toListFileShares")
    def to_list_file_shares(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a list of the file shares for a specific file gateway, or the list of file shares that belong to the calling user account.

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListFileShares.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListFileShares", []))

    @jsii.member(jsii_name="toListFileSystemAssociations")
    def to_list_file_system_associations(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a list of the file system associations for the specified gateway.

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListFileSystemAssociations.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListFileSystemAssociations", []))

    @jsii.member(jsii_name="toListGateways")
    def to_list_gateways(self) -> "Storagegateway":
        '''(experimental) Grants permission to list gateways owned by an AWS account in a region specified in the request.

        The returned list is ordered by gateway Amazon Resource Name (ARN)

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListGateways.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListGateways", []))

    @jsii.member(jsii_name="toListLocalDisks")
    def to_list_local_disks(self) -> "Storagegateway":
        '''(experimental) Grants permission to get a list of the gateway's local disks.

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListLocalDisks.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListLocalDisks", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Storagegateway":
        '''(experimental) Grants permission to get the tags that have been added to the specified resource.

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTapePools")
    def to_list_tape_pools(self) -> "Storagegateway":
        '''(experimental) Grants permission to list tape pools owned by your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListTapePools.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListTapePools", []))

    @jsii.member(jsii_name="toListTapes")
    def to_list_tapes(self) -> "Storagegateway":
        '''(experimental) Grants permission to list virtual tapes in your virtual tape library (VTL) and your virtual tape shelf (VTS).

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListTapes.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListTapes", []))

    @jsii.member(jsii_name="toListVolumeInitiators")
    def to_list_volume_initiators(self) -> "Storagegateway":
        '''(experimental) Grants permission to list iSCSI initiators that are connected to a volume.

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListVolumeInitiators.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListVolumeInitiators", []))

    @jsii.member(jsii_name="toListVolumeRecoveryPoints")
    def to_list_volume_recovery_points(self) -> "Storagegateway":
        '''(experimental) Grants permission to list the recovery points for a specified gateway.

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListVolumeRecoveryPoints.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListVolumeRecoveryPoints", []))

    @jsii.member(jsii_name="toListVolumes")
    def to_list_volumes(self) -> "Storagegateway":
        '''(experimental) Grants permission to list the iSCSI stored volumes of a gateway.

        Access Level: List

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ListVolumes.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toListVolumes", []))

    @jsii.member(jsii_name="toNotifyWhenUploaded")
    def to_notify_when_uploaded(self) -> "Storagegateway":
        '''(experimental) Grants permission to send you a notification through CloudWatch Events when all files written to your NFS file share have been uploaded to Amazon S3.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_NotifyWhenUploaded.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toNotifyWhenUploaded", []))

    @jsii.member(jsii_name="toRefreshCache")
    def to_refresh_cache(self) -> "Storagegateway":
        '''(experimental) Grants permission to refresh the cache for the specified file share.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_RefreshCache.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toRefreshCache", []))

    @jsii.member(jsii_name="toRemoveTagsFromResource")
    def to_remove_tags_from_resource(self) -> "Storagegateway":
        '''(experimental) Grants permission to remove one or more tags from the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_RemoveTagsFromResource.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toRemoveTagsFromResource", []))

    @jsii.member(jsii_name="toResetCache")
    def to_reset_cache(self) -> "Storagegateway":
        '''(experimental) Grants permission to reset all cache disks that have encountered a error and makes the disks available for reconfiguration as cache storage.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ResetCache.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toResetCache", []))

    @jsii.member(jsii_name="toRetrieveTapeArchive")
    def to_retrieve_tape_archive(self) -> "Storagegateway":
        '''(experimental) Grants permission to retrieve an archived virtual tape from the virtual tape shelf (VTS) to a gateway-VTL.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_RetrieveTapeArchive.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toRetrieveTapeArchive", []))

    @jsii.member(jsii_name="toRetrieveTapeRecoveryPoint")
    def to_retrieve_tape_recovery_point(self) -> "Storagegateway":
        '''(experimental) Grants permission to retrieve the recovery point for the specified virtual tape.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_RetrieveTapeRecoveryPoint.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toRetrieveTapeRecoveryPoint", []))

    @jsii.member(jsii_name="toSetLocalConsolePassword")
    def to_set_local_console_password(self) -> "Storagegateway":
        '''(experimental) Grants permission to set the password for your VM local console.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_SetLocalConsolePassword.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toSetLocalConsolePassword", []))

    @jsii.member(jsii_name="toSetSMBGuestPassword")
    def to_set_smb_guest_password(self) -> "Storagegateway":
        '''(experimental) Grants permission to set the password for SMB Guest user.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_SetSMBGuestPassword.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toSetSMBGuestPassword", []))

    @jsii.member(jsii_name="toShutdownGateway")
    def to_shutdown_gateway(self) -> "Storagegateway":
        '''(experimental) Grants permission to shut down a gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_ShutdownGateway.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toShutdownGateway", []))

    @jsii.member(jsii_name="toStartAvailabilityMonitorTest")
    def to_start_availability_monitor_test(self) -> "Storagegateway":
        '''(experimental) Grants permission to start a test that verifies that the specified gateway is configured for High Availability monitoring in your host environment.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_StartAvailabilityMonitorTest.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toStartAvailabilityMonitorTest", []))

    @jsii.member(jsii_name="toStartGateway")
    def to_start_gateway(self) -> "Storagegateway":
        '''(experimental) Grants permission to start a gateway that you previously shut down.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_StartGateway.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toStartGateway", []))

    @jsii.member(jsii_name="toUpdateAutomaticTapeCreationPolicy")
    def to_update_automatic_tape_creation_policy(self) -> "Storagegateway":
        '''(experimental) Grants permission to update the automatic tape creation policy configured on a gateway-VTL.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateAutomaticTapeCreationPolicy.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateAutomaticTapeCreationPolicy", []))

    @jsii.member(jsii_name="toUpdateBandwidthRateLimit")
    def to_update_bandwidth_rate_limit(self) -> "Storagegateway":
        '''(experimental) Grants permission to update the bandwidth rate limits of a gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateBandwidthRateLimit.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateBandwidthRateLimit", []))

    @jsii.member(jsii_name="toUpdateBandwidthRateLimitSchedule")
    def to_update_bandwidth_rate_limit_schedule(self) -> "Storagegateway":
        '''(experimental) Grants permission to update the bandwidth rate limit schedule of a gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateBandwidthRateLimitSchedule.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateBandwidthRateLimitSchedule", []))

    @jsii.member(jsii_name="toUpdateChapCredentials")
    def to_update_chap_credentials(self) -> "Storagegateway":
        '''(experimental) Grants permission to update the Challenge-Handshake Authentication Protocol (CHAP) credentials for a specified iSCSI target.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateChapCredentials.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateChapCredentials", []))

    @jsii.member(jsii_name="toUpdateFileSystemAssociation")
    def to_update_file_system_association(self) -> "Storagegateway":
        '''(experimental) Grants permission to update a file system association.

        Access Level: Write

        Dependent actions:

        - logs:CreateLogDelivery
        - logs:DeleteLogDelivery
        - logs:GetLogDelivery
        - logs:ListLogDeliveries
        - logs:UpdateLogDelivery

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateFileSystemAssociation.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateFileSystemAssociation", []))

    @jsii.member(jsii_name="toUpdateGatewayInformation")
    def to_update_gateway_information(self) -> "Storagegateway":
        '''(experimental) Grants permission to update a gateway's metadata, which includes the gateway's name and time zone.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateGatewayInformation.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateGatewayInformation", []))

    @jsii.member(jsii_name="toUpdateGatewaySoftwareNow")
    def to_update_gateway_software_now(self) -> "Storagegateway":
        '''(experimental) Grants permission to update the gateway virtual machine (VM) software.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateGatewaySoftwareNow.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateGatewaySoftwareNow", []))

    @jsii.member(jsii_name="toUpdateMaintenanceStartTime")
    def to_update_maintenance_start_time(self) -> "Storagegateway":
        '''(experimental) Grants permission to update a gateway's weekly maintenance start time information, including day and time of the week.

        The maintenance time is the time in your gateway's time zone

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateMaintenanceStartTime.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateMaintenanceStartTime", []))

    @jsii.member(jsii_name="toUpdateNFSFileShare")
    def to_update_nfs_file_share(self) -> "Storagegateway":
        '''(experimental) Grants permission to update a NFS file share.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateNFSFileShare.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateNFSFileShare", []))

    @jsii.member(jsii_name="toUpdateSMBFileShare")
    def to_update_smb_file_share(self) -> "Storagegateway":
        '''(experimental) Grants permission to update a SMB file share.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateSMBFileShare.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateSMBFileShare", []))

    @jsii.member(jsii_name="toUpdateSMBFileShareVisibility")
    def to_update_smb_file_share_visibility(self) -> "Storagegateway":
        '''(experimental) Grants permission to update whether the shares on a gateway are visible in a net view or browse list.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateSMBFileShareVisibility.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateSMBFileShareVisibility", []))

    @jsii.member(jsii_name="toUpdateSMBLocalGroups")
    def to_update_smb_local_groups(self) -> "Storagegateway":
        '''(experimental) Grants permission to update the list of Active Directory users and groups that have special permissions for SMB file shares on the gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateSMBLocalGroups.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateSMBLocalGroups", []))

    @jsii.member(jsii_name="toUpdateSMBSecurityStrategy")
    def to_update_smb_security_strategy(self) -> "Storagegateway":
        '''(experimental) Grants permission to update the SMB security strategy on a file gateway.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateSMBSecurityStrategy.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateSMBSecurityStrategy", []))

    @jsii.member(jsii_name="toUpdateSnapshotSchedule")
    def to_update_snapshot_schedule(self) -> "Storagegateway":
        '''(experimental) Grants permission to update a snapshot schedule configured for a gateway volume.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateSnapshotSchedule.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateSnapshotSchedule", []))

    @jsii.member(jsii_name="toUpdateVTLDeviceType")
    def to_update_vtl_device_type(self) -> "Storagegateway":
        '''(experimental) Grants permission to update the type of medium changer in a gateway-VTL.

        Access Level: Write

        https://docs.aws.amazon.com/storagegateway/latest/APIReference/API_UpdateVTLDeviceType.html

        :stability: experimental
        '''
        return typing.cast("Storagegateway", jsii.invoke(self, "toUpdateVTLDeviceType", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__624ac004b79de488a735dc28b99c40109dae9abadde957c06a478a6cde0ee75e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6bdad3bd6ed61feb8e92d788c9dfca5cdbed68ac2821485015452809f74134e0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Sts(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Sts"):
    '''(experimental) Statement provider for service `sts <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssecuritytokenservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sts <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssecuritytokenservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__86e170b56bd3a15c7143c1e29f676d302d10480b8c95be9866db5a5e9d47e758)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAmazonAppId")
    def if_amazon_app_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the Login with Amazon application ID.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_id

        Applies to actions:

        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d4dea5fb5f8cd93353f5ccf2006653ef2d8fc926a945e4bc5d16474bd9043c52)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifAmazonAppId", [value, operator]))

    @jsii.member(jsii_name="ifAmazonUserId")
    def if_amazon_user_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the Login with Amazon user ID.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_id

        Applies to actions:

        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8e6725f230c6c875e30b5562b4774ff1a66746857730bb4c3396078f00acf952)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifAmazonUserId", [value, operator]))

    @jsii.member(jsii_name="ifAWSServiceName")
    def if_aws_service_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the service that is obtaining a bearer token.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_awsservicename

        Applies to actions:

        - .toGetServiceBearerToken()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__80fc49431fb3c404f8c2dc22277c0cee68e4a616cd02b4a7fb5c13a278fe45e6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifAWSServiceName", [value, operator]))

    @jsii.member(jsii_name="ifCognitoAmr")
    def if_cognito_amr(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the login information for Amazon Cognito.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_amr

        Applies to actions:

        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d41dab24468618589a7a45f9d2fe0fa567e02e703c8f4c935a67de4cbd197d75)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifCognitoAmr", [value, operator]))

    @jsii.member(jsii_name="ifCognitoAud")
    def if_cognito_aud(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the Amazon Cognito identity pool ID.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_aud

        Applies to actions:

        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9613326b8506bb94417ca35ecc47e23c583842939f8eee1a3ff84cd4da2e9f61)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifCognitoAud", [value, operator]))

    @jsii.member(jsii_name="ifCognitoSub")
    def if_cognito_sub(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the subject of the claim (the Amazon Cognito user ID).

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_sub

        Applies to actions:

        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d26ac9a1d2229cf5de57c1dee38992fcbee5ecd4c10665875da2885630ab2e0f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifCognitoSub", [value, operator]))

    @jsii.member(jsii_name="ifExternalId")
    def if_external_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the unique identifier required when you assume a role in another account.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_externalid

        Applies to actions:

        - .toAssumeRole()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__58033881b816cf03cd91fe2d4377ffc19c642e3f8747fc47a90301eca9ac7be2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifExternalId", [value, operator]))

    @jsii.member(jsii_name="ifFacebookAppId")
    def if_facebook_app_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the Facebook application ID.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_id

        Applies to actions:

        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9ddbdf61f3b746862785cb87f5a34889697fd1543d74221c5a33355a4598f3ce)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifFacebookAppId", [value, operator]))

    @jsii.member(jsii_name="ifFacebookId")
    def if_facebook_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the Facebook user ID.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_id

        Applies to actions:

        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ed77f7dd92e58c7e561e2b08384e270f8d317b25764c55ae350b84decf89c7cf)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifFacebookId", [value, operator]))

    @jsii.member(jsii_name="ifGoogleAud")
    def if_google_aud(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the Google application ID.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_aud

        Applies to actions:

        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1a39288a20bd0992caf1e14ee9a4dc1417fbb45b706cf187be9081f0436df352)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifGoogleAud", [value, operator]))

    @jsii.member(jsii_name="ifGoogleOaud")
    def if_google_oaud(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the Google audience.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_oaud

        Applies to actions:

        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ef185aa1c2330a9cdebed47e2dc2f25f6eeb749684c0a09abcf744d5934dd785)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifGoogleOaud", [value, operator]))

    @jsii.member(jsii_name="ifGoogleSub")
    def if_google_sub(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the subject of the claim (the Google user ID).

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_sub

        Applies to actions:

        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7c5024da0f6a7450c4110cde370ca0e7a028e151ad5b68b7cac2fb243e1e562c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifGoogleSub", [value, operator]))

    @jsii.member(jsii_name="ifIamResourceTag")
    def if_iam_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the tags that are attached to the role that is being assumed.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_ResourceTag

        Applies to actions:

        - .toAssumeRole()

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4751655c11baeee8911ec1dba9af835a411a98069116e6de3a803d241f894c49)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifIamResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifRoleSessionName")
    def if_role_session_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the role session name required when you assume a role.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_rolesessionname

        Applies to actions:

        - .toAssumeRole()
        - .toAssumeRoleWithSAML()
        - .toAssumeRoleWithWebIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fd2897ec1e6ede668d3db6593bc41b4c76efdcff066b36ef6c159e129bead359)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifRoleSessionName", [value, operator]))

    @jsii.member(jsii_name="ifSamlAud")
    def if_saml_aud(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the endpoint URL to which SAML assertions are presented.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_aud

        Applies to actions:

        - .toAssumeRoleWithSAML()
        - .toTagSession()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7e6cc41b9ae285697ba05f96b9f2c45f278c23eaf6990a4f89ebb57914eee537)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlAud", [value, operator]))

    @jsii.member(jsii_name="ifSamlCn")
    def if_saml_cn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the eduOrg attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_cn

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5a246586d4a47e7c8c472ea8fbe7f298308e4eae0bed4f08735dcfbcd6d36103)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlCn", [value, operator]))

    @jsii.member(jsii_name="ifSamlCommonName")
    def if_saml_common_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the commonName attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_commonname

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f73de92cbc62d86829fdf56f54beb68287fd51146d8491ccf2654e2f0259b6bc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlCommonName", [value, operator]))

    @jsii.member(jsii_name="ifSamlDoc")
    def if_saml_doc(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by on the principal that was used to assume the role.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_doc

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__119f4ef398ada60b80718a14f0ff8f7ff6d605055ae3037fd3d9f1056f48a8dc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlDoc", [value, operator]))

    @jsii.member(jsii_name="ifSamlEduorghomepageuri")
    def if_saml_eduorghomepageuri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the eduOrg attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_eduorghomepageuri

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c18ff4e47b571b9b521ee344ccf390062475dacaf971a6a27729423d1e317935)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEduorghomepageuri", [value, operator]))

    @jsii.member(jsii_name="ifSamlEduorgidentityauthnpolicyuri")
    def if_saml_eduorgidentityauthnpolicyuri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the eduOrg attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_aud

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0e5c2c792cb26c5833dfebbdb60a3662beb1abfae5415c34a2d82df5399d7ae9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEduorgidentityauthnpolicyuri", [value, operator]))

    @jsii.member(jsii_name="ifSamlEduorglegalname")
    def if_saml_eduorglegalname(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the eduOrg attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_eduorglegalname

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__097107d31340096dee938186a1394aa944cef8e425f4b3101ed6f6f00bc850f8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEduorglegalname", [value, operator]))

    @jsii.member(jsii_name="ifSamlEduorgsuperioruri")
    def if_saml_eduorgsuperioruri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the eduOrg attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_eduorgsuperioruri

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__28fe106fa961c346331008e48c8648cc036e739f9ebc459cf6a5977039fc17cf)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEduorgsuperioruri", [value, operator]))

    @jsii.member(jsii_name="ifSamlEduorgwhitepagesuri")
    def if_saml_eduorgwhitepagesuri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the eduOrg attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_eduorgwhitepagesuri

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e00d8fa17cf7675f5a2aab7603d1e68d20cacb4c9f80187579838be8234d295b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEduorgwhitepagesuri", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersonaffiliation")
    def if_saml_edupersonaffiliation(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersonaffiliation

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4b56c9d23932256637837ba0e00e3c217642fbefdfacbfa85d694242089163ea)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersonaffiliation", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersonassurance")
    def if_saml_edupersonassurance(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersonassurance

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8fd070e199c8d4d948a364af1585418ed8216267987cb3f2320eaf7cd3f0e96d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersonassurance", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersonentitlement")
    def if_saml_edupersonentitlement(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersonentitlement

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cf0c6ddda289a88b108d90713a468ad7ff905587f4d32fb8539a4541735576a7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersonentitlement", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersonnickname")
    def if_saml_edupersonnickname(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersonnickname

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3be76b5a622b89d650aee6ad081bc2f72100eafb6d78fdb54bd98e95071b27a2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersonnickname", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersonorgdn")
    def if_saml_edupersonorgdn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersonorgdn

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e2def24883e16b11b1c7f4e1b6aeafa31bb701bbb792f28b33833ceaaa6b6e14)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersonorgdn", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersonorgunitdn")
    def if_saml_edupersonorgunitdn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersonorgunitdn

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0a4b9c8ef93daf99263415b1787025c7939133c6aed81a65f4071fe599dc3761)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersonorgunitdn", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersonprimaryaffiliation")
    def if_saml_edupersonprimaryaffiliation(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersonprimaryaffiliation

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__40927177ed01317019d4346c0f3a59e4ce83c2e5c6b563d83efdac8465f111e2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersonprimaryaffiliation", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersonprimaryorgunitdn")
    def if_saml_edupersonprimaryorgunitdn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersonprimaryorgunitdn

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__aeb67f5368baf9421cb4234c2c42937f7139b84fb2a09e1756e0a95942b78858)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersonprimaryorgunitdn", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersonprincipalname")
    def if_saml_edupersonprincipalname(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersonprincipalname

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ce9474e89919cd0c15f3b7c7128e1d7a94d57922b51ea4076547a679dbfda28b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersonprincipalname", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersonscopedaffiliation")
    def if_saml_edupersonscopedaffiliation(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersonscopedaffiliation

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7bb522bcfa7ce1ef9eff5880794b44ab61392fc968f3ca987b4683cca3b5d02f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersonscopedaffiliation", [value, operator]))

    @jsii.member(jsii_name="ifSamlEdupersontargetedid")
    def if_saml_edupersontargetedid(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the eduPerson attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_edupersontargetedid

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9cc9cef74dbd4eaa87838f37d9ea514f1daefd3d66287b13976343041bb541ad)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlEdupersontargetedid", [value, operator]))

    @jsii.member(jsii_name="ifSamlGivenName")
    def if_saml_given_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the givenName attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_givenname

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fc3582cf863121fef55d0e223fb7708753fb6392a9dcb1340678eed309104dab)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlGivenName", [value, operator]))

    @jsii.member(jsii_name="ifSamlIss")
    def if_saml_iss(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by on the issuer, which is represented by a URN.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_iss

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9676d5ef1d2d61698b96b5f2a827a843cc1211587c9c67723660bf4334e644d2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlIss", [value, operator]))

    @jsii.member(jsii_name="ifSamlMail")
    def if_saml_mail(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the mail attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_mail

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dc4620aaf2e705eef7492643d1e3be1d1c0888246740771fc8b71999ff5cdb24)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlMail", [value, operator]))

    @jsii.member(jsii_name="ifSamlName")
    def if_saml_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the name attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_name

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__90bd70bd821af043c7fe793294cafca4af1f1850ace81cc763b14f4ffbc2594f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlName", [value, operator]))

    @jsii.member(jsii_name="ifSamlNamequalifier")
    def if_saml_namequalifier(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the hash value of the issuer, account ID, and friendly name.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_namequalifier

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2fa6ff17f83e90c9034d6779b19e37a54d2deeb0e6c1798dae7c97e5fb6de71a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlNamequalifier", [value, operator]))

    @jsii.member(jsii_name="ifSamlOrganizationStatus")
    def if_saml_organization_status(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the organizationStatus attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_organizationstatus

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dbeb608be78161f55c7dd2bb6f4dffe1fa3ef69a02d66df7abcfcd6c280eef07)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlOrganizationStatus", [value, operator]))

    @jsii.member(jsii_name="ifSamlPrimaryGroupSID")
    def if_saml_primary_group_sid(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the primaryGroupSID attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_primarygroupsid

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__01f13036fd39efefad3d0e0b1868c764473ba8f41c050bfb2d904e4968caa5b4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlPrimaryGroupSID", [value, operator]))

    @jsii.member(jsii_name="ifSamlSub")
    def if_saml_sub(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the subject of the claim (the SAML user ID).

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_sub

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5725398960785bb97bd65260f913cf39c476eb7564678edcc32f0618a69c5f30)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlSub", [value, operator]))

    @jsii.member(jsii_name="ifSamlSubType")
    def if_saml_sub_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the value persistent, transient, or the full Format URI.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_subtype

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__40adba0ddeb6e4210248574a1347c35b57f08a87fbd87c6693b0a1d2362c7cd4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlSubType", [value, operator]))

    @jsii.member(jsii_name="ifSamlSurname")
    def if_saml_surname(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the surname attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_surname

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__905761b6982a83a87ada445a61d2fbcb4859b18f72a4439c61cc6c3c9f447e72)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlSurname", [value, operator]))

    @jsii.member(jsii_name="ifSamlUid")
    def if_saml_uid(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the uid attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_uid

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2b113d389bd6b42a0cd95224efa65ad56d4adefbc807187259aeb312442b7c99)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlUid", [value, operator]))

    @jsii.member(jsii_name="ifSamlX500UniqueIdentifier")
    def if_saml_x500_unique_identifier(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the uid attribute.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_x500uniqueidentifier

        Applies to actions:

        - .toAssumeRoleWithSAML()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__497da8efeb48a097a4171b058d5e7b4749e3868fe18ab12704f1672efdba3910)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSamlX500UniqueIdentifier", [value, operator]))

    @jsii.member(jsii_name="ifSourceIdentity")
    def if_source_identity(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the source identity that is passed in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_sourceidentity

        Applies to actions:

        - .toAssumeRole()
        - .toAssumeRoleWithSAML()
        - .toAssumeRoleWithWebIdentity()
        - .toSetSourceIdentity()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__101f270d955990943edb3d54190d63435f2cc26d28be1eb793c481e3cd8eb7d5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifSourceIdentity", [value, operator]))

    @jsii.member(jsii_name="ifTransitiveTagKeys")
    def if_transitive_tag_keys(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Sts":
        '''(experimental) Filters access by the transitive tag keys that are passed in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_TransitiveTagKeys

        Applies to actions:

        - .toAssumeRole()
        - .toAssumeRoleWithSAML()
        - .toAssumeRoleWithWebIdentity()
        - .toTagSession()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__800339932e78f3fd812c48d204510ab3fef77c221f0fa84752391ecef66931ac)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Sts", jsii.invoke(self, "ifTransitiveTagKeys", [value, operator]))

    @jsii.member(jsii_name="onRole")
    def on_role(
        self,
        role_name_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sts":
        '''(experimental) Adds a resource of type role to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html

        :param role_name_with_path: - Identifier for the roleNameWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__10e9461fb8138723b4aae739414da04da16bbb70a553f555d73a01fdb41f41a0)
            check_type(argname="argument role_name_with_path", value=role_name_with_path, expected_type=type_hints["role_name_with_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sts", jsii.invoke(self, "onRole", [role_name_with_path, account, partition]))

    @jsii.member(jsii_name="onUser")
    def on_user(
        self,
        user_name_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sts":
        '''(experimental) Adds a resource of type user to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html

        :param user_name_with_path: - Identifier for the userNameWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a1f9095d2b2e63ef1801b7290b6594aaf2e2e707e291bc0b2d7906cf4f496cbb)
            check_type(argname="argument user_name_with_path", value=user_name_with_path, expected_type=type_hints["user_name_with_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sts", jsii.invoke(self, "onUser", [user_name_with_path, account, partition]))

    @jsii.member(jsii_name="toAssumeRole")
    def to_assume_role(self) -> "Sts":
        '''(experimental) Grants permission to obtain a set of temporary security credentials that you can use to access AWS resources that you might not normally have access to.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifTransitiveTagKeys()
        - .ifExternalId()
        - .ifRoleSessionName()
        - .ifIamResourceTag()
        - .ifSourceIdentity()

        https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toAssumeRole", []))

    @jsii.member(jsii_name="toAssumeRoleWithSAML")
    def to_assume_role_with_saml(self) -> "Sts":
        '''(experimental) Grants permission to obtain a set of temporary security credentials for users who have been authenticated via a SAML authentication response.

        Access Level: Write

        Possible conditions:

        - .ifSamlNamequalifier()
        - .ifSamlSub()
        - .ifSamlSubType()
        - .ifSamlAud()
        - .ifSamlIss()
        - .ifSamlDoc()
        - .ifSamlCn()
        - .ifSamlCommonName()
        - .ifSamlEduorghomepageuri()
        - .ifSamlEduorgidentityauthnpolicyuri()
        - .ifSamlEduorglegalname()
        - .ifSamlEduorgsuperioruri()
        - .ifSamlEduorgwhitepagesuri()
        - .ifSamlEdupersonaffiliation()
        - .ifSamlEdupersonassurance()
        - .ifSamlEdupersonentitlement()
        - .ifSamlEdupersonnickname()
        - .ifSamlEdupersonorgdn()
        - .ifSamlEdupersonorgunitdn()
        - .ifSamlEdupersonprimaryaffiliation()
        - .ifSamlEdupersonprimaryorgunitdn()
        - .ifSamlEdupersonprincipalname()
        - .ifSamlEdupersonscopedaffiliation()
        - .ifSamlEdupersontargetedid()
        - .ifSamlGivenName()
        - .ifSamlMail()
        - .ifSamlName()
        - .ifSamlOrganizationStatus()
        - .ifSamlPrimaryGroupSID()
        - .ifSamlSurname()
        - .ifSamlUid()
        - .ifSamlX500UniqueIdentifier()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifTransitiveTagKeys()
        - .ifSourceIdentity()
        - .ifRoleSessionName()

        https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toAssumeRoleWithSAML", []))

    @jsii.member(jsii_name="toAssumeRoleWithWebIdentity")
    def to_assume_role_with_web_identity(self) -> "Sts":
        '''(experimental) Grants permission to obtain a set of temporary security credentials for users who have been authenticated in a mobile or web application with a web identity provider.

        Access Level: Write

        Possible conditions:

        - .ifCognitoAmr()
        - .ifCognitoAud()
        - .ifCognitoSub()
        - .ifAmazonAppId()
        - .ifAmazonUserId()
        - .ifFacebookAppId()
        - .ifFacebookId()
        - .ifGoogleAud()
        - .ifGoogleOaud()
        - .ifGoogleSub()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifTransitiveTagKeys()
        - .ifSourceIdentity()
        - .ifRoleSessionName()

        https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toAssumeRoleWithWebIdentity", []))

    @jsii.member(jsii_name="toDecodeAuthorizationMessage")
    def to_decode_authorization_message(self) -> "Sts":
        '''(experimental) Grants permission to decode additional information about the authorization status of a request from an encoded message returned in response to an AWS request.

        Access Level: Write

        https://docs.aws.amazon.com/STS/latest/APIReference/API_DecodeAuthorizationMessage.html

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toDecodeAuthorizationMessage", []))

    @jsii.member(jsii_name="toGetAccessKeyInfo")
    def to_get_access_key_info(self) -> "Sts":
        '''(experimental) Grants permission to obtain details about the access key id passed as a parameter to the request.

        Access Level: Read

        https://docs.aws.amazon.com/STS/latest/APIReference/API_GetAccessKeyInfo.html

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toGetAccessKeyInfo", []))

    @jsii.member(jsii_name="toGetCallerIdentity")
    def to_get_caller_identity(self) -> "Sts":
        '''(experimental) Grants permission to obtain details about the IAM identity whose credentials are used to call the API.

        Access Level: Read

        https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toGetCallerIdentity", []))

    @jsii.member(jsii_name="toGetFederationToken")
    def to_get_federation_token(self) -> "Sts":
        '''(experimental) Grants permission to obtain a set of temporary security credentials (consisting of an access key ID, a secret access key, and a security token) for a federated user.

        Access Level: Read

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/STS/latest/APIReference/API_GetFederationToken.html

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toGetFederationToken", []))

    @jsii.member(jsii_name="toGetServiceBearerToken")
    def to_get_service_bearer_token(self) -> "Sts":
        '''(experimental) Grants permission to obtain a STS bearer token for an AWS root user, IAM role, or an IAM user.

        Access Level: Read

        Possible conditions:

        - .ifAWSServiceName()

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_bearer.html

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toGetServiceBearerToken", []))

    @jsii.member(jsii_name="toGetSessionToken")
    def to_get_session_token(self) -> "Sts":
        '''(experimental) Grants permission to obtain a set of temporary security credentials (consisting of an access key ID, a secret access key, and a security token) for an AWS account or IAM user.

        Access Level: Read

        https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toGetSessionToken", []))

    @jsii.member(jsii_name="toSetSourceIdentity")
    def to_set_source_identity(self) -> "Sts":
        '''(experimental) Grants permission to set a source identity on a STS session.

        Access Level: Write

        Possible conditions:

        - .ifSourceIdentity()

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html#id_credentials_temp_control-access_monitor-perms

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toSetSourceIdentity", []))

    @jsii.member(jsii_name="toTagSession")
    def to_tag_session(self) -> "Sts":
        '''(experimental) Grants permission to add tags to a STS session.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifTransitiveTagKeys()
        - .ifSamlAud()

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html

        :stability: experimental
        '''
        return typing.cast("Sts", jsii.invoke(self, "toTagSession", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5c389ee1ca374f6e575b6f61ce8ae74569e28ea4a131139cb5213d9b828fb1fa)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f9dc5225c527b4109a7a8f2e0be8d261ed0f5149821e2645cbf7633941fbddc4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Sumerian(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Sumerian",
):
    '''(experimental) Statement provider for service `sumerian <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsumerian.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sumerian <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsumerian.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2710d56d7481cb2137a67683680a49ef0ca63eee56abb66a0638dd24d3038d53)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Sumerian":
        '''(experimental) Adds a resource of type project to the statement.

        https://docs.aws.amazon.com/sumerian/latest/userguide/sumerian-concepts.html

        :param project_name: - Identifier for the projectName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c2c787ff866306980d383230807ec7cf190f1d3704145a00cf06f01a3eea7334)
            check_type(argname="argument project_name", value=project_name, expected_type=type_hints["project_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Sumerian", jsii.invoke(self, "onProject", [project_name, account, region, partition]))

    @jsii.member(jsii_name="toLogin")
    def to_login(self) -> "Sumerian":
        '''(experimental) Grants permission to log into the Sumerian console.

        Access Level: Write

        https://docs.aws.amazon.com/sumerian/latest/userguide/sumerian-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sumerian", jsii.invoke(self, "toLogin", []))

    @jsii.member(jsii_name="toViewRelease")
    def to_view_release(self) -> "Sumerian":
        '''(experimental) Grants permission to view a project release.

        Access Level: Read

        https://docs.aws.amazon.com/sumerian/latest/userguide/sumerian-permissions.html

        :stability: experimental
        '''
        return typing.cast("Sumerian", jsii.invoke(self, "toViewRelease", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__20d1f1c66dfe136039bb797d75f4cc0e20b2f58faac8351c8de8414b2c53df26)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a3d0ddb65847027cf1a4d109b4e5c0b9f1ede3bb8639560b61baed62d3ee5cdd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Support(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Support"):
    '''(experimental) Statement provider for service `support <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupport.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `support <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupport.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d9cf79fd3d670e6fed5baa91453f7d2d241b6445e1f3535d8d71c090e90d506e)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toAddAttachmentsToSet")
    def to_add_attachments_to_set(self) -> "Support":
        '''(experimental) Adds one or more attachments to an AWS Support case.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_AddAttachmentsToSet.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toAddAttachmentsToSet", []))

    @jsii.member(jsii_name="toAddCommunicationToCase")
    def to_add_communication_to_case(self) -> "Support":
        '''(experimental) Adds a customer communication to an AWS Support case.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_AddCommunicationToCase.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toAddCommunicationToCase", []))

    @jsii.member(jsii_name="toCreateCase")
    def to_create_case(self) -> "Support":
        '''(experimental) Creates a new AWS Support case.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_CreateCase.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toCreateCase", []))

    @jsii.member(jsii_name="toDescribeAttachment")
    def to_describe_attachment(self) -> "Support":
        '''(experimental) Returns the description for an attachment.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_DescribeAttachment.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeAttachment", []))

    @jsii.member(jsii_name="toDescribeCaseAttributes")
    def to_describe_case_attributes(self) -> "Support":
        '''(experimental) This is an internally managed function which allows secondary services to read AWS Support case attributes.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeCaseAttributes", []))

    @jsii.member(jsii_name="toDescribeCases")
    def to_describe_cases(self) -> "Support":
        '''(experimental) Returns a list of AWS Support cases that matches the given inputs.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_DescribeCases.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeCases", []))

    @jsii.member(jsii_name="toDescribeCommunications")
    def to_describe_communications(self) -> "Support":
        '''(experimental) Returns the communications and attachments for one or more AWS Support cases.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_DescribeCommunications.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeCommunications", []))

    @jsii.member(jsii_name="toDescribeIssueTypes")
    def to_describe_issue_types(self) -> "Support":
        '''(experimental) Returns issue types for AWS Support cases.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeIssueTypes", []))

    @jsii.member(jsii_name="toDescribeServices")
    def to_describe_services(self) -> "Support":
        '''(experimental) Returns the current list of AWS services and categories that applies to each service.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_DescribeServices.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeServices", []))

    @jsii.member(jsii_name="toDescribeSeverityLevels")
    def to_describe_severity_levels(self) -> "Support":
        '''(experimental) Returns the list of severity levels that can be assigned to an AWS Support case.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_DescribeSeverityLevels.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeSeverityLevels", []))

    @jsii.member(jsii_name="toDescribeSupportLevel")
    def to_describe_support_level(self) -> "Support":
        '''(experimental) Returns the support level for an AWS Account identifier.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeSupportLevel", []))

    @jsii.member(jsii_name="toDescribeTrustedAdvisorCheckRefreshStatuses")
    def to_describe_trusted_advisor_check_refresh_statuses(self) -> "Support":
        '''(experimental) Returns the status of a Trusted Advisor refresh check based on a list of check identifiers.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_DescribeTrustedAdvisorCheckRefreshStatuses.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeTrustedAdvisorCheckRefreshStatuses", []))

    @jsii.member(jsii_name="toDescribeTrustedAdvisorCheckResult")
    def to_describe_trusted_advisor_check_result(self) -> "Support":
        '''(experimental) Returns the results of the Trusted Advisor check that has the specified check identifier.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_DescribeTrustedAdvisorCheckResult.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeTrustedAdvisorCheckResult", []))

    @jsii.member(jsii_name="toDescribeTrustedAdvisorChecks")
    def to_describe_trusted_advisor_checks(self) -> "Support":
        '''(experimental) Returns a list of all available Trusted Advisor checks, including name, identifier, category and description.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_DescribeTrustedAdvisorChecks.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeTrustedAdvisorChecks", []))

    @jsii.member(jsii_name="toDescribeTrustedAdvisorCheckSummaries")
    def to_describe_trusted_advisor_check_summaries(self) -> "Support":
        '''(experimental) Returns the summaries of the results of the Trusted Advisor checks that have the specified check identifiers.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_DescribeTrustedAdvisorCheckSummaries.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toDescribeTrustedAdvisorCheckSummaries", []))

    @jsii.member(jsii_name="toInitiateCallForCase")
    def to_initiate_call_for_case(self) -> "Support":
        '''(experimental) This is an internally managed function to initiate a call on AWS Support Center.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toInitiateCallForCase", []))

    @jsii.member(jsii_name="toInitiateChatForCase")
    def to_initiate_chat_for_case(self) -> "Support":
        '''(experimental) This is an internally managed function to initiate a chat on AWS Support Center.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toInitiateChatForCase", []))

    @jsii.member(jsii_name="toPutCaseAttributes")
    def to_put_case_attributes(self) -> "Support":
        '''(experimental) This is an internally managed function which allows secondary services to attach attributes to AWS Support cases.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toPutCaseAttributes", []))

    @jsii.member(jsii_name="toRateCaseCommunication")
    def to_rate_case_communication(self) -> "Support":
        '''(experimental) Rate an AWS Support case communication.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toRateCaseCommunication", []))

    @jsii.member(jsii_name="toRefreshTrustedAdvisorCheck")
    def to_refresh_trusted_advisor_check(self) -> "Support":
        '''(experimental) Requests a refresh of the Trusted Advisor check that has the specified check identifier.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_RefreshTrustedAdvisorCheck.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toRefreshTrustedAdvisorCheck", []))

    @jsii.member(jsii_name="toResolveCase")
    def to_resolve_case(self) -> "Support":
        '''(experimental) Resolves an AWS Support case.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_ResolveCase.html

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toResolveCase", []))

    @jsii.member(jsii_name="toSearchForCases")
    def to_search_for_cases(self) -> "Support":
        '''(experimental) Returns a list of AWS Support cases that matches the given inputs.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Support", jsii.invoke(self, "toSearchForCases", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5e9f9672f2e4d93df4a37cbd07d16014e208cd750c38b27a6bf19b60230a445d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8aba9e97a71679f0c06c93273ae543ffcd64744f79f243aa89d60baf689242c8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Supportapp(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Supportapp",
):
    '''(experimental) Statement provider for service `supportapp <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupportappinslack.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `supportapp <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupportappinslack.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__880d648c725d62e41c16e576729a2a0800f28e6c1d4c4af096ceff529700be0c)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toCreateSlackChannelConfiguration")
    def to_create_slack_channel_configuration(self) -> "Supportapp":
        '''(experimental) Grants permission to create a Slack channel configuration for your account.

        Access Level: Write

        https://docs.aws.amazon.com/supportapp/latest/APIReference/API_CreateSlackChannelConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Supportapp", jsii.invoke(self, "toCreateSlackChannelConfiguration", []))

    @jsii.member(jsii_name="toDeleteAccountAlias")
    def to_delete_account_alias(self) -> "Supportapp":
        '''(experimental) Grants permission to delete an alias from your account.

        Access Level: Write

        https://docs.aws.amazon.com/supportapp/latest/APIReference/API_DeleteAccountAlias.html

        :stability: experimental
        '''
        return typing.cast("Supportapp", jsii.invoke(self, "toDeleteAccountAlias", []))

    @jsii.member(jsii_name="toDeleteSlackChannelConfiguration")
    def to_delete_slack_channel_configuration(self) -> "Supportapp":
        '''(experimental) Grants permission to delete a Slack channel configuration from your account.

        Access Level: Write

        https://docs.aws.amazon.com/supportapp/latest/APIReference/API_DeleteSlackChannelConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Supportapp", jsii.invoke(self, "toDeleteSlackChannelConfiguration", []))

    @jsii.member(jsii_name="toDeleteSlackWorkspaceConfiguration")
    def to_delete_slack_workspace_configuration(self) -> "Supportapp":
        '''(experimental) Grants permission to delete a Slack workspace configuration from your account.

        Access Level: Write

        https://docs.aws.amazon.com/supportapp/latest/APIReference/API_DeleteSlackWorkspaceConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Supportapp", jsii.invoke(self, "toDeleteSlackWorkspaceConfiguration", []))

    @jsii.member(jsii_name="toDescribeSlackChannels")
    def to_describe_slack_channels(self) -> "Supportapp":
        '''(experimental) Grants permission to list all public Slack channels in a workspace that have invited the AWS Support App.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/slack-authorization-permissions.html

        :stability: experimental
        '''
        return typing.cast("Supportapp", jsii.invoke(self, "toDescribeSlackChannels", []))

    @jsii.member(jsii_name="toGetAccountAlias")
    def to_get_account_alias(self) -> "Supportapp":
        '''(experimental) Grants permission to get the alias for your account.

        Access Level: Read

        https://docs.aws.amazon.com/supportapp/latest/APIReference/API_GetAccountAlias.html

        :stability: experimental
        '''
        return typing.cast("Supportapp", jsii.invoke(self, "toGetAccountAlias", []))

    @jsii.member(jsii_name="toGetSlackOauthParameters")
    def to_get_slack_oauth_parameters(self) -> "Supportapp":
        '''(experimental) Grants permission to get parameters for the Slack OAuth code, which the AWS Support App uses to authorize the workspace.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/slack-authorization-permissions.html

        :stability: experimental
        '''
        return typing.cast("Supportapp", jsii.invoke(self, "toGetSlackOauthParameters", []))

    @jsii.member(jsii_name="toListSlackChannelConfigurations")
    def to_list_slack_channel_configurations(self) -> "Supportapp":
        '''(experimental) Grants permission to list all Slack channel configurations for your account.

        Access Level: Read

        https://docs.aws.amazon.com/supportapp/latest/APIReference/API_ListSlackChannelConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Supportapp", jsii.invoke(self, "toListSlackChannelConfigurations", []))

    @jsii.member(jsii_name="toListSlackWorkspaceConfigurations")
    def to_list_slack_workspace_configurations(self) -> "Supportapp":
        '''(experimental) Grants permission to list all Slack workspace configurations for your account.

        Access Level: Read

        https://docs.aws.amazon.com/supportapp/latest/APIReference/API_ListSlackWorkspaceConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Supportapp", jsii.invoke(self, "toListSlackWorkspaceConfigurations", []))

    @jsii.member(jsii_name="toPutAccountAlias")
    def to_put_account_alias(self) -> "Supportapp":
        '''(experimental) Grants permission to create or update an alias for your account.

        Access Level: Write

        https://docs.aws.amazon.com/supportapp/latest/APIReference/API_PutAccountAlias.html

        :stability: experimental
        '''
        return typing.cast("Supportapp", jsii.invoke(self, "toPutAccountAlias", []))

    @jsii.member(jsii_name="toRedeemSlackOauthCode")
    def to_redeem_slack_oauth_code(self) -> "Supportapp":
        '''(experimental) Grants permission to redeem the Slack OAuth code, which the AWS Support App uses to authorize the workspace.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/user/slack-authorization-permissions.html

        :stability: experimental
        '''
        return typing.cast("Supportapp", jsii.invoke(self, "toRedeemSlackOauthCode", []))

    @jsii.member(jsii_name="toRegisterSlackWorkspaceForOrganization")
    def to_register_slack_workspace_for_organization(self) -> "Supportapp":
        '''(experimental) Grants permission to register a Slack workspace for an AWS account that is part of an organization.

        Access Level: Write

        https://docs.aws.amazon.com/supportapp/latest/APIReference/API_RegisterSlackWorkspaceForOrganization.html

        :stability: experimental
        '''
        return typing.cast("Supportapp", jsii.invoke(self, "toRegisterSlackWorkspaceForOrganization", []))

    @jsii.member(jsii_name="toUpdateSlackChannelConfiguration")
    def to_update_slack_channel_configuration(self) -> "Supportapp":
        '''(experimental) Grants permission to update a Slack channel configuration for your account.

        Access Level: Write

        https://docs.aws.amazon.com/supportapp/latest/APIReference/API_UpdateSlackChannelConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Supportapp", jsii.invoke(self, "toUpdateSlackChannelConfiguration", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__39aa9f762a42beebbc40899a7838347d25b92ff92e62d24842328e0d939420be)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c606e7cc7ef1a932ad96527f6119385bfbe9fe6e33a195402cbb0e076433c0bc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Supportplans(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Supportplans",
):
    '''(experimental) Statement provider for service `supportplans <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupportplans.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `supportplans <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssupportplans.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f7118001cbe60d38ec66523ca6a6b1280e40ef727fd7654484593cf521d6eca2)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toGetSupportPlan")
    def to_get_support_plan(self) -> "Supportplans":
        '''(experimental) Grants permission to view details about the current support plan for this AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-support-plans.html

        :stability: experimental
        '''
        return typing.cast("Supportplans", jsii.invoke(self, "toGetSupportPlan", []))

    @jsii.member(jsii_name="toGetSupportPlanUpdateStatus")
    def to_get_support_plan_update_status(self) -> "Supportplans":
        '''(experimental) Grants permission to view details about the status for a request to update a support plan.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-support-plans.html

        :stability: experimental
        '''
        return typing.cast("Supportplans", jsii.invoke(self, "toGetSupportPlanUpdateStatus", []))

    @jsii.member(jsii_name="toStartSupportPlanUpdate")
    def to_start_support_plan_update(self) -> "Supportplans":
        '''(experimental) Grants permission to update the support plan for this AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/user/security-support-plans.html

        :stability: experimental
        '''
        return typing.cast("Supportplans", jsii.invoke(self, "toStartSupportPlanUpdate", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f7eb470d0fedadad25bcf462354641906fb70020a819f1c033895bf4775afef4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__663cbfcc2cfcbf5ed11f789bce19f76ba688244c0189506d72e3e4e0f94a8168)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Sustainability(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Sustainability",
):
    '''(experimental) Statement provider for service `sustainability <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssustainability.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `sustainability <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssustainability.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f3a2d1de5e087e267ac010fd913702d408585ea13a5cb4b0b7c727d37d8786b5)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toGetCarbonFootprintSummary")
    def to_get_carbon_footprint_summary(self) -> "Sustainability":
        '''(experimental) Grants permission to view the carbon footprint tool.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Sustainability", jsii.invoke(self, "toGetCarbonFootprintSummary", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__85d3722f0c6a35f4974c570596c493df12d3bea4a45f6aa9c036261e7a6f6016)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__92717c3b3e1958ba21275c5cf277c4bfc9b4cfb0f838fa5b362a71d59bd7f11f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Swf(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Swf"):
    '''(experimental) Statement provider for service `swf <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsimpleworkflowservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `swf <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsimpleworkflowservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__401005076d8d2ef514993ed0d56b7e0d3fd47f3cbbb277a1a36370133acc0c2a)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifActivityTypeName")
    def if_activity_type_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Filters access by the name of the activity type.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toDeprecateActivityType()
        - .toDescribeActivityType()
        - .toRespondActivityTaskCompleted()
        - .toUndeprecateActivityType()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9f98bd1b99d83c024228cf2f41ee3e186dbee2b13f17c1a8cd611a3c6c5f5000)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Swf", jsii.invoke(self, "ifActivityTypeName", [value, operator]))

    @jsii.member(jsii_name="ifActivityTypeVersion")
    def if_activity_type_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Filters access by the version of the activity type.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toDeprecateActivityType()
        - .toDescribeActivityType()
        - .toRespondActivityTaskCompleted()
        - .toUndeprecateActivityType()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ab2940dccaadef726b66e3d000815f5e71a781aded7385299b23f26dcbf0dabc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Swf", jsii.invoke(self, "ifActivityTypeVersion", [value, operator]))

    @jsii.member(jsii_name="ifDefaultTaskListName")
    def if_default_task_list_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Filters access by the name of the default task list.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toRegisterActivityType()
        - .toRegisterWorkflowType()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ab8b097c6f56ec476347e8f7e64f632ddf5ab70de1c05dfea9c479ba5c2a0391)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Swf", jsii.invoke(self, "ifDefaultTaskListName", [value, operator]))

    @jsii.member(jsii_name="ifName")
    def if_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Filters access by the name of activities or workflows.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toRegisterActivityType()
        - .toRegisterWorkflowType()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__546fdb198014edd7d9e7598cae50e7c495cf4d78b58276f5fc4161d28d8fe8e5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Swf", jsii.invoke(self, "ifName", [value, operator]))

    @jsii.member(jsii_name="ifTagFilterTag")
    def if_tag_filter_tag(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Filters access by the value of tagFilter.tag.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toCountClosedWorkflowExecutions()
        - .toCountOpenWorkflowExecutions()
        - .toListClosedWorkflowExecutions()
        - .toListOpenWorkflowExecutions()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1da560b7a0b6df9245e3a63ce433b4fac6af3f3150e93b9ccf934151ef8edee1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Swf", jsii.invoke(self, "ifTagFilterTag", [value, operator]))

    @jsii.member(jsii_name="ifTagListMember0")
    def if_tag_list_member0(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Filters access by the specified tag.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toRespondActivityTaskCompleted()
        - .toStartWorkflowExecution()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cf067ab42a1590e2947268626f21d4650207bf17fef2ee41f1f6a001d6406ad6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Swf", jsii.invoke(self, "ifTagListMember0", [value, operator]))

    @jsii.member(jsii_name="ifTagListMember1")
    def if_tag_list_member1(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Filters access by the specified tag.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toRespondActivityTaskCompleted()
        - .toStartWorkflowExecution()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__081ca266b067a927bf42506e3e02b1a5ac5684fe78da5aed049a35e19a1e7650)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Swf", jsii.invoke(self, "ifTagListMember1", [value, operator]))

    @jsii.member(jsii_name="ifTagListMember2")
    def if_tag_list_member2(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Filters access by the specified tag.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toRespondActivityTaskCompleted()
        - .toStartWorkflowExecution()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9dd5654595f04a41c77b6b28d80025ced96f956ac9e5665f363f7f1ca8c1f1d3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Swf", jsii.invoke(self, "ifTagListMember2", [value, operator]))

    @jsii.member(jsii_name="ifTagListMember3")
    def if_tag_list_member3(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Filters access by the specified tag.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toRespondActivityTaskCompleted()
        - .toStartWorkflowExecution()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fbd2445b760cd02155a46ffdb2334b89cab3e4209c17380c124f21b056e9eae0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Swf", jsii.invoke(self, "ifTagListMember3", [value, operator]))

    @jsii.member(jsii_name="ifTagListMember4")
    def if_tag_list_member4(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Filters access by the specified tag.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toRespondActivityTaskCompleted()
        - .toStartWorkflowExecution()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1e6e40d34be7990b9ab90c1d9552001f13a6cef48bc1deef5a3f068b139805e5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Swf", jsii.invoke(self, "ifTagListMember4", [value, operator]))

    @jsii.member(jsii_name="ifTaskListName")
    def if_task_list_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Filters access by the name of the tasklist.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toCountPendingActivityTasks()
        - .toCountPendingDecisionTasks()
        - .toPollForActivityTask()
        - .toPollForDecisionTask()
        - .toRespondActivityTaskCompleted()
        - .toStartWorkflowExecution()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cc742c8a8b3d1e16b5bf5c727f0d1ab7d31d9d35616a118e7961f66605112824)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Swf", jsii.invoke(self, "ifTaskListName", [value, operator]))

    @jsii.member(jsii_name="ifTypeFilterName")
    def if_type_filter_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Filters access by the name of the type filter.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toCountClosedWorkflowExecutions()
        - .toCountOpenWorkflowExecutions()
        - .toListClosedWorkflowExecutions()
        - .toListOpenWorkflowExecutions()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d5f2a620f5ec538cca1695d4fc05ea5e7dee2a96af40b939228eabc69422bbf6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Swf", jsii.invoke(self, "ifTypeFilterName", [value, operator]))

    @jsii.member(jsii_name="ifTypeFilterVersion")
    def if_type_filter_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Filters access by the version of the type filter.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toCountClosedWorkflowExecutions()
        - .toCountOpenWorkflowExecutions()
        - .toListClosedWorkflowExecutions()
        - .toListOpenWorkflowExecutions()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ab706faaab2a04b42d721d376e089783cc7e42ca78b8ebad193ef079b2af66a4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Swf", jsii.invoke(self, "ifTypeFilterVersion", [value, operator]))

    @jsii.member(jsii_name="ifVersion")
    def if_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Filters access by the version of activities or workflows.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toRegisterActivityType()
        - .toRegisterWorkflowType()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__73843ec09987a1b3413aec002d4b18cb3ab587aa083d202745b7079fd2d2acab)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Swf", jsii.invoke(self, "ifVersion", [value, operator]))

    @jsii.member(jsii_name="ifWorkflowTypeName")
    def if_workflow_type_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Filters access by the name of the workflow type.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toDeprecateWorkflowType()
        - .toDescribeWorkflowType()
        - .toRespondActivityTaskCompleted()
        - .toStartWorkflowExecution()
        - .toUndeprecateWorkflowType()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__89f08a0aba629adec94302d327b8ec07ddc4f5e2f942c3316c743444af7cfbcb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Swf", jsii.invoke(self, "ifWorkflowTypeName", [value, operator]))

    @jsii.member(jsii_name="ifWorkflowTypeVersion")
    def if_workflow_type_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Swf":
        '''(experimental) Filters access by the version of the workflow type.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-iam.html##swf-dev-iam.api

        Applies to actions:

        - .toDeprecateWorkflowType()
        - .toDescribeWorkflowType()
        - .toRespondActivityTaskCompleted()
        - .toStartWorkflowExecution()
        - .toUndeprecateWorkflowType()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__84172be50fbaa397baf1d7f83b76ae68f10193c7e748f0accbcb873d1b870c00)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Swf", jsii.invoke(self, "ifWorkflowTypeVersion", [value, operator]))

    @jsii.member(jsii_name="onDomain")
    def on_domain(
        self,
        domain_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Swf":
        '''(experimental) Adds a resource of type domain to the statement.

        https://docs.aws.amazon.com/amazonswf/latest/developerguide/swf-dev-domains.html

        :param domain_name: - Identifier for the domainName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2a3d9c3088480cebe2589e1cd841df224ab0b29b935755f529dae072216a409a)
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Swf", jsii.invoke(self, "onDomain", [domain_name, account, partition]))

    @jsii.member(jsii_name="toCancelTimer")
    def to_cancel_timer(self) -> "Swf":
        '''(experimental) Grants permission to cancel a previously started timer and record a TimerCanceled event in the history.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_Decision.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toCancelTimer", []))

    @jsii.member(jsii_name="toCancelWorkflowExecution")
    def to_cancel_workflow_execution(self) -> "Swf":
        '''(experimental) Grants permission to close the workflow execution and record a WorkflowExecutionCanceled event in the history.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_Decision.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toCancelWorkflowExecution", []))

    @jsii.member(jsii_name="toCompleteWorkflowExecution")
    def to_complete_workflow_execution(self) -> "Swf":
        '''(experimental) Grants permission to close the workflow execution and record a WorkflowExecutionCompleted event in the history.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_Decision.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toCompleteWorkflowExecution", []))

    @jsii.member(jsii_name="toContinueAsNewWorkflowExecution")
    def to_continue_as_new_workflow_execution(self) -> "Swf":
        '''(experimental) Grants permission to close the workflow execution and start a new workflow execution of the same type using the same workflow ID and a unique run Id.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_Decision.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toContinueAsNewWorkflowExecution", []))

    @jsii.member(jsii_name="toCountClosedWorkflowExecutions")
    def to_count_closed_workflow_executions(self) -> "Swf":
        '''(experimental) Grants permission to return the number of closed workflow executions within the given domain that meet the specified filtering criteria.

        Access Level: Read

        Possible conditions:

        - .ifTagFilterTag()
        - .ifTypeFilterName()
        - .ifTypeFilterVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_CountClosedWorkflowExecutions.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toCountClosedWorkflowExecutions", []))

    @jsii.member(jsii_name="toCountOpenWorkflowExecutions")
    def to_count_open_workflow_executions(self) -> "Swf":
        '''(experimental) Grants permission to return the number of open workflow executions within the given domain that meet the specified filtering criteria.

        Access Level: Read

        Possible conditions:

        - .ifTagFilterTag()
        - .ifTypeFilterName()
        - .ifTypeFilterVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_CountOpenWorkflowExecutions.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toCountOpenWorkflowExecutions", []))

    @jsii.member(jsii_name="toCountPendingActivityTasks")
    def to_count_pending_activity_tasks(self) -> "Swf":
        '''(experimental) Grants permission to return the estimated number of activity tasks in the specified task list.

        Access Level: Read

        Possible conditions:

        - .ifTaskListName()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_CountPendingActivityTasks.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toCountPendingActivityTasks", []))

    @jsii.member(jsii_name="toCountPendingDecisionTasks")
    def to_count_pending_decision_tasks(self) -> "Swf":
        '''(experimental) Grants permission to return the estimated number of decision tasks in the specified task list.

        Access Level: Read

        Possible conditions:

        - .ifTaskListName()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_CountPendingDecisionTasks.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toCountPendingDecisionTasks", []))

    @jsii.member(jsii_name="toDeprecateActivityType")
    def to_deprecate_activity_type(self) -> "Swf":
        '''(experimental) Grants permission to deprecate the specified activity type.

        Access Level: Write

        Possible conditions:

        - .ifActivityTypeName()
        - .ifActivityTypeVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_DeprecateActivityType.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toDeprecateActivityType", []))

    @jsii.member(jsii_name="toDeprecateDomain")
    def to_deprecate_domain(self) -> "Swf":
        '''(experimental) Grants permission to deprecate the specified domain.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_DeprecateDomain.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toDeprecateDomain", []))

    @jsii.member(jsii_name="toDeprecateWorkflowType")
    def to_deprecate_workflow_type(self) -> "Swf":
        '''(experimental) Grants permission to deprecate the specified workflow type.

        Access Level: Write

        Possible conditions:

        - .ifWorkflowTypeName()
        - .ifWorkflowTypeVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_DeprecateWorkflowType.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toDeprecateWorkflowType", []))

    @jsii.member(jsii_name="toDescribeActivityType")
    def to_describe_activity_type(self) -> "Swf":
        '''(experimental) Grants permission to return information about the specified activity type.

        Access Level: Read

        Possible conditions:

        - .ifActivityTypeName()
        - .ifActivityTypeVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_DescribeActivityType.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toDescribeActivityType", []))

    @jsii.member(jsii_name="toDescribeDomain")
    def to_describe_domain(self) -> "Swf":
        '''(experimental) Grants permission to return information about the specified domain, including its description and status.

        Access Level: Read

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_DescribeDomain.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toDescribeDomain", []))

    @jsii.member(jsii_name="toDescribeWorkflowExecution")
    def to_describe_workflow_execution(self) -> "Swf":
        '''(experimental) Grants permission to return information about the specified workflow execution including its type and some statistics.

        Access Level: Read

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_DescribeWorkflowExecution.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toDescribeWorkflowExecution", []))

    @jsii.member(jsii_name="toDescribeWorkflowType")
    def to_describe_workflow_type(self) -> "Swf":
        '''(experimental) Grants permission to return information about the specified workflow type.

        Access Level: Read

        Possible conditions:

        - .ifWorkflowTypeName()
        - .ifWorkflowTypeVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_DescribeWorkflowType.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toDescribeWorkflowType", []))

    @jsii.member(jsii_name="toFailWorkflowExecution")
    def to_fail_workflow_execution(self) -> "Swf":
        '''(experimental) Grants permission to close the workflow execution and record a WorkflowExecutionFailed event in the history.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_Decision.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toFailWorkflowExecution", []))

    @jsii.member(jsii_name="toGetWorkflowExecutionHistory")
    def to_get_workflow_execution_history(self) -> "Swf":
        '''(experimental) Grants permission to return the history of the specified workflow execution.

        Access Level: Read

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_GetWorkflowExecutionHistory.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toGetWorkflowExecutionHistory", []))

    @jsii.member(jsii_name="toListActivityTypes")
    def to_list_activity_types(self) -> "Swf":
        '''(experimental) Grants permission to return information about all activities registered in the specified domain that match the specified name and registration status.

        Access Level: List

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_ListActivityTypes.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toListActivityTypes", []))

    @jsii.member(jsii_name="toListClosedWorkflowExecutions")
    def to_list_closed_workflow_executions(self) -> "Swf":
        '''(experimental) Grants permission to return a list of closed workflow executions in the specified domain that meet the filtering criteria.

        Access Level: List

        Possible conditions:

        - .ifTagFilterTag()
        - .ifTypeFilterName()
        - .ifTypeFilterVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_ListClosedWorkflowExecutions.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toListClosedWorkflowExecutions", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Swf":
        '''(experimental) Grants permission to return the list of domains registered in the account.

        Access Level: List

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_ListDomains.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toListOpenWorkflowExecutions")
    def to_list_open_workflow_executions(self) -> "Swf":
        '''(experimental) Grants permission to return a list of open workflow executions in the specified domain that meet the filtering criteria.

        Access Level: List

        Possible conditions:

        - .ifTagFilterTag()
        - .ifTypeFilterName()
        - .ifTypeFilterVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_ListOpenWorkflowExecutions.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toListOpenWorkflowExecutions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Swf":
        '''(experimental) Grants permission to list tags for an AWS SWF resource.

        Access Level: List

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWorkflowTypes")
    def to_list_workflow_types(self) -> "Swf":
        '''(experimental) Grants permission to return information about workflow types in the specified domain.

        Access Level: List

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_ListWorkflowTypes.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toListWorkflowTypes", []))

    @jsii.member(jsii_name="toPollForActivityTask")
    def to_poll_for_activity_task(self) -> "Swf":
        '''(experimental) Grants permission to workers to get an ActivityTask from the specified activity taskList.

        Access Level: Write

        Possible conditions:

        - .ifTaskListName()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_PollForActivityTask.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toPollForActivityTask", []))

    @jsii.member(jsii_name="toPollForDecisionTask")
    def to_poll_for_decision_task(self) -> "Swf":
        '''(experimental) Grants permission to deciders to get a DecisionTask from the specified decision taskList.

        Access Level: Write

        Possible conditions:

        - .ifTaskListName()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_PollForDecisionTask.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toPollForDecisionTask", []))

    @jsii.member(jsii_name="toRecordActivityTaskHeartbeat")
    def to_record_activity_task_heartbeat(self) -> "Swf":
        '''(experimental) Grants permission to workers to report to the service that the ActivityTask represented by the specified taskToken is still making progress.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RecordActivityTaskHeartbeat.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRecordActivityTaskHeartbeat", []))

    @jsii.member(jsii_name="toRecordMarker")
    def to_record_marker(self) -> "Swf":
        '''(experimental) Grants permission to record a MarkerRecorded event in the history.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_Decision.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRecordMarker", []))

    @jsii.member(jsii_name="toRegisterActivityType")
    def to_register_activity_type(self) -> "Swf":
        '''(experimental) Grants permission to register a new activity type along with its configuration settings in the specified domain.

        Access Level: Write

        Possible conditions:

        - .ifDefaultTaskListName()
        - .ifName()
        - .ifVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RegisterActivityType.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRegisterActivityType", []))

    @jsii.member(jsii_name="toRegisterDomain")
    def to_register_domain(self) -> "Swf":
        '''(experimental) Grants permission to register a new domain.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RegisterDomain.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRegisterDomain", []))

    @jsii.member(jsii_name="toRegisterWorkflowType")
    def to_register_workflow_type(self) -> "Swf":
        '''(experimental) Grants permission to register a new workflow type and its configuration settings in the specified domain.

        Access Level: Write

        Possible conditions:

        - .ifDefaultTaskListName()
        - .ifName()
        - .ifVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RegisterWorkflowType.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRegisterWorkflowType", []))

    @jsii.member(jsii_name="toRequestCancelActivityTask")
    def to_request_cancel_activity_task(self) -> "Swf":
        '''(experimental) Grants permission to attempt to cancel a previously scheduled activity task.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_Decision.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRequestCancelActivityTask", []))

    @jsii.member(jsii_name="toRequestCancelExternalWorkflowExecution")
    def to_request_cancel_external_workflow_execution(self) -> "Swf":
        '''(experimental) Grants permission to request that a request be made to cancel the specified external workflow execution.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_Decision.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRequestCancelExternalWorkflowExecution", []))

    @jsii.member(jsii_name="toRequestCancelWorkflowExecution")
    def to_request_cancel_workflow_execution(self) -> "Swf":
        '''(experimental) Grants permission to record a WorkflowExecutionCancelRequested event in the currently running workflow execution identified by the given domain, workflowId, and runId.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RequestCancelWorkflowExecution.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRequestCancelWorkflowExecution", []))

    @jsii.member(jsii_name="toRespondActivityTaskCanceled")
    def to_respond_activity_task_canceled(self) -> "Swf":
        '''(experimental) Grants permission to workers to tell the service that the ActivityTask identified by the taskToken was successfully canceled.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RespondActivityTaskCanceled.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRespondActivityTaskCanceled", []))

    @jsii.member(jsii_name="toRespondActivityTaskCompleted")
    def to_respond_activity_task_completed(self) -> "Swf":
        '''(experimental) Grants permission to workers to tell the service that the ActivityTask identified by the taskToken completed successfully with a result (if provided).

        Access Level: Write

        Possible conditions:

        - .ifActivityTypeName()
        - .ifActivityTypeVersion()
        - .ifTagListMember0()
        - .ifTagListMember1()
        - .ifTagListMember2()
        - .ifTagListMember3()
        - .ifTagListMember4()
        - .ifTaskListName()
        - .ifWorkflowTypeName()
        - .ifWorkflowTypeVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RespondActivityTaskCompleted.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRespondActivityTaskCompleted", []))

    @jsii.member(jsii_name="toRespondActivityTaskFailed")
    def to_respond_activity_task_failed(self) -> "Swf":
        '''(experimental) Grants permission to workers to tell the service that the ActivityTask identified by the taskToken has failed with reason (if specified).

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RespondActivityTaskFailed.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRespondActivityTaskFailed", []))

    @jsii.member(jsii_name="toRespondDecisionTaskCompleted")
    def to_respond_decision_task_completed(self) -> "Swf":
        '''(experimental) Grants permission to deciders to tell the service that the DecisionTask identified by the taskToken has successfully completed.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_RespondDecisionTaskCompleted.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toRespondDecisionTaskCompleted", []))

    @jsii.member(jsii_name="toScheduleActivityTask")
    def to_schedule_activity_task(self) -> "Swf":
        '''(experimental) Grants permission to schedule an activity task.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_Decision.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toScheduleActivityTask", []))

    @jsii.member(jsii_name="toSignalExternalWorkflowExecution")
    def to_signal_external_workflow_execution(self) -> "Swf":
        '''(experimental) Grants permission to request a signal to be delivered to the specified external workflow execution and records.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_Decision.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toSignalExternalWorkflowExecution", []))

    @jsii.member(jsii_name="toSignalWorkflowExecution")
    def to_signal_workflow_execution(self) -> "Swf":
        '''(experimental) Grants permission to record a WorkflowExecutionSignaled event in the workflow execution history and create a decision task for the workflow execution identified by the given domain, workflowId and runId.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_SignalWorkflowExecution.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toSignalWorkflowExecution", []))

    @jsii.member(jsii_name="toStartChildWorkflowExecution")
    def to_start_child_workflow_execution(self) -> "Swf":
        '''(experimental) Grants permission to request that a child workflow execution be started.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_Decision.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toStartChildWorkflowExecution", []))

    @jsii.member(jsii_name="toStartTimer")
    def to_start_timer(self) -> "Swf":
        '''(experimental) Grants permission to start a timer for a workflow execution.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_Decision.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toStartTimer", []))

    @jsii.member(jsii_name="toStartWorkflowExecution")
    def to_start_workflow_execution(self) -> "Swf":
        '''(experimental) Grants permission to start an execution of the workflow type in the specified domain using the provided workflowId and input data.

        Access Level: Write

        Possible conditions:

        - .ifTagListMember0()
        - .ifTagListMember1()
        - .ifTagListMember2()
        - .ifTagListMember3()
        - .ifTagListMember4()
        - .ifTaskListName()
        - .ifWorkflowTypeName()
        - .ifWorkflowTypeVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_StartWorkflowExecution.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toStartWorkflowExecution", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Swf":
        '''(experimental) Grants permission to tag an AWS SWF resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTerminateWorkflowExecution")
    def to_terminate_workflow_execution(self) -> "Swf":
        '''(experimental) Grants permission to record a WorkflowExecutionTerminated event and force closure of the workflow execution identified by the given domain, runId, and workflowId.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_TerminateWorkflowExecution.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toTerminateWorkflowExecution", []))

    @jsii.member(jsii_name="toUndeprecateActivityType")
    def to_undeprecate_activity_type(self) -> "Swf":
        '''(experimental) Grants permission to undeprecate a previously deprecated activity type.

        Access Level: Write

        Possible conditions:

        - .ifActivityTypeName()
        - .ifActivityTypeVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_UndeprecateActivityType.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toUndeprecateActivityType", []))

    @jsii.member(jsii_name="toUndeprecateDomain")
    def to_undeprecate_domain(self) -> "Swf":
        '''(experimental) Grants permission to undeprecate a previously deprecated domain.

        Access Level: Write

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_UndeprecateDomain.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toUndeprecateDomain", []))

    @jsii.member(jsii_name="toUndeprecateWorkflowType")
    def to_undeprecate_workflow_type(self) -> "Swf":
        '''(experimental) Grants permission to undeprecate a previously deprecated workflow type.

        Access Level: Write

        Possible conditions:

        - .ifWorkflowTypeName()
        - .ifWorkflowTypeVersion()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_UndeprecateWorkflowType.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toUndeprecateWorkflowType", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Swf":
        '''(experimental) Grants permission to remove a tag from an AWS SWF resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/amazonswf/latest/apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Swf", jsii.invoke(self, "toUntagResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bbd8a1618acf55cedf4988ce47735c675ad40fce308dd1fd89b5e132740aa37f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__729dc5ea8c1aea81b5eacc910a37804635e8dcacc1da1dc7677c0a38f65799ca)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Synthetics(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Synthetics",
):
    '''(experimental) Statement provider for service `synthetics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchsynthetics.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `synthetics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchsynthetics.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f41f0ea26593ead621dd90c949d7bb3a809aac3110ab3a1e4159aef02ab4033b)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifNames")
    def if_names(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Synthetics":
        '''(experimental) Filters access based on the name of the canary.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries_Restricted.html

        Applies to actions:

        - .toDescribeCanaries()
        - .toDescribeCanariesLastRun()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__79db552aad46ba626a797c24f6894397fe326ceafb3f2719fcbc605d30e14e0b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Synthetics", jsii.invoke(self, "ifNames", [value, operator]))

    @jsii.member(jsii_name="onCanary")
    def on_canary(
        self,
        canary_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Synthetics":
        '''(experimental) Adds a resource of type canary to the statement.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Canaries.html

        :param canary_name: - Identifier for the canaryName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__31e9b4b3753b07d12de9b34cdb8e83885aebcfc1d6d51b21b0ea574fcee818e9)
            check_type(argname="argument canary_name", value=canary_name, expected_type=type_hints["canary_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Synthetics", jsii.invoke(self, "onCanary", [canary_name, account, region, partition]))

    @jsii.member(jsii_name="onGroup")
    def on_group(
        self,
        group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Synthetics":
        '''(experimental) Adds a resource of type group to the statement.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Synthetics_Groups.html

        :param group_id: - Identifier for the groupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4d3d9f9fd8682951232d1ab254ebd7940b33b544a5dedc84a1c699c41c9ff8a0)
            check_type(argname="argument group_id", value=group_id, expected_type=type_hints["group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Synthetics", jsii.invoke(self, "onGroup", [group_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateResource")
    def to_associate_resource(self) -> "Synthetics":
        '''(experimental) Grants permission to associate a resource with a group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_AssociateResource.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toAssociateResource", []))

    @jsii.member(jsii_name="toCreateCanary")
    def to_create_canary(self) -> "Synthetics":
        '''(experimental) Grants permission to create a canary.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_CreateCanary.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toCreateCanary", []))

    @jsii.member(jsii_name="toCreateGroup")
    def to_create_group(self) -> "Synthetics":
        '''(experimental) Grants permission to create a group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_CreateGroup.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toCreateGroup", []))

    @jsii.member(jsii_name="toDeleteCanary")
    def to_delete_canary(self) -> "Synthetics":
        '''(experimental) Grants permission to delete a canary.

        Amazon Synthetics deletes all the resources except for the Lambda function and the CloudWatch Alarms if you created one

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_DeleteCanary.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toDeleteCanary", []))

    @jsii.member(jsii_name="toDeleteGroup")
    def to_delete_group(self) -> "Synthetics":
        '''(experimental) Grants permission to delete a group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_DeleteGroup.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toDeleteGroup", []))

    @jsii.member(jsii_name="toDescribeCanaries")
    def to_describe_canaries(self) -> "Synthetics":
        '''(experimental) Grants permission to list information of all canaries.

        Access Level: Read

        Possible conditions:

        - .ifNames()

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_DescribeCanaries.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toDescribeCanaries", []))

    @jsii.member(jsii_name="toDescribeCanariesLastRun")
    def to_describe_canaries_last_run(self) -> "Synthetics":
        '''(experimental) Grants permission to list information about the last test run associated with all canaries.

        Access Level: Read

        Possible conditions:

        - .ifNames()

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_DescribeCanariesLastRun.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toDescribeCanariesLastRun", []))

    @jsii.member(jsii_name="toDescribeRuntimeVersions")
    def to_describe_runtime_versions(self) -> "Synthetics":
        '''(experimental) Grants permission to list information about Synthetics canary runtime versions.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_DescribeRuntimeVersions.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toDescribeRuntimeVersions", []))

    @jsii.member(jsii_name="toDisassociateResource")
    def to_disassociate_resource(self) -> "Synthetics":
        '''(experimental) Grants permission to disassociate a resource from a group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_DisassociateResource.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toDisassociateResource", []))

    @jsii.member(jsii_name="toGetCanary")
    def to_get_canary(self) -> "Synthetics":
        '''(experimental) Grants permission to view the details of a canary.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_GetCanary.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toGetCanary", []))

    @jsii.member(jsii_name="toGetCanaryRuns")
    def to_get_canary_runs(self) -> "Synthetics":
        '''(experimental) Grants permission to list information about all the test runs associated with a canary.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_GetCanaryRuns.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toGetCanaryRuns", []))

    @jsii.member(jsii_name="toGetGroup")
    def to_get_group(self) -> "Synthetics":
        '''(experimental) Grants permission to view the details of a group.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_GetGroup.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toGetGroup", []))

    @jsii.member(jsii_name="toListAssociatedGroups")
    def to_list_associated_groups(self) -> "Synthetics":
        '''(experimental) Grants permission to list information about the associated groups of a canary.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_ListAssociatedGroups.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toListAssociatedGroups", []))

    @jsii.member(jsii_name="toListGroupResources")
    def to_list_group_resources(self) -> "Synthetics":
        '''(experimental) Grants permission to list information about canaries in a group.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_ListGroupResources.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toListGroupResources", []))

    @jsii.member(jsii_name="toListGroups")
    def to_list_groups(self) -> "Synthetics":
        '''(experimental) Grants permission to list information of all groups.

        Access Level: List

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_ListGroups.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toListGroups", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Synthetics":
        '''(experimental) Grants permission to list all tags and values associated with a resource.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartCanary")
    def to_start_canary(self) -> "Synthetics":
        '''(experimental) Grants permission to start a canary, so that Amazon CloudWatch Synthetics starts monitoring a website.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_StartCanary.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toStartCanary", []))

    @jsii.member(jsii_name="toStopCanary")
    def to_stop_canary(self) -> "Synthetics":
        '''(experimental) Grants permission to stop a canary.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_StopCanary.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toStopCanary", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Synthetics":
        '''(experimental) Grants permission to add one or more tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Synthetics":
        '''(experimental) Grants permission to remove one or more tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateCanary")
    def to_update_canary(self) -> "Synthetics":
        '''(experimental) Grants permission to update a canary.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_UpdateCanary.html

        :stability: experimental
        '''
        return typing.cast("Synthetics", jsii.invoke(self, "toUpdateCanary", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d6c71e74bf6da61bd48a10f2b9e989cfecd358777ea64135eaec08e30190d6f9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__228a815b6e912cf29c33be27353eb4fabb696070fac0d6469fcb33efb6b83ae5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Tag(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Tag"):
    '''(experimental) Statement provider for service `tag <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonresourcegrouptaggingapi.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `tag <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonresourcegrouptaggingapi.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__95a714f3bf823af6dc4f9ce45c95903e192ec56b42e0ec5098ff9500ffc2ad28)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toDescribeReportCreation")
    def to_describe_report_creation(self) -> "Tag":
        '''(experimental) Grants permission to describe the status of the StartReportCreation operation.

        Access Level: Read

        https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_DescribeReportCreation.html

        :stability: experimental
        '''
        return typing.cast("Tag", jsii.invoke(self, "toDescribeReportCreation", []))

    @jsii.member(jsii_name="toGetComplianceSummary")
    def to_get_compliance_summary(self) -> "Tag":
        '''(experimental) Grants permission to retrieve a summary of how many resources are noncompliant with their effective tag policies.

        Access Level: Read

        https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_GetComplianceSummary.html

        :stability: experimental
        '''
        return typing.cast("Tag", jsii.invoke(self, "toGetComplianceSummary", []))

    @jsii.member(jsii_name="toGetResources")
    def to_get_resources(self) -> "Tag":
        '''(experimental) Grants permission to return tagged or previously tagged resources in the specified AWS Region for the calling account.

        Access Level: Read

        https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_GetResources.html

        :stability: experimental
        '''
        return typing.cast("Tag", jsii.invoke(self, "toGetResources", []))

    @jsii.member(jsii_name="toGetTagKeys")
    def to_get_tag_keys(self) -> "Tag":
        '''(experimental) Grants permission to returns tag keys currently in use in the specified AWS Region for the calling account.

        Access Level: Read

        https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_GetTagKeys.html

        :stability: experimental
        '''
        return typing.cast("Tag", jsii.invoke(self, "toGetTagKeys", []))

    @jsii.member(jsii_name="toGetTagValues")
    def to_get_tag_values(self) -> "Tag":
        '''(experimental) Grants permission to return tag values for the specified key that are used in the specified AWS Region for the calling account.

        Access Level: Read

        https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_GetTagValues.html

        :stability: experimental
        '''
        return typing.cast("Tag", jsii.invoke(self, "toGetTagValues", []))

    @jsii.member(jsii_name="toStartReportCreation")
    def to_start_report_creation(self) -> "Tag":
        '''(experimental) Grants permission to start generating a report listing all tagged resources in accounts across your organization, and whether each resource is compliant with the effective tag policy.

        Access Level: Write

        https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_StartReportCreation.html

        :stability: experimental
        '''
        return typing.cast("Tag", jsii.invoke(self, "toStartReportCreation", []))

    @jsii.member(jsii_name="toTagResources")
    def to_tag_resources(self) -> "Tag":
        '''(experimental) Grants permission to apply one or more tags to the specified resources.

        Access Level: Tagging

        https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_TagResources.html

        :stability: experimental
        '''
        return typing.cast("Tag", jsii.invoke(self, "toTagResources", []))

    @jsii.member(jsii_name="toUntagResources")
    def to_untag_resources(self) -> "Tag":
        '''(experimental) Grants permission to remove the specified tags from the specified resources.

        Access Level: Tagging

        https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_UntagResources.html

        :stability: experimental
        '''
        return typing.cast("Tag", jsii.invoke(self, "toUntagResources", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1d4ae76c379cc588fc843f99fbc8b810b2c61963ae29dbf121cab91595cc161d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__224dc8b2d664c93d8122348a9421478b4e5710789c0411462ae3391607768d14)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Tax(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Tax"):
    '''(experimental) Statement provider for service `tax <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awstaxsettings.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `tax <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awstaxsettings.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d8128e8848d9e1a176bee2c0f654b0581b5b3817d8939785cb378fc68f5f122b)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toBatchPutTaxRegistration")
    def to_batch_put_tax_registration(self) -> "Tax":
        '''(experimental) Grants permission to batch update tax registrations.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Tax", jsii.invoke(self, "toBatchPutTaxRegistration", []))

    @jsii.member(jsii_name="toDeleteTaxRegistration")
    def to_delete_tax_registration(self) -> "Tax":
        '''(experimental) Grants permission to delete tax registration data.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Tax", jsii.invoke(self, "toDeleteTaxRegistration", []))

    @jsii.member(jsii_name="toGetExemptions")
    def to_get_exemptions(self) -> "Tax":
        '''(experimental) Grants permission to view tax exemptions data.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Tax", jsii.invoke(self, "toGetExemptions", []))

    @jsii.member(jsii_name="toGetTaxInheritance")
    def to_get_tax_inheritance(self) -> "Tax":
        '''(experimental) Grants permission to view tax inheritance status.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Tax", jsii.invoke(self, "toGetTaxInheritance", []))

    @jsii.member(jsii_name="toGetTaxInterview")
    def to_get_tax_interview(self) -> "Tax":
        '''(experimental) Grants permission to retrieve tax interview data.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/userguide/detailed-management-portal-permissions.html

        :stability: experimental
        '''
        return typing.cast("Tax", jsii.invoke(self, "toGetTaxInterview", []))

    @jsii.member(jsii_name="toGetTaxRegistration")
    def to_get_tax_registration(self) -> "Tax":
        '''(experimental) Grants permission to view tax registrations data.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/userguide/detailed-management-portal-permissions.html

        :stability: experimental
        '''
        return typing.cast("Tax", jsii.invoke(self, "toGetTaxRegistration", []))

    @jsii.member(jsii_name="toGetTaxRegistrationDocument")
    def to_get_tax_registration_document(self) -> "Tax":
        '''(experimental) Grants permission to download tax registration documents.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Tax", jsii.invoke(self, "toGetTaxRegistrationDocument", []))

    @jsii.member(jsii_name="toListTaxRegistrations")
    def to_list_tax_registrations(self) -> "Tax":
        '''(experimental) Grants permission to view tax registrations.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Tax", jsii.invoke(self, "toListTaxRegistrations", []))

    @jsii.member(jsii_name="toPutTaxInheritance")
    def to_put_tax_inheritance(self) -> "Tax":
        '''(experimental) Grants permission to set tax inheritance.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Tax", jsii.invoke(self, "toPutTaxInheritance", []))

    @jsii.member(jsii_name="toPutTaxInterview")
    def to_put_tax_interview(self) -> "Tax":
        '''(experimental) Grants permission to update tax interview data.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/userguide/detailed-management-portal-permissions.html

        :stability: experimental
        '''
        return typing.cast("Tax", jsii.invoke(self, "toPutTaxInterview", []))

    @jsii.member(jsii_name="toPutTaxRegistration")
    def to_put_tax_registration(self) -> "Tax":
        '''(experimental) Grants permission to update tax registrations data.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/userguide/detailed-management-portal-permissions.html

        :stability: experimental
        '''
        return typing.cast("Tax", jsii.invoke(self, "toPutTaxRegistration", []))

    @jsii.member(jsii_name="toUpdateExemptions")
    def to_update_exemptions(self) -> "Tax":
        '''(experimental) Grants permission to update tax exemptions data.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Tax", jsii.invoke(self, "toUpdateExemptions", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fa8c212cece8aa01566cfeb6723b9be64a2ed0ed34cf32d9aa3b707bb7f591f3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1719ad04cb3fad19fe645a6a79b118d106a66b625e2c3341b8b12f35438d6bfb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Textract(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Textract",
):
    '''(experimental) Statement provider for service `textract <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazontextract.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `textract <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazontextract.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__de24a031499f3d290e14f3a644e23ff5c989c20963f4c8be26d59837b6bb6d7b)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toAnalyzeDocument")
    def to_analyze_document(self) -> "Textract":
        '''(experimental) Grants permission to detect instances of real-world document entities within an image provided as input.

        Access Level: Read

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/textract/latest/dg/API_AnalyzeDocument.html

        :stability: experimental
        '''
        return typing.cast("Textract", jsii.invoke(self, "toAnalyzeDocument", []))

    @jsii.member(jsii_name="toAnalyzeExpense")
    def to_analyze_expense(self) -> "Textract":
        '''(experimental) Grants permission to detect instances of real-world document entities within an image provided as input.

        Access Level: Read

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/textract/latest/dg/API_AnalyzeExpense.html

        :stability: experimental
        '''
        return typing.cast("Textract", jsii.invoke(self, "toAnalyzeExpense", []))

    @jsii.member(jsii_name="toAnalyzeID")
    def to_analyze_id(self) -> "Textract":
        '''(experimental) Grants permission to detect relevant information from identity documents provided as input.

        Access Level: Read

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/textract/latest/dg/API_AnalyzeID.html

        :stability: experimental
        '''
        return typing.cast("Textract", jsii.invoke(self, "toAnalyzeID", []))

    @jsii.member(jsii_name="toDetectDocumentText")
    def to_detect_document_text(self) -> "Textract":
        '''(experimental) Grants permission to detect text in document images.

        Access Level: Read

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/textract/latest/dg/API_DetectDocumentText.html

        :stability: experimental
        '''
        return typing.cast("Textract", jsii.invoke(self, "toDetectDocumentText", []))

    @jsii.member(jsii_name="toGetDocumentAnalysis")
    def to_get_document_analysis(self) -> "Textract":
        '''(experimental) Grants permission to return information about a document analysis job.

        Access Level: Read

        https://docs.aws.amazon.com/textract/latest/dg/API_GetDocumentAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Textract", jsii.invoke(self, "toGetDocumentAnalysis", []))

    @jsii.member(jsii_name="toGetDocumentTextDetection")
    def to_get_document_text_detection(self) -> "Textract":
        '''(experimental) Grants permission to return information about a document text detection job.

        Access Level: Read

        https://docs.aws.amazon.com/textract/latest/dg/API_GetDocumentTextDetection.html

        :stability: experimental
        '''
        return typing.cast("Textract", jsii.invoke(self, "toGetDocumentTextDetection", []))

    @jsii.member(jsii_name="toGetExpenseAnalysis")
    def to_get_expense_analysis(self) -> "Textract":
        '''(experimental) Grants permission to return information about an expense analysis job.

        Access Level: Read

        https://docs.aws.amazon.com/textract/latest/dg/API_GetExpenseAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Textract", jsii.invoke(self, "toGetExpenseAnalysis", []))

    @jsii.member(jsii_name="toGetLendingAnalysis")
    def to_get_lending_analysis(self) -> "Textract":
        '''(experimental) Grants permission to retrieve page-level information regarding a lending analysis job.

        Access Level: Read

        https://docs.aws.amazon.com/textract/latest/dg/API_GetLendingAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Textract", jsii.invoke(self, "toGetLendingAnalysis", []))

    @jsii.member(jsii_name="toGetLendingAnalysisSummary")
    def to_get_lending_analysis_summary(self) -> "Textract":
        '''(experimental) Grants permission to retrieve summarized information regarding a lending analysis job.

        Access Level: Read

        https://docs.aws.amazon.com/textract/latest/dg/API_GetLendingAnalysisSummary.html

        :stability: experimental
        '''
        return typing.cast("Textract", jsii.invoke(self, "toGetLendingAnalysisSummary", []))

    @jsii.member(jsii_name="toStartDocumentAnalysis")
    def to_start_document_analysis(self) -> "Textract":
        '''(experimental) Grants permission to start an asynchronous job to detect instances of real-world document entities within an image or pdf provided as input.

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/textract/latest/dg/API_StartDocumentAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Textract", jsii.invoke(self, "toStartDocumentAnalysis", []))

    @jsii.member(jsii_name="toStartDocumentTextDetection")
    def to_start_document_text_detection(self) -> "Textract":
        '''(experimental) Grants permission to start an asynchronous job to detect text in document images or pdfs.

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/textract/latest/dg/API_StartDocumentTextDetection.html

        :stability: experimental
        '''
        return typing.cast("Textract", jsii.invoke(self, "toStartDocumentTextDetection", []))

    @jsii.member(jsii_name="toStartExpenseAnalysis")
    def to_start_expense_analysis(self) -> "Textract":
        '''(experimental) Grants permission to start an asynchronous job to detect instances of invoices or receipts within an image or pdf provided as input.

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/textract/latest/dg/API_StartExpenseAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Textract", jsii.invoke(self, "toStartExpenseAnalysis", []))

    @jsii.member(jsii_name="toStartLendingAnalysis")
    def to_start_lending_analysis(self) -> "Textract":
        '''(experimental) Grants permission to start an asynchronous job for detection of entities in a lending document, takes a provided image or PDF as input.

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/textract/latest/dg/API_StartLendingAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Textract", jsii.invoke(self, "toStartLendingAnalysis", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__48b47a21c3b86e66a9299a6cb18d33a99147d5bb399455915f73d2182b242a40)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ee483bda936ec13f0f62d200494cf4aef6c632961fa6554826a283eaa024e9dc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Timestream(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Timestream",
):
    '''(experimental) Statement provider for service `timestream <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazontimestream.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `timestream <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazontimestream.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d22c607ca6010838de47efe07c056fde26cde6fb02fca8cacc5ea8f9d73f7511)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDatabase")
    def on_database(
        self,
        database_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Timestream":
        '''(experimental) Adds a resource of type database to the statement.

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_Database.html

        :param database_name: - Identifier for the databaseName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ec70fc662bf2e01e7afc89c49998eee675a84dd05102e577b840c94408d91aa8)
            check_type(argname="argument database_name", value=database_name, expected_type=type_hints["database_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Timestream", jsii.invoke(self, "onDatabase", [database_name, account, region, partition]))

    @jsii.member(jsii_name="onScheduledQuery")
    def on_scheduled_query(
        self,
        scheduled_query_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Timestream":
        '''(experimental) Adds a resource of type scheduled-query to the statement.

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_ScheduledQuery.html

        :param scheduled_query_name: - Identifier for the scheduledQueryName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2f1bb7f0bfe8635d3c001ce5e21e9a9e0109cdadef77f57ade3dc033e5807d3d)
            check_type(argname="argument scheduled_query_name", value=scheduled_query_name, expected_type=type_hints["scheduled_query_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Timestream", jsii.invoke(self, "onScheduledQuery", [scheduled_query_name, account, region, partition]))

    @jsii.member(jsii_name="onTable")
    def on_table(
        self,
        database_name: builtins.str,
        table_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Timestream":
        '''(experimental) Adds a resource of type table to the statement.

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_Table.html

        :param database_name: - Identifier for the databaseName.
        :param table_name: - Identifier for the tableName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cfc4cc2ec883b8f2354d272a0976e7207b21055ebb7f8de5de41a932b814dcee)
            check_type(argname="argument database_name", value=database_name, expected_type=type_hints["database_name"])
            check_type(argname="argument table_name", value=table_name, expected_type=type_hints["table_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Timestream", jsii.invoke(self, "onTable", [database_name, table_name, account, region, partition]))

    @jsii.member(jsii_name="toCancelQuery")
    def to_cancel_query(self) -> "Timestream":
        '''(experimental) Grants permission to cancel queries in your account.

        Access Level: Write

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_query_CancelQuery.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toCancelQuery", []))

    @jsii.member(jsii_name="toCreateBatchLoadTask")
    def to_create_batch_load_task(self) -> "Timestream":
        '''(experimental) Grants permission to create a batch load task in your account.

        Access Level: Write

        Dependent actions:

        - timestream:DescribeEndpoints
        - timestream:WriteRecords

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_CreateBatchLoadTask.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toCreateBatchLoadTask", []))

    @jsii.member(jsii_name="toCreateDatabase")
    def to_create_database(self) -> "Timestream":
        '''(experimental) Grants permission to create a database in your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_CreateDatabase.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toCreateDatabase", []))

    @jsii.member(jsii_name="toCreateScheduledQuery")
    def to_create_scheduled_query(self) -> "Timestream":
        '''(experimental) Grants permission to create a scheduled query in your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole
        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_CreateScheduledQuery.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toCreateScheduledQuery", []))

    @jsii.member(jsii_name="toCreateTable")
    def to_create_table(self) -> "Timestream":
        '''(experimental) Grants permission to create a table in your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_CreateTable.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toCreateTable", []))

    @jsii.member(jsii_name="toDeleteDatabase")
    def to_delete_database(self) -> "Timestream":
        '''(experimental) Grants permission to delete a database in your account.

        Access Level: Write

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_DeleteDatabase.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toDeleteDatabase", []))

    @jsii.member(jsii_name="toDeleteScheduledQuery")
    def to_delete_scheduled_query(self) -> "Timestream":
        '''(experimental) Grants permission to delete a scheduled query in your account.

        Access Level: Write

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_DeleteScheduledQuery.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toDeleteScheduledQuery", []))

    @jsii.member(jsii_name="toDeleteTable")
    def to_delete_table(self) -> "Timestream":
        '''(experimental) Grants permission to delete a table in your account.

        Access Level: Write

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_DeleteTable.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toDeleteTable", []))

    @jsii.member(jsii_name="toDescribeBatchLoadTask")
    def to_describe_batch_load_task(self) -> "Timestream":
        '''(experimental) Grants permission to describe a batch load task in your account.

        Access Level: Read

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_DescribeBatchLoadTask.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toDescribeBatchLoadTask", []))

    @jsii.member(jsii_name="toDescribeDatabase")
    def to_describe_database(self) -> "Timestream":
        '''(experimental) Grants permission to describe a database in your account.

        Access Level: Read

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_DescribeDatabase.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toDescribeDatabase", []))

    @jsii.member(jsii_name="toDescribeEndpoints")
    def to_describe_endpoints(self) -> "Timestream":
        '''(experimental) Grants permission to describe timestream endpoints.

        Access Level: List

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_DescribeEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toDescribeEndpoints", []))

    @jsii.member(jsii_name="toDescribeScheduledQuery")
    def to_describe_scheduled_query(self) -> "Timestream":
        '''(experimental) Grants permission to describe a scheduled query in your account.

        Access Level: Read

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_DescribeScheduledQuery.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toDescribeScheduledQuery", []))

    @jsii.member(jsii_name="toDescribeTable")
    def to_describe_table(self) -> "Timestream":
        '''(experimental) Grants permission to describe a table in your account.

        Access Level: Read

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_DescribeTable.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toDescribeTable", []))

    @jsii.member(jsii_name="toExecuteScheduledQuery")
    def to_execute_scheduled_query(self) -> "Timestream":
        '''(experimental) Grants permission to execute a scheduled query in your account.

        Access Level: Write

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_ExecuteScheduledQuery.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toExecuteScheduledQuery", []))

    @jsii.member(jsii_name="toGetAwsBackupStatus")
    def to_get_aws_backup_status(self) -> "Timestream":
        '''(experimental) Grants permission to get Status of a Timestream Table Backup.

        Access Level: Read

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/backups.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toGetAwsBackupStatus", []))

    @jsii.member(jsii_name="toGetAwsRestoreStatus")
    def to_get_aws_restore_status(self) -> "Timestream":
        '''(experimental) Grants permission to get Status of a Timestream Table Restore.

        Access Level: Read

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/backups.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toGetAwsRestoreStatus", []))

    @jsii.member(jsii_name="toListBatchLoadTasks")
    def to_list_batch_load_tasks(self) -> "Timestream":
        '''(experimental) Grants permission to list batch load tasks in your account.

        Access Level: List

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_ListBatchLoadTasks.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toListBatchLoadTasks", []))

    @jsii.member(jsii_name="toListDatabases")
    def to_list_databases(self) -> "Timestream":
        '''(experimental) Grants permission to list databases in your account.

        Access Level: List

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_ListDatabases.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toListDatabases", []))

    @jsii.member(jsii_name="toListMeasures")
    def to_list_measures(self) -> "Timestream":
        '''(experimental) Grants permission to list measures of a table in your account.

        Access Level: List

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_query_Query.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toListMeasures", []))

    @jsii.member(jsii_name="toListScheduledQueries")
    def to_list_scheduled_queries(self) -> "Timestream":
        '''(experimental) Grants permission to list scheduled queries in your account.

        Access Level: List

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_ListScheduledQueries.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toListScheduledQueries", []))

    @jsii.member(jsii_name="toListTables")
    def to_list_tables(self) -> "Timestream":
        '''(experimental) Grants permission to list tables in your account.

        Access Level: List

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_ListTables.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toListTables", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Timestream":
        '''(experimental) Grants permission to list tags of a resource in your account.

        Access Level: Read

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPrepareQuery")
    def to_prepare_query(self) -> "Timestream":
        '''(experimental) Grants permission to issue prepare queries.

        Access Level: Read

        Dependent actions:

        - timestream:DescribeEndpoints
        - timestream:Select

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_query_PrepareQuery.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toPrepareQuery", []))

    @jsii.member(jsii_name="toResumeBatchLoadTask")
    def to_resume_batch_load_task(self) -> "Timestream":
        '''(experimental) Grants permission to resume a batch load task in your account.

        Access Level: Write

        Dependent actions:

        - timestream:DescribeEndpoints
        - timestream:WriteRecords

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_ResumeBatchLoadTask.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toResumeBatchLoadTask", []))

    @jsii.member(jsii_name="toSelect")
    def to_select(self) -> "Timestream":
        '''(experimental) Grants permission to issue 'select from table' queries.

        Access Level: Read

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_query_Query.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toSelect", []))

    @jsii.member(jsii_name="toSelectValues")
    def to_select_values(self) -> "Timestream":
        '''(experimental) Grants permission to issue 'select 1' queries.

        Access Level: Read

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_query_Query.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toSelectValues", []))

    @jsii.member(jsii_name="toStartAwsBackupJob")
    def to_start_aws_backup_job(self) -> "Timestream":
        '''(experimental) Grants permission to start a Backup Job for a Timestream Table.

        Access Level: Write

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/backups.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toStartAwsBackupJob", []))

    @jsii.member(jsii_name="toStartAwsRestoreJob")
    def to_start_aws_restore_job(self) -> "Timestream":
        '''(experimental) Grants permission to start Restore Job for a Backup of Timestream Table.

        Access Level: Write

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/backups.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toStartAwsRestoreJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Timestream":
        '''(experimental) Grants permission to add tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Timestream":
        '''(experimental) Grants permission to remove a tag from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDatabase")
    def to_update_database(self) -> "Timestream":
        '''(experimental) Grants permission to update a database in your account.

        Access Level: Write

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_UpdateDatabase.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toUpdateDatabase", []))

    @jsii.member(jsii_name="toUpdateScheduledQuery")
    def to_update_scheduled_query(self) -> "Timestream":
        '''(experimental) Grants permission to update a scheduled query in your account.

        Access Level: Write

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_UpdateScheduledQuery.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toUpdateScheduledQuery", []))

    @jsii.member(jsii_name="toUpdateTable")
    def to_update_table(self) -> "Timestream":
        '''(experimental) Grants permission to update a table in your account.

        Access Level: Write

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_UpdateTable.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toUpdateTable", []))

    @jsii.member(jsii_name="toWriteRecords")
    def to_write_records(self) -> "Timestream":
        '''(experimental) Grants permission to ingest data to a table in your account.

        Access Level: Write

        Dependent actions:

        - timestream:DescribeEndpoints

        https://docs.aws.amazon.com/timestream/latest/developerguide/API_WriteRecords.html

        :stability: experimental
        '''
        return typing.cast("Timestream", jsii.invoke(self, "toWriteRecords", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5b24675b710539b8947b64871894e4d3621614bc30f6fd6f7986305186a26839)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1815e746353d2c032737c60eccd675e1d2dc9661055528ab81eb4829cbdfdc87)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Tiros(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Tiros"):
    '''(experimental) Statement provider for service `tiros <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awstiros.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `tiros <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awstiros.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__da72cfafc3a77f77e384569ba362c315660f7e44829adfea275cd3f2c787dda5)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toCreateQuery")
    def to_create_query(self) -> "Tiros":
        '''(experimental) Grants permission to create a VPC reachability query.

        Access Level: Write

        https://docs.aws.amazon.com/vpc/latest/reachability/security_iam_required-API-permissions.html

        :stability: experimental
        '''
        return typing.cast("Tiros", jsii.invoke(self, "toCreateQuery", []))

    @jsii.member(jsii_name="toExtendQuery")
    def to_extend_query(self) -> "Tiros":
        '''(experimental) Grants permission to extend a VPC reachability query to include the calling principals account.

        Access Level: Write

        https://docs.aws.amazon.com/vpc/latest/reachability/security_iam_required-API-permissions.html

        :stability: experimental
        '''
        return typing.cast("Tiros", jsii.invoke(self, "toExtendQuery", []))

    @jsii.member(jsii_name="toGetQueryAnswer")
    def to_get_query_answer(self) -> "Tiros":
        '''(experimental) Grants permission to get VPC reachability query answers.

        Access Level: Read

        https://docs.aws.amazon.com/vpc/latest/reachability/security_iam_required-API-permissions.html

        :stability: experimental
        '''
        return typing.cast("Tiros", jsii.invoke(self, "toGetQueryAnswer", []))

    @jsii.member(jsii_name="toGetQueryExplanation")
    def to_get_query_explanation(self) -> "Tiros":
        '''(experimental) Grants permission to get VPC reachability query explanations.

        Access Level: Read

        https://docs.aws.amazon.com/vpc/latest/reachability/security_iam_required-API-permissions.html

        :stability: experimental
        '''
        return typing.cast("Tiros", jsii.invoke(self, "toGetQueryExplanation", []))

    @jsii.member(jsii_name="toGetQueryExtensionAccounts")
    def to_get_query_extension_accounts(self) -> "Tiros":
        '''(experimental) Grants permission to list accounts that might be useful in a new query.

        Access Level: Read

        https://docs.aws.amazon.com/vpc/latest/reachability/security_iam_required-API-permissions.html

        :stability: experimental
        '''
        return typing.cast("Tiros", jsii.invoke(self, "toGetQueryExtensionAccounts", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bc6d8bca1745d4c25b6b37fe67ef7cf9ae0e1ca75fc4861f2758fd49a33fdc36)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__34af5f1ad639e27f581e68a8d5146b9fa768e2d115b6afdd3dd972676de91258)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Tnb(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Tnb"):
    '''(experimental) Statement provider for service `tnb <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awstelconetworkbuilder.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `tnb <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awstelconetworkbuilder.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__94745ec3295d458cc0fdd3abfb4bf925955eebc8b62306f6d5acc9fb806696d3)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onFunctionInstance")
    def on_function_instance(
        self,
        function_instance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Tnb":
        '''(experimental) Adds a resource of type function-instance to the statement.

        https://docs.aws.amazon.com/tnb/latest/ug/function-packages.html

        :param function_instance_id: - Identifier for the functionInstanceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9125165f1c7e2676fb6c8ced601153f4ad0013f021e1d01784f944fbcaef60fa)
            check_type(argname="argument function_instance_id", value=function_instance_id, expected_type=type_hints["function_instance_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Tnb", jsii.invoke(self, "onFunctionInstance", [function_instance_id, account, region, partition]))

    @jsii.member(jsii_name="onFunctionPackage")
    def on_function_package(
        self,
        function_package_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Tnb":
        '''(experimental) Adds a resource of type function-package to the statement.

        https://docs.aws.amazon.com/tnb/latest/ug/function-packages.html

        :param function_package_id: - Identifier for the functionPackageId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4af165ab86e053df8df675925f1632131a6cfc87f148c69b3975591e15a5cd0b)
            check_type(argname="argument function_package_id", value=function_package_id, expected_type=type_hints["function_package_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Tnb", jsii.invoke(self, "onFunctionPackage", [function_package_id, account, region, partition]))

    @jsii.member(jsii_name="onNetworkInstance")
    def on_network_instance(
        self,
        network_instance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Tnb":
        '''(experimental) Adds a resource of type network-instance to the statement.

        https://docs.aws.amazon.com/tnb/latest/ug/network-instances.html

        :param network_instance_id: - Identifier for the networkInstanceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2417c6ee036e1e7b7139b71523506c92fa7e42ce0d13280b4d796d0b809fa507)
            check_type(argname="argument network_instance_id", value=network_instance_id, expected_type=type_hints["network_instance_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Tnb", jsii.invoke(self, "onNetworkInstance", [network_instance_id, account, region, partition]))

    @jsii.member(jsii_name="onNetworkOperation")
    def on_network_operation(
        self,
        network_operation_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Tnb":
        '''(experimental) Adds a resource of type network-operation to the statement.

        https://docs.aws.amazon.com/tnb/latest/ug/network-operations.html

        :param network_operation_id: - Identifier for the networkOperationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__910361a523340d3ec21662d1139acb43c279a4226d15bdb3e715241ec8dcd180)
            check_type(argname="argument network_operation_id", value=network_operation_id, expected_type=type_hints["network_operation_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Tnb", jsii.invoke(self, "onNetworkOperation", [network_operation_id, account, region, partition]))

    @jsii.member(jsii_name="onNetworkPackage")
    def on_network_package(
        self,
        network_package_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Tnb":
        '''(experimental) Adds a resource of type network-package to the statement.

        https://docs.aws.amazon.com/tnb/latest/ug/network-packages.html

        :param network_package_id: - Identifier for the networkPackageId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e34c79e9d9232cce4bcddcccf1b541d952438eaba3a28ff3bd344c33048007ee)
            check_type(argname="argument network_package_id", value=network_package_id, expected_type=type_hints["network_package_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Tnb", jsii.invoke(self, "onNetworkPackage", [network_package_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelSolNetworkOperation")
    def to_cancel_sol_network_operation(self) -> "Tnb":
        '''(experimental) Grants permission to cancel a network operation.

        Access Level: Write

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_CancelSolNetworkOperation.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toCancelSolNetworkOperation", []))

    @jsii.member(jsii_name="toCreateSolFunctionPackage")
    def to_create_sol_function_package(self) -> "Tnb":
        '''(experimental) Grants permission to create a function package.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_CreateSolFunctionPackage.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toCreateSolFunctionPackage", []))

    @jsii.member(jsii_name="toCreateSolNetworkInstance")
    def to_create_sol_network_instance(self) -> "Tnb":
        '''(experimental) Grants permission to create a network instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_CreateSolNetworkInstance.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toCreateSolNetworkInstance", []))

    @jsii.member(jsii_name="toCreateSolNetworkPackage")
    def to_create_sol_network_package(self) -> "Tnb":
        '''(experimental) Grants permission to create a network package.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_CreateSolNetworkPackage.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toCreateSolNetworkPackage", []))

    @jsii.member(jsii_name="toDeleteSolFunctionPackage")
    def to_delete_sol_function_package(self) -> "Tnb":
        '''(experimental) Grants permission to delete a function package.

        Access Level: Write

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_DeleteSolFunctionPackage.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toDeleteSolFunctionPackage", []))

    @jsii.member(jsii_name="toDeleteSolNetworkInstance")
    def to_delete_sol_network_instance(self) -> "Tnb":
        '''(experimental) Grants permission to delete a network instance.

        Access Level: Write

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_DeleteSolNetworkInstance.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toDeleteSolNetworkInstance", []))

    @jsii.member(jsii_name="toDeleteSolNetworkPackage")
    def to_delete_sol_network_package(self) -> "Tnb":
        '''(experimental) Grants permission to delete a network package.

        Access Level: Write

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_DeleteSolNetworkPackage.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toDeleteSolNetworkPackage", []))

    @jsii.member(jsii_name="toGetSolFunctionInstance")
    def to_get_sol_function_instance(self) -> "Tnb":
        '''(experimental) Grants permission to get a function instance.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_GetSolFunctionInstance.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toGetSolFunctionInstance", []))

    @jsii.member(jsii_name="toGetSolFunctionPackage")
    def to_get_sol_function_package(self) -> "Tnb":
        '''(experimental) Grants permission to get a function package.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_GetSolFunctionPackage.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toGetSolFunctionPackage", []))

    @jsii.member(jsii_name="toGetSolFunctionPackageContent")
    def to_get_sol_function_package_content(self) -> "Tnb":
        '''(experimental) Grants permission to get a function package contents.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_GetSolFunctionPackageContent.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toGetSolFunctionPackageContent", []))

    @jsii.member(jsii_name="toGetSolFunctionPackageDescriptor")
    def to_get_sol_function_package_descriptor(self) -> "Tnb":
        '''(experimental) Grants permission to get a function package descriptor.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_GetSolFunctionPackageDescriptor.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toGetSolFunctionPackageDescriptor", []))

    @jsii.member(jsii_name="toGetSolNetworkInstance")
    def to_get_sol_network_instance(self) -> "Tnb":
        '''(experimental) Grants permission to get a network instance.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_GetSolNetworkInstance.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toGetSolNetworkInstance", []))

    @jsii.member(jsii_name="toGetSolNetworkOperation")
    def to_get_sol_network_operation(self) -> "Tnb":
        '''(experimental) Grants permission to get a network operation.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_GetSolNetworkOperation.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toGetSolNetworkOperation", []))

    @jsii.member(jsii_name="toGetSolNetworkPackage")
    def to_get_sol_network_package(self) -> "Tnb":
        '''(experimental) Grants permission to get a network package.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_GetSolNetworkPackage.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toGetSolNetworkPackage", []))

    @jsii.member(jsii_name="toGetSolNetworkPackageContent")
    def to_get_sol_network_package_content(self) -> "Tnb":
        '''(experimental) Grants permission to get a network package contents.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_GetSolNetworkPackageContent.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toGetSolNetworkPackageContent", []))

    @jsii.member(jsii_name="toGetSolNetworkPackageDescriptor")
    def to_get_sol_network_package_descriptor(self) -> "Tnb":
        '''(experimental) Grants permission to get a network package descriptor.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_GetSolNetworkPackageDescriptor.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toGetSolNetworkPackageDescriptor", []))

    @jsii.member(jsii_name="toInstantiateSolNetworkInstance")
    def to_instantiate_sol_network_instance(self) -> "Tnb":
        '''(experimental) Grants permission to instantiate a network instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_InstantiateSolNetworkInstance.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toInstantiateSolNetworkInstance", []))

    @jsii.member(jsii_name="toListSolFunctionInstances")
    def to_list_sol_function_instances(self) -> "Tnb":
        '''(experimental) Grants permission to list function instances.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_ListSolFunctionInstances.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toListSolFunctionInstances", []))

    @jsii.member(jsii_name="toListSolFunctionPackages")
    def to_list_sol_function_packages(self) -> "Tnb":
        '''(experimental) Grants permission to list function packages.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_ListSolFunctionPackages.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toListSolFunctionPackages", []))

    @jsii.member(jsii_name="toListSolNetworkInstances")
    def to_list_sol_network_instances(self) -> "Tnb":
        '''(experimental) Grants permission to list network instances.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_ListSolNetworkInstances.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toListSolNetworkInstances", []))

    @jsii.member(jsii_name="toListSolNetworkOperations")
    def to_list_sol_network_operations(self) -> "Tnb":
        '''(experimental) Grants permission to list network operations.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_ListSolNetworkOperations.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toListSolNetworkOperations", []))

    @jsii.member(jsii_name="toListSolNetworkPackages")
    def to_list_sol_network_packages(self) -> "Tnb":
        '''(experimental) Grants permission to list network packages.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_ListSolNetworkPackages.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toListSolNetworkPackages", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Tnb":
        '''(experimental) Grants permission to return a list of tags for a resource.

        Access Level: List

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutSolFunctionPackageContent")
    def to_put_sol_function_package_content(self) -> "Tnb":
        '''(experimental) Grants permission to upload function package content.

        Access Level: Write

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_PutSolFunctionPackageContent.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toPutSolFunctionPackageContent", []))

    @jsii.member(jsii_name="toPutSolNetworkPackageContent")
    def to_put_sol_network_package_content(self) -> "Tnb":
        '''(experimental) Grants permission to upload network package content.

        Access Level: Write

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_PutSolNetworkPackageContent.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toPutSolNetworkPackageContent", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Tnb":
        '''(experimental) Grants permission to add tags to the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTerminateSolNetworkInstance")
    def to_terminate_sol_network_instance(self) -> "Tnb":
        '''(experimental) Grants permission to terminate a network instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_TerminateSolNetworkInstance.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toTerminateSolNetworkInstance", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Tnb":
        '''(experimental) Grants permission to remove tags from the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateSolFunctionPackage")
    def to_update_sol_function_package(self) -> "Tnb":
        '''(experimental) Grants permission to update a function package.

        Access Level: Write

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_UpdateSolFunctionPackage.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toUpdateSolFunctionPackage", []))

    @jsii.member(jsii_name="toUpdateSolNetworkInstance")
    def to_update_sol_network_instance(self) -> "Tnb":
        '''(experimental) Grants permission to update a network instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_UpdateSolNetworkInstance.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toUpdateSolNetworkInstance", []))

    @jsii.member(jsii_name="toUpdateSolNetworkPackage")
    def to_update_sol_network_package(self) -> "Tnb":
        '''(experimental) Grants permission to update a network package.

        Access Level: Write

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_UpdateSolNetworkPackage.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toUpdateSolNetworkPackage", []))

    @jsii.member(jsii_name="toValidateSolFunctionPackageContent")
    def to_validate_sol_function_package_content(self) -> "Tnb":
        '''(experimental) Grants permission to validate function package content.

        Access Level: Write

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_ValidateSolFunctionPackageContent.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toValidateSolFunctionPackageContent", []))

    @jsii.member(jsii_name="toValidateSolNetworkPackageContent")
    def to_validate_sol_network_package_content(self) -> "Tnb":
        '''(experimental) Grants permission to validate network package content.

        Access Level: Write

        https://docs.aws.amazon.com/tnb/latest/APIReference/API_ValidateSolNetworkPackageContent.html

        :stability: experimental
        '''
        return typing.cast("Tnb", jsii.invoke(self, "toValidateSolNetworkPackageContent", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a1d172520938b2ef7ef3168c4a2d5938d261a2483f49063dc0d2b067fa4222fa)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d4dbe9a1c7c65978f2b13564faf2cfdeef0bc3cfb5bab92845179acd644cb77b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Transcribe(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Transcribe",
):
    '''(experimental) Statement provider for service `transcribe <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazontranscribe.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `transcribe <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazontranscribe.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5240abf1b7e52717682400c05c8437b1468e8ac7d4ac1d2d5d539a4b51654e57)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifOutputBucketName")
    def if_output_bucket_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Transcribe":
        '''(experimental) Filters access based on the output bucket name included in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazontranscribe.html#amazontranscribe-policy-keys

        Applies to actions:

        - .toStartMedicalTranscriptionJob()
        - .toStartTranscriptionJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ee4022d350c718f8c830b2d4c9c06b1197b866025d7b933d0d1a4c8447d61e22)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Transcribe", jsii.invoke(self, "ifOutputBucketName", [value, operator]))

    @jsii.member(jsii_name="ifOutputEncryptionKMSKeyId")
    def if_output_encryption_kms_key_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Transcribe":
        '''(experimental) Filters access based on the KMS key id included in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazontranscribe.html#amazontranscribe-policy-keys

        Applies to actions:

        - .toStartCallAnalyticsJob()
        - .toStartMedicalTranscriptionJob()
        - .toStartTranscriptionJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3b160391d20bb786d185bf14331a1cbcb14c73e9bc8bc94db69a03c6d59ce507)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Transcribe", jsii.invoke(self, "ifOutputEncryptionKMSKeyId", [value, operator]))

    @jsii.member(jsii_name="ifOutputKey")
    def if_output_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Transcribe":
        '''(experimental) Filters access based on the output key included in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazontranscribe.html#amazontranscribe-policy-keys

        Applies to actions:

        - .toStartMedicalTranscriptionJob()
        - .toStartTranscriptionJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cf92ca4f951110771ea4a5922a131081870458345095f285ba32a8109dd27440)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Transcribe", jsii.invoke(self, "ifOutputKey", [value, operator]))

    @jsii.member(jsii_name="ifOutputLocation")
    def if_output_location(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Transcribe":
        '''(experimental) Filters access based on the output location included in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazontranscribe.html#amazontranscribe-policy-keys

        Applies to actions:

        - .toStartCallAnalyticsJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dda65eb06857ba8b510afeff64300b238057f3390c63080c9735da027371f0db)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Transcribe", jsii.invoke(self, "ifOutputLocation", [value, operator]))

    @jsii.member(jsii_name="onCallanalyticscategory")
    def on_callanalyticscategory(
        self,
        category_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Transcribe":
        '''(experimental) Adds a resource of type callanalyticscategory to the statement.

        https://docs.aws.amazon.com/transcribe/latest/dg/API_CreateCallAnalyticsCategory.html

        :param category_name: - Identifier for the categoryName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__58b2f48793dc1f004a7e05b726003a1f95cbd6e9e3cd19b79ba500cae210f2e7)
            check_type(argname="argument category_name", value=category_name, expected_type=type_hints["category_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Transcribe", jsii.invoke(self, "onCallanalyticscategory", [category_name, account, region, partition]))

    @jsii.member(jsii_name="onCallanalyticsjob")
    def on_callanalyticsjob(
        self,
        job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Transcribe":
        '''(experimental) Adds a resource of type callanalyticsjob to the statement.

        https://docs.aws.amazon.com/transcribe/latest/dg/API_CallAnalyticsJob.html

        :param job_name: - Identifier for the jobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f6056a54bc5acbfc56fc175e9d8f08ae3e8f4b503c032fbd97b3d00571c0eee9)
            check_type(argname="argument job_name", value=job_name, expected_type=type_hints["job_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Transcribe", jsii.invoke(self, "onCallanalyticsjob", [job_name, account, region, partition]))

    @jsii.member(jsii_name="onLanguagemodel")
    def on_languagemodel(
        self,
        model_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Transcribe":
        '''(experimental) Adds a resource of type languagemodel to the statement.

        https://docs.aws.amazon.com/transcribe/latest/dg/API_LanguageModel.html

        :param model_name: - Identifier for the modelName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__894a96f27215e4eb9f586f8db36eef8bbe92b01f85473e051610127b5573625e)
            check_type(argname="argument model_name", value=model_name, expected_type=type_hints["model_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Transcribe", jsii.invoke(self, "onLanguagemodel", [model_name, account, region, partition]))

    @jsii.member(jsii_name="onMedicaltranscriptionjob")
    def on_medicaltranscriptionjob(
        self,
        job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Transcribe":
        '''(experimental) Adds a resource of type medicaltranscriptionjob to the statement.

        https://docs.aws.amazon.com/transcribe/latest/dg/API_MedicalTranscriptionJob.html

        :param job_name: - Identifier for the jobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2914d583e3ffce5dc6a9224a0afb431fa41bfe3ed78b05b641abf2dc82476b82)
            check_type(argname="argument job_name", value=job_name, expected_type=type_hints["job_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Transcribe", jsii.invoke(self, "onMedicaltranscriptionjob", [job_name, account, region, partition]))

    @jsii.member(jsii_name="onMedicalvocabulary")
    def on_medicalvocabulary(
        self,
        vocabulary_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Transcribe":
        '''(experimental) Adds a resource of type medicalvocabulary to the statement.

        https://docs.aws.amazon.com/transcribe/latest/dg/API_CreateMedicalVocabulary.html

        :param vocabulary_name: - Identifier for the vocabularyName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dd11428f223cf45d3e9d13766cc19d19e3fc255507d60491bee6b64a754217c0)
            check_type(argname="argument vocabulary_name", value=vocabulary_name, expected_type=type_hints["vocabulary_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Transcribe", jsii.invoke(self, "onMedicalvocabulary", [vocabulary_name, account, region, partition]))

    @jsii.member(jsii_name="onTranscriptionjob")
    def on_transcriptionjob(
        self,
        job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Transcribe":
        '''(experimental) Adds a resource of type transcriptionjob to the statement.

        https://docs.aws.amazon.com/transcribe/latest/dg/API_TranscriptionJob.html

        :param job_name: - Identifier for the jobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d1cc5fcea587f0dd81ba30c68b13493830415ac411cd5d24f33ec8474199feed)
            check_type(argname="argument job_name", value=job_name, expected_type=type_hints["job_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Transcribe", jsii.invoke(self, "onTranscriptionjob", [job_name, account, region, partition]))

    @jsii.member(jsii_name="onVocabulary")
    def on_vocabulary(
        self,
        vocabulary_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Transcribe":
        '''(experimental) Adds a resource of type vocabulary to the statement.

        https://docs.aws.amazon.com/transcribe/latest/dg/API_CreateVocabulary.html

        :param vocabulary_name: - Identifier for the vocabularyName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2c7e9b0a14032534c593b9a0de35b7886a2e12098116a67cd5273a891702622f)
            check_type(argname="argument vocabulary_name", value=vocabulary_name, expected_type=type_hints["vocabulary_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Transcribe", jsii.invoke(self, "onVocabulary", [vocabulary_name, account, region, partition]))

    @jsii.member(jsii_name="onVocabularyfilter")
    def on_vocabularyfilter(
        self,
        vocabulary_filter_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Transcribe":
        '''(experimental) Adds a resource of type vocabularyfilter to the statement.

        https://docs.aws.amazon.com/transcribe/latest/dg/API_CreateVocabularyFilter.html

        :param vocabulary_filter_name: - Identifier for the vocabularyFilterName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__68be0fc75254e58a1c0ff6d22635f76e37e8524b0c92432efd3366bdb438167b)
            check_type(argname="argument vocabulary_filter_name", value=vocabulary_filter_name, expected_type=type_hints["vocabulary_filter_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Transcribe", jsii.invoke(self, "onVocabularyfilter", [vocabulary_filter_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateCallAnalyticsCategory")
    def to_create_call_analytics_category(self) -> "Transcribe":
        '''(experimental) Grants permission to create an analytics category.

        Amazon Transcribe applies the conditions specified by your analytics categories to your call analytics jobs

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_CreateCallAnalyticsCategory.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toCreateCallAnalyticsCategory", []))

    @jsii.member(jsii_name="toCreateLanguageModel")
    def to_create_language_model(self) -> "Transcribe":
        '''(experimental) Grants permission to create a new custom language model.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - s3:GetObject
        - s3:ListBucket

        https://docs.aws.amazon.com/transcribe/latest/dg/API_CreateLanguageModel.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toCreateLanguageModel", []))

    @jsii.member(jsii_name="toCreateMedicalVocabulary")
    def to_create_medical_vocabulary(self) -> "Transcribe":
        '''(experimental) Grants permission to create a new custom vocabulary that you can use to change the way Amazon Transcribe Medical handles transcription of an audio file.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/transcribe/latest/dg/API_CreateMedicalVocabulary.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toCreateMedicalVocabulary", []))

    @jsii.member(jsii_name="toCreateVocabulary")
    def to_create_vocabulary(self) -> "Transcribe":
        '''(experimental) Grants permission to create a new custom vocabulary that you can use to change the way Amazon Transcribe handles transcription of an audio file.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/transcribe/latest/dg/API_CreateVocabulary.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toCreateVocabulary", []))

    @jsii.member(jsii_name="toCreateVocabularyFilter")
    def to_create_vocabulary_filter(self) -> "Transcribe":
        '''(experimental) Grants permission to create a new vocabulary filter that you can use to filter out words from the transcription of an audio file generated by Amazon Transcribe.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/transcribe/latest/dg/API_CreateVocabularyFilter.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toCreateVocabularyFilter", []))

    @jsii.member(jsii_name="toDeleteCallAnalyticsCategory")
    def to_delete_call_analytics_category(self) -> "Transcribe":
        '''(experimental) Grants permission to delete a call analytics category using its name from Amazon Transcribe.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_DeleteCallAnalyticsCategory.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toDeleteCallAnalyticsCategory", []))

    @jsii.member(jsii_name="toDeleteCallAnalyticsJob")
    def to_delete_call_analytics_job(self) -> "Transcribe":
        '''(experimental) Grants permission to delete a previously submitted call analytics job along with any other generated results such as the transcription, models, and so on.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_DeleteCallAnalyticsJob.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toDeleteCallAnalyticsJob", []))

    @jsii.member(jsii_name="toDeleteLanguageModel")
    def to_delete_language_model(self) -> "Transcribe":
        '''(experimental) Grants permission to delete a previously created custom language model.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_DeleteLanguageModel.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toDeleteLanguageModel", []))

    @jsii.member(jsii_name="toDeleteMedicalTranscriptionJob")
    def to_delete_medical_transcription_job(self) -> "Transcribe":
        '''(experimental) Grants permission to delete a previously submitted medical transcription job.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_DeleteMedicalTranscriptionJob.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toDeleteMedicalTranscriptionJob", []))

    @jsii.member(jsii_name="toDeleteMedicalVocabulary")
    def to_delete_medical_vocabulary(self) -> "Transcribe":
        '''(experimental) Grants permission to delete a medical vocabulary from Amazon Transcribe.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_DeleteMedicalVocabulary.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toDeleteMedicalVocabulary", []))

    @jsii.member(jsii_name="toDeleteTranscriptionJob")
    def to_delete_transcription_job(self) -> "Transcribe":
        '''(experimental) Grants permission to delete a previously submitted transcription job along with any other generated results such as the transcription, models, and so on.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_DeleteTranscriptionJob.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toDeleteTranscriptionJob", []))

    @jsii.member(jsii_name="toDeleteVocabulary")
    def to_delete_vocabulary(self) -> "Transcribe":
        '''(experimental) Grants permission to delete a vocabulary from Amazon Transcribe.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_DeleteVocabulary.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toDeleteVocabulary", []))

    @jsii.member(jsii_name="toDeleteVocabularyFilter")
    def to_delete_vocabulary_filter(self) -> "Transcribe":
        '''(experimental) Grants permission to delete a vocabulary filter from Amazon Transcribe.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_DeleteVocabularyFilter.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toDeleteVocabularyFilter", []))

    @jsii.member(jsii_name="toDescribeLanguageModel")
    def to_describe_language_model(self) -> "Transcribe":
        '''(experimental) Grants permission to return information about a custom language model.

        Access Level: Read

        https://docs.aws.amazon.com/transcribe/latest/dg/API_DescribeLanguageModel.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toDescribeLanguageModel", []))

    @jsii.member(jsii_name="toGetCallAnalyticsCategory")
    def to_get_call_analytics_category(self) -> "Transcribe":
        '''(experimental) Grants permission to retrieve information about a call analytics category.

        Access Level: Read

        https://docs.aws.amazon.com/transcribe/latest/dg/API_GetCallAnalyticsCategory.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toGetCallAnalyticsCategory", []))

    @jsii.member(jsii_name="toGetCallAnalyticsJob")
    def to_get_call_analytics_job(self) -> "Transcribe":
        '''(experimental) Grants permission to return information about a call analytics job.

        Access Level: Read

        https://docs.aws.amazon.com/transcribe/latest/dg/API_GetCallAnalyticsJob.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toGetCallAnalyticsJob", []))

    @jsii.member(jsii_name="toGetMedicalTranscriptionJob")
    def to_get_medical_transcription_job(self) -> "Transcribe":
        '''(experimental) Grants permission to return information about a medical transcription job.

        Access Level: Read

        https://docs.aws.amazon.com/transcribe/latest/dg/API_GetMedicalTranscriptionJob.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toGetMedicalTranscriptionJob", []))

    @jsii.member(jsii_name="toGetMedicalVocabulary")
    def to_get_medical_vocabulary(self) -> "Transcribe":
        '''(experimental) Grants permission to get information about a medical vocabulary.

        Access Level: Read

        https://docs.aws.amazon.com/transcribe/latest/dg/API_GetMedicalVocabulary.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toGetMedicalVocabulary", []))

    @jsii.member(jsii_name="toGetTranscriptionJob")
    def to_get_transcription_job(self) -> "Transcribe":
        '''(experimental) Grants permission to return information about a transcription job.

        Access Level: Read

        https://docs.aws.amazon.com/transcribe/latest/dg/API_GetTranscriptionJob.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toGetTranscriptionJob", []))

    @jsii.member(jsii_name="toGetVocabulary")
    def to_get_vocabulary(self) -> "Transcribe":
        '''(experimental) Grants permission to to get information about a vocabulary.

        Access Level: Read

        https://docs.aws.amazon.com/transcribe/latest/dg/API_GetVocabulary.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toGetVocabulary", []))

    @jsii.member(jsii_name="toGetVocabularyFilter")
    def to_get_vocabulary_filter(self) -> "Transcribe":
        '''(experimental) Grants permission to get information about a vocabulary filter.

        Access Level: Read

        https://docs.aws.amazon.com/transcribe/latest/dg/API_GetVocabularyFilter.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toGetVocabularyFilter", []))

    @jsii.member(jsii_name="toListCallAnalyticsCategories")
    def to_list_call_analytics_categories(self) -> "Transcribe":
        '''(experimental) Grants permission to list call analytics categories that has been created.

        Access Level: List

        https://docs.aws.amazon.com/transcribe/latest/dg/API_ListCallAnalyticsCategories.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toListCallAnalyticsCategories", []))

    @jsii.member(jsii_name="toListCallAnalyticsJobs")
    def to_list_call_analytics_jobs(self) -> "Transcribe":
        '''(experimental) Grants permission to list call analytics jobs with the specified status.

        Access Level: List

        https://docs.aws.amazon.com/transcribe/latest/dg/API_ListCallAnalyticsJobs.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toListCallAnalyticsJobs", []))

    @jsii.member(jsii_name="toListLanguageModels")
    def to_list_language_models(self) -> "Transcribe":
        '''(experimental) Grants permission to list custom language models.

        Access Level: List

        https://docs.aws.amazon.com/transcribe/latest/dg/API_ListLanguageModels.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toListLanguageModels", []))

    @jsii.member(jsii_name="toListMedicalTranscriptionJobs")
    def to_list_medical_transcription_jobs(self) -> "Transcribe":
        '''(experimental) Grants permission to list medical transcription jobs with the specified status.

        Access Level: List

        https://docs.aws.amazon.com/transcribe/latest/dg/API_ListMedicalTranscriptionJobs.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toListMedicalTranscriptionJobs", []))

    @jsii.member(jsii_name="toListMedicalVocabularies")
    def to_list_medical_vocabularies(self) -> "Transcribe":
        '''(experimental) Grants permission to return a list of medical vocabularies that match the specified criteria.

        If no criteria are specified, returns the entire list of vocabularies

        Access Level: List

        https://docs.aws.amazon.com/transcribe/latest/dg/API_ListMedicalVocabularies.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toListMedicalVocabularies", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Transcribe":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/transcribe/latest/dg/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTranscriptionJobs")
    def to_list_transcription_jobs(self) -> "Transcribe":
        '''(experimental) Grants permission to list transcription jobs with the specified status.

        Access Level: List

        https://docs.aws.amazon.com/transcribe/latest/dg/API_ListTranscriptionJobs.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toListTranscriptionJobs", []))

    @jsii.member(jsii_name="toListVocabularies")
    def to_list_vocabularies(self) -> "Transcribe":
        '''(experimental) Grants permission to return a list of vocabularies that match the specified criteria.

        If no criteria are specified, returns the entire list of vocabularies

        Access Level: List

        https://docs.aws.amazon.com/transcribe/latest/dg/API_ListVocabularies.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toListVocabularies", []))

    @jsii.member(jsii_name="toListVocabularyFilters")
    def to_list_vocabulary_filters(self) -> "Transcribe":
        '''(experimental) Grants permission to return a list of vocabulary filters that match the specified criteria.

        If no criteria are specified, returns the at most 5 vocabulary filters

        Access Level: List

        https://docs.aws.amazon.com/transcribe/latest/dg/API_ListVocabularyFilters.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toListVocabularyFilters", []))

    @jsii.member(jsii_name="toStartCallAnalyticsJob")
    def to_start_call_analytics_job(self) -> "Transcribe":
        '''(experimental) Grants permission to start an asynchronous analytics job that not only transcribes the audio recording of a caller and agent, but also returns additional insights.

        Access Level: Write

        Possible conditions:

        - .ifOutputEncryptionKMSKeyId()
        - .ifOutputLocation()

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/transcribe/latest/dg/API_StartCallAnalyticsJob.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toStartCallAnalyticsJob", []))

    @jsii.member(jsii_name="toStartCallAnalyticsStreamTranscription")
    def to_start_call_analytics_stream_transcription(self) -> "Transcribe":
        '''(experimental) Grants permission to start a protocol where audio is streamed to Transcribe Call Analytics and the transcription results are streamed to your application.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_streaming_StartCallAnalyticsStreamTranscription.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toStartCallAnalyticsStreamTranscription", []))

    @jsii.member(jsii_name="toStartCallAnalyticsStreamTranscriptionWebSocket")
    def to_start_call_analytics_stream_transcription_web_socket(self) -> "Transcribe":
        '''(experimental) Grants permission to start a WebSocket where audio is streamed to Transcribe Call Analytics and the transcription results are streamed to your application.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_streaming_StartCallAnalyticsStreamTranscriptionWebSocket.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toStartCallAnalyticsStreamTranscriptionWebSocket", []))

    @jsii.member(jsii_name="toStartMedicalStreamTranscription")
    def to_start_medical_stream_transcription(self) -> "Transcribe":
        '''(experimental) Grants permission to start a protocol where audio is streamed to Transcribe Medical and the transcription results are streamed to your application.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_streaming_StartMedicalStreamTranscription.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toStartMedicalStreamTranscription", []))

    @jsii.member(jsii_name="toStartMedicalStreamTranscriptionWebSocket")
    def to_start_medical_stream_transcription_web_socket(self) -> "Transcribe":
        '''(experimental) Grants permission to start a WebSocket where audio is streamed to Transcribe Medical and the transcription results are streamed to your application.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_streaming_StartMedicalStreamTranscriptionWebSocket.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toStartMedicalStreamTranscriptionWebSocket", []))

    @jsii.member(jsii_name="toStartMedicalTranscriptionJob")
    def to_start_medical_transcription_job(self) -> "Transcribe":
        '''(experimental) Grants permission to start an asynchronous job to transcribe medical speech to text.

        Access Level: Write

        Possible conditions:

        - .ifOutputBucketName()
        - .ifOutputEncryptionKMSKeyId()
        - .ifOutputKey()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/transcribe/latest/dg/API_StartMedicalTranscriptionJob.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toStartMedicalTranscriptionJob", []))

    @jsii.member(jsii_name="toStartStreamTranscription")
    def to_start_stream_transcription(self) -> "Transcribe":
        '''(experimental) Grants permission to start a bidirectional HTTP2 stream to transcribe speech to text in real time.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_streaming_StartStreamTranscription.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toStartStreamTranscription", []))

    @jsii.member(jsii_name="toStartStreamTranscriptionWebSocket")
    def to_start_stream_transcription_web_socket(self) -> "Transcribe":
        '''(experimental) Grants permission to start a websocket stream to transcribe speech to text in real time.

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_streaming_StartStreamTranscriptionWebSocket.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toStartStreamTranscriptionWebSocket", []))

    @jsii.member(jsii_name="toStartTranscriptionJob")
    def to_start_transcription_job(self) -> "Transcribe":
        '''(experimental) Grants permission to start an asynchronous job to transcribe speech to text.

        Access Level: Write

        Possible conditions:

        - .ifOutputBucketName()
        - .ifOutputEncryptionKMSKeyId()
        - .ifOutputKey()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/transcribe/latest/dg/API_StartTranscriptionJob.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toStartTranscriptionJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Transcribe":
        '''(experimental) Grants permission to tag a resource with given key value pairs.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/transcribe/latest/dg/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Transcribe":
        '''(experimental) Grants permission to untag a resource with given key.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/transcribe/latest/dg/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateCallAnalyticsCategory")
    def to_update_call_analytics_category(self) -> "Transcribe":
        '''(experimental) Grants permission to update the call analytics category with new values.

        The UpdateCallAnalyticsCategory operation overwrites all of the existing information with the values that you provide in the request

        Access Level: Write

        https://docs.aws.amazon.com/transcribe/latest/dg/API_UpdateCallAnalyticsCategory.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toUpdateCallAnalyticsCategory", []))

    @jsii.member(jsii_name="toUpdateMedicalVocabulary")
    def to_update_medical_vocabulary(self) -> "Transcribe":
        '''(experimental) Grants permission to update an existing medical vocabulary with new values.

        The UpdateMedicalVocabulary operation overwrites all of the existing information with the values that you provide in the request

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/transcribe/latest/dg/API_UpdateMedicalVocabulary.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toUpdateMedicalVocabulary", []))

    @jsii.member(jsii_name="toUpdateVocabulary")
    def to_update_vocabulary(self) -> "Transcribe":
        '''(experimental) Grants permission to update an existing vocabulary with new values.

        The UpdateVocabulary operation overwrites all of the existing information with the values that you provide in the request

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/transcribe/latest/dg/API_UpdateVocabulary.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toUpdateVocabulary", []))

    @jsii.member(jsii_name="toUpdateVocabularyFilter")
    def to_update_vocabulary_filter(self) -> "Transcribe":
        '''(experimental) Grants permission to update an existing vocabulary filter with new values.

        The UpdateVocabularyFilter operation overwrites all of the existing information with the values that you provide in the request

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/transcribe/latest/dg/API_UpdateVocabularyFilter.html

        :stability: experimental
        '''
        return typing.cast("Transcribe", jsii.invoke(self, "toUpdateVocabularyFilter", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2fb9e4e30259cde4213b501402bdc8a53264216191ffce66eef7648e4fc7d648)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5a14473164302e1ed8c1319d09e750fcbf6ad095b6857f28cf10b54e89ded17c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Transfer(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Transfer",
):
    '''(experimental) Statement provider for service `transfer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awstransferfamily.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `transfer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awstransferfamily.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__63b9f22b8cf9806947fc6410cb8c2fd74fffda7969b1953575d4248125f435b4)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAgreement")
    def on_agreement(
        self,
        agreement_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Transfer":
        '''(experimental) Adds a resource of type agreement to the statement.

        https://docs.aws.amazon.com/transfer/latest/userguide/create-b2b-server.html

        :param agreement_id: - Identifier for the agreementId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e5287b1d3c771413c286a5c9592ac1ac0212bea69ae07628cb635d822a8c9f6c)
            check_type(argname="argument agreement_id", value=agreement_id, expected_type=type_hints["agreement_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Transfer", jsii.invoke(self, "onAgreement", [agreement_id, account, region, partition]))

    @jsii.member(jsii_name="onCertificate")
    def on_certificate(
        self,
        certificate_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Transfer":
        '''(experimental) Adds a resource of type certificate to the statement.

        https://docs.aws.amazon.com/transfer/latest/userguide/create-b2b-server.html

        :param certificate_id: - Identifier for the certificateId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0750c1caa2dea27b2fce681238b105f1e4c48b1c079bd259873cac449f1ee736)
            check_type(argname="argument certificate_id", value=certificate_id, expected_type=type_hints["certificate_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Transfer", jsii.invoke(self, "onCertificate", [certificate_id, account, region, partition]))

    @jsii.member(jsii_name="onConnector")
    def on_connector(
        self,
        connector_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Transfer":
        '''(experimental) Adds a resource of type connector to the statement.

        https://docs.aws.amazon.com/transfer/latest/userguide/create-b2b-server.html

        :param connector_id: - Identifier for the connectorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0f9cba706901a6d118adbd5f5e24deb3470063da1f65187b091540730b986540)
            check_type(argname="argument connector_id", value=connector_id, expected_type=type_hints["connector_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Transfer", jsii.invoke(self, "onConnector", [connector_id, account, region, partition]))

    @jsii.member(jsii_name="onHostKey")
    def on_host_key(
        self,
        server_id: builtins.str,
        host_key_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Transfer":
        '''(experimental) Adds a resource of type host-key to the statement.

        https://docs.aws.amazon.com/transfer/latest/userguide/edit-server-config.html

        :param server_id: - Identifier for the serverId.
        :param host_key_id: - Identifier for the hostKeyId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3e3b6e5d1b47679d1593a7ba675cbe4ffb693be9d61360820ea365b12ed1d90d)
            check_type(argname="argument server_id", value=server_id, expected_type=type_hints["server_id"])
            check_type(argname="argument host_key_id", value=host_key_id, expected_type=type_hints["host_key_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Transfer", jsii.invoke(self, "onHostKey", [server_id, host_key_id, account, region, partition]))

    @jsii.member(jsii_name="onProfile")
    def on_profile(
        self,
        profile_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Transfer":
        '''(experimental) Adds a resource of type profile to the statement.

        https://docs.aws.amazon.com/transfer/latest/userguide/create-b2b-server.html

        :param profile_id: - Identifier for the profileId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c5a85ca9f4292acfb24a318bc530500ab8a1e7fa4347e84382ddc9013bb24d48)
            check_type(argname="argument profile_id", value=profile_id, expected_type=type_hints["profile_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Transfer", jsii.invoke(self, "onProfile", [profile_id, account, region, partition]))

    @jsii.member(jsii_name="onServer")
    def on_server(
        self,
        server_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Transfer":
        '''(experimental) Adds a resource of type server to the statement.

        https://docs.aws.amazon.com/transfer/latest/userguide/configuring-servers.html

        :param server_id: - Identifier for the serverId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4d0141f74c4d81f4771424ef73f0e9a62a429f02ab4d2d36363181f67e624487)
            check_type(argname="argument server_id", value=server_id, expected_type=type_hints["server_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Transfer", jsii.invoke(self, "onServer", [server_id, account, region, partition]))

    @jsii.member(jsii_name="onUser")
    def on_user(
        self,
        server_id: builtins.str,
        user_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Transfer":
        '''(experimental) Adds a resource of type user to the statement.

        https://docs.aws.amazon.com/transfer/latest/userguide/create-user.html

        :param server_id: - Identifier for the serverId.
        :param user_name: - Identifier for the userName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dee9d058c76c3478cff9bdf2f5e1b9bee7d1ada30a57f2440e6a05a0c5a14fc6)
            check_type(argname="argument server_id", value=server_id, expected_type=type_hints["server_id"])
            check_type(argname="argument user_name", value=user_name, expected_type=type_hints["user_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Transfer", jsii.invoke(self, "onUser", [server_id, user_name, account, region, partition]))

    @jsii.member(jsii_name="onWorkflow")
    def on_workflow(
        self,
        workflow_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Transfer":
        '''(experimental) Adds a resource of type workflow to the statement.

        https://docs.aws.amazon.com/transfer/latest/userguide/transfer-workflows.html

        :param workflow_id: - Identifier for the workflowId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__13dec3df02b9eabd2871a514e4e4115a6a5327efcced82bf2f29ee75f97631b4)
            check_type(argname="argument workflow_id", value=workflow_id, expected_type=type_hints["workflow_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Transfer", jsii.invoke(self, "onWorkflow", [workflow_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateAccess")
    def to_create_access(self) -> "Transfer":
        '''(experimental) Grants permission to add an access associated with a server.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/transfer/latest/userguide/API_CreateAccess.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toCreateAccess", []))

    @jsii.member(jsii_name="toCreateAgreement")
    def to_create_agreement(self) -> "Transfer":
        '''(experimental) Grants permission to add an agreement associated with a server.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/transfer/latest/userguide/API_CreateAgreement.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toCreateAgreement", []))

    @jsii.member(jsii_name="toCreateConnector")
    def to_create_connector(self) -> "Transfer":
        '''(experimental) Grants permission to create a connector.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/transfer/latest/userguide/API_CreateConnector.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toCreateConnector", []))

    @jsii.member(jsii_name="toCreateProfile")
    def to_create_profile(self) -> "Transfer":
        '''(experimental) Grants permission to create a profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/transfer/latest/userguide/API_CreateProfile.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toCreateProfile", []))

    @jsii.member(jsii_name="toCreateServer")
    def to_create_server(self) -> "Transfer":
        '''(experimental) Grants permission to create a server.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/transfer/latest/userguide/API_CreateServer.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toCreateServer", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Transfer":
        '''(experimental) Grants permission to add a user associated with a server.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/transfer/latest/userguide/API_CreateUser.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toCreateWorkflow")
    def to_create_workflow(self) -> "Transfer":
        '''(experimental) Grants permission to create a workflow.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/transfer/latest/userguide/API_CreateWorkflow.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toCreateWorkflow", []))

    @jsii.member(jsii_name="toDeleteAccess")
    def to_delete_access(self) -> "Transfer":
        '''(experimental) Grants permission to delete access.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DeleteAccess.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDeleteAccess", []))

    @jsii.member(jsii_name="toDeleteAgreement")
    def to_delete_agreement(self) -> "Transfer":
        '''(experimental) Grants permission to delete agreement.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DeleteAgreement.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDeleteAgreement", []))

    @jsii.member(jsii_name="toDeleteCertificate")
    def to_delete_certificate(self) -> "Transfer":
        '''(experimental) Grants permission to delete certificate.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DeleteCertificate.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDeleteCertificate", []))

    @jsii.member(jsii_name="toDeleteConnector")
    def to_delete_connector(self) -> "Transfer":
        '''(experimental) Grants permission to delete connector.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DeleteConnector.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDeleteConnector", []))

    @jsii.member(jsii_name="toDeleteHostKey")
    def to_delete_host_key(self) -> "Transfer":
        '''(experimental) Grants permission to delete a host key associated with a server.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DeleteHostKey.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDeleteHostKey", []))

    @jsii.member(jsii_name="toDeleteProfile")
    def to_delete_profile(self) -> "Transfer":
        '''(experimental) Grants permission to delete profile.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DeleteProfile.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDeleteProfile", []))

    @jsii.member(jsii_name="toDeleteServer")
    def to_delete_server(self) -> "Transfer":
        '''(experimental) Grants permission to delete a server.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DeleteServer.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDeleteServer", []))

    @jsii.member(jsii_name="toDeleteSshPublicKey")
    def to_delete_ssh_public_key(self) -> "Transfer":
        '''(experimental) Grants permission to delete an SSH public key from a user.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DeleteSshPublicKey.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDeleteSshPublicKey", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "Transfer":
        '''(experimental) Grants permission to delete a user associated with a server.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDeleteWorkflow")
    def to_delete_workflow(self) -> "Transfer":
        '''(experimental) Grants permission to delete a workflow.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DeleteWorkflow.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDeleteWorkflow", []))

    @jsii.member(jsii_name="toDescribeAccess")
    def to_describe_access(self) -> "Transfer":
        '''(experimental) Grants permission to describe an access assigned to a server.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DescribeAccess.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDescribeAccess", []))

    @jsii.member(jsii_name="toDescribeAgreement")
    def to_describe_agreement(self) -> "Transfer":
        '''(experimental) Grants permission to describe an agreement assigned to a server.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DescribeAgreement.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDescribeAgreement", []))

    @jsii.member(jsii_name="toDescribeCertificate")
    def to_describe_certificate(self) -> "Transfer":
        '''(experimental) Grants permission to describe a certificate.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DescribeCertificate.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDescribeCertificate", []))

    @jsii.member(jsii_name="toDescribeConnector")
    def to_describe_connector(self) -> "Transfer":
        '''(experimental) Grants permission to describe a connector.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DescribeConnector.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDescribeConnector", []))

    @jsii.member(jsii_name="toDescribeExecution")
    def to_describe_execution(self) -> "Transfer":
        '''(experimental) Grants permission to describe an execution associated with a workflow.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DescribeExecution.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDescribeExecution", []))

    @jsii.member(jsii_name="toDescribeHostKey")
    def to_describe_host_key(self) -> "Transfer":
        '''(experimental) Grants permission to describe a host key associated with a server.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DescribeHostKey.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDescribeHostKey", []))

    @jsii.member(jsii_name="toDescribeProfile")
    def to_describe_profile(self) -> "Transfer":
        '''(experimental) Grants permission to describe a profile.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DescribeProfile.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDescribeProfile", []))

    @jsii.member(jsii_name="toDescribeSecurityPolicy")
    def to_describe_security_policy(self) -> "Transfer":
        '''(experimental) Grants permission to describe a security policy.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DescribeSecurityPolicy.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDescribeSecurityPolicy", []))

    @jsii.member(jsii_name="toDescribeServer")
    def to_describe_server(self) -> "Transfer":
        '''(experimental) Grants permission to describe a server.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DescribeServer.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDescribeServer", []))

    @jsii.member(jsii_name="toDescribeUser")
    def to_describe_user(self) -> "Transfer":
        '''(experimental) Grants permission to describe a user associated with a server.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DescribeUser.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDescribeUser", []))

    @jsii.member(jsii_name="toDescribeWorkflow")
    def to_describe_workflow(self) -> "Transfer":
        '''(experimental) Grants permission to describe a workflow.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_DescribeWorkflow.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toDescribeWorkflow", []))

    @jsii.member(jsii_name="toImportCertificate")
    def to_import_certificate(self) -> "Transfer":
        '''(experimental) Grants permission to add a certificate.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/transfer/latest/userguide/API_ImportCertificate.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toImportCertificate", []))

    @jsii.member(jsii_name="toImportHostKey")
    def to_import_host_key(self) -> "Transfer":
        '''(experimental) Grants permission to add a host key to a server.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/transfer/latest/userguide/API_ImportHostKey.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toImportHostKey", []))

    @jsii.member(jsii_name="toImportSshPublicKey")
    def to_import_ssh_public_key(self) -> "Transfer":
        '''(experimental) Grants permission to add an SSH public key to a user.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_ImportSshPublicKey.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toImportSshPublicKey", []))

    @jsii.member(jsii_name="toListAccesses")
    def to_list_accesses(self) -> "Transfer":
        '''(experimental) Grants permission to list accesses.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_ListAccesses.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toListAccesses", []))

    @jsii.member(jsii_name="toListAgreements")
    def to_list_agreements(self) -> "Transfer":
        '''(experimental) Grants permission to list agreements.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_ListAgreements.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toListAgreements", []))

    @jsii.member(jsii_name="toListCertificates")
    def to_list_certificates(self) -> "Transfer":
        '''(experimental) Grants permission to list certificates.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_ListCertificates.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toListCertificates", []))

    @jsii.member(jsii_name="toListConnectors")
    def to_list_connectors(self) -> "Transfer":
        '''(experimental) Grants permission to list connectors.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_ListConnectors.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toListConnectors", []))

    @jsii.member(jsii_name="toListExecutions")
    def to_list_executions(self) -> "Transfer":
        '''(experimental) Grants permission to list executions associated with a workflow.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_ListExecutions.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toListExecutions", []))

    @jsii.member(jsii_name="toListHostKeys")
    def to_list_host_keys(self) -> "Transfer":
        '''(experimental) Grants permission to list host keys associated with a server.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_ListHostKeys.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toListHostKeys", []))

    @jsii.member(jsii_name="toListProfiles")
    def to_list_profiles(self) -> "Transfer":
        '''(experimental) Grants permission to list profiles.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_ListProfiles.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toListProfiles", []))

    @jsii.member(jsii_name="toListSecurityPolicies")
    def to_list_security_policies(self) -> "Transfer":
        '''(experimental) Grants permission to list security policies.

        Access Level: List

        https://docs.aws.amazon.com/transfer/latest/userguide/API_ListSecurityPolicies.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toListSecurityPolicies", []))

    @jsii.member(jsii_name="toListServers")
    def to_list_servers(self) -> "Transfer":
        '''(experimental) Grants permission to list servers.

        Access Level: List

        https://docs.aws.amazon.com/transfer/latest/userguide/API_ListServers.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toListServers", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Transfer":
        '''(experimental) Grants permission to list tags for an AWS Transfer Family resource.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListUsers")
    def to_list_users(self) -> "Transfer":
        '''(experimental) Grants permission to list users associated with a server.

        Access Level: List

        https://docs.aws.amazon.com/transfer/latest/userguide/API_ListUsers.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toListUsers", []))

    @jsii.member(jsii_name="toListWorkflows")
    def to_list_workflows(self) -> "Transfer":
        '''(experimental) Grants permission to list workflows.

        Access Level: List

        https://docs.aws.amazon.com/transfer/latest/userguide/API_ListWorkflows.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toListWorkflows", []))

    @jsii.member(jsii_name="toSendWorkflowStepState")
    def to_send_workflow_step_state(self) -> "Transfer":
        '''(experimental) Grants permission to send a callback for asynchronous custom steps.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_SendWorkflowStepState.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toSendWorkflowStepState", []))

    @jsii.member(jsii_name="toStartFileTransfer")
    def to_start_file_transfer(self) -> "Transfer":
        '''(experimental) Grants permission to initiate a connector file transfer.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_StartFileTransfer.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toStartFileTransfer", []))

    @jsii.member(jsii_name="toStartServer")
    def to_start_server(self) -> "Transfer":
        '''(experimental) Grants permission to start a server.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_StartServer.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toStartServer", []))

    @jsii.member(jsii_name="toStopServer")
    def to_stop_server(self) -> "Transfer":
        '''(experimental) Grants permission to stop a server.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_StopServer.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toStopServer", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Transfer":
        '''(experimental) Grants permission to tag an AWS Transfer Family resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/transfer/latest/userguide/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestIdentityProvider")
    def to_test_identity_provider(self) -> "Transfer":
        '''(experimental) Grants permission to test a server's custom identity provider.

        Access Level: Read

        https://docs.aws.amazon.com/transfer/latest/userguide/API_TestIdentityProvider.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toTestIdentityProvider", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Transfer":
        '''(experimental) Grants permission to untag an AWS Transfer Family resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/transfer/latest/userguide/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAccess")
    def to_update_access(self) -> "Transfer":
        '''(experimental) Grants permission to update access.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/transfer/latest/userguide/API_UpdateAccess.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toUpdateAccess", []))

    @jsii.member(jsii_name="toUpdateAgreement")
    def to_update_agreement(self) -> "Transfer":
        '''(experimental) Grants permission to update an agreement.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/transfer/latest/userguide/API_UpdateAgreement.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toUpdateAgreement", []))

    @jsii.member(jsii_name="toUpdateCertificate")
    def to_update_certificate(self) -> "Transfer":
        '''(experimental) Grants permission to update a certificate.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_UpdateCertificate.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toUpdateCertificate", []))

    @jsii.member(jsii_name="toUpdateConnector")
    def to_update_connector(self) -> "Transfer":
        '''(experimental) Grants permission to update a connector.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/transfer/latest/userguide/API_UpdateConnector.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toUpdateConnector", []))

    @jsii.member(jsii_name="toUpdateHostKey")
    def to_update_host_key(self) -> "Transfer":
        '''(experimental) Grants permission to update a host key.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_UpdateHostKey.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toUpdateHostKey", []))

    @jsii.member(jsii_name="toUpdateProfile")
    def to_update_profile(self) -> "Transfer":
        '''(experimental) Grants permission to update a profile.

        Access Level: Write

        https://docs.aws.amazon.com/transfer/latest/userguide/API_UpdateProfile.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toUpdateProfile", []))

    @jsii.member(jsii_name="toUpdateServer")
    def to_update_server(self) -> "Transfer":
        '''(experimental) Grants permission to update the configuration of a server.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/transfer/latest/userguide/API_UpdateServer.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toUpdateServer", []))

    @jsii.member(jsii_name="toUpdateUser")
    def to_update_user(self) -> "Transfer":
        '''(experimental) Grants permission to update the configuration of a user.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/transfer/latest/userguide/API_UpdateUser.html

        :stability: experimental
        '''
        return typing.cast("Transfer", jsii.invoke(self, "toUpdateUser", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__726e466d63afaba0c4c860c214eedbaa63f57a9ea828f8fa13daddbf693ea283)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__76fde3cc12ba747dc8826adeed16df8a898cab1bbd60f40112e3376afa417f7e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Translate(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Translate",
):
    '''(experimental) Statement provider for service `translate <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazontranslate.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `translate <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazontranslate.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__576460c0eb2ed326e5ff565e62262b7df3825892d3d899463573360b47a1a171)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onParallelData")
    def on_parallel_data(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Translate":
        '''(experimental) Adds a resource of type parallel-data to the statement.

        https://docs.aws.amazon.com/translate/latest/dg/customizing-translations-parallel-data.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6352ca38c76e4ab07ae86904adbe3dd56ba64021960ff42439662839bd37b06d)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Translate", jsii.invoke(self, "onParallelData", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onTerminology")
    def on_terminology(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Translate":
        '''(experimental) Adds a resource of type terminology to the statement.

        https://docs.aws.amazon.com/translate/latest/dg/how-custom-terminology.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8192602327a443c39da8311ad6fe802dbb7151d65b114c34a7c0ff4a297d608e)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Translate", jsii.invoke(self, "onTerminology", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateParallelData")
    def to_create_parallel_data(self) -> "Translate":
        '''(experimental) Grants permission to create a Parallel Data.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/translate/latest/APIReference/API_CreateParallelData.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toCreateParallelData", []))

    @jsii.member(jsii_name="toDeleteParallelData")
    def to_delete_parallel_data(self) -> "Translate":
        '''(experimental) Grants permission to delete a Parallel Data.

        Access Level: Write

        https://docs.aws.amazon.com/translate/latest/APIReference/API_DeleteParallelData.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toDeleteParallelData", []))

    @jsii.member(jsii_name="toDeleteTerminology")
    def to_delete_terminology(self) -> "Translate":
        '''(experimental) Grants permission to delete a terminology.

        Access Level: Write

        https://docs.aws.amazon.com/translate/latest/APIReference/API_DeleteTerminology.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toDeleteTerminology", []))

    @jsii.member(jsii_name="toDescribeTextTranslationJob")
    def to_describe_text_translation_job(self) -> "Translate":
        '''(experimental) Grants permission to get the properties associated with an asynchronous batch translation job.

        Access Level: Read

        https://docs.aws.amazon.com/translate/latest/APIReference/API_DescribeTextTranslationJob.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toDescribeTextTranslationJob", []))

    @jsii.member(jsii_name="toGetParallelData")
    def to_get_parallel_data(self) -> "Translate":
        '''(experimental) Grants permission to get a Parallel Data.

        Access Level: Read

        https://docs.aws.amazon.com/translate/latest/APIReference/API_GetParallelData.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toGetParallelData", []))

    @jsii.member(jsii_name="toGetTerminology")
    def to_get_terminology(self) -> "Translate":
        '''(experimental) Grants permission to retrieve a terminology.

        Access Level: Read

        https://docs.aws.amazon.com/translate/latest/APIReference/API_GetTerminology.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toGetTerminology", []))

    @jsii.member(jsii_name="toImportTerminology")
    def to_import_terminology(self) -> "Translate":
        '''(experimental) Grants permission to create or update a terminology, depending on whether or not one already exists for the given terminology name.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/translate/latest/APIReference/API_ImportTerminology.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toImportTerminology", []))

    @jsii.member(jsii_name="toListLanguages")
    def to_list_languages(self) -> "Translate":
        '''(experimental) Grants permission to list supported languages.

        Access Level: List

        https://docs.aws.amazon.com/translate/latest/APIReference/API_ListLanguages.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toListLanguages", []))

    @jsii.member(jsii_name="toListParallelData")
    def to_list_parallel_data(self) -> "Translate":
        '''(experimental) Grants permission to list Parallel Data associated with your account.

        Access Level: List

        https://docs.aws.amazon.com/translate/latest/APIReference/API_ListParallelData.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toListParallelData", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Translate":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/translate/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTerminologies")
    def to_list_terminologies(self) -> "Translate":
        '''(experimental) Grants permission to list terminologies associated with your account.

        Access Level: List

        https://docs.aws.amazon.com/translate/latest/APIReference/API_ListTerminologies.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toListTerminologies", []))

    @jsii.member(jsii_name="toListTextTranslationJobs")
    def to_list_text_translation_jobs(self) -> "Translate":
        '''(experimental) Grants permission to list batch translation jobs that you have submitted.

        Access Level: List

        https://docs.aws.amazon.com/translate/latest/APIReference/API_ListTextTranslationJobs.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toListTextTranslationJobs", []))

    @jsii.member(jsii_name="toStartTextTranslationJob")
    def to_start_text_translation_job(self) -> "Translate":
        '''(experimental) Grants permission to start an asynchronous batch translation job.

        Batch translation jobs can be used to translate large volumes of text across multiple documents at once

        Access Level: Write

        https://docs.aws.amazon.com/translate/latest/APIReference/API_StartTextTranslationJob.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toStartTextTranslationJob", []))

    @jsii.member(jsii_name="toStopTextTranslationJob")
    def to_stop_text_translation_job(self) -> "Translate":
        '''(experimental) Grants permission to stop an asynchronous batch translation job that is in progress.

        Access Level: Write

        https://docs.aws.amazon.com/translate/latest/APIReference/API_StopTextTranslationJob.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toStopTextTranslationJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Translate":
        '''(experimental) Grants permission to tag a resource with given key value pairs.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/translate/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTranslateText")
    def to_translate_text(self) -> "Translate":
        '''(experimental) Grants permission to translate text from a source language to a target language.

        Access Level: Read

        https://docs.aws.amazon.com/translate/latest/APIReference/API_TranslateText.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toTranslateText", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Translate":
        '''(experimental) Grants permission to untag a resource with given key.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/translate/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateParallelData")
    def to_update_parallel_data(self) -> "Translate":
        '''(experimental) Grants permission to update an existing Parallel Data.

        Access Level: Write

        https://docs.aws.amazon.com/translate/latest/APIReference/API_UpdateParallelData.html

        :stability: experimental
        '''
        return typing.cast("Translate", jsii.invoke(self, "toUpdateParallelData", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ae8b38e7e9759a3c41489b788ccd843b99bc6310c0b066e5a6646a7a1426ad6b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2be198120610f90bbdf7df7c478141d424d7c5a096feed64cd119a9f0344879f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Trustedadvisor(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Trustedadvisor",
):
    '''(experimental) Statement provider for service `trustedadvisor <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awstrustedadvisor.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `trustedadvisor <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awstrustedadvisor.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__43444a5d8678154f5e5aaf4a0fdc618b727452f3725d75347e30282cec97bb95)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onChecks")
    def on_checks(
        self,
        category_code: builtins.str,
        check_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Trustedadvisor":
        '''(experimental) Adds a resource of type checks to the statement.

        https://docs.aws.amazon.com/awssupport/latest/APIReference/API_TrustedAdvisorCheckDescription.html

        :param category_code: - Identifier for the categoryCode.
        :param check_id: - Identifier for the checkId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1fb83e395cf3c99d9bfd4825ff29375f23d5c3cf53e8310bee528f863421591e)
            check_type(argname="argument category_code", value=category_code, expected_type=type_hints["category_code"])
            check_type(argname="argument check_id", value=check_id, expected_type=type_hints["check_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Trustedadvisor", jsii.invoke(self, "onChecks", [category_code, check_id, account, region, partition]))

    @jsii.member(jsii_name="toDeleteNotificationConfigurationForDelegatedAdmin")
    def to_delete_notification_configuration_for_delegated_admin(
        self,
    ) -> "Trustedadvisor":
        '''(experimental) Grants permission to the organization management account to delete email notification preferences from a delegated administrator account for Trusted Advisor Priority.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDeleteNotificationConfigurationForDelegatedAdmin", []))

    @jsii.member(jsii_name="toDescribeAccount")
    def to_describe_account(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view the AWS Support plan and various AWS Trusted Advisor preferences.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeAccount", []))

    @jsii.member(jsii_name="toDescribeAccountAccess")
    def to_describe_account_access(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view if the AWS account has enabled or disabled AWS Trusted Advisor.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeAccountAccess", []))

    @jsii.member(jsii_name="toDescribeCheckItems")
    def to_describe_check_items(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view details for the check items.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeCheckItems", []))

    @jsii.member(jsii_name="toDescribeCheckRefreshStatuses")
    def to_describe_check_refresh_statuses(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view the refresh statuses for AWS Trusted Advisor checks.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeCheckRefreshStatuses", []))

    @jsii.member(jsii_name="toDescribeChecks")
    def to_describe_checks(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view details for AWS Trusted Advisor checks.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeChecks", []))

    @jsii.member(jsii_name="toDescribeCheckStatusHistoryChanges")
    def to_describe_check_status_history_changes(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view the results and changed statuses for checks in the last 30 days.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeCheckStatusHistoryChanges", []))

    @jsii.member(jsii_name="toDescribeCheckSummaries")
    def to_describe_check_summaries(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view AWS Trusted Advisor check summaries.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeCheckSummaries", []))

    @jsii.member(jsii_name="toDescribeNotificationConfigurations")
    def to_describe_notification_configurations(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to get your email notification preferences for Trusted Advisor Priority.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeNotificationConfigurations", []))

    @jsii.member(jsii_name="toDescribeNotificationPreferences")
    def to_describe_notification_preferences(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view the notification preferences for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeNotificationPreferences", []))

    @jsii.member(jsii_name="toDescribeOrganization")
    def to_describe_organization(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view if the AWS account meets the requirements to enable the organizational view feature.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeOrganization", []))

    @jsii.member(jsii_name="toDescribeOrganizationAccounts")
    def to_describe_organization_accounts(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view the linked AWS accounts that are in the organization.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeOrganizationAccounts", []))

    @jsii.member(jsii_name="toDescribeReports")
    def to_describe_reports(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view details for organizational view reports, such as the report name, runtime, date created, status, and format.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeReports", []))

    @jsii.member(jsii_name="toDescribeRisk")
    def to_describe_risk(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view risk details in AWS Trusted Advisor Priority.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeRisk", []))

    @jsii.member(jsii_name="toDescribeRiskResources")
    def to_describe_risk_resources(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view affected resources for a risk in AWS Trusted Advisor Priority.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeRiskResources", []))

    @jsii.member(jsii_name="toDescribeRisks")
    def to_describe_risks(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view risks in AWS Trusted Advisor Priority.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeRisks", []))

    @jsii.member(jsii_name="toDescribeServiceMetadata")
    def to_describe_service_metadata(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view information about organizational view reports, such as the AWS Regions, check categories, check names, and resource statuses.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDescribeServiceMetadata", []))

    @jsii.member(jsii_name="toDownloadRisk")
    def to_download_risk(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to download a file that contains details about the risk in AWS Trusted Advisor Priority.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toDownloadRisk", []))

    @jsii.member(jsii_name="toExcludeCheckItems")
    def to_exclude_check_items(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to exclude recommendations for AWS Trusted Advisor checks.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toExcludeCheckItems", []))

    @jsii.member(jsii_name="toGenerateReport")
    def to_generate_report(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to create a report for AWS Trusted Advisor checks in your organization.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toGenerateReport", []))

    @jsii.member(jsii_name="toIncludeCheckItems")
    def to_include_check_items(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to include recommendations for AWS Trusted Advisor checks.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toIncludeCheckItems", []))

    @jsii.member(jsii_name="toListAccountsForParent")
    def to_list_accounts_for_parent(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view, in the Trusted Advisor console, all of the accounts in an AWS organization that are contained by a root or organizational unit (OU).

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toListAccountsForParent", []))

    @jsii.member(jsii_name="toListOrganizationalUnitsForParent")
    def to_list_organizational_units_for_parent(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view, in the Trusted Advisor console, all of the organizational units (OUs) in a parent organizational unit or root.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toListOrganizationalUnitsForParent", []))

    @jsii.member(jsii_name="toListRoots")
    def to_list_roots(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to view, in the Trusted Advisor console, all of the roots that are defined in an AWS organization.

        Access Level: Read

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toListRoots", []))

    @jsii.member(jsii_name="toRefreshCheck")
    def to_refresh_check(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to refresh an AWS Trusted Advisor check.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toRefreshCheck", []))

    @jsii.member(jsii_name="toSetAccountAccess")
    def to_set_account_access(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to enable or disable AWS Trusted Advisor for the account.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toSetAccountAccess", []))

    @jsii.member(jsii_name="toSetOrganizationAccess")
    def to_set_organization_access(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to enable the organizational view feature for AWS Trusted Advisor.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toSetOrganizationAccess", []))

    @jsii.member(jsii_name="toUpdateNotificationConfigurations")
    def to_update_notification_configurations(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to create or update your email notification preferences for Trusted Advisor Priority.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toUpdateNotificationConfigurations", []))

    @jsii.member(jsii_name="toUpdateNotificationPreferences")
    def to_update_notification_preferences(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to update notification preferences for AWS Trusted Advisor.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toUpdateNotificationPreferences", []))

    @jsii.member(jsii_name="toUpdateRiskStatus")
    def to_update_risk_status(self) -> "Trustedadvisor":
        '''(experimental) Grants permission to update the risk status in AWS Trusted Advisor Priority.

        Access Level: Write

        https://docs.aws.amazon.com/awssupport/latest/user/security-trusted-advisor.html#trusted-advisor-operations

        :stability: experimental
        '''
        return typing.cast("Trustedadvisor", jsii.invoke(self, "toUpdateRiskStatus", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f405f62c342c4bd37d784f4aa40861e19f52346f09af6280e0e2c219eaae27eb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__272fe5e0190e057edf02a745db15f1df81396e8d9fa8f0e20ee6e3d634f07626)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class VendorInsights(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.VendorInsights",
):
    '''(experimental) Statement provider for service `vendor-insights <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacevendorinsights.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `vendor-insights <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacevendorinsights.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9593447a04d774bc87a3cdc642ccd9c7f5727e04f557d840e6febe1524e47985)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDataSource")
    def on_data_source(
        self,
        resource_id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "VendorInsights":
        '''(experimental) Adds a resource of type DataSource to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacevendorinsights.html#awsmarketplacevendorinsights-resources-for-iam-policies

        :param resource_id: - Identifier for the resourceId.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f13a4fbf1efe19ee7435ed6bb1f97cb61e21b93187570eb1e79768e147c29deb)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("VendorInsights", jsii.invoke(self, "onDataSource", [resource_id, partition]))

    @jsii.member(jsii_name="onSecurityProfile")
    def on_security_profile(
        self,
        resource_id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "VendorInsights":
        '''(experimental) Adds a resource of type SecurityProfile to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacevendorinsights.html#awsmarketplacevendorinsights-resources-for-iam-policies

        :param resource_id: - Identifier for the resourceId.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__873c3d7fda770ffbf18f274b85b69785dc6f9ca5bd1717d0377aca0afb8d9a57)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("VendorInsights", jsii.invoke(self, "onSecurityProfile", [resource_id, partition]))

    @jsii.member(jsii_name="toActivateSecurityProfile")
    def to_activate_security_profile(self) -> "VendorInsights":
        '''(experimental) Grants permission to activate the security profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/marketplace/latest/userguide/vendor-insights-seller-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toActivateSecurityProfile", []))

    @jsii.member(jsii_name="toAssociateDataSource")
    def to_associate_data_source(self) -> "VendorInsights":
        '''(experimental) Grants permission to associate security profile with a data source.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - vendor-insights:GetDataSource

        https://docs.aws.amazon.com/marketplace/latest/userguide/vendor-insights-seller-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toAssociateDataSource", []))

    @jsii.member(jsii_name="toCreateDataSource")
    def to_create_data_source(self) -> "VendorInsights":
        '''(experimental) Grants permission to create a new data source.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - vendor-insights:TagResource

        https://docs.aws.amazon.com/marketplace/latest/userguide/vendor-insights-seller-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toCreateDataSource", []))

    @jsii.member(jsii_name="toCreateSecurityProfile")
    def to_create_security_profile(self) -> "VendorInsights":
        '''(experimental) Grants permission to create a new security profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - vendor-insights:TagResource

        https://docs.aws.amazon.com/marketplace/latest/userguide/vendor-insights-seller-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toCreateSecurityProfile", []))

    @jsii.member(jsii_name="toDeactivateSecurityProfile")
    def to_deactivate_security_profile(self) -> "VendorInsights":
        '''(experimental) Grants permission to deactivate the security profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/marketplace/latest/userguide/vendor-insights-seller-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toDeactivateSecurityProfile", []))

    @jsii.member(jsii_name="toDeleteDataSource")
    def to_delete_data_source(self) -> "VendorInsights":
        '''(experimental) Grants permission to delete a data source.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/marketplace/latest/userguide/vendor-insights-seller-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toDeleteDataSource", []))

    @jsii.member(jsii_name="toDisassociateDataSource")
    def to_disassociate_data_source(self) -> "VendorInsights":
        '''(experimental) Grants permission to disassociate security profile from a data source.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - vendor-insights:GetDataSource

        https://docs.aws.amazon.com/marketplace/latest/userguide/vendor-insights-seller-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toDisassociateDataSource", []))

    @jsii.member(jsii_name="toGetDataSource")
    def to_get_data_source(self) -> "VendorInsights":
        '''(experimental) Grants permission to retrieve the details of an existing data source.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/marketplace/latest/userguide/vendor-insights-seller-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toGetDataSource", []))

    @jsii.member(jsii_name="toGetEntitledSecurityProfileSnapshot")
    def to_get_entitled_security_profile_snapshot(self) -> "VendorInsights":
        '''(experimental) Grants permission to return the details of a security profile snapshot that requester is entitled to read.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-vendor-insights-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toGetEntitledSecurityProfileSnapshot", []))

    @jsii.member(jsii_name="toGetProfileAccessTerms")
    def to_get_profile_access_terms(self) -> "VendorInsights":
        '''(experimental) Grants permission to get the access terms for a vendor insights profile.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-vendor-insights-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toGetProfileAccessTerms", []))

    @jsii.member(jsii_name="toGetSecurityProfile")
    def to_get_security_profile(self) -> "VendorInsights":
        '''(experimental) Grants permission to return the details of an existing security profile.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/marketplace/latest/userguide/vendor-insights-seller-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toGetSecurityProfile", []))

    @jsii.member(jsii_name="toGetSecurityProfileSnapshot")
    def to_get_security_profile_snapshot(self) -> "VendorInsights":
        '''(experimental) Grants permission to return the details of a security profile snapshot.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/marketplace/latest/userguide/vendor-insights-seller-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toGetSecurityProfileSnapshot", []))

    @jsii.member(jsii_name="toListDataSources")
    def to_list_data_sources(self) -> "VendorInsights":
        '''(experimental) Grants permission to list existing data sources.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/userguide/vendor-insights-seller-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toListDataSources", []))

    @jsii.member(jsii_name="toListEntitledSecurityProfiles")
    def to_list_entitled_security_profiles(self) -> "VendorInsights":
        '''(experimental) Grants permission to list entitled security profiles.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-vendor-insights-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toListEntitledSecurityProfiles", []))

    @jsii.member(jsii_name="toListEntitledSecurityProfileSnapshots")
    def to_list_entitled_security_profile_snapshots(self) -> "VendorInsights":
        '''(experimental) Grants permission to return the snapshot summary list for an existing security profile that requester is entitled to list.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-vendor-insights-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toListEntitledSecurityProfileSnapshots", []))

    @jsii.member(jsii_name="toListSecurityProfiles")
    def to_list_security_profiles(self) -> "VendorInsights":
        '''(experimental) Grants permission to list existing security profiles.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/userguide/vendor-insights-seller-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toListSecurityProfiles", []))

    @jsii.member(jsii_name="toListSecurityProfileSnapshots")
    def to_list_security_profile_snapshots(self) -> "VendorInsights":
        '''(experimental) Grants permission to return the snapshot summary list for an existing security profile.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/marketplace/latest/userguide/vendor-insights-seller-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toListSecurityProfileSnapshots", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "VendorInsights":
        '''(experimental) Grants permission to list tags for vendor insights resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/marketplace/latest/userguide/vendor-insights-seller-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "VendorInsights":
        '''(experimental) Grants permission to tag vendor insights resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/marketplace/latest/userguide/vendor-insights-seller-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "VendorInsights":
        '''(experimental) Grants permission to untag vendor insights resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/marketplace/latest/userguide/vendor-insights-seller-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateSecurityProfile")
    def to_update_security_profile(self) -> "VendorInsights":
        '''(experimental) Grants permission to update the security profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/marketplace/latest/userguide/vendor-insights-seller-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toUpdateSecurityProfile", []))

    @jsii.member(jsii_name="toUpdateSecurityProfileSnapshotCreationConfiguration")
    def to_update_security_profile_snapshot_creation_configuration(
        self,
    ) -> "VendorInsights":
        '''(experimental) Grants permission to update the security profile snapshot creation configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/marketplace/latest/userguide/vendor-insights-seller-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toUpdateSecurityProfileSnapshotCreationConfiguration", []))

    @jsii.member(jsii_name="toUpdateSecurityProfileSnapshotReleaseConfiguration")
    def to_update_security_profile_snapshot_release_configuration(
        self,
    ) -> "VendorInsights":
        '''(experimental) Grants permission to update the security profile snapshot release configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/marketplace/latest/userguide/vendor-insights-seller-controlling-access.html

        :stability: experimental
        '''
        return typing.cast("VendorInsights", jsii.invoke(self, "toUpdateSecurityProfileSnapshotReleaseConfiguration", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c00e49488d435a86243ff99f52da64f8995f0fdbe6cc0cbba4c932920d71e84d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2b0de9f2c082eb465ce66656b25026c6166a16f5745dcbcc5dfe9d33721f02c8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Voiceid(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Voiceid"):
    '''(experimental) Statement provider for service `voiceid <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonconnectvoiceid.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `voiceid <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonconnectvoiceid.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2e7a0f581a6afbad03ab167c2841c0489f6f38f5d55240743435ea2a9167bac4)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDomain")
    def on_domain(
        self,
        domain_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Voiceid":
        '''(experimental) Adds a resource of type domain to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-voiceid.html#voiceid-domain

        :param domain_id: - Identifier for the domainId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__09b7139463151ebef24e6e6889ee936fbc167fdcbbadd69420237d3443ea2326)
            check_type(argname="argument domain_id", value=domain_id, expected_type=type_hints["domain_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Voiceid", jsii.invoke(self, "onDomain", [domain_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateFraudster")
    def to_associate_fraudster(self) -> "Voiceid":
        '''(experimental) Grants permission to associate a fraudster with a watchlist.

        Access Level: Write

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_AssociateFraudster.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toAssociateFraudster", []))

    @jsii.member(jsii_name="toCreateDomain")
    def to_create_domain(self) -> "Voiceid":
        '''(experimental) Grants permission to create a domain.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_CreateDomain.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toCreateDomain", []))

    @jsii.member(jsii_name="toCreateWatchlist")
    def to_create_watchlist(self) -> "Voiceid":
        '''(experimental) Grants permission to create a watchlist.

        Access Level: Write

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_CreateWatchlist.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toCreateWatchlist", []))

    @jsii.member(jsii_name="toDeleteDomain")
    def to_delete_domain(self) -> "Voiceid":
        '''(experimental) Grants permission to delete a domain.

        Access Level: Write

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_DeleteDomain.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toDeleteDomain", []))

    @jsii.member(jsii_name="toDeleteFraudster")
    def to_delete_fraudster(self) -> "Voiceid":
        '''(experimental) Grants permission to delete a fraudster.

        Access Level: Write

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_DeleteFraudster.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toDeleteFraudster", []))

    @jsii.member(jsii_name="toDeleteSpeaker")
    def to_delete_speaker(self) -> "Voiceid":
        '''(experimental) Grants permission to delete a speaker.

        Access Level: Write

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_DeleteSpeaker.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toDeleteSpeaker", []))

    @jsii.member(jsii_name="toDeleteWatchlist")
    def to_delete_watchlist(self) -> "Voiceid":
        '''(experimental) Grants permission to delete a watchlist.

        Access Level: Write

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_DeleteWatchlist.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toDeleteWatchlist", []))

    @jsii.member(jsii_name="toDescribeComplianceConsent")
    def to_describe_compliance_consent(self) -> "Voiceid":
        '''(experimental) Grants permission to describe compliance consent.

        Access Level: Read

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-voiceid.html#enable-voiceid-step1

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toDescribeComplianceConsent", []))

    @jsii.member(jsii_name="toDescribeDomain")
    def to_describe_domain(self) -> "Voiceid":
        '''(experimental) Grants permission to describe a domain.

        Access Level: Read

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_DescribeDomain.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toDescribeDomain", []))

    @jsii.member(jsii_name="toDescribeFraudster")
    def to_describe_fraudster(self) -> "Voiceid":
        '''(experimental) Grants permission to describe a fraudster.

        Access Level: Read

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_DescribeFraudster.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toDescribeFraudster", []))

    @jsii.member(jsii_name="toDescribeFraudsterRegistrationJob")
    def to_describe_fraudster_registration_job(self) -> "Voiceid":
        '''(experimental) Grants permission to describe a fraudster registration job.

        Access Level: Read

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_DescribeFraudsterRegistrationJob.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toDescribeFraudsterRegistrationJob", []))

    @jsii.member(jsii_name="toDescribeSpeaker")
    def to_describe_speaker(self) -> "Voiceid":
        '''(experimental) Grants permission to describe a speaker.

        Access Level: Read

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_DescribeSpeaker.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toDescribeSpeaker", []))

    @jsii.member(jsii_name="toDescribeSpeakerEnrollmentJob")
    def to_describe_speaker_enrollment_job(self) -> "Voiceid":
        '''(experimental) Grants permission to describe a speaker enrollment job.

        Access Level: Read

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_DescribeSpeakerEnrollmentJob.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toDescribeSpeakerEnrollmentJob", []))

    @jsii.member(jsii_name="toDescribeWatchlist")
    def to_describe_watchlist(self) -> "Voiceid":
        '''(experimental) Grants permission to describe a watchlist.

        Access Level: Read

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_DescribeWatchlist.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toDescribeWatchlist", []))

    @jsii.member(jsii_name="toDisassociateFraudster")
    def to_disassociate_fraudster(self) -> "Voiceid":
        '''(experimental) Grants permission to disassociate a fraudster from a watchlist.

        Access Level: Write

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_DisassociateFraudster.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toDisassociateFraudster", []))

    @jsii.member(jsii_name="toEvaluateSession")
    def to_evaluate_session(self) -> "Voiceid":
        '''(experimental) Grants permission to evaluate a session.

        Access Level: Write

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_EvaluateSession.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toEvaluateSession", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Voiceid":
        '''(experimental) Grants permission to list domains for an account.

        Access Level: List

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_ListDomains.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toListFraudsterRegistrationJobs")
    def to_list_fraudster_registration_jobs(self) -> "Voiceid":
        '''(experimental) Grants permission to list fraudster registration jobs for a domain.

        Access Level: List

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_ListFraudsterRegistrationJobs.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toListFraudsterRegistrationJobs", []))

    @jsii.member(jsii_name="toListFraudsters")
    def to_list_fraudsters(self) -> "Voiceid":
        '''(experimental) Grants permission to list fraudsters for a domain or watchlist.

        Access Level: List

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_ListFraudsters.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toListFraudsters", []))

    @jsii.member(jsii_name="toListSpeakerEnrollmentJobs")
    def to_list_speaker_enrollment_jobs(self) -> "Voiceid":
        '''(experimental) Grants permission to list speaker enrollment jobs for a domain.

        Access Level: List

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_ListSpeakerEnrollmentJobs.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toListSpeakerEnrollmentJobs", []))

    @jsii.member(jsii_name="toListSpeakers")
    def to_list_speakers(self) -> "Voiceid":
        '''(experimental) Grants permission to list speakers for a domain.

        Access Level: List

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_ListSpeakers.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toListSpeakers", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Voiceid":
        '''(experimental) Grants permission to list tags for a Voice ID resource.

        Access Level: Read

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWatchlists")
    def to_list_watchlists(self) -> "Voiceid":
        '''(experimental) Grants permission to list watchlists for a domain.

        Access Level: List

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_ListWatchlists.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toListWatchlists", []))

    @jsii.member(jsii_name="toOptOutSpeaker")
    def to_opt_out_speaker(self) -> "Voiceid":
        '''(experimental) Grants permission to opt out a speaker.

        Access Level: Write

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_OptOutSpeaker.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toOptOutSpeaker", []))

    @jsii.member(jsii_name="toRegisterComplianceConsent")
    def to_register_compliance_consent(self) -> "Voiceid":
        '''(experimental) Grants permission to register compliance consent.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-voiceid.html#enable-voiceid-step1

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toRegisterComplianceConsent", []))

    @jsii.member(jsii_name="toStartFraudsterRegistrationJob")
    def to_start_fraudster_registration_job(self) -> "Voiceid":
        '''(experimental) Grants permission to start a fraudster registration job.

        Access Level: Write

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_StartFraudsterRegistrationJob.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toStartFraudsterRegistrationJob", []))

    @jsii.member(jsii_name="toStartSpeakerEnrollmentJob")
    def to_start_speaker_enrollment_job(self) -> "Voiceid":
        '''(experimental) Grants permission to start a speaker enrollment job.

        Access Level: Write

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_StartSpeakerEnrollmentJob.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toStartSpeakerEnrollmentJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Voiceid":
        '''(experimental) Grants permission to tag a Voice ID resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Voiceid":
        '''(experimental) Grants permission to remove a tag from a Voice ID resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDomain")
    def to_update_domain(self) -> "Voiceid":
        '''(experimental) Grants permission to update a domain.

        Access Level: Write

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_UpdateDomain.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toUpdateDomain", []))

    @jsii.member(jsii_name="toUpdateWatchlist")
    def to_update_watchlist(self) -> "Voiceid":
        '''(experimental) Grants permission to update a watchlist.

        Access Level: Write

        https://docs.aws.amazon.com/voiceid/latest/APIReference/API_UpdateWatchlist.html

        :stability: experimental
        '''
        return typing.cast("Voiceid", jsii.invoke(self, "toUpdateWatchlist", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c9c9c6986ef1c0cfabdcc3bde64476c9331a58401adc275ed19e13f92db7f25d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__42d308245a17e33df44d6c12be17fedf783af7167609ef5629fbc79867635dc1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class VpcLattice(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.VpcLattice",
):
    '''(experimental) Statement provider for service `vpc-lattice <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonvpclattice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `vpc-lattice <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonvpclattice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6b145f8b254834cfdee8fe9a8f1d34dbec995e2107b83bc0ce26d94fd648eb70)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAuthType")
    def if_auth_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "VpcLattice":
        '''(experimental) Filters access by the auth type specified in the request.

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        Applies to actions:

        - .toCreateService()
        - .toCreateServiceNetwork()
        - .toUpdateService()
        - .toUpdateServiceNetwork()

        Applies to resource types:

        - ServiceNetwork
        - Service

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2e17c8d391c2eb5335ef273753c826b40b22f9a55a4e1cdd14569d623a87270a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("VpcLattice", jsii.invoke(self, "ifAuthType", [value, operator]))

    @jsii.member(jsii_name="ifProtocol")
    def if_protocol(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "VpcLattice":
        '''(experimental) Filters access by the protocol specified in the request.

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        Applies to actions:

        - .toCreateListener()

        Applies to resource types:

        - Listener

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c8ebf003c42352209f555b1e4106a42a714b02b835b08c5e0ee41de97421e588)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("VpcLattice", jsii.invoke(self, "ifProtocol", [value, operator]))

    @jsii.member(jsii_name="ifSecurityGroupIds")
    def if_security_group_ids(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "VpcLattice":
        '''(experimental) Filters access by the IDs of security groups.

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        Applies to actions:

        - .toCreateServiceNetworkVpcAssociation()
        - .toUpdateServiceNetworkVpcAssociation()

        Applies to resource types:

        - ServiceNetworkVpcAssociation

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__78cc658b293ed08bad100724d9abe01426354d6ad961bb6988a0466b5a159256)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("VpcLattice", jsii.invoke(self, "ifSecurityGroupIds", [value, operator]))

    @jsii.member(jsii_name="ifServiceArn")
    def if_service_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "VpcLattice":
        '''(experimental) Filters access by the ARN of a service.

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        Applies to actions:

        - .toCreateServiceNetworkServiceAssociation()
        - .toDeleteServiceNetworkServiceAssociation()
        - .toGetServiceNetworkServiceAssociation()
        - .toListServiceNetworkServiceAssociations()

        Applies to resource types:

        - ServiceNetworkServiceAssociation

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3d3785840fc1c498dc02c99058237b24f0b965fcf7c65e83f0f5a50849fce6e3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("VpcLattice", jsii.invoke(self, "ifServiceArn", [value, operator]))

    @jsii.member(jsii_name="ifServiceNetworkArn")
    def if_service_network_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "VpcLattice":
        '''(experimental) Filters access by the ARN of a service network.

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        Applies to actions:

        - .toCreateServiceNetworkServiceAssociation()
        - .toCreateServiceNetworkVpcAssociation()
        - .toDeleteServiceNetworkServiceAssociation()
        - .toDeleteServiceNetworkVpcAssociation()
        - .toGetServiceNetworkServiceAssociation()
        - .toGetServiceNetworkVpcAssociation()
        - .toListServiceNetworkServiceAssociations()
        - .toListServiceNetworkVpcAssociations()
        - .toUpdateServiceNetworkVpcAssociation()

        Applies to resource types:

        - ServiceNetworkVpcAssociation
        - ServiceNetworkServiceAssociation

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dabb495b3ede5ff6309375f9556d22e44174004e6660f475197e9b1400561e40)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("VpcLattice", jsii.invoke(self, "ifServiceNetworkArn", [value, operator]))

    @jsii.member(jsii_name="ifTargetGroupArns")
    def if_target_group_arns(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "VpcLattice":
        '''(experimental) Filters access by the ARNs of target groups.

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        Applies to actions:

        - .toCreateListener()
        - .toCreateRule()
        - .toUpdateListener()
        - .toUpdateRule()

        Applies to resource types:

        - Listener
        - Rule

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ef9d0ab6e91db608f64da2e162940c514eff6c9286cac276af4ac048f102268c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("VpcLattice", jsii.invoke(self, "ifTargetGroupArns", [value, operator]))

    @jsii.member(jsii_name="ifVpcId")
    def if_vpc_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "VpcLattice":
        '''(experimental) Filters access by the ID of a virtual private cloud (VPC).

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        Applies to actions:

        - .toCreateServiceNetworkVpcAssociation()
        - .toCreateTargetGroup()
        - .toDeleteServiceNetworkVpcAssociation()
        - .toGetServiceNetworkVpcAssociation()
        - .toListServiceNetworkVpcAssociations()
        - .toUpdateServiceNetworkVpcAssociation()

        Applies to resource types:

        - ServiceNetworkVpcAssociation
        - TargetGroup

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f8c26dff454d7e40b1b73aea8acc534deaa2f929843f1aed91deabd6d5849393)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("VpcLattice", jsii.invoke(self, "ifVpcId", [value, operator]))

    @jsii.member(jsii_name="onAccessLogSubscription")
    def on_access_log_subscription(
        self,
        access_log_subscription_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "VpcLattice":
        '''(experimental) Adds a resource of type AccessLogSubscription to the statement.

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :param access_log_subscription_id: - Identifier for the accessLogSubscriptionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1e5dd5c1d6114a88640462d5fc2d312189c75c52926cbce38578aa4d67307203)
            check_type(argname="argument access_log_subscription_id", value=access_log_subscription_id, expected_type=type_hints["access_log_subscription_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("VpcLattice", jsii.invoke(self, "onAccessLogSubscription", [access_log_subscription_id, account, region, partition]))

    @jsii.member(jsii_name="onListener")
    def on_listener(
        self,
        service_id: builtins.str,
        listener_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "VpcLattice":
        '''(experimental) Adds a resource of type Listener to the statement.

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :param service_id: - Identifier for the serviceId.
        :param listener_id: - Identifier for the listenerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifProtocol() - .ifTargetGroupArns()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__63ef2d6533edf6220457aea405a7efab37b29d19fe8bf5728f807b6855fab9f1)
            check_type(argname="argument service_id", value=service_id, expected_type=type_hints["service_id"])
            check_type(argname="argument listener_id", value=listener_id, expected_type=type_hints["listener_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("VpcLattice", jsii.invoke(self, "onListener", [service_id, listener_id, account, region, partition]))

    @jsii.member(jsii_name="onRule")
    def on_rule(
        self,
        service_id: builtins.str,
        listener_id: builtins.str,
        rule_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "VpcLattice":
        '''(experimental) Adds a resource of type Rule to the statement.

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :param service_id: - Identifier for the serviceId.
        :param listener_id: - Identifier for the listenerId.
        :param rule_id: - Identifier for the ruleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifTargetGroupArns()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__34a33e99c3761bb826c680e1a45a02b160423342f311a095fceed67ea4ba1e37)
            check_type(argname="argument service_id", value=service_id, expected_type=type_hints["service_id"])
            check_type(argname="argument listener_id", value=listener_id, expected_type=type_hints["listener_id"])
            check_type(argname="argument rule_id", value=rule_id, expected_type=type_hints["rule_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("VpcLattice", jsii.invoke(self, "onRule", [service_id, listener_id, rule_id, account, region, partition]))

    @jsii.member(jsii_name="onService")
    def on_service(
        self,
        service_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "VpcLattice":
        '''(experimental) Adds a resource of type Service to the statement.

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :param service_id: - Identifier for the serviceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAuthType()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8add5ec497a6b0305efed45bb3c41316b2282e1c39f02927d04ea8cb4c46a6b5)
            check_type(argname="argument service_id", value=service_id, expected_type=type_hints["service_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("VpcLattice", jsii.invoke(self, "onService", [service_id, account, region, partition]))

    @jsii.member(jsii_name="onServiceNetwork")
    def on_service_network(
        self,
        service_network_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "VpcLattice":
        '''(experimental) Adds a resource of type ServiceNetwork to the statement.

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :param service_network_id: - Identifier for the serviceNetworkId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAuthType()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cd37aa53463cfa9f6252c08263fbe746dfa46ae4c278af8e0e121644f8223969)
            check_type(argname="argument service_network_id", value=service_network_id, expected_type=type_hints["service_network_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("VpcLattice", jsii.invoke(self, "onServiceNetwork", [service_network_id, account, region, partition]))

    @jsii.member(jsii_name="onServiceNetworkServiceAssociation")
    def on_service_network_service_association(
        self,
        service_network_service_association_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "VpcLattice":
        '''(experimental) Adds a resource of type ServiceNetworkServiceAssociation to the statement.

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :param service_network_service_association_id: - Identifier for the serviceNetworkServiceAssociationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifServiceArn() - .ifServiceNetworkArn()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__19aae0712db45d8efb1b31b0649f75e3c594d3282fa1fd4ef16e7ba15bf0a25f)
            check_type(argname="argument service_network_service_association_id", value=service_network_service_association_id, expected_type=type_hints["service_network_service_association_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("VpcLattice", jsii.invoke(self, "onServiceNetworkServiceAssociation", [service_network_service_association_id, account, region, partition]))

    @jsii.member(jsii_name="onServiceNetworkVpcAssociation")
    def on_service_network_vpc_association(
        self,
        service_network_vpc_association_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "VpcLattice":
        '''(experimental) Adds a resource of type ServiceNetworkVpcAssociation to the statement.

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :param service_network_vpc_association_id: - Identifier for the serviceNetworkVpcAssociationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifSecurityGroupIds() - .ifServiceNetworkArn() - .ifVpcId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__686e4ddba7b08974e00a7032284b1fc0569cbb4576818e5c1e5b2208b564b6ec)
            check_type(argname="argument service_network_vpc_association_id", value=service_network_vpc_association_id, expected_type=type_hints["service_network_vpc_association_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("VpcLattice", jsii.invoke(self, "onServiceNetworkVpcAssociation", [service_network_vpc_association_id, account, region, partition]))

    @jsii.member(jsii_name="onTargetGroup")
    def on_target_group(
        self,
        target_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "VpcLattice":
        '''(experimental) Adds a resource of type TargetGroup to the statement.

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :param target_group_id: - Identifier for the targetGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifVpcId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2c885de69dd5492dc63dedf1201bdcb8ed83c516a48729466595d414fe0cd6a3)
            check_type(argname="argument target_group_id", value=target_group_id, expected_type=type_hints["target_group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("VpcLattice", jsii.invoke(self, "onTargetGroup", [target_group_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateAccessLogSubscription")
    def to_create_access_log_subscription(self) -> "VpcLattice":
        '''(experimental) Grants permission to create an access log subscription.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - logs:CreateLogDelivery
        - logs:GetLogDelivery

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toCreateAccessLogSubscription", []))

    @jsii.member(jsii_name="toCreateListener")
    def to_create_listener(self) -> "VpcLattice":
        '''(experimental) Grants permission to create a listener.

        Access Level: Write

        Possible conditions:

        - .ifProtocol()
        - .ifTargetGroupArns()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toCreateListener", []))

    @jsii.member(jsii_name="toCreateRule")
    def to_create_rule(self) -> "VpcLattice":
        '''(experimental) Grants permission to create a rule.

        Access Level: Write

        Possible conditions:

        - .ifTargetGroupArns()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toCreateRule", []))

    @jsii.member(jsii_name="toCreateService")
    def to_create_service(self) -> "VpcLattice":
        '''(experimental) Grants permission to create a service.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toCreateService", []))

    @jsii.member(jsii_name="toCreateServiceNetwork")
    def to_create_service_network(self) -> "VpcLattice":
        '''(experimental) Grants permission to create a service network.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toCreateServiceNetwork", []))

    @jsii.member(jsii_name="toCreateServiceNetworkServiceAssociation")
    def to_create_service_network_service_association(self) -> "VpcLattice":
        '''(experimental) Grants permission to create a service network and service association.

        Access Level: Write

        Possible conditions:

        - .ifServiceNetworkArn()
        - .ifServiceArn()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toCreateServiceNetworkServiceAssociation", []))

    @jsii.member(jsii_name="toCreateServiceNetworkVpcAssociation")
    def to_create_service_network_vpc_association(self) -> "VpcLattice":
        '''(experimental) Grants permission to create a service network and VPC association.

        Access Level: Write

        Possible conditions:

        - .ifVpcId()
        - .ifServiceNetworkArn()
        - .ifSecurityGroupIds()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toCreateServiceNetworkVpcAssociation", []))

    @jsii.member(jsii_name="toCreateTargetGroup")
    def to_create_target_group(self) -> "VpcLattice":
        '''(experimental) Grants permission to create a target group.

        Access Level: Write

        Possible conditions:

        - .ifVpcId()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toCreateTargetGroup", []))

    @jsii.member(jsii_name="toDeleteAccessLogSubscription")
    def to_delete_access_log_subscription(self) -> "VpcLattice":
        '''(experimental) Grants permission to delete an access log subscription.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - logs:DeleteLogDelivery
        - logs:GetLogDelivery

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toDeleteAccessLogSubscription", []))

    @jsii.member(jsii_name="toDeleteAuthPolicy")
    def to_delete_auth_policy(self) -> "VpcLattice":
        '''(experimental) Grants permission to delete an auth policy.

        Access Level: Permissions management

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toDeleteAuthPolicy", []))

    @jsii.member(jsii_name="toDeleteListener")
    def to_delete_listener(self) -> "VpcLattice":
        '''(experimental) Grants permission to delete a listener.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toDeleteListener", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "VpcLattice":
        '''(experimental) Grants permission to delete a resource policy.

        Access Level: Write

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteRule")
    def to_delete_rule(self) -> "VpcLattice":
        '''(experimental) Grants permission to delete a rule.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toDeleteRule", []))

    @jsii.member(jsii_name="toDeleteService")
    def to_delete_service(self) -> "VpcLattice":
        '''(experimental) Grants permission to delete a service.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toDeleteService", []))

    @jsii.member(jsii_name="toDeleteServiceNetwork")
    def to_delete_service_network(self) -> "VpcLattice":
        '''(experimental) Grants permission to delete a service network.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toDeleteServiceNetwork", []))

    @jsii.member(jsii_name="toDeleteServiceNetworkServiceAssociation")
    def to_delete_service_network_service_association(self) -> "VpcLattice":
        '''(experimental) Grants permission to delete a service network service association.

        Access Level: Write

        Possible conditions:

        - .ifServiceNetworkArn()
        - .ifServiceArn()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toDeleteServiceNetworkServiceAssociation", []))

    @jsii.member(jsii_name="toDeleteServiceNetworkVpcAssociation")
    def to_delete_service_network_vpc_association(self) -> "VpcLattice":
        '''(experimental) Grants permission to delete a service network and VPC association.

        Access Level: Write

        Possible conditions:

        - .ifVpcId()
        - .ifServiceNetworkArn()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toDeleteServiceNetworkVpcAssociation", []))

    @jsii.member(jsii_name="toDeleteTargetGroup")
    def to_delete_target_group(self) -> "VpcLattice":
        '''(experimental) Grants permission to delete a target group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toDeleteTargetGroup", []))

    @jsii.member(jsii_name="toDeregisterTargets")
    def to_deregister_targets(self) -> "VpcLattice":
        '''(experimental) Grants permission to deregister targets from a target group.

        Access Level: Write

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toDeregisterTargets", []))

    @jsii.member(jsii_name="toGetAccessLogSubscription")
    def to_get_access_log_subscription(self) -> "VpcLattice":
        '''(experimental) Grants permission to get information about an access log subscription.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - logs:GetLogDelivery

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toGetAccessLogSubscription", []))

    @jsii.member(jsii_name="toGetAuthPolicy")
    def to_get_auth_policy(self) -> "VpcLattice":
        '''(experimental) Grants permission to get information about an auth policy.

        Access Level: Read

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toGetAuthPolicy", []))

    @jsii.member(jsii_name="toGetListener")
    def to_get_listener(self) -> "VpcLattice":
        '''(experimental) Grants permission to get information about a listener.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toGetListener", []))

    @jsii.member(jsii_name="toGetResourcePolicy")
    def to_get_resource_policy(self) -> "VpcLattice":
        '''(experimental) Grants permission to get information about a resource policy.

        Access Level: Read

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toGetResourcePolicy", []))

    @jsii.member(jsii_name="toGetRule")
    def to_get_rule(self) -> "VpcLattice":
        '''(experimental) Grants permission to get information about a rule.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toGetRule", []))

    @jsii.member(jsii_name="toGetService")
    def to_get_service(self) -> "VpcLattice":
        '''(experimental) Grants permission to get information about a service.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toGetService", []))

    @jsii.member(jsii_name="toGetServiceNetwork")
    def to_get_service_network(self) -> "VpcLattice":
        '''(experimental) Grants permission to get information about a service network.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toGetServiceNetwork", []))

    @jsii.member(jsii_name="toGetServiceNetworkServiceAssociation")
    def to_get_service_network_service_association(self) -> "VpcLattice":
        '''(experimental) Grants permission to get information about a service network and service association.

        Access Level: Read

        Possible conditions:

        - .ifServiceNetworkArn()
        - .ifServiceArn()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toGetServiceNetworkServiceAssociation", []))

    @jsii.member(jsii_name="toGetServiceNetworkVpcAssociation")
    def to_get_service_network_vpc_association(self) -> "VpcLattice":
        '''(experimental) Grants permission to get information about a service network and VPC association.

        Access Level: Read

        Possible conditions:

        - .ifVpcId()
        - .ifServiceNetworkArn()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toGetServiceNetworkVpcAssociation", []))

    @jsii.member(jsii_name="toGetTargetGroup")
    def to_get_target_group(self) -> "VpcLattice":
        '''(experimental) Grants permission to get information about a target group.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toGetTargetGroup", []))

    @jsii.member(jsii_name="toListAccessLogSubscriptions")
    def to_list_access_log_subscriptions(self) -> "VpcLattice":
        '''(experimental) Grants permission to list some or all access log subscriptions about a service network or a service.

        Access Level: List

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toListAccessLogSubscriptions", []))

    @jsii.member(jsii_name="toListListeners")
    def to_list_listeners(self) -> "VpcLattice":
        '''(experimental) Grants permission to list some or all listeners.

        Access Level: List

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toListListeners", []))

    @jsii.member(jsii_name="toListRules")
    def to_list_rules(self) -> "VpcLattice":
        '''(experimental) Grants permission to list some or all rules.

        Access Level: List

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toListRules", []))

    @jsii.member(jsii_name="toListServiceNetworks")
    def to_list_service_networks(self) -> "VpcLattice":
        '''(experimental) Grants permission to list the service networks owned by a caller account or shared with the caller account.

        Access Level: List

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toListServiceNetworks", []))

    @jsii.member(jsii_name="toListServiceNetworkServiceAssociations")
    def to_list_service_network_service_associations(self) -> "VpcLattice":
        '''(experimental) Grants permission to list some or all service network and service associations.

        Access Level: List

        Possible conditions:

        - .ifServiceNetworkArn()
        - .ifServiceArn()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toListServiceNetworkServiceAssociations", []))

    @jsii.member(jsii_name="toListServiceNetworkVpcAssociations")
    def to_list_service_network_vpc_associations(self) -> "VpcLattice":
        '''(experimental) Grants permission to list some or all service network and VPC associations.

        Access Level: List

        Possible conditions:

        - .ifVpcId()
        - .ifServiceNetworkArn()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toListServiceNetworkVpcAssociations", []))

    @jsii.member(jsii_name="toListServices")
    def to_list_services(self) -> "VpcLattice":
        '''(experimental) Grants permission to list the services owned by a caller account or shared with the caller account.

        Access Level: List

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toListServices", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "VpcLattice":
        '''(experimental) Grants permission to list tags for a vpc-lattice resource.

        Access Level: Read

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTargetGroups")
    def to_list_target_groups(self) -> "VpcLattice":
        '''(experimental) Grants permission to list some or all target groups.

        Access Level: List

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toListTargetGroups", []))

    @jsii.member(jsii_name="toListTargets")
    def to_list_targets(self) -> "VpcLattice":
        '''(experimental) Grants permission to list some or all targets in a target group.

        Access Level: List

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toListTargets", []))

    @jsii.member(jsii_name="toPutAuthPolicy")
    def to_put_auth_policy(self) -> "VpcLattice":
        '''(experimental) Grants permission to create or update the auth policy for a service network or a service.

        Access Level: Permissions management

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toPutAuthPolicy", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "VpcLattice":
        '''(experimental) Grants permission to create a resource policy for a service network or a service.

        Access Level: Write

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toRegisterTargets")
    def to_register_targets(self) -> "VpcLattice":
        '''(experimental) Grants permission to register targets to a target group.

        Access Level: Write

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toRegisterTargets", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "VpcLattice":
        '''(experimental) Grants permission to tag a vpc-lattice resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "VpcLattice":
        '''(experimental) Grants permission to untag a vpc-lattice resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAccessLogSubscription")
    def to_update_access_log_subscription(self) -> "VpcLattice":
        '''(experimental) Grants permission to update an access log subscription.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - logs:GetLogDelivery
        - logs:UpdateLogDelivery

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toUpdateAccessLogSubscription", []))

    @jsii.member(jsii_name="toUpdateListener")
    def to_update_listener(self) -> "VpcLattice":
        '''(experimental) Grants permission to update a listener.

        Access Level: Write

        Possible conditions:

        - .ifTargetGroupArns()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toUpdateListener", []))

    @jsii.member(jsii_name="toUpdateRule")
    def to_update_rule(self) -> "VpcLattice":
        '''(experimental) Grants permission to update a rule.

        Access Level: Write

        Possible conditions:

        - .ifTargetGroupArns()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toUpdateRule", []))

    @jsii.member(jsii_name="toUpdateService")
    def to_update_service(self) -> "VpcLattice":
        '''(experimental) Grants permission to update a service.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toUpdateService", []))

    @jsii.member(jsii_name="toUpdateServiceNetwork")
    def to_update_service_network(self) -> "VpcLattice":
        '''(experimental) Grants permission to update a service network.

        Access Level: Write

        Possible conditions:

        - .ifAuthType()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toUpdateServiceNetwork", []))

    @jsii.member(jsii_name="toUpdateServiceNetworkVpcAssociation")
    def to_update_service_network_vpc_association(self) -> "VpcLattice":
        '''(experimental) Grants permission to update a service network and VPC association.

        Access Level: Write

        Possible conditions:

        - .ifVpcId()
        - .ifServiceNetworkArn()
        - .ifSecurityGroupIds()
        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:DescribeSecurityGroups
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toUpdateServiceNetworkVpcAssociation", []))

    @jsii.member(jsii_name="toUpdateTargetGroup")
    def to_update_target_group(self) -> "VpcLattice":
        '''(experimental) Grants permission to update a target group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/vpc-lattice/latest/ug/

        :stability: experimental
        '''
        return typing.cast("VpcLattice", jsii.invoke(self, "toUpdateTargetGroup", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9ecafe5751623fc79b59cc0312d49dd0e061269bb6a09dcf95b23701bcd30058)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7a9f0d3583e6ea80d2ff4a46ac5225fd15bcc1dc3b4ac038ea40955d72f130bf)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class VpcLatticeSvcs(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.VpcLatticeSvcs",
):
    '''(experimental) Statement provider for service `vpc-lattice-svcs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonvpclatticeservices.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `vpc-lattice-svcs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonvpclatticeservices.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__21fd17d8bf348e0de13f57c5a36a5871783e07eb4bb04869386dc8ec78f8f44a)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifPort")
    def if_port(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "VpcLatticeSvcs":
        '''(experimental) Filters access by the destination port the request is made to.

        https://aws.amazon.com/vpc/lattice

        Applies to actions:

        - .toInvoke()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cb261d588a95d09b2376b6db795db1d5d102f086a1462bd50b85598b8a501f9a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("VpcLatticeSvcs", jsii.invoke(self, "ifPort", [value, operator]))

    @jsii.member(jsii_name="ifRequestHeader")
    def if_request_header(
        self,
        header_name: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "VpcLatticeSvcs":
        '''(experimental) Filters access by a header name-value pair in the request headers.

        https://aws.amazon.com/vpc/lattice

        Applies to actions:

        - .toInvoke()

        :param header_name: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__07987bc737c37191cd05fb028257a93f91378b95de9d5e1727fecffab860fb8b)
            check_type(argname="argument header_name", value=header_name, expected_type=type_hints["header_name"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("VpcLatticeSvcs", jsii.invoke(self, "ifRequestHeader", [header_name, value, operator]))

    @jsii.member(jsii_name="ifRequestMethod")
    def if_request_method(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "VpcLatticeSvcs":
        '''(experimental) Filters access by the method of the request.

        https://aws.amazon.com/vpc/lattice

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f9242a839edd50560a4e8165b51a3d0057b01354ec3b4d31ba2736c5ec0c0246)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("VpcLatticeSvcs", jsii.invoke(self, "ifRequestMethod", [value, operator]))

    @jsii.member(jsii_name="ifRequestQueryString")
    def if_request_query_string(
        self,
        query_string_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "VpcLatticeSvcs":
        '''(experimental) Filters access by the query string key-value pairs in the request URL.

        https://aws.amazon.com/vpc/lattice

        Applies to actions:

        - .toInvoke()

        :param query_string_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e109807f9f71cc58676d6e69b92befa0bcc2c3caf8d785d4bced3eb5e0cc09f0)
            check_type(argname="argument query_string_key", value=query_string_key, expected_type=type_hints["query_string_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("VpcLatticeSvcs", jsii.invoke(self, "ifRequestQueryString", [query_string_key, value, operator]))

    @jsii.member(jsii_name="ifServiceArn")
    def if_service_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "VpcLatticeSvcs":
        '''(experimental) Filters access by the ARN of the service receiving the request.

        https://aws.amazon.com/vpc/lattice

        Applies to actions:

        - .toInvoke()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f24b0b34978fea8301a3f3edf1912e53743dd6b947eb0b209e3cfeb3f96d079a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("VpcLatticeSvcs", jsii.invoke(self, "ifServiceArn", [value, operator]))

    @jsii.member(jsii_name="ifServiceNetworkArn")
    def if_service_network_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "VpcLatticeSvcs":
        '''(experimental) Filters access by the ARN of the service network receiving the request.

        https://aws.amazon.com/vpc/lattice

        Applies to actions:

        - .toInvoke()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__97521041b694c093e07bcc809ca8d67af2846ab3d626ff66613b65e01c3f7a8e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("VpcLatticeSvcs", jsii.invoke(self, "ifServiceNetworkArn", [value, operator]))

    @jsii.member(jsii_name="ifSourceVpc")
    def if_source_vpc(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "VpcLatticeSvcs":
        '''(experimental) Filters access by the VPC the request is made from.

        https://aws.amazon.com/vpc/lattice

        Applies to actions:

        - .toInvoke()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3c20a6f76e6fb9e18838a1c020b7cd6a3860e4cd77579d56c058477ebaa97dd0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("VpcLatticeSvcs", jsii.invoke(self, "ifSourceVpc", [value, operator]))

    @jsii.member(jsii_name="ifSourceVpcOwnerAccount")
    def if_source_vpc_owner_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "VpcLatticeSvcs":
        '''(experimental) Filters access by the owning account of the VPC the request is made from.

        https://aws.amazon.com/vpc/lattice

        Applies to actions:

        - .toInvoke()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f4494e7c2c11addbfef0616fa94e781dd6a20a076b76c0bf0d85ffae09707c86)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("VpcLatticeSvcs", jsii.invoke(self, "ifSourceVpcOwnerAccount", [value, operator]))

    @jsii.member(jsii_name="onService")
    def on_service(
        self,
        service_id: builtins.str,
        request_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "VpcLatticeSvcs":
        '''(experimental) Adds a resource of type Service to the statement.

        https://aws.amazon.com/vpc/lattice

        :param service_id: - Identifier for the serviceId.
        :param request_path: - Identifier for the requestPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2b6aa799a7f4f728fcea20d780a9f9915ce9eb4b201bcfb38242388af71f2de8)
            check_type(argname="argument service_id", value=service_id, expected_type=type_hints["service_id"])
            check_type(argname="argument request_path", value=request_path, expected_type=type_hints["request_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("VpcLatticeSvcs", jsii.invoke(self, "onService", [service_id, request_path, account, region, partition]))

    @jsii.member(jsii_name="toInvoke")
    def to_invoke(self) -> "VpcLatticeSvcs":
        '''(experimental) Grants permission to invoke a VPC Lattice service.

        Access Level: Write

        Possible conditions:

        - .ifPort()
        - .ifServiceNetworkArn()
        - .ifServiceArn()
        - .ifSourceVpc()
        - .ifSourceVpcOwnerAccount()
        - .ifRequestHeader()
        - .ifRequestQueryString()

        https://aws.amazon.com/vpc/lattice

        :stability: experimental
        '''
        return typing.cast("VpcLatticeSvcs", jsii.invoke(self, "toInvoke", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b2cc5bf015252401dda404b06fde5c2e95b9a418e1da95aa361fe57d489e2c14)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c5003a0afe40e1e3525452f90b7beb31af7f35cebe6346eae3fe3a2a472c33d9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Waf(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Waf"):
    '''(experimental) Statement provider for service `waf <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswaf.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `waf <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswaf.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3bc13df1895b0cfd5a765bbeec3fc77caae030e5c57bdb3d50839ddcd3f6b82c)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onBytematchset")
    def on_bytematchset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type bytematchset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ByteMatchSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c692b6b58c96d4645697f9174ed7f2f632315c04eecdfa1154b4c98eb8706827)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Waf", jsii.invoke(self, "onBytematchset", [id, account, partition]))

    @jsii.member(jsii_name="onGeomatchset")
    def on_geomatchset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type geomatchset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GeoMatchSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__818f146e02f74a396ff42c7900e8d92ed3cfca16a339fa8e3a5bcb2e90227d16)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Waf", jsii.invoke(self, "onGeomatchset", [id, account, partition]))

    @jsii.member(jsii_name="onIpset")
    def on_ipset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type ipset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_IPSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c6beb09e881dc212819a0d780e9946c774abb1add3a42e8e14ee459eca692434)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Waf", jsii.invoke(self, "onIpset", [id, account, partition]))

    @jsii.member(jsii_name="onRatebasedrule")
    def on_ratebasedrule(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type ratebasedrule to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_RateBasedRule.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__96bb1fe18c57614b0bc7d23fd452d3e0cb3db573ed1cce2bfc79a7c29530c9cc)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Waf", jsii.invoke(self, "onRatebasedrule", [id, account, partition]))

    @jsii.member(jsii_name="onRegexmatchset")
    def on_regexmatchset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type regexmatchset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_RegexMatchSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2645070c6205dc0bbc961aaecf9bb6ac394f52116fe10c42a3d9ff9f8cf30c67)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Waf", jsii.invoke(self, "onRegexmatchset", [id, account, partition]))

    @jsii.member(jsii_name="onRegexpatternset")
    def on_regexpatternset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type regexpatternset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_RegexPatternSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c34c35151a8cee1b7fbfa72dc4569a23bcaa1968e80a5e059af9e477a4b02905)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Waf", jsii.invoke(self, "onRegexpatternset", [id, account, partition]))

    @jsii.member(jsii_name="onRule")
    def on_rule(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type rule to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_Rule.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f94f619ee20145f614f863016bda748b1f8c6c4521906b71dc80aa9d6b03fcbd)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Waf", jsii.invoke(self, "onRule", [id, account, partition]))

    @jsii.member(jsii_name="onRulegroup")
    def on_rulegroup(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type rulegroup to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_RuleGroup.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cca752a58267c43c70ef6ffafb76bd5ace0a8f282003022ae6d3d9189a80de28)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Waf", jsii.invoke(self, "onRulegroup", [id, account, partition]))

    @jsii.member(jsii_name="onSizeconstraintset")
    def on_sizeconstraintset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type sizeconstraintset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_SizeConstraintSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0eecffe102a95073d3243834ae4e243fdc05d69704abf0291ba8dcf7f8024dd6)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Waf", jsii.invoke(self, "onSizeconstraintset", [id, account, partition]))

    @jsii.member(jsii_name="onSqlinjectionmatchset")
    def on_sqlinjectionmatchset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type sqlinjectionmatchset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_SqlInjectionMatchSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__20615ddce06b6856de117ff9ecce0a7f2456138b81ffa356ccd04e8f82445d1d)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Waf", jsii.invoke(self, "onSqlinjectionmatchset", [id, account, partition]))

    @jsii.member(jsii_name="onWebacl")
    def on_webacl(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type webacl to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_WebACL.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1c8aa9f60359359391795c3f2acef57a6c982a507a9057ac939b9c0ad4851641)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Waf", jsii.invoke(self, "onWebacl", [id, account, partition]))

    @jsii.member(jsii_name="onXssmatchset")
    def on_xssmatchset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Waf":
        '''(experimental) Adds a resource of type xssmatchset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_XssMatchSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__28a8b895f9d775ba465b7c50f720b92c7babce89464da6ceb517d375687030e9)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Waf", jsii.invoke(self, "onXssmatchset", [id, account, partition]))

    @jsii.member(jsii_name="toCreateByteMatchSet")
    def to_create_byte_match_set(self) -> "Waf":
        '''(experimental) Grants permission to create a ByteMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateByteMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateByteMatchSet", []))

    @jsii.member(jsii_name="toCreateGeoMatchSet")
    def to_create_geo_match_set(self) -> "Waf":
        '''(experimental) Grants permission to create a GeoMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateGeoMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateGeoMatchSet", []))

    @jsii.member(jsii_name="toCreateIPSet")
    def to_create_ip_set(self) -> "Waf":
        '''(experimental) Grants permission to create an IPSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateIPSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateIPSet", []))

    @jsii.member(jsii_name="toCreateRateBasedRule")
    def to_create_rate_based_rule(self) -> "Waf":
        '''(experimental) Grants permission to create a RateBasedRule for limiting the volume of requests from a single IP address.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateRateBasedRule.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateRateBasedRule", []))

    @jsii.member(jsii_name="toCreateRegexMatchSet")
    def to_create_regex_match_set(self) -> "Waf":
        '''(experimental) Grants permission to create a RegexMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateRegexMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateRegexMatchSet", []))

    @jsii.member(jsii_name="toCreateRegexPatternSet")
    def to_create_regex_pattern_set(self) -> "Waf":
        '''(experimental) Grants permission to create a RegexPatternSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateRegexPatternSet", []))

    @jsii.member(jsii_name="toCreateRule")
    def to_create_rule(self) -> "Waf":
        '''(experimental) Grants permission to create a Rule for filtering web requests.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateRule.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateRule", []))

    @jsii.member(jsii_name="toCreateRuleGroup")
    def to_create_rule_group(self) -> "Waf":
        '''(experimental) Grants permission to create a RuleGroup, which is a collection of predefined rules that you can use in a WebACL.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateRuleGroup", []))

    @jsii.member(jsii_name="toCreateSizeConstraintSet")
    def to_create_size_constraint_set(self) -> "Waf":
        '''(experimental) Grants permission to create a SizeConstraintSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateSizeConstraintSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateSizeConstraintSet", []))

    @jsii.member(jsii_name="toCreateSqlInjectionMatchSet")
    def to_create_sql_injection_match_set(self) -> "Waf":
        '''(experimental) Grants permission to create an SqlInjectionMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateSqlInjectionMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateSqlInjectionMatchSet", []))

    @jsii.member(jsii_name="toCreateWebACL")
    def to_create_web_acl(self) -> "Waf":
        '''(experimental) Grants permission to create a WebACL, which contains rules for filtering web requests.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateWebACL.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateWebACL", []))

    @jsii.member(jsii_name="toCreateWebACLMigrationStack")
    def to_create_web_acl_migration_stack(self) -> "Waf":
        '''(experimental) Grants permission to create a CloudFormation web ACL template in an S3 bucket for the purposes of migrating the web ACL from AWS WAF Classic to AWS WAF v2.

        Access Level: Write

        Dependent actions:

        - s3:PutObject

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateWebACLMigrationStack.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateWebACLMigrationStack", []))

    @jsii.member(jsii_name="toCreateXssMatchSet")
    def to_create_xss_match_set(self) -> "Waf":
        '''(experimental) Grants permission to create an XssMatchSet, which you use to detect requests that contain cross-site scripting attacks.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_CreateXssMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toCreateXssMatchSet", []))

    @jsii.member(jsii_name="toDeleteByteMatchSet")
    def to_delete_byte_match_set(self) -> "Waf":
        '''(experimental) Grants permission to delete a ByteMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteByteMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteByteMatchSet", []))

    @jsii.member(jsii_name="toDeleteGeoMatchSet")
    def to_delete_geo_match_set(self) -> "Waf":
        '''(experimental) Grants permission to delete a GeoMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteGeoMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteGeoMatchSet", []))

    @jsii.member(jsii_name="toDeleteIPSet")
    def to_delete_ip_set(self) -> "Waf":
        '''(experimental) Grants permission to delete an IPSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteIPSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteIPSet", []))

    @jsii.member(jsii_name="toDeleteLoggingConfiguration")
    def to_delete_logging_configuration(self) -> "Waf":
        '''(experimental) Grants permission to delete the LoggingConfiguration from a web ACL.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteLoggingConfiguration", []))

    @jsii.member(jsii_name="toDeletePermissionPolicy")
    def to_delete_permission_policy(self) -> "Waf":
        '''(experimental) Grants permission to delete an IAM policy from a rule group.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeletePermissionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeletePermissionPolicy", []))

    @jsii.member(jsii_name="toDeleteRateBasedRule")
    def to_delete_rate_based_rule(self) -> "Waf":
        '''(experimental) Grants permission to delete a RateBasedRule.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteRateBasedRule.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteRateBasedRule", []))

    @jsii.member(jsii_name="toDeleteRegexMatchSet")
    def to_delete_regex_match_set(self) -> "Waf":
        '''(experimental) Grants permission to delete a RegexMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteRegexMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteRegexMatchSet", []))

    @jsii.member(jsii_name="toDeleteRegexPatternSet")
    def to_delete_regex_pattern_set(self) -> "Waf":
        '''(experimental) Grants permission to delete a RegexPatternSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteRegexPatternSet", []))

    @jsii.member(jsii_name="toDeleteRule")
    def to_delete_rule(self) -> "Waf":
        '''(experimental) Grants permission to delete a Rule.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteRule.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteRule", []))

    @jsii.member(jsii_name="toDeleteRuleGroup")
    def to_delete_rule_group(self) -> "Waf":
        '''(experimental) Grants permission to delete a RuleGroup.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteRuleGroup", []))

    @jsii.member(jsii_name="toDeleteSizeConstraintSet")
    def to_delete_size_constraint_set(self) -> "Waf":
        '''(experimental) Grants permission to delete a SizeConstraintSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteSizeConstraintSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteSizeConstraintSet", []))

    @jsii.member(jsii_name="toDeleteSqlInjectionMatchSet")
    def to_delete_sql_injection_match_set(self) -> "Waf":
        '''(experimental) Grants permission to delete an SqlInjectionMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteSqlInjectionMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteSqlInjectionMatchSet", []))

    @jsii.member(jsii_name="toDeleteWebACL")
    def to_delete_web_acl(self) -> "Waf":
        '''(experimental) Grants permission to delete a WebACL.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteWebACL.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteWebACL", []))

    @jsii.member(jsii_name="toDeleteXssMatchSet")
    def to_delete_xss_match_set(self) -> "Waf":
        '''(experimental) Grants permission to delete an XssMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_DeleteXssMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toDeleteXssMatchSet", []))

    @jsii.member(jsii_name="toGetByteMatchSet")
    def to_get_byte_match_set(self) -> "Waf":
        '''(experimental) Grants permission to retrieve a ByteMatchSet.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetByteMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetByteMatchSet", []))

    @jsii.member(jsii_name="toGetChangeToken")
    def to_get_change_token(self) -> "Waf":
        '''(experimental) Grants permission to retrieve a change token to use in create, update, and delete requests.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetChangeToken.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetChangeToken", []))

    @jsii.member(jsii_name="toGetChangeTokenStatus")
    def to_get_change_token_status(self) -> "Waf":
        '''(experimental) Grants permission to retrieve the status of a change token.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetChangeTokenStatus.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetChangeTokenStatus", []))

    @jsii.member(jsii_name="toGetGeoMatchSet")
    def to_get_geo_match_set(self) -> "Waf":
        '''(experimental) Grants permission to retrieve a GeoMatchSet.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetGeoMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetGeoMatchSet", []))

    @jsii.member(jsii_name="toGetIPSet")
    def to_get_ip_set(self) -> "Waf":
        '''(experimental) Grants permission to retrieve an IPSet.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetIPSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetIPSet", []))

    @jsii.member(jsii_name="toGetLoggingConfiguration")
    def to_get_logging_configuration(self) -> "Waf":
        '''(experimental) Grants permission to retrieve a LoggingConfiguration for a web ACL.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetLoggingConfiguration", []))

    @jsii.member(jsii_name="toGetPermissionPolicy")
    def to_get_permission_policy(self) -> "Waf":
        '''(experimental) Grants permission to retrieve an IAM policy for a rule group.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetPermissionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetPermissionPolicy", []))

    @jsii.member(jsii_name="toGetRateBasedRule")
    def to_get_rate_based_rule(self) -> "Waf":
        '''(experimental) Grants permission to retrieve a RateBasedRule.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetRateBasedRule.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetRateBasedRule", []))

    @jsii.member(jsii_name="toGetRateBasedRuleManagedKeys")
    def to_get_rate_based_rule_managed_keys(self) -> "Waf":
        '''(experimental) Grants permission to retrieve the array of IP addresses that are currently being blocked by a RateBasedRule.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetRateBasedRuleManagedKeys.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetRateBasedRuleManagedKeys", []))

    @jsii.member(jsii_name="toGetRegexMatchSet")
    def to_get_regex_match_set(self) -> "Waf":
        '''(experimental) Grants permission to retrieve a RegexMatchSet.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetRegexMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetRegexMatchSet", []))

    @jsii.member(jsii_name="toGetRegexPatternSet")
    def to_get_regex_pattern_set(self) -> "Waf":
        '''(experimental) Grants permission to retrieve a RegexPatternSet.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetRegexPatternSet", []))

    @jsii.member(jsii_name="toGetRule")
    def to_get_rule(self) -> "Waf":
        '''(experimental) Grants permission to retrieve a Rule.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetRule.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetRule", []))

    @jsii.member(jsii_name="toGetRuleGroup")
    def to_get_rule_group(self) -> "Waf":
        '''(experimental) Grants permission to retrieve a RuleGroup.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetRuleGroup", []))

    @jsii.member(jsii_name="toGetSampledRequests")
    def to_get_sampled_requests(self) -> "Waf":
        '''(experimental) Grants permission to retrieve detailed information about a sample set of web requests.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetSampledRequests.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetSampledRequests", []))

    @jsii.member(jsii_name="toGetSizeConstraintSet")
    def to_get_size_constraint_set(self) -> "Waf":
        '''(experimental) Grants permission to retrieve a SizeConstraintSet.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetSizeConstraintSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetSizeConstraintSet", []))

    @jsii.member(jsii_name="toGetSqlInjectionMatchSet")
    def to_get_sql_injection_match_set(self) -> "Waf":
        '''(experimental) Grants permission to retrieve an SqlInjectionMatchSet.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetSqlInjectionMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetSqlInjectionMatchSet", []))

    @jsii.member(jsii_name="toGetWebACL")
    def to_get_web_acl(self) -> "Waf":
        '''(experimental) Grants permission to retrieve a WebACL.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetWebACL.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetWebACL", []))

    @jsii.member(jsii_name="toGetXssMatchSet")
    def to_get_xss_match_set(self) -> "Waf":
        '''(experimental) Grants permission to retrieve an XssMatchSet.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_GetXssMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toGetXssMatchSet", []))

    @jsii.member(jsii_name="toListActivatedRulesInRuleGroup")
    def to_list_activated_rules_in_rule_group(self) -> "Waf":
        '''(experimental) Grants permission to retrieve an array of ActivatedRule objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListActivatedRulesInRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListActivatedRulesInRuleGroup", []))

    @jsii.member(jsii_name="toListByteMatchSets")
    def to_list_byte_match_sets(self) -> "Waf":
        '''(experimental) Grants permission to retrieve an array of ByteMatchSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListByteMatchSets.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListByteMatchSets", []))

    @jsii.member(jsii_name="toListGeoMatchSets")
    def to_list_geo_match_sets(self) -> "Waf":
        '''(experimental) Grants permission to retrieve an array of GeoMatchSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListGeoMatchSets.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListGeoMatchSets", []))

    @jsii.member(jsii_name="toListIPSets")
    def to_list_ip_sets(self) -> "Waf":
        '''(experimental) Grants permission to retrieve an array of IPSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListIPSets.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListIPSets", []))

    @jsii.member(jsii_name="toListLoggingConfigurations")
    def to_list_logging_configurations(self) -> "Waf":
        '''(experimental) Grants permission to retrieve an array of LoggingConfiguration objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListLoggingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListLoggingConfigurations", []))

    @jsii.member(jsii_name="toListRateBasedRules")
    def to_list_rate_based_rules(self) -> "Waf":
        '''(experimental) Grants permission to retrieve an array of RuleSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListRateBasedRules.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListRateBasedRules", []))

    @jsii.member(jsii_name="toListRegexMatchSets")
    def to_list_regex_match_sets(self) -> "Waf":
        '''(experimental) Grants permission to retrieve an array of RegexMatchSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListRegexMatchSets.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListRegexMatchSets", []))

    @jsii.member(jsii_name="toListRegexPatternSets")
    def to_list_regex_pattern_sets(self) -> "Waf":
        '''(experimental) Grants permission to retrieve an array of RegexPatternSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListRegexPatternSets.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListRegexPatternSets", []))

    @jsii.member(jsii_name="toListRuleGroups")
    def to_list_rule_groups(self) -> "Waf":
        '''(experimental) Grants permission to retrieve an array of RuleGroup objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListRuleGroups.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListRuleGroups", []))

    @jsii.member(jsii_name="toListRules")
    def to_list_rules(self) -> "Waf":
        '''(experimental) Grants permission to retrieve an array of RuleSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListRules.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListRules", []))

    @jsii.member(jsii_name="toListSizeConstraintSets")
    def to_list_size_constraint_sets(self) -> "Waf":
        '''(experimental) Grants permission to retrieve an array of SizeConstraintSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListSizeConstraintSets.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListSizeConstraintSets", []))

    @jsii.member(jsii_name="toListSqlInjectionMatchSets")
    def to_list_sql_injection_match_sets(self) -> "Waf":
        '''(experimental) Grants permission to retrieve an array of SqlInjectionMatchSet objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListSqlInjectionMatchSets.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListSqlInjectionMatchSets", []))

    @jsii.member(jsii_name="toListSubscribedRuleGroups")
    def to_list_subscribed_rule_groups(self) -> "Waf":
        '''(experimental) Grants permission to retrieve an array of RuleGroup objects that you are subscribed to.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListSubscribedRuleGroups.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListSubscribedRuleGroups", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Waf":
        '''(experimental) Grants permission to retrieve the tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWebACLs")
    def to_list_web_ac_ls(self) -> "Waf":
        '''(experimental) Grants permission to retrieve an array of WebACLSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListWebACLs.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListWebACLs", []))

    @jsii.member(jsii_name="toListXssMatchSets")
    def to_list_xss_match_sets(self) -> "Waf":
        '''(experimental) Grants permission to retrieve an array of XssMatchSet objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_ListXssMatchSets.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toListXssMatchSets", []))

    @jsii.member(jsii_name="toPutLoggingConfiguration")
    def to_put_logging_configuration(self) -> "Waf":
        '''(experimental) Grants permission to associate a LoggingConfiguration with a specified web ACL.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_PutLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toPutLoggingConfiguration", []))

    @jsii.member(jsii_name="toPutPermissionPolicy")
    def to_put_permission_policy(self) -> "Waf":
        '''(experimental) Grants permission to attach an IAM policy to a rule group, to share the rule group between accounts.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_PutPermissionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toPutPermissionPolicy", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Waf":
        '''(experimental) Grants permission to add a Tag to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Waf":
        '''(experimental) Grants permission to remove a Tag from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateByteMatchSet")
    def to_update_byte_match_set(self) -> "Waf":
        '''(experimental) Grants permission to insert or delete ByteMatchTuple objects in a ByteMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateByteMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateByteMatchSet", []))

    @jsii.member(jsii_name="toUpdateGeoMatchSet")
    def to_update_geo_match_set(self) -> "Waf":
        '''(experimental) Grants permission to insert or delete GeoMatchConstraint objects in a GeoMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateGeoMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateGeoMatchSet", []))

    @jsii.member(jsii_name="toUpdateIPSet")
    def to_update_ip_set(self) -> "Waf":
        '''(experimental) Grants permission to insert or delete IPSetDescriptor objects in an IPSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateIPSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateIPSet", []))

    @jsii.member(jsii_name="toUpdateRateBasedRule")
    def to_update_rate_based_rule(self) -> "Waf":
        '''(experimental) Grants permission to modify a rate based rule.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateRateBasedRule.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateRateBasedRule", []))

    @jsii.member(jsii_name="toUpdateRegexMatchSet")
    def to_update_regex_match_set(self) -> "Waf":
        '''(experimental) Grants permission to insert or delete RegexMatchTuple objects in a RegexMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateRegexMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateRegexMatchSet", []))

    @jsii.member(jsii_name="toUpdateRegexPatternSet")
    def to_update_regex_pattern_set(self) -> "Waf":
        '''(experimental) Grants permission to insert or delete RegexPatternStrings in a RegexPatternSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateRegexPatternSet", []))

    @jsii.member(jsii_name="toUpdateRule")
    def to_update_rule(self) -> "Waf":
        '''(experimental) Grants permission to modify a Rule.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateRule.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateRule", []))

    @jsii.member(jsii_name="toUpdateRuleGroup")
    def to_update_rule_group(self) -> "Waf":
        '''(experimental) Grants permission to insert or delete ActivatedRule objects in a RuleGroup.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateRuleGroup", []))

    @jsii.member(jsii_name="toUpdateSizeConstraintSet")
    def to_update_size_constraint_set(self) -> "Waf":
        '''(experimental) Grants permission to insert or delete SizeConstraint objects in a SizeConstraintSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateSizeConstraintSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateSizeConstraintSet", []))

    @jsii.member(jsii_name="toUpdateSqlInjectionMatchSet")
    def to_update_sql_injection_match_set(self) -> "Waf":
        '''(experimental) Grants permission to insert or delete SqlInjectionMatchTuple objects in an SqlInjectionMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateSqlInjectionMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateSqlInjectionMatchSet", []))

    @jsii.member(jsii_name="toUpdateWebACL")
    def to_update_web_acl(self) -> "Waf":
        '''(experimental) Grants permission to insert or delete ActivatedRule objects in a WebACL.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateWebACL.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateWebACL", []))

    @jsii.member(jsii_name="toUpdateXssMatchSet")
    def to_update_xss_match_set(self) -> "Waf":
        '''(experimental) Grants permission to insert or delete XssMatchTuple objects in an XssMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_waf_UpdateXssMatchSet.html

        :stability: experimental
        '''
        return typing.cast("Waf", jsii.invoke(self, "toUpdateXssMatchSet", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__20ad43cabba8f0c1be2eb448f03640aaf78095de38e4cc27870c3594174af771)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a29ceca0eeed58b6a9352a581c8cf369c91086f7aaea8dca24693465699040b9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class WafRegional(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.WafRegional",
):
    '''(experimental) Statement provider for service `waf-regional <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswafregional.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `waf-regional <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswafregional.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d574bd245cbe6dde573b73d771c892f07c9ba50f333341b86a22bbb527fc6461)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onBytematchset")
    def on_bytematchset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type bytematchset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ByteMatchSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__94d8284d30fbf83f5481e30bf816486fc095885057ddc12c87e0facdfa1fd303)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("WafRegional", jsii.invoke(self, "onBytematchset", [id, account, region, partition]))

    @jsii.member(jsii_name="onGeomatchset")
    def on_geomatchset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type geomatchset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GeoMatchSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c99d780fbc63c7ed1aa3422bf41e0bc85c3a1c619d425a4f1e3c351b7add396e)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("WafRegional", jsii.invoke(self, "onGeomatchset", [id, account, region, partition]))

    @jsii.member(jsii_name="onIpset")
    def on_ipset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type ipset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_IPSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bd0b25f1f4e31cdde14e1bbccaaf348f50b7b3e1a097b8bebbeca51f62a2fa25)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("WafRegional", jsii.invoke(self, "onIpset", [id, account, region, partition]))

    @jsii.member(jsii_name="onLoadbalancerApp")
    def on_loadbalancer_app(
        self,
        load_balancer_name: builtins.str,
        load_balancer_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type loadbalancer/app/ to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_WebACL.html

        :param load_balancer_name: - Identifier for the loadBalancerName.
        :param load_balancer_id: - Identifier for the loadBalancerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__401f97f7245f32609b37d08a4c5c04e64475ff806f1e063f67e4b8567e386434)
            check_type(argname="argument load_balancer_name", value=load_balancer_name, expected_type=type_hints["load_balancer_name"])
            check_type(argname="argument load_balancer_id", value=load_balancer_id, expected_type=type_hints["load_balancer_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("WafRegional", jsii.invoke(self, "onLoadbalancerApp", [load_balancer_name, load_balancer_id, account, region, partition]))

    @jsii.member(jsii_name="onRatebasedrule")
    def on_ratebasedrule(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type ratebasedrule to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_RateBasedRule.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__11aa1cc37fc1041577d27f9e9e6bf099295794106f781dc025f34a21effde631)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("WafRegional", jsii.invoke(self, "onRatebasedrule", [id, account, region, partition]))

    @jsii.member(jsii_name="onRegexmatchset")
    def on_regexmatchset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type regexmatchset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_RegexMatchSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__620bad07cb7eee52a967a497dab207a30ba9e828883b2f217ff5b78a388bd6ed)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("WafRegional", jsii.invoke(self, "onRegexmatchset", [id, account, region, partition]))

    @jsii.member(jsii_name="onRegexpatternset")
    def on_regexpatternset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type regexpatternset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_RegexPatternSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f0feb395ebee2ada7fe779086c263ca1ee647e26069af2415f4315502f4b12b5)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("WafRegional", jsii.invoke(self, "onRegexpatternset", [id, account, region, partition]))

    @jsii.member(jsii_name="onRule")
    def on_rule(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type rule to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_Rule.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__22c3889231e446fd7925006fbb9629510b0753418ab4216adaab585146dd671f)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("WafRegional", jsii.invoke(self, "onRule", [id, account, region, partition]))

    @jsii.member(jsii_name="onRulegroup")
    def on_rulegroup(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type rulegroup to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_RuleGroup.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__47ff2eb76197bbb6b4d970431bd2b6946a521bfca4e94c9ed511f57c99175295)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("WafRegional", jsii.invoke(self, "onRulegroup", [id, account, region, partition]))

    @jsii.member(jsii_name="onSizeconstraintset")
    def on_sizeconstraintset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type sizeconstraintset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_SizeConstraintSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2d5cfc72dffc594ddd66eaa43783e867977b15c315b093ba789cc85dcd66a3af)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("WafRegional", jsii.invoke(self, "onSizeconstraintset", [id, account, region, partition]))

    @jsii.member(jsii_name="onSqlinjectionmatchset")
    def on_sqlinjectionmatchset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type sqlinjectionmatchset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_SqlInjectionMatchSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1c2e2b569bd1539d314ac1f2d14563aecddb641107c6893bfd1caf677c05c902)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("WafRegional", jsii.invoke(self, "onSqlinjectionmatchset", [id, account, region, partition]))

    @jsii.member(jsii_name="onWebacl")
    def on_webacl(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type webacl to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_WebACL.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__470469c6f19e413ca9d904490937f95c398bf0c698c7bc1fccf1eabc208b554b)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("WafRegional", jsii.invoke(self, "onWebacl", [id, account, region, partition]))

    @jsii.member(jsii_name="onXssmatchset")
    def on_xssmatchset(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WafRegional":
        '''(experimental) Adds a resource of type xssmatchset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_XssMatchSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__230db673ac1664025a1b78b70996f9ae753801a52baeaf5b4bc141dffccc15e8)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("WafRegional", jsii.invoke(self, "onXssmatchset", [id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateWebACL")
    def to_associate_web_acl(self) -> "WafRegional":
        '''(experimental) Grants permission to associate a web ACL with a resource.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_AssociateWebACL.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toAssociateWebACL", []))

    @jsii.member(jsii_name="toCreateByteMatchSet")
    def to_create_byte_match_set(self) -> "WafRegional":
        '''(experimental) Grants permission to create a ByteMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateByteMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateByteMatchSet", []))

    @jsii.member(jsii_name="toCreateGeoMatchSet")
    def to_create_geo_match_set(self) -> "WafRegional":
        '''(experimental) Grants permission to create a GeoMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateGeoMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateGeoMatchSet", []))

    @jsii.member(jsii_name="toCreateIPSet")
    def to_create_ip_set(self) -> "WafRegional":
        '''(experimental) Grants permission to create an IPSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateIPSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateIPSet", []))

    @jsii.member(jsii_name="toCreateRateBasedRule")
    def to_create_rate_based_rule(self) -> "WafRegional":
        '''(experimental) Grants permission to create a RateBasedRule.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateRateBasedRule.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateRateBasedRule", []))

    @jsii.member(jsii_name="toCreateRegexMatchSet")
    def to_create_regex_match_set(self) -> "WafRegional":
        '''(experimental) Grants permission to create a RegexMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateRegexMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateRegexMatchSet", []))

    @jsii.member(jsii_name="toCreateRegexPatternSet")
    def to_create_regex_pattern_set(self) -> "WafRegional":
        '''(experimental) Grants permission to create a RegexPatternSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateRegexPatternSet", []))

    @jsii.member(jsii_name="toCreateRule")
    def to_create_rule(self) -> "WafRegional":
        '''(experimental) Grants permission to create a Rule.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateRule.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateRule", []))

    @jsii.member(jsii_name="toCreateRuleGroup")
    def to_create_rule_group(self) -> "WafRegional":
        '''(experimental) Grants permission to create a RuleGroup.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateRuleGroup", []))

    @jsii.member(jsii_name="toCreateSizeConstraintSet")
    def to_create_size_constraint_set(self) -> "WafRegional":
        '''(experimental) Grants permission to create a SizeConstraintSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateSizeConstraintSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateSizeConstraintSet", []))

    @jsii.member(jsii_name="toCreateSqlInjectionMatchSet")
    def to_create_sql_injection_match_set(self) -> "WafRegional":
        '''(experimental) Grants permission to create an SqlInjectionMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateSqlInjectionMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateSqlInjectionMatchSet", []))

    @jsii.member(jsii_name="toCreateWebACL")
    def to_create_web_acl(self) -> "WafRegional":
        '''(experimental) Grants permission to create a WebACL.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateWebACL.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateWebACL", []))

    @jsii.member(jsii_name="toCreateWebACLMigrationStack")
    def to_create_web_acl_migration_stack(self) -> "WafRegional":
        '''(experimental) Grants permission to create a CloudFormation web ACL template in an S3 bucket for the purposes of migrating the web ACL from AWS WAF Classic to AWS WAF v2.

        Access Level: Write

        Dependent actions:

        - s3:PutObject

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateWebACLMigrationStack.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateWebACLMigrationStack", []))

    @jsii.member(jsii_name="toCreateXssMatchSet")
    def to_create_xss_match_set(self) -> "WafRegional":
        '''(experimental) Grants permission to create an XssMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_CreateXssMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toCreateXssMatchSet", []))

    @jsii.member(jsii_name="toDeleteByteMatchSet")
    def to_delete_byte_match_set(self) -> "WafRegional":
        '''(experimental) Grants permission to delete a ByteMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteByteMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteByteMatchSet", []))

    @jsii.member(jsii_name="toDeleteGeoMatchSet")
    def to_delete_geo_match_set(self) -> "WafRegional":
        '''(experimental) Grants permission to delete a GeoMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteGeoMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteGeoMatchSet", []))

    @jsii.member(jsii_name="toDeleteIPSet")
    def to_delete_ip_set(self) -> "WafRegional":
        '''(experimental) Grants permission to delete an IPSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteIPSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteIPSet", []))

    @jsii.member(jsii_name="toDeleteLoggingConfiguration")
    def to_delete_logging_configuration(self) -> "WafRegional":
        '''(experimental) Grants permission to delete a LoggingConfiguration from a web ACL.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteLoggingConfiguration", []))

    @jsii.member(jsii_name="toDeletePermissionPolicy")
    def to_delete_permission_policy(self) -> "WafRegional":
        '''(experimental) Grants permission to delete an IAM policy from a rule group.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeletePermissionPolicy.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeletePermissionPolicy", []))

    @jsii.member(jsii_name="toDeleteRateBasedRule")
    def to_delete_rate_based_rule(self) -> "WafRegional":
        '''(experimental) Grants permission to delete a RateBasedRule.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteRateBasedRule.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteRateBasedRule", []))

    @jsii.member(jsii_name="toDeleteRegexMatchSet")
    def to_delete_regex_match_set(self) -> "WafRegional":
        '''(experimental) Grants permission to delete a RegexMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteRegexMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteRegexMatchSet", []))

    @jsii.member(jsii_name="toDeleteRegexPatternSet")
    def to_delete_regex_pattern_set(self) -> "WafRegional":
        '''(experimental) Grants permission to delete a RegexPatternSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteRegexPatternSet", []))

    @jsii.member(jsii_name="toDeleteRule")
    def to_delete_rule(self) -> "WafRegional":
        '''(experimental) Grants permission to delete a Rule.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteRule.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteRule", []))

    @jsii.member(jsii_name="toDeleteRuleGroup")
    def to_delete_rule_group(self) -> "WafRegional":
        '''(experimental) Grants permission to delete a RuleGroup.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteRuleGroup", []))

    @jsii.member(jsii_name="toDeleteSizeConstraintSet")
    def to_delete_size_constraint_set(self) -> "WafRegional":
        '''(experimental) Grants permission to delete a SizeConstraintSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteSizeConstraintSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteSizeConstraintSet", []))

    @jsii.member(jsii_name="toDeleteSqlInjectionMatchSet")
    def to_delete_sql_injection_match_set(self) -> "WafRegional":
        '''(experimental) Grants permission to delete an SqlInjectionMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteSqlInjectionMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteSqlInjectionMatchSet", []))

    @jsii.member(jsii_name="toDeleteWebACL")
    def to_delete_web_acl(self) -> "WafRegional":
        '''(experimental) Grants permission to delete a WebACL.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteWebACL.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteWebACL", []))

    @jsii.member(jsii_name="toDeleteXssMatchSet")
    def to_delete_xss_match_set(self) -> "WafRegional":
        '''(experimental) Grants permission to delete an XssMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DeleteXssMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDeleteXssMatchSet", []))

    @jsii.member(jsii_name="toDisassociateWebACL")
    def to_disassociate_web_acl(self) -> "WafRegional":
        '''(experimental) Grants permission to delete an association between a web ACL and a resource.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_DisassociateWebACL.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toDisassociateWebACL", []))

    @jsii.member(jsii_name="toGetByteMatchSet")
    def to_get_byte_match_set(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve a ByteMatchSet.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetByteMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetByteMatchSet", []))

    @jsii.member(jsii_name="toGetChangeToken")
    def to_get_change_token(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve a change token to use in create, update, and delete requests.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetChangeToken.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetChangeToken", []))

    @jsii.member(jsii_name="toGetChangeTokenStatus")
    def to_get_change_token_status(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve the status of a change token.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetChangeTokenStatus.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetChangeTokenStatus", []))

    @jsii.member(jsii_name="toGetGeoMatchSet")
    def to_get_geo_match_set(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve a GeoMatchSet.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetGeoMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetGeoMatchSet", []))

    @jsii.member(jsii_name="toGetIPSet")
    def to_get_ip_set(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve an IPSet.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetIPSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetIPSet", []))

    @jsii.member(jsii_name="toGetLoggingConfiguration")
    def to_get_logging_configuration(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve a LoggingConfiguration.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetLoggingConfiguration", []))

    @jsii.member(jsii_name="toGetPermissionPolicy")
    def to_get_permission_policy(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve an IAM policy attached to a RuleGroup.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetPermissionPolicy.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetPermissionPolicy", []))

    @jsii.member(jsii_name="toGetRateBasedRule")
    def to_get_rate_based_rule(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve a RateBasedRule.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetRateBasedRule.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetRateBasedRule", []))

    @jsii.member(jsii_name="toGetRateBasedRuleManagedKeys")
    def to_get_rate_based_rule_managed_keys(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve the array of IP addresses that are currently being blocked by a RateBasedRule.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetRateBasedRuleManagedKeys.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetRateBasedRuleManagedKeys", []))

    @jsii.member(jsii_name="toGetRegexMatchSet")
    def to_get_regex_match_set(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve a RegexMatchSet.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetRegexMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetRegexMatchSet", []))

    @jsii.member(jsii_name="toGetRegexPatternSet")
    def to_get_regex_pattern_set(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve a RegexPatternSet.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetRegexPatternSet", []))

    @jsii.member(jsii_name="toGetRule")
    def to_get_rule(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve a Rule.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetRule.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetRule", []))

    @jsii.member(jsii_name="toGetRuleGroup")
    def to_get_rule_group(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve a RuleGroup.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetRuleGroup", []))

    @jsii.member(jsii_name="toGetSampledRequests")
    def to_get_sampled_requests(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve detailed information for a sample set of web requests.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetSampledRequests.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetSampledRequests", []))

    @jsii.member(jsii_name="toGetSizeConstraintSet")
    def to_get_size_constraint_set(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve a SizeConstraintSet.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetSizeConstraintSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetSizeConstraintSet", []))

    @jsii.member(jsii_name="toGetSqlInjectionMatchSet")
    def to_get_sql_injection_match_set(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve an SqlInjectionMatchSet.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetSqlInjectionMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetSqlInjectionMatchSet", []))

    @jsii.member(jsii_name="toGetWebACL")
    def to_get_web_acl(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve a WebACL.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetWebACL.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetWebACL", []))

    @jsii.member(jsii_name="toGetWebACLForResource")
    def to_get_web_acl_for_resource(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve a WebACL that's associated with a specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetWebACLForResource.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetWebACLForResource", []))

    @jsii.member(jsii_name="toGetXssMatchSet")
    def to_get_xss_match_set(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve an XssMatchSet.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_GetXssMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toGetXssMatchSet", []))

    @jsii.member(jsii_name="toListActivatedRulesInRuleGroup")
    def to_list_activated_rules_in_rule_group(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve an array of ActivatedRule objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListActivatedRulesInRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListActivatedRulesInRuleGroup", []))

    @jsii.member(jsii_name="toListByteMatchSets")
    def to_list_byte_match_sets(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve an array of ByteMatchSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListByteMatchSets.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListByteMatchSets", []))

    @jsii.member(jsii_name="toListGeoMatchSets")
    def to_list_geo_match_sets(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve an array of GeoMatchSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListGeoMatchSets.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListGeoMatchSets", []))

    @jsii.member(jsii_name="toListIPSets")
    def to_list_ip_sets(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve an array of IPSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListIPSets.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListIPSets", []))

    @jsii.member(jsii_name="toListLoggingConfigurations")
    def to_list_logging_configurations(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve an array of LoggingConfiguration objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListLoggingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListLoggingConfigurations", []))

    @jsii.member(jsii_name="toListRateBasedRules")
    def to_list_rate_based_rules(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve an array of RuleSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListRateBasedRules.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListRateBasedRules", []))

    @jsii.member(jsii_name="toListRegexMatchSets")
    def to_list_regex_match_sets(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve an array of RegexMatchSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListRegexMatchSets.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListRegexMatchSets", []))

    @jsii.member(jsii_name="toListRegexPatternSets")
    def to_list_regex_pattern_sets(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve an array of RegexPatternSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListRegexPatternSets.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListRegexPatternSets", []))

    @jsii.member(jsii_name="toListResourcesForWebACL")
    def to_list_resources_for_web_acl(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve an array of resources associated with a specified WebACL.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListResourcesForWebACL.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListResourcesForWebACL", []))

    @jsii.member(jsii_name="toListRuleGroups")
    def to_list_rule_groups(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve an array of RuleGroup objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListRuleGroups.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListRuleGroups", []))

    @jsii.member(jsii_name="toListRules")
    def to_list_rules(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve an array of RuleSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListRules.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListRules", []))

    @jsii.member(jsii_name="toListSizeConstraintSets")
    def to_list_size_constraint_sets(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve an array of SizeConstraintSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListSizeConstraintSets.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListSizeConstraintSets", []))

    @jsii.member(jsii_name="toListSqlInjectionMatchSets")
    def to_list_sql_injection_match_sets(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve an array of SqlInjectionMatchSet objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListSqlInjectionMatchSets.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListSqlInjectionMatchSets", []))

    @jsii.member(jsii_name="toListSubscribedRuleGroups")
    def to_list_subscribed_rule_groups(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve an array of RuleGroup objects that you are subscribed to.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListSubscribedRuleGroups.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListSubscribedRuleGroups", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "WafRegional":
        '''(experimental) Grants permission to lists the Tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWebACLs")
    def to_list_web_ac_ls(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve an array of WebACLSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListWebACLs.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListWebACLs", []))

    @jsii.member(jsii_name="toListXssMatchSets")
    def to_list_xss_match_sets(self) -> "WafRegional":
        '''(experimental) Grants permission to retrieve an array of XssMatchSet objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_ListXssMatchSets.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toListXssMatchSets", []))

    @jsii.member(jsii_name="toPutLoggingConfiguration")
    def to_put_logging_configuration(self) -> "WafRegional":
        '''(experimental) Grants permission to associates a LoggingConfiguration with a web ACL.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_PutLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toPutLoggingConfiguration", []))

    @jsii.member(jsii_name="toPutPermissionPolicy")
    def to_put_permission_policy(self) -> "WafRegional":
        '''(experimental) Grants permission to attach an IAM policy to a specified rule group, to support rule group sharing between accounts.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_PutPermissionPolicy.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toPutPermissionPolicy", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "WafRegional":
        '''(experimental) Grants permission to add a Tag to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_TagResource.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "WafRegional":
        '''(experimental) Grants permission to remove a Tag from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateByteMatchSet")
    def to_update_byte_match_set(self) -> "WafRegional":
        '''(experimental) Grants permission to insert or delete ByteMatchTuple objects in a ByteMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateByteMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateByteMatchSet", []))

    @jsii.member(jsii_name="toUpdateGeoMatchSet")
    def to_update_geo_match_set(self) -> "WafRegional":
        '''(experimental) Grants permission to insert or delete GeoMatchConstraint objects in a GeoMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateGeoMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateGeoMatchSet", []))

    @jsii.member(jsii_name="toUpdateIPSet")
    def to_update_ip_set(self) -> "WafRegional":
        '''(experimental) Grants permission to insert or delete IPSetDescriptor objects in an IPSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateIPSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateIPSet", []))

    @jsii.member(jsii_name="toUpdateRateBasedRule")
    def to_update_rate_based_rule(self) -> "WafRegional":
        '''(experimental) Grants permission to insert or delete predicate objects in a rate based rule and update the RateLimit in the rule.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateRateBasedRule.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateRateBasedRule", []))

    @jsii.member(jsii_name="toUpdateRegexMatchSet")
    def to_update_regex_match_set(self) -> "WafRegional":
        '''(experimental) Grants permission to insert or delete RegexMatchTuple objects in a RegexMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateRegexMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateRegexMatchSet", []))

    @jsii.member(jsii_name="toUpdateRegexPatternSet")
    def to_update_regex_pattern_set(self) -> "WafRegional":
        '''(experimental) Grants permission to insert or delete RegexPatternStrings in a RegexPatternSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateRegexPatternSet", []))

    @jsii.member(jsii_name="toUpdateRule")
    def to_update_rule(self) -> "WafRegional":
        '''(experimental) Grants permission to insert or delete predicate objects in a Rule.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateRule.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateRule", []))

    @jsii.member(jsii_name="toUpdateRuleGroup")
    def to_update_rule_group(self) -> "WafRegional":
        '''(experimental) Grants permission to insert or delete ActivatedRule objects in a RuleGroup.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateRuleGroup", []))

    @jsii.member(jsii_name="toUpdateSizeConstraintSet")
    def to_update_size_constraint_set(self) -> "WafRegional":
        '''(experimental) Grants permission to insert or delete SizeConstraint objects in a SizeConstraintSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateSizeConstraintSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateSizeConstraintSet", []))

    @jsii.member(jsii_name="toUpdateSqlInjectionMatchSet")
    def to_update_sql_injection_match_set(self) -> "WafRegional":
        '''(experimental) Grants permission to insert or delete SqlInjectionMatchTuple objects in an SqlInjectionMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateSqlInjectionMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateSqlInjectionMatchSet", []))

    @jsii.member(jsii_name="toUpdateWebACL")
    def to_update_web_acl(self) -> "WafRegional":
        '''(experimental) Grants permission to insert or delete ActivatedRule objects in a WebACL.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateWebACL.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateWebACL", []))

    @jsii.member(jsii_name="toUpdateXssMatchSet")
    def to_update_xss_match_set(self) -> "WafRegional":
        '''(experimental) Grants permission to insert or delete XssMatchTuple objects in an XssMatchSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_wafRegional_UpdateXssMatchSet.html

        :stability: experimental
        '''
        return typing.cast("WafRegional", jsii.invoke(self, "toUpdateXssMatchSet", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__557336f89a5153158f41d1c1e9e1897b8b246303394b343ba4cc3c574d2fa350)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__455bb298b135b115f8da13a918bf4a3fc0c408ffc19ae664020fe00290396765)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Wafv2(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Wafv2"):
    '''(experimental) Statement provider for service `wafv2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswafv2.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `wafv2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswafv2.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a48a992334a6f2dc0631958e729b9081620e778548435bac3fd641d1673ea664)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onApigateway")
    def on_apigateway(
        self,
        api_id: builtins.str,
        stage_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wafv2":
        '''(experimental) Adds a resource of type apigateway to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_WebACL.html

        :param api_id: - Identifier for the apiId.
        :param stage_name: - Identifier for the stageName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ade2809a597527fff600188676aad69f2e336cfbad22f16374cd4a7307ef19ad)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument stage_name", value=stage_name, expected_type=type_hints["stage_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Wafv2", jsii.invoke(self, "onApigateway", [api_id, stage_name, account, region, partition]))

    @jsii.member(jsii_name="onAppsync")
    def on_appsync(
        self,
        graph_qlapi_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wafv2":
        '''(experimental) Adds a resource of type appsync to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_WebACL.html

        :param graph_qlapi_id: - Identifier for the graphQLAPIId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__536dadfab5117cf6529d6258430d4a1bc6dae21ebdbabcc819869677e7c85494)
            check_type(argname="argument graph_qlapi_id", value=graph_qlapi_id, expected_type=type_hints["graph_qlapi_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Wafv2", jsii.invoke(self, "onAppsync", [graph_qlapi_id, account, region, partition]))

    @jsii.member(jsii_name="onIpset")
    def on_ipset(
        self,
        scope: builtins.str,
        name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wafv2":
        '''(experimental) Adds a resource of type ipset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_IPSet.html

        :param scope: - Identifier for the scope.
        :param name: - Identifier for the name.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__534184cc4cdd1b7d0deb7f74a8b1a6d7e2588eeeb0b5710fdb606966ce5a4d18)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Wafv2", jsii.invoke(self, "onIpset", [scope, name, id, account, region, partition]))

    @jsii.member(jsii_name="onLoadbalancerApp")
    def on_loadbalancer_app(
        self,
        load_balancer_name: builtins.str,
        load_balancer_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wafv2":
        '''(experimental) Adds a resource of type loadbalancer/app/ to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_WebACL.html

        :param load_balancer_name: - Identifier for the loadBalancerName.
        :param load_balancer_id: - Identifier for the loadBalancerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__902fe171a2f44f862878a54c489268eae9eb962e7d5058930e25d61013161fc8)
            check_type(argname="argument load_balancer_name", value=load_balancer_name, expected_type=type_hints["load_balancer_name"])
            check_type(argname="argument load_balancer_id", value=load_balancer_id, expected_type=type_hints["load_balancer_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Wafv2", jsii.invoke(self, "onLoadbalancerApp", [load_balancer_name, load_balancer_id, account, region, partition]))

    @jsii.member(jsii_name="onManagedruleset")
    def on_managedruleset(
        self,
        scope: builtins.str,
        name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wafv2":
        '''(experimental) Adds a resource of type managedruleset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_ManagedRuleSet.html

        :param scope: - Identifier for the scope.
        :param name: - Identifier for the name.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c7250e95d21ba834aa9a27a2d1481c53b0a8e6d6fb461b8b77f7b664987d78e9)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Wafv2", jsii.invoke(self, "onManagedruleset", [scope, name, id, account, region, partition]))

    @jsii.member(jsii_name="onRegexpatternset")
    def on_regexpatternset(
        self,
        scope: builtins.str,
        name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wafv2":
        '''(experimental) Adds a resource of type regexpatternset to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_RegexPatternSet.html

        :param scope: - Identifier for the scope.
        :param name: - Identifier for the name.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a8090d788946545a9608b8edcc4c4488c5fd4c70e50bf6914ed4639f21ae1a53)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Wafv2", jsii.invoke(self, "onRegexpatternset", [scope, name, id, account, region, partition]))

    @jsii.member(jsii_name="onRulegroup")
    def on_rulegroup(
        self,
        scope: builtins.str,
        name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wafv2":
        '''(experimental) Adds a resource of type rulegroup to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_RuleGroup.html

        :param scope: - Identifier for the scope.
        :param name: - Identifier for the name.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__778b4e5066ef26178cff9789ce121ef103670b551f8ccc213bf3b25413ed68f5)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Wafv2", jsii.invoke(self, "onRulegroup", [scope, name, id, account, region, partition]))

    @jsii.member(jsii_name="onUserpool")
    def on_userpool(
        self,
        user_pool_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wafv2":
        '''(experimental) Adds a resource of type userpool to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_WebACL.html

        :param user_pool_id: - Identifier for the userPoolId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__60bd028351ab91356da9cbba4e431fb2153b0cb190c930117f30cae354aaa045)
            check_type(argname="argument user_pool_id", value=user_pool_id, expected_type=type_hints["user_pool_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Wafv2", jsii.invoke(self, "onUserpool", [user_pool_id, account, region, partition]))

    @jsii.member(jsii_name="onWebacl")
    def on_webacl(
        self,
        scope: builtins.str,
        name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wafv2":
        '''(experimental) Adds a resource of type webacl to the statement.

        https://docs.aws.amazon.com/waf/latest/APIReference/API_WebACL.html

        :param scope: - Identifier for the scope.
        :param name: - Identifier for the name.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0645c5ee1547c5d0f9138d4056af1c6bced2edf738ec41fdbce9f9dfb8f5f668)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Wafv2", jsii.invoke(self, "onWebacl", [scope, name, id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateWebACL")
    def to_associate_web_acl(self) -> "Wafv2":
        '''(experimental) Grants permission to associate a WebACL with a resource.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_AssociateWebACL.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toAssociateWebACL", []))

    @jsii.member(jsii_name="toCheckCapacity")
    def to_check_capacity(self) -> "Wafv2":
        '''(experimental) Grants permission to calculate web ACL capacity unit (WCU) requirements for a specified scope and set of rules.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_CheckCapacity.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toCheckCapacity", []))

    @jsii.member(jsii_name="toCreateIPSet")
    def to_create_ip_set(self) -> "Wafv2":
        '''(experimental) Grants permission to create an IPSet.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateIPSet.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toCreateIPSet", []))

    @jsii.member(jsii_name="toCreateRegexPatternSet")
    def to_create_regex_pattern_set(self) -> "Wafv2":
        '''(experimental) Grants permission to create a RegexPatternSet.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toCreateRegexPatternSet", []))

    @jsii.member(jsii_name="toCreateRuleGroup")
    def to_create_rule_group(self) -> "Wafv2":
        '''(experimental) Grants permission to create a RuleGroup.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toCreateRuleGroup", []))

    @jsii.member(jsii_name="toCreateWebACL")
    def to_create_web_acl(self) -> "Wafv2":
        '''(experimental) Grants permission to create a WebACL.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateWebACL.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toCreateWebACL", []))

    @jsii.member(jsii_name="toDeleteFirewallManagerRuleGroups")
    def to_delete_firewall_manager_rule_groups(self) -> "Wafv2":
        '''(experimental) Grants permission to delete FirewallManagedRulesGroups from a WebACL if not managed by Firewall Manager anymore.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_DeleteFirewallManagerRuleGroups.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toDeleteFirewallManagerRuleGroups", []))

    @jsii.member(jsii_name="toDeleteIPSet")
    def to_delete_ip_set(self) -> "Wafv2":
        '''(experimental) Grants permission to delete an IPSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_DeleteIPSet.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toDeleteIPSet", []))

    @jsii.member(jsii_name="toDeleteLoggingConfiguration")
    def to_delete_logging_configuration(self) -> "Wafv2":
        '''(experimental) Grants permission to delete the LoggingConfiguration from a WebACL.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_DeleteLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toDeleteLoggingConfiguration", []))

    @jsii.member(jsii_name="toDeletePermissionPolicy")
    def to_delete_permission_policy(self) -> "Wafv2":
        '''(experimental) Grants permission to delete the PermissionPolicy on a RuleGroup.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_DeletePermissionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toDeletePermissionPolicy", []))

    @jsii.member(jsii_name="toDeleteRegexPatternSet")
    def to_delete_regex_pattern_set(self) -> "Wafv2":
        '''(experimental) Grants permission to delete a RegexPatternSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_DeleteRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toDeleteRegexPatternSet", []))

    @jsii.member(jsii_name="toDeleteRuleGroup")
    def to_delete_rule_group(self) -> "Wafv2":
        '''(experimental) Grants permission to delete a RuleGroup.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_DeleteRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toDeleteRuleGroup", []))

    @jsii.member(jsii_name="toDeleteWebACL")
    def to_delete_web_acl(self) -> "Wafv2":
        '''(experimental) Grants permission to delete a WebACL.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_DeleteWebACL.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toDeleteWebACL", []))

    @jsii.member(jsii_name="toDescribeManagedRuleGroup")
    def to_describe_managed_rule_group(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve high-level information for a managed rule group.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_DescribeManagedRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toDescribeManagedRuleGroup", []))

    @jsii.member(jsii_name="toDisassociateFirewallManager")
    def to_disassociate_firewall_manager(self) -> "Wafv2":
        '''(experimental) Grants permission to disassociate Firewall Manager from a WebACL.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_DisassociateFirewallManager.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toDisassociateFirewallManager", []))

    @jsii.member(jsii_name="toDisassociateWebACL")
    def to_disassociate_web_acl(self) -> "Wafv2":
        '''(experimental) Grants permission to disassociate a WebACL from an application resource.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_DisassociateWebACL.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toDisassociateWebACL", []))

    @jsii.member(jsii_name="toGenerateMobileSdkReleaseUrl")
    def to_generate_mobile_sdk_release_url(self) -> "Wafv2":
        '''(experimental) Grants permission to generate a presigned download URL for the specified release of the mobile SDK.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GenerateMobileSdkReleaseUrl.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGenerateMobileSdkReleaseUrl", []))

    @jsii.member(jsii_name="toGetIPSet")
    def to_get_ip_set(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve details about an IPSet.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GetIPSet.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGetIPSet", []))

    @jsii.member(jsii_name="toGetLoggingConfiguration")
    def to_get_logging_configuration(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve LoggingConfiguration for a WebACL.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GetLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGetLoggingConfiguration", []))

    @jsii.member(jsii_name="toGetManagedRuleSet")
    def to_get_managed_rule_set(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve details about a ManagedRuleSet.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GetManagedRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGetManagedRuleSet", []))

    @jsii.member(jsii_name="toGetMobileSdkRelease")
    def to_get_mobile_sdk_release(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve information for the specified mobile SDK release, including release notes and tags.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GetMobileSdkRelease.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGetMobileSdkRelease", []))

    @jsii.member(jsii_name="toGetPermissionPolicy")
    def to_get_permission_policy(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve a PermissionPolicy for a RuleGroup.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GetPermissionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGetPermissionPolicy", []))

    @jsii.member(jsii_name="toGetRateBasedStatementManagedKeys")
    def to_get_rate_based_statement_managed_keys(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve the keys that are currently blocked by a rate-based rule.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GetRateBasedStatementManagedKeys.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGetRateBasedStatementManagedKeys", []))

    @jsii.member(jsii_name="toGetRegexPatternSet")
    def to_get_regex_pattern_set(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve details about a RegexPatternSet.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GetRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGetRegexPatternSet", []))

    @jsii.member(jsii_name="toGetRuleGroup")
    def to_get_rule_group(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve details about a RuleGroup.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GetRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGetRuleGroup", []))

    @jsii.member(jsii_name="toGetSampledRequests")
    def to_get_sampled_requests(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve detailed information about a sampling of web requests.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GetSampledRequests.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGetSampledRequests", []))

    @jsii.member(jsii_name="toGetWebACL")
    def to_get_web_acl(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve details about a WebACL.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GetWebACL.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGetWebACL", []))

    @jsii.member(jsii_name="toGetWebACLForResource")
    def to_get_web_acl_for_resource(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve the WebACL that's associated with a resource.

        Access Level: Read

        https://docs.aws.amazon.com/waf/latest/APIReference/API_GetWebACLForResource.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toGetWebACLForResource", []))

    @jsii.member(jsii_name="toListAvailableManagedRuleGroups")
    def to_list_available_managed_rule_groups(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve an array of managed rule groups that are available for you to use.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_ListAvailableManagedRuleGroups.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toListAvailableManagedRuleGroups", []))

    @jsii.member(jsii_name="toListAvailableManagedRuleGroupVersions")
    def to_list_available_managed_rule_group_versions(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve an array of managed rule group versions that are available for you to use.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_ListAvailableManagedRuleGroupVersions.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toListAvailableManagedRuleGroupVersions", []))

    @jsii.member(jsii_name="toListIPSets")
    def to_list_ip_sets(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve an array of IPSetSummary objects for the IP sets that you manage.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_ListIPSets.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toListIPSets", []))

    @jsii.member(jsii_name="toListLoggingConfigurations")
    def to_list_logging_configurations(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve an array of your LoggingConfiguration objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_ListLoggingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toListLoggingConfigurations", []))

    @jsii.member(jsii_name="toListManagedRuleSets")
    def to_list_managed_rule_sets(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve an array of your ManagedRuleSet objects.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_ListManagedRuleSets.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toListManagedRuleSets", []))

    @jsii.member(jsii_name="toListMobileSdkReleases")
    def to_list_mobile_sdk_releases(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve a list of the available releases for the mobile SDK and the specified device platform.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_ListMobileSdkReleases.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toListMobileSdkReleases", []))

    @jsii.member(jsii_name="toListRegexPatternSets")
    def to_list_regex_pattern_sets(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve an array of RegexPatternSetSummary objects for the regex pattern sets that you manage.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_ListRegexPatternSets.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toListRegexPatternSets", []))

    @jsii.member(jsii_name="toListResourcesForWebACL")
    def to_list_resources_for_web_acl(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve an array of the Amazon Resource Names (ARNs) for the resources that are associated with a web ACL.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_ListResourcesForWebACL.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toListResourcesForWebACL", []))

    @jsii.member(jsii_name="toListRuleGroups")
    def to_list_rule_groups(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve an array of RuleGroupSummary objects for the rule groups that you manage.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_ListRuleGroups.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toListRuleGroups", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Wafv2":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWebACLs")
    def to_list_web_ac_ls(self) -> "Wafv2":
        '''(experimental) Grants permission to retrieve an array of WebACLSummary objects for the web ACLs that you manage.

        Access Level: List

        https://docs.aws.amazon.com/waf/latest/APIReference/API_ListWebACLs.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toListWebACLs", []))

    @jsii.member(jsii_name="toPutFirewallManagerRuleGroups")
    def to_put_firewall_manager_rule_groups(self) -> "Wafv2":
        '''(experimental) Grants permission to create FirewallManagedRulesGroups in a WebACL.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_PutFirewallManagerRuleGroups.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toPutFirewallManagerRuleGroups", []))

    @jsii.member(jsii_name="toPutLoggingConfiguration")
    def to_put_logging_configuration(self) -> "Wafv2":
        '''(experimental) Grants permission to enable a LoggingConfiguration, to start logging for a web ACL.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/waf/latest/APIReference/API_PutLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toPutLoggingConfiguration", []))

    @jsii.member(jsii_name="toPutManagedRuleSetVersions")
    def to_put_managed_rule_set_versions(self) -> "Wafv2":
        '''(experimental) Grants permission to enable create a new or update an existing version of a ManagedRuleSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_PutManagedRuleSetVersions.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toPutManagedRuleSetVersions", []))

    @jsii.member(jsii_name="toPutPermissionPolicy")
    def to_put_permission_policy(self) -> "Wafv2":
        '''(experimental) Grants permission to attach an IAM policy to a resource, used to share rule groups between accounts.

        Access Level: Permissions management

        https://docs.aws.amazon.com/waf/latest/APIReference/API_PutPermissionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toPutPermissionPolicy", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Wafv2":
        '''(experimental) Grants permission to associate tags with a AWS resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Wafv2":
        '''(experimental) Grants permission to disassociate tags from an AWS resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateIPSet")
    def to_update_ip_set(self) -> "Wafv2":
        '''(experimental) Grants permission to update an IPSet.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_UpdateIPSet.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toUpdateIPSet", []))

    @jsii.member(jsii_name="toUpdateManagedRuleSetVersionExpiryDate")
    def to_update_managed_rule_set_version_expiry_date(self) -> "Wafv2":
        '''(experimental) Grants permission to update the expiry date of a version in ManagedRuleSet.

        Access Level: Write

        https://docs.aws.amazon.com/waf/latest/APIReference/API_UpdateManagedRuleSetVersionExpiryDate.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toUpdateManagedRuleSetVersionExpiryDate", []))

    @jsii.member(jsii_name="toUpdateRegexPatternSet")
    def to_update_regex_pattern_set(self) -> "Wafv2":
        '''(experimental) Grants permission to update a RegexPatternSet.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_UpdateRegexPatternSet.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toUpdateRegexPatternSet", []))

    @jsii.member(jsii_name="toUpdateRuleGroup")
    def to_update_rule_group(self) -> "Wafv2":
        '''(experimental) Grants permission to update a RuleGroup.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_UpdateRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toUpdateRuleGroup", []))

    @jsii.member(jsii_name="toUpdateWebACL")
    def to_update_web_acl(self) -> "Wafv2":
        '''(experimental) Grants permission to update a WebACL.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/waf/latest/APIReference/API_UpdateWebACL.html

        :stability: experimental
        '''
        return typing.cast("Wafv2", jsii.invoke(self, "toUpdateWebACL", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e6b35d1f0f552822286259b90ced6e618fa5086e26826c17717fb375f423071c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5127268e62fdbf1de5d5ea9a0549a4af69513e6efdeb8e96b8df34db2a3a48b6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Wam(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Wam"):
    '''(experimental) Statement provider for service `wam <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkspacesapplicationmanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `wam <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkspacesapplicationmanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f33b07b992c08d2b12e8991929922b3936016db905588d6df8641b58370b49f1)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toAuthenticatePackager")
    def to_authenticate_packager(self) -> "Wam":
        '''(experimental) Allows the Amazon WAM packaging instance to access your application package catalog.

        Access Level: Write

        https://docs.aws.amazon.com/wam/latest/adminguide/iam.html

        :stability: experimental
        '''
        return typing.cast("Wam", jsii.invoke(self, "toAuthenticatePackager", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9c7e4f0a087c0dbdb79cee9c7235b92d19c610d44dcd46533fb3c3c959026bc5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7ccbe05a775d0ad42744e765af6f01b2f2e57a63f14f981016e198f20ecf4a87)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Wellarchitected(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Wellarchitected",
):
    '''(experimental) Statement provider for service `wellarchitected <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswell-architectedtool.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `wellarchitected <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswell-architectedtool.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__44edddf868534d6afffcc35c7f65203a5be0054511a82160e59104de7cdd55f8)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onLens")
    def on_lens(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wellarchitected":
        '''(experimental) Adds a resource of type lens to the statement.

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_Lens.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__54b64cf2d8416e0ce74c5dbe7caa457b16cb4a5689b7df0aefb6dd0f303dbbc9)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Wellarchitected", jsii.invoke(self, "onLens", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onWorkload")
    def on_workload(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wellarchitected":
        '''(experimental) Adds a resource of type workload to the statement.

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_Workload.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8c163ac88fcdf471ff6a0e79f2cff729b9643d76ab5d98b000719cf4e2d2c5bf)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Wellarchitected", jsii.invoke(self, "onWorkload", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateLenses")
    def to_associate_lenses(self) -> "Wellarchitected":
        '''(experimental) Grants permission to associate a lens to the specified workload.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_AssociateLenses.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toAssociateLenses", []))

    @jsii.member(jsii_name="toCreateLensShare")
    def to_create_lens_share(self) -> "Wellarchitected":
        '''(experimental) Grants permission to an owner of a lens to share with other AWS accounts and IAM Users.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_CreateLensShare.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toCreateLensShare", []))

    @jsii.member(jsii_name="toCreateLensVersion")
    def to_create_lens_version(self) -> "Wellarchitected":
        '''(experimental) Grants permission to create a new lens version.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_CreateLensVersion.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toCreateLensVersion", []))

    @jsii.member(jsii_name="toCreateMilestone")
    def to_create_milestone(self) -> "Wellarchitected":
        '''(experimental) Grants permission to create a new milestone for the specified workload.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_CreateMilestone.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toCreateMilestone", []))

    @jsii.member(jsii_name="toCreateWorkload")
    def to_create_workload(self) -> "Wellarchitected":
        '''(experimental) Grants permission to create a new workload.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_CreateWorkload.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toCreateWorkload", []))

    @jsii.member(jsii_name="toCreateWorkloadShare")
    def to_create_workload_share(self) -> "Wellarchitected":
        '''(experimental) Grants permission to share a workload with another account.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_CreateWorkloadShare.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toCreateWorkloadShare", []))

    @jsii.member(jsii_name="toDeleteLens")
    def to_delete_lens(self) -> "Wellarchitected":
        '''(experimental) Grants permission to delete a lens.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_DeleteLens.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toDeleteLens", []))

    @jsii.member(jsii_name="toDeleteLensShare")
    def to_delete_lens_share(self) -> "Wellarchitected":
        '''(experimental) Grants permission to delete an existing lens share.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_DeleteLensShare.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toDeleteLensShare", []))

    @jsii.member(jsii_name="toDeleteWorkload")
    def to_delete_workload(self) -> "Wellarchitected":
        '''(experimental) Grants permission to delete an existing workload.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_DeleteWorkload.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toDeleteWorkload", []))

    @jsii.member(jsii_name="toDeleteWorkloadShare")
    def to_delete_workload_share(self) -> "Wellarchitected":
        '''(experimental) Grants permission to delete an existing workload share.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_DeleteWorkloadShare.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toDeleteWorkloadShare", []))

    @jsii.member(jsii_name="toDisassociateLenses")
    def to_disassociate_lenses(self) -> "Wellarchitected":
        '''(experimental) Grants permission to disassociate a lens from the specified workload.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_DisassociateLenses.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toDisassociateLenses", []))

    @jsii.member(jsii_name="toExportLens")
    def to_export_lens(self) -> "Wellarchitected":
        '''(experimental) Grants permission to export an existing lens.

        Access Level: Read

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ExportLens.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toExportLens", []))

    @jsii.member(jsii_name="toGetAnswer")
    def to_get_answer(self) -> "Wellarchitected":
        '''(experimental) Grants permission to retrieve the specified answer from the specified lens review.

        Access Level: Read

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_GetAnswer.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toGetAnswer", []))

    @jsii.member(jsii_name="toGetLens")
    def to_get_lens(self) -> "Wellarchitected":
        '''(experimental) Grants permission to get an existing lens.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_DeleteLensShare.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toGetLens", []))

    @jsii.member(jsii_name="toGetLensReview")
    def to_get_lens_review(self) -> "Wellarchitected":
        '''(experimental) Grants permission to retrieve the specified lens review of the specified workload.

        Access Level: Read

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_GetLensReview.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toGetLensReview", []))

    @jsii.member(jsii_name="toGetLensReviewReport")
    def to_get_lens_review_report(self) -> "Wellarchitected":
        '''(experimental) Grants permission to retrieve the report for the specified lens review.

        Access Level: Read

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_GetLensReviewReport.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toGetLensReviewReport", []))

    @jsii.member(jsii_name="toGetLensVersionDifference")
    def to_get_lens_version_difference(self) -> "Wellarchitected":
        '''(experimental) Grants permission to get the difference between the specified lens version and latest available lens version.

        Access Level: Read

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_GetLensVersionDifference.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toGetLensVersionDifference", []))

    @jsii.member(jsii_name="toGetMilestone")
    def to_get_milestone(self) -> "Wellarchitected":
        '''(experimental) Grants permission to retrieve the specified milestone of the specified workload.

        Access Level: Read

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_GetMilestone.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toGetMilestone", []))

    @jsii.member(jsii_name="toGetWorkload")
    def to_get_workload(self) -> "Wellarchitected":
        '''(experimental) Grants permission to retrieve the specified workload.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_GetWorkload.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toGetWorkload", []))

    @jsii.member(jsii_name="toImportLens")
    def to_import_lens(self) -> "Wellarchitected":
        '''(experimental) Grants permission to import a new lens.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ImportLens.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toImportLens", []))

    @jsii.member(jsii_name="toListAnswers")
    def to_list_answers(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list the answers from the specified lens review.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListAnswers.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListAnswers", []))

    @jsii.member(jsii_name="toListCheckDetails")
    def to_list_check_details(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list the check-details for the workload.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListCheckDetails.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListCheckDetails", []))

    @jsii.member(jsii_name="toListCheckSummaries")
    def to_list_check_summaries(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list the check-summaries for the workload.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListCheckSummaries.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListCheckSummaries", []))

    @jsii.member(jsii_name="toListLenses")
    def to_list_lenses(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list the lenses available to this account.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListLenses.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListLenses", []))

    @jsii.member(jsii_name="toListLensReviewImprovements")
    def to_list_lens_review_improvements(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list the improvements of the specified lens review.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListLensReviewImprovements.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListLensReviewImprovements", []))

    @jsii.member(jsii_name="toListLensReviews")
    def to_list_lens_reviews(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list the lens reviews of the specified workload.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListLensReviews.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListLensReviews", []))

    @jsii.member(jsii_name="toListLensShares")
    def to_list_lens_shares(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list all shares created for a lens.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListLensShares.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListLensShares", []))

    @jsii.member(jsii_name="toListMilestones")
    def to_list_milestones(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list the milestones of the specified workload.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListMilestones.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListMilestones", []))

    @jsii.member(jsii_name="toListNotifications")
    def to_list_notifications(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list notifications related to the account or specified resource.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListNotifications.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListNotifications", []))

    @jsii.member(jsii_name="toListShareInvitations")
    def to_list_share_invitations(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list the workload share invitations of the specified account or user.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListShareInvitations.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListShareInvitations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list tags for a Well-Architected resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWorkloads")
    def to_list_workloads(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list the workloads in this account.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListWorkloads.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListWorkloads", []))

    @jsii.member(jsii_name="toListWorkloadShares")
    def to_list_workload_shares(self) -> "Wellarchitected":
        '''(experimental) Grants permission to list the workload shares of the specified workload.

        Access Level: List

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_ListWorkloadShares.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toListWorkloadShares", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Wellarchitected":
        '''(experimental) Grants permission to tag a Well-Architected resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Wellarchitected":
        '''(experimental) Grants permission to untag a Well-Architected resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAnswer")
    def to_update_answer(self) -> "Wellarchitected":
        '''(experimental) Grants permission to update properties of the specified answer.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_UpdateAnswer.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toUpdateAnswer", []))

    @jsii.member(jsii_name="toUpdateGlobalSettings")
    def to_update_global_settings(self) -> "Wellarchitected":
        '''(experimental) Grants permission to update settings to enable aws-organization support.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_UpdateGlobalSettings.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toUpdateGlobalSettings", []))

    @jsii.member(jsii_name="toUpdateLensReview")
    def to_update_lens_review(self) -> "Wellarchitected":
        '''(experimental) Grants permission to update properties of the specified lens review.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_UpdateLensReview.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toUpdateLensReview", []))

    @jsii.member(jsii_name="toUpdateShareInvitation")
    def to_update_share_invitation(self) -> "Wellarchitected":
        '''(experimental) Grants permission to update status of the specified workload share invitation.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_UpdateShareInvitation.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toUpdateShareInvitation", []))

    @jsii.member(jsii_name="toUpdateWorkload")
    def to_update_workload(self) -> "Wellarchitected":
        '''(experimental) Grants permission to update properties of the specified workload.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_UpdateWorkload.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toUpdateWorkload", []))

    @jsii.member(jsii_name="toUpdateWorkloadShare")
    def to_update_workload_share(self) -> "Wellarchitected":
        '''(experimental) Grants permission to update properties of the specified workload.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_UpdateWorkloadShare.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toUpdateWorkloadShare", []))

    @jsii.member(jsii_name="toUpgradeLensReview")
    def to_upgrade_lens_review(self) -> "Wellarchitected":
        '''(experimental) Grants permission to upgrade the specified lens review to use the latest version of the associated lens.

        Access Level: Write

        https://docs.aws.amazon.com/wellarchitected/latest/APIReference/API_UpgradeLensReview.html

        :stability: experimental
        '''
        return typing.cast("Wellarchitected", jsii.invoke(self, "toUpgradeLensReview", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ac478942613a3a1c0f5efad39d3bc197b0abc3ea9ed5c7e1e0d8a8de548a8848)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bcc9addc08dbc1ce288346a132885e9412a43e7653fe3e8922c01383b482e62a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Wickr(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Wickr"):
    '''(experimental) Statement provider for service `wickr <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswickr.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `wickr <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awswickr.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__29f48c371042037dc0369a50c48445ac686f25f39e4c5ebac87708e653fc4e3d)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onNetwork")
    def on_network(
        self,
        network_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wickr":
        '''(experimental) Adds a resource of type network to the statement.

        https://docs.aws.amazon.com/wickr/latest/adminguide/

        :param network_id: - Identifier for the networkId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__79a1b63282d4ed3d7caa2d9047a101dcdc5e8e6538fb94ddb6b050ea10002586)
            check_type(argname="argument network_id", value=network_id, expected_type=type_hints["network_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Wickr", jsii.invoke(self, "onNetwork", [network_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateAdminSession")
    def to_create_admin_session(self) -> "Wickr":
        '''(experimental) Grants permission to create and manage Wickr networks.

        Access Level: Write

        https://docs.aws.amazon.com/wickr/latest/adminguide/security-iam.html

        :stability: experimental
        '''
        return typing.cast("Wickr", jsii.invoke(self, "toCreateAdminSession", []))

    @jsii.member(jsii_name="toCreateNetwork")
    def to_create_network(self) -> "Wickr":
        '''(experimental) Grants permission to create a new wickr network.

        Access Level: Write

        https://docs.aws.amazon.com/wickr/latest/adminguide/security-iam.html

        :stability: experimental
        '''
        return typing.cast("Wickr", jsii.invoke(self, "toCreateNetwork", []))

    @jsii.member(jsii_name="toListNetworks")
    def to_list_networks(self) -> "Wickr":
        '''(experimental) Grants permission to view Wickr networks.

        Access Level: Write

        https://docs.aws.amazon.com/wickr/latest/adminguide/security-iam.html

        :stability: experimental
        '''
        return typing.cast("Wickr", jsii.invoke(self, "toListNetworks", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Wickr":
        '''(experimental) Grants permission to list the tags applied to a Wickr resource.

        Access Level: Read

        https://docs.aws.amazon.com/wickr/latest/adminguide/security-iam.html

        :stability: experimental
        '''
        return typing.cast("Wickr", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Wickr":
        '''(experimental) Grants permission to add tags to a specified wickr resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/wickr/latest/adminguide/security-iam.html

        :stability: experimental
        '''
        return typing.cast("Wickr", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Wickr":
        '''(experimental) Grants permission to untag the specified tags from the specified wickr resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/wickr/latest/adminguide/security-iam.html

        :stability: experimental
        '''
        return typing.cast("Wickr", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateNetworkDetails")
    def to_update_network_details(self) -> "Wickr":
        '''(experimental) Grants permission to update Wickr network details.

        Access Level: Write

        https://docs.aws.amazon.com/wickr/latest/adminguide/security-iam.html

        :stability: experimental
        '''
        return typing.cast("Wickr", jsii.invoke(self, "toUpdateNetworkDetails", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6fc18e96263e03f8dae42c7c3a556466687d0fc8c84c147fb5a03dbbb7763b34)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__633b66838e207be051d6981e3f54f92f9cb268bdc98a7c5d38826ec78112fa8b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Wisdom(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Wisdom"):
    '''(experimental) Statement provider for service `wisdom <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonconnectwisdom.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `wisdom <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonconnectwisdom.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__348ca49635bfe6a12b97203a79e3b81805c988400b7424d45b5d7a0432675e1b)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAssistant")
    def on_assistant(
        self,
        assistant_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wisdom":
        '''(experimental) Adds a resource of type Assistant to the statement.

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_AssistantData.html

        :param assistant_id: - Identifier for the assistantId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e6041c13bd857b0e76431eba36c75203834085da57bebdcbea7784c3da6b2d59)
            check_type(argname="argument assistant_id", value=assistant_id, expected_type=type_hints["assistant_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Wisdom", jsii.invoke(self, "onAssistant", [assistant_id, account, region, partition]))

    @jsii.member(jsii_name="onAssistantAssociation")
    def on_assistant_association(
        self,
        assistant_id: builtins.str,
        assistant_association_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wisdom":
        '''(experimental) Adds a resource of type AssistantAssociation to the statement.

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_AssistantAssociationData.html

        :param assistant_id: - Identifier for the assistantId.
        :param assistant_association_id: - Identifier for the assistantAssociationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6607552f3a967264ee9cf477a1f648ac8b2ffd409944b0dbae8efb5be3ff4e79)
            check_type(argname="argument assistant_id", value=assistant_id, expected_type=type_hints["assistant_id"])
            check_type(argname="argument assistant_association_id", value=assistant_association_id, expected_type=type_hints["assistant_association_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Wisdom", jsii.invoke(self, "onAssistantAssociation", [assistant_id, assistant_association_id, account, region, partition]))

    @jsii.member(jsii_name="onContent")
    def on_content(
        self,
        knowledge_base_id: builtins.str,
        content_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wisdom":
        '''(experimental) Adds a resource of type Content to the statement.

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_ContentData.html

        :param knowledge_base_id: - Identifier for the knowledgeBaseId.
        :param content_id: - Identifier for the contentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fc6d5b36ce8fec1fb24ce6e7cfdcc2095623181f7f7d7a63846fe905a1860301)
            check_type(argname="argument knowledge_base_id", value=knowledge_base_id, expected_type=type_hints["knowledge_base_id"])
            check_type(argname="argument content_id", value=content_id, expected_type=type_hints["content_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Wisdom", jsii.invoke(self, "onContent", [knowledge_base_id, content_id, account, region, partition]))

    @jsii.member(jsii_name="onKnowledgeBase")
    def on_knowledge_base(
        self,
        knowledge_base_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wisdom":
        '''(experimental) Adds a resource of type KnowledgeBase to the statement.

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_KnowledgeBaseData.html

        :param knowledge_base_id: - Identifier for the knowledgeBaseId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__294a0f24f77096fee8f806c05067bfc7cc162e7f723ae44ce0035cb35375ffc1)
            check_type(argname="argument knowledge_base_id", value=knowledge_base_id, expected_type=type_hints["knowledge_base_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Wisdom", jsii.invoke(self, "onKnowledgeBase", [knowledge_base_id, account, region, partition]))

    @jsii.member(jsii_name="onSession")
    def on_session(
        self,
        assistant_id: builtins.str,
        session_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Wisdom":
        '''(experimental) Adds a resource of type Session to the statement.

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_SessionData.html

        :param assistant_id: - Identifier for the assistantId.
        :param session_id: - Identifier for the sessionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5a9fca40b8ecae515fb46856d2005988dbc476e88f548c927082c566ad300393)
            check_type(argname="argument assistant_id", value=assistant_id, expected_type=type_hints["assistant_id"])
            check_type(argname="argument session_id", value=session_id, expected_type=type_hints["session_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Wisdom", jsii.invoke(self, "onSession", [assistant_id, session_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateAssistant")
    def to_create_assistant(self) -> "Wisdom":
        '''(experimental) Grants permission to create an assistant.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_CreateAssistant.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toCreateAssistant", []))

    @jsii.member(jsii_name="toCreateAssistantAssociation")
    def to_create_assistant_association(self) -> "Wisdom":
        '''(experimental) Grants permission to create an association between an assistant and another resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_CreateAssistantAssociation.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toCreateAssistantAssociation", []))

    @jsii.member(jsii_name="toCreateContent")
    def to_create_content(self) -> "Wisdom":
        '''(experimental) Grants permission to create content.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_CreateContent.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toCreateContent", []))

    @jsii.member(jsii_name="toCreateKnowledgeBase")
    def to_create_knowledge_base(self) -> "Wisdom":
        '''(experimental) Grants permission to create a knowledge base.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_CreateKnowledgeBase.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toCreateKnowledgeBase", []))

    @jsii.member(jsii_name="toCreateSession")
    def to_create_session(self) -> "Wisdom":
        '''(experimental) Grants permission to create a session.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_CreateSession.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toCreateSession", []))

    @jsii.member(jsii_name="toDeleteAssistant")
    def to_delete_assistant(self) -> "Wisdom":
        '''(experimental) Grants permission to delete an assistant.

        Access Level: Write

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_DeleteAssistant.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toDeleteAssistant", []))

    @jsii.member(jsii_name="toDeleteAssistantAssociation")
    def to_delete_assistant_association(self) -> "Wisdom":
        '''(experimental) Grants permission to delete an assistant association.

        Access Level: Write

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_DeleteAssistantAssociation.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toDeleteAssistantAssociation", []))

    @jsii.member(jsii_name="toDeleteContent")
    def to_delete_content(self) -> "Wisdom":
        '''(experimental) Grants permission to delete content.

        Access Level: Write

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_DeleteContent.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toDeleteContent", []))

    @jsii.member(jsii_name="toDeleteKnowledgeBase")
    def to_delete_knowledge_base(self) -> "Wisdom":
        '''(experimental) Grants permission to delete a knowledge base.

        Access Level: Write

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_DeleteKnowledgeBase.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toDeleteKnowledgeBase", []))

    @jsii.member(jsii_name="toGetAssistant")
    def to_get_assistant(self) -> "Wisdom":
        '''(experimental) Grants permission to retrieve information about an assistant.

        Access Level: Read

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_GetAssistant.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toGetAssistant", []))

    @jsii.member(jsii_name="toGetAssistantAssociation")
    def to_get_assistant_association(self) -> "Wisdom":
        '''(experimental) Grants permission to retrieve information about an assistant association.

        Access Level: Read

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_GetAssistantAssociation.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toGetAssistantAssociation", []))

    @jsii.member(jsii_name="toGetContent")
    def to_get_content(self) -> "Wisdom":
        '''(experimental) Grants permission to retrieve content, including a pre-signed URL to download the content.

        Access Level: Read

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_GetContent.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toGetContent", []))

    @jsii.member(jsii_name="toGetContentSummary")
    def to_get_content_summary(self) -> "Wisdom":
        '''(experimental) Grants permission to retrieve summary information about the content.

        Access Level: Read

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_GetContentSummary.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toGetContentSummary", []))

    @jsii.member(jsii_name="toGetKnowledgeBase")
    def to_get_knowledge_base(self) -> "Wisdom":
        '''(experimental) Grants permission to retrieve information about the knowledge base.

        Access Level: Read

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_GetKnowledgeBase.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toGetKnowledgeBase", []))

    @jsii.member(jsii_name="toGetRecommendations")
    def to_get_recommendations(self) -> "Wisdom":
        '''(experimental) Grants permission to retrieve recommendations for the specified session.

        Access Level: Read

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_GetRecommendations.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toGetRecommendations", []))

    @jsii.member(jsii_name="toGetSession")
    def to_get_session(self) -> "Wisdom":
        '''(experimental) Grants permission to retrieve information for a specified session.

        Access Level: Read

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_GetSession.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toGetSession", []))

    @jsii.member(jsii_name="toListAssistantAssociations")
    def to_list_assistant_associations(self) -> "Wisdom":
        '''(experimental) Grants permission to list information about assistant associations.

        Access Level: List

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_ListAssistantAssociations.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toListAssistantAssociations", []))

    @jsii.member(jsii_name="toListAssistants")
    def to_list_assistants(self) -> "Wisdom":
        '''(experimental) Grants permission to list information about assistants.

        Access Level: List

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_ListAssistants.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toListAssistants", []))

    @jsii.member(jsii_name="toListContents")
    def to_list_contents(self) -> "Wisdom":
        '''(experimental) Grants permission to list the content with a knowledge base.

        Access Level: List

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_ListContents.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toListContents", []))

    @jsii.member(jsii_name="toListKnowledgeBases")
    def to_list_knowledge_bases(self) -> "Wisdom":
        '''(experimental) Grants permission to list information about knowledge bases.

        Access Level: List

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_ListKnowledgeBases.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toListKnowledgeBases", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Wisdom":
        '''(experimental) Grants permission to list the tags for the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toNotifyRecommendationsReceived")
    def to_notify_recommendations_received(self) -> "Wisdom":
        '''(experimental) Grants permission to remove the specified recommendations from the specified assistant's queue of newly available recommendations.

        Access Level: Write

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_NotifyRecommendationsReceived.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toNotifyRecommendationsReceived", []))

    @jsii.member(jsii_name="toQueryAssistant")
    def to_query_assistant(self) -> "Wisdom":
        '''(experimental) Grants permission to perform a manual search against the specified assistant.

        Access Level: Read

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_QueryAssistant.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toQueryAssistant", []))

    @jsii.member(jsii_name="toRemoveKnowledgeBaseTemplateUri")
    def to_remove_knowledge_base_template_uri(self) -> "Wisdom":
        '''(experimental) Grants permission to remove a URI template from a knowledge base.

        Access Level: Write

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_RemoveKnowledgeBaseTemplateUri.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toRemoveKnowledgeBaseTemplateUri", []))

    @jsii.member(jsii_name="toSearchContent")
    def to_search_content(self) -> "Wisdom":
        '''(experimental) Grants permission to search for content referencing a specified knowledge base.

        Can be used to get a specific content resource by its name

        Access Level: Read

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_SearchContent.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toSearchContent", []))

    @jsii.member(jsii_name="toSearchSessions")
    def to_search_sessions(self) -> "Wisdom":
        '''(experimental) Grants permission to search for sessions referencing a specified assistant.

        Can be used to et a specific session resource by its name

        Access Level: Read

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_SearchSessions.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toSearchSessions", []))

    @jsii.member(jsii_name="toStartContentUpload")
    def to_start_content_upload(self) -> "Wisdom":
        '''(experimental) Grants permission to get a URL to upload content to a knowledge base.

        Access Level: Write

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_StartContentUpload.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toStartContentUpload", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Wisdom":
        '''(experimental) Grants permission to add the specified tags to the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Wisdom":
        '''(experimental) Grants permission to remove the specified tags from the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateContent")
    def to_update_content(self) -> "Wisdom":
        '''(experimental) Grants permission to update information about the content.

        Access Level: Write

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_UpdateContent.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toUpdateContent", []))

    @jsii.member(jsii_name="toUpdateKnowledgeBaseTemplateUri")
    def to_update_knowledge_base_template_uri(self) -> "Wisdom":
        '''(experimental) Grants permission to update the template URI of a knowledge base.

        Access Level: Write

        https://docs.aws.amazon.com/wisdom/latest/APIReference/API_UpdateKnowledgeBaseTemplateUri.html

        :stability: experimental
        '''
        return typing.cast("Wisdom", jsii.invoke(self, "toUpdateKnowledgeBaseTemplateUri", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__676d194e909053a3703c2f0b6c6b58742bb3ba3cbd459cf3bc73974a8bdee78d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__05f8179e59c1e462940be949e3c4bc4fb74810889911452b3f25cc76b485bdab)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Workdocs(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Workdocs",
):
    '''(experimental) Statement provider for service `workdocs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkdocs.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `workdocs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkdocs.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a78829170a6d1c01c2c74d544b4af5928d82951a7c6156bc79df8fef02e3630c)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toAbortDocumentVersionUpload")
    def to_abort_document_version_upload(self) -> "Workdocs":
        '''(experimental) Grants permission to abort the upload of the specified document version that was previously initiated by InitiateDocumentVersionUpload.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_AbortDocumentVersionUpload.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toAbortDocumentVersionUpload", []))

    @jsii.member(jsii_name="toActivateUser")
    def to_activate_user(self) -> "Workdocs":
        '''(experimental) Grants permission to activate the specified user. Only active users can access Amazon WorkDocs.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_ActivateUser.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toActivateUser", []))

    @jsii.member(jsii_name="toAddNotificationPermissions")
    def to_add_notification_permissions(self) -> "Workdocs":
        '''(experimental) Grants permission to add principals that are allowed to call notification subscription APIs for a given WorkDocs site.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/adminguide/manage-notifications.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toAddNotificationPermissions", []))

    @jsii.member(jsii_name="toAddResourcePermissions")
    def to_add_resource_permissions(self) -> "Workdocs":
        '''(experimental) Grants permission to create a set of permissions for the specified folder or document.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_AddResourcePermissions.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toAddResourcePermissions", []))

    @jsii.member(jsii_name="toAddUserToGroup")
    def to_add_user_to_group(self) -> "Workdocs":
        '''(experimental) Grants permission to add a user to a group.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/adminguide/manage_set_admin.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toAddUserToGroup", []))

    @jsii.member(jsii_name="toCheckAlias")
    def to_check_alias(self) -> "Workdocs":
        '''(experimental) Grants permission to check an alias.

        Access Level: Read

        https://docs.aws.amazon.com/workdocs/latest/adminguide/cloud_quick_start.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toCheckAlias", []))

    @jsii.member(jsii_name="toCreateComment")
    def to_create_comment(self) -> "Workdocs":
        '''(experimental) Grants permission to add a new comment to the specified document version.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_CreateComment.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toCreateComment", []))

    @jsii.member(jsii_name="toCreateCustomMetadata")
    def to_create_custom_metadata(self) -> "Workdocs":
        '''(experimental) Grants permission to add one or more custom properties to the specified resource.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_CreateCustomMetadata.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toCreateCustomMetadata", []))

    @jsii.member(jsii_name="toCreateFolder")
    def to_create_folder(self) -> "Workdocs":
        '''(experimental) Grants permission to create a folder with the specified name and parent folder.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_CreateFolder.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toCreateFolder", []))

    @jsii.member(jsii_name="toCreateInstance")
    def to_create_instance(self) -> "Workdocs":
        '''(experimental) Grants permission to create an instance.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/adminguide/getting_started.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toCreateInstance", []))

    @jsii.member(jsii_name="toCreateLabels")
    def to_create_labels(self) -> "Workdocs":
        '''(experimental) Grants permission to add labels to the given resource.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_CreateLabels.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toCreateLabels", []))

    @jsii.member(jsii_name="toCreateNotificationSubscription")
    def to_create_notification_subscription(self) -> "Workdocs":
        '''(experimental) Grants permission to configure WorkDocs to use Amazon SNS notifications.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_CreateNotificationSubscription.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toCreateNotificationSubscription", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Workdocs":
        '''(experimental) Grants permission to create a user in a Simple AD or Microsoft AD directory.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_CreateUser.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toDeactivateUser")
    def to_deactivate_user(self) -> "Workdocs":
        '''(experimental) Grants permission to deactivate the specified user, which revokes the user's access to Amazon WorkDocs.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DeactivateUser.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeactivateUser", []))

    @jsii.member(jsii_name="toDeleteComment")
    def to_delete_comment(self) -> "Workdocs":
        '''(experimental) Grants permission to delete the specified comment from the document version.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DeleteComment.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeleteComment", []))

    @jsii.member(jsii_name="toDeleteCustomMetadata")
    def to_delete_custom_metadata(self) -> "Workdocs":
        '''(experimental) Grants permission to delete custom metadata from the specified resource.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DeleteCustomMetadata.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeleteCustomMetadata", []))

    @jsii.member(jsii_name="toDeleteDocument")
    def to_delete_document(self) -> "Workdocs":
        '''(experimental) Grants permission to permanently delete the specified document and its associated metadata.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DeleteDocument.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeleteDocument", []))

    @jsii.member(jsii_name="toDeleteDocumentVersion")
    def to_delete_document_version(self) -> "Workdocs":
        '''(experimental) Grants permission to delete versions of a specified document.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DeleteDocumentVersion.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeleteDocumentVersion", []))

    @jsii.member(jsii_name="toDeleteFolder")
    def to_delete_folder(self) -> "Workdocs":
        '''(experimental) Grants permission to permanently delete the specified folder and its contents.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DeleteFolder.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeleteFolder", []))

    @jsii.member(jsii_name="toDeleteFolderContents")
    def to_delete_folder_contents(self) -> "Workdocs":
        '''(experimental) Grants permission to delete the contents of the specified folder.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DeleteFolderContents.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeleteFolderContents", []))

    @jsii.member(jsii_name="toDeleteInstance")
    def to_delete_instance(self) -> "Workdocs":
        '''(experimental) Grants permission to delete an instance.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/adminguide/manage-sites.html#delete_site

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeleteInstance", []))

    @jsii.member(jsii_name="toDeleteLabels")
    def to_delete_labels(self) -> "Workdocs":
        '''(experimental) Grants permission to delete one or more labels from a resource.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DeleteLabels.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeleteLabels", []))

    @jsii.member(jsii_name="toDeleteNotificationPermissions")
    def to_delete_notification_permissions(self) -> "Workdocs":
        '''(experimental) Grants permission to delete principals that are allowed to call notification subscription APIs for a given WorkDocs site.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/adminguide/manage-notifications.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeleteNotificationPermissions", []))

    @jsii.member(jsii_name="toDeleteNotificationSubscription")
    def to_delete_notification_subscription(self) -> "Workdocs":
        '''(experimental) Grants permission to delete the specified subscription from the specified organization.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DeleteNotificationSubscription.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeleteNotificationSubscription", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "Workdocs":
        '''(experimental) Grants permission to delete the specified user from a Simple AD or Microsoft AD directory.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDeregisterDirectory")
    def to_deregister_directory(self) -> "Workdocs":
        '''(experimental) Grants permission to deregister a directory.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/adminguide/manage-sites.html#delete_site

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDeregisterDirectory", []))

    @jsii.member(jsii_name="toDescribeActivities")
    def to_describe_activities(self) -> "Workdocs":
        '''(experimental) Grants permission to fetch user activities in a specified time period.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DescribeActivities.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeActivities", []))

    @jsii.member(jsii_name="toDescribeAvailableDirectories")
    def to_describe_available_directories(self) -> "Workdocs":
        '''(experimental) Grants permission to describe available directories.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/adminguide/getting_started.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeAvailableDirectories", []))

    @jsii.member(jsii_name="toDescribeComments")
    def to_describe_comments(self) -> "Workdocs":
        '''(experimental) Grants permission to list all the comments for the specified document version.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DescribeComments.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeComments", []))

    @jsii.member(jsii_name="toDescribeDocumentVersions")
    def to_describe_document_versions(self) -> "Workdocs":
        '''(experimental) Grants permission to retrieve the document versions for the specified document.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DescribeDocumentVersions.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeDocumentVersions", []))

    @jsii.member(jsii_name="toDescribeFolderContents")
    def to_describe_folder_contents(self) -> "Workdocs":
        '''(experimental) Grants permission to describe the contents of the specified folder, including its documents and sub-folders.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DescribeFolderContents.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeFolderContents", []))

    @jsii.member(jsii_name="toDescribeGroups")
    def to_describe_groups(self) -> "Workdocs":
        '''(experimental) Grants permission to describe the user groups.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DescribeGroups.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeGroups", []))

    @jsii.member(jsii_name="toDescribeInstances")
    def to_describe_instances(self) -> "Workdocs":
        '''(experimental) Grants permission to describe instances.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/adminguide/getting_started.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeInstances", []))

    @jsii.member(jsii_name="toDescribeNotificationPermissions")
    def to_describe_notification_permissions(self) -> "Workdocs":
        '''(experimental) Grants permission to describe principals that are allowed to call notification subscription APIs for a given WorkDocs site.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/adminguide/manage-notifications.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeNotificationPermissions", []))

    @jsii.member(jsii_name="toDescribeNotificationSubscriptions")
    def to_describe_notification_subscriptions(self) -> "Workdocs":
        '''(experimental) Grants permission to list the specified notification subscriptions.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DescribeNotificationSubscriptions.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeNotificationSubscriptions", []))

    @jsii.member(jsii_name="toDescribeResourcePermissions")
    def to_describe_resource_permissions(self) -> "Workdocs":
        '''(experimental) Grants permission to view a description of a specified resource's permissions.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DescribeResourcePermissions.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeResourcePermissions", []))

    @jsii.member(jsii_name="toDescribeRootFolders")
    def to_describe_root_folders(self) -> "Workdocs":
        '''(experimental) Grants permission to describe the root folders.

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DescribeRootFolders.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeRootFolders", []))

    @jsii.member(jsii_name="toDescribeUsers")
    def to_describe_users(self) -> "Workdocs":
        '''(experimental) Grants permission to view a description of the specified users.

        You can describe all users or filter the results (for example, by status or organization)

        Access Level: List

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_DescribeUsers.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDescribeUsers", []))

    @jsii.member(jsii_name="toDownloadDocumentVersion")
    def to_download_document_version(self) -> "Workdocs":
        '''(experimental) Grants permission to download a specified document version.

        Access Level: Read

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_GetDocumentVersion.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toDownloadDocumentVersion", []))

    @jsii.member(jsii_name="toGetCurrentUser")
    def to_get_current_user(self) -> "Workdocs":
        '''(experimental) Grants permission to retrieve the details of the current user.

        Access Level: Read

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_GetCurrentUser.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toGetCurrentUser", []))

    @jsii.member(jsii_name="toGetDocument")
    def to_get_document(self) -> "Workdocs":
        '''(experimental) Grants permission to retrieve the specified document object.

        Access Level: Read

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_GetDocument.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toGetDocument", []))

    @jsii.member(jsii_name="toGetDocumentPath")
    def to_get_document_path(self) -> "Workdocs":
        '''(experimental) Grants permission to retrieve the path information (the hierarchy from the root folder) for the requested document.

        Access Level: Read

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_GetDocumentPath.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toGetDocumentPath", []))

    @jsii.member(jsii_name="toGetDocumentVersion")
    def to_get_document_version(self) -> "Workdocs":
        '''(experimental) Grants permission to retrieve version metadata for the specified document.

        Access Level: Read

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_GetDocumentVersion.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toGetDocumentVersion", []))

    @jsii.member(jsii_name="toGetFolder")
    def to_get_folder(self) -> "Workdocs":
        '''(experimental) Grants permission to retrieve the metadata of the specified folder.

        Access Level: Read

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_GetFolder.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toGetFolder", []))

    @jsii.member(jsii_name="toGetFolderPath")
    def to_get_folder_path(self) -> "Workdocs":
        '''(experimental) Grants permission to retrieve the path information (the hierarchy from the root folder) for the specified folder.

        Access Level: Read

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_GetFolderPath.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toGetFolderPath", []))

    @jsii.member(jsii_name="toGetGroup")
    def to_get_group(self) -> "Workdocs":
        '''(experimental) Grants permission to retrieve details for the specified group.

        Access Level: Read

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_Operations.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toGetGroup", []))

    @jsii.member(jsii_name="toGetResources")
    def to_get_resources(self) -> "Workdocs":
        '''(experimental) Grants permission to get a collection of resources.

        Access Level: Read

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_GetResources.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toGetResources", []))

    @jsii.member(jsii_name="toInitiateDocumentVersionUpload")
    def to_initiate_document_version_upload(self) -> "Workdocs":
        '''(experimental) Grants permission to create a new document object and version object.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_InitiateDocumentVersionUpload.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toInitiateDocumentVersionUpload", []))

    @jsii.member(jsii_name="toRegisterDirectory")
    def to_register_directory(self) -> "Workdocs":
        '''(experimental) Grants permission to register a directory.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/adminguide/existing-dir-setup.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toRegisterDirectory", []))

    @jsii.member(jsii_name="toRemoveAllResourcePermissions")
    def to_remove_all_resource_permissions(self) -> "Workdocs":
        '''(experimental) Grants permission to remove all the permissions from the specified resource.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_RemoveAllResourcePermissions.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toRemoveAllResourcePermissions", []))

    @jsii.member(jsii_name="toRemoveResourcePermission")
    def to_remove_resource_permission(self) -> "Workdocs":
        '''(experimental) Grants permission to remove the permission for the specified principal from the specified resource.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_RemoveResourcePermission.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toRemoveResourcePermission", []))

    @jsii.member(jsii_name="toRestoreDocumentVersions")
    def to_restore_document_versions(self) -> "Workdocs":
        '''(experimental) Grants permission to restore versions of a specified document.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_RestoreDocumentVersions.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toRestoreDocumentVersions", []))

    @jsii.member(jsii_name="toUpdateDocument")
    def to_update_document(self) -> "Workdocs":
        '''(experimental) Grants permission to update the specified attributes of the specified document.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_UpdateDocument.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toUpdateDocument", []))

    @jsii.member(jsii_name="toUpdateDocumentVersion")
    def to_update_document_version(self) -> "Workdocs":
        '''(experimental) Grants permission to change the status of the document version to ACTIVE.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_UpdateDocumentVersion.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toUpdateDocumentVersion", []))

    @jsii.member(jsii_name="toUpdateFolder")
    def to_update_folder(self) -> "Workdocs":
        '''(experimental) Grants permission to update the specified attributes of the specified folder.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_UpdateFolder.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toUpdateFolder", []))

    @jsii.member(jsii_name="toUpdateInstanceAlias")
    def to_update_instance_alias(self) -> "Workdocs":
        '''(experimental) Grants permission to update an instance alias.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/adminguide/getting_started.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toUpdateInstanceAlias", []))

    @jsii.member(jsii_name="toUpdateUser")
    def to_update_user(self) -> "Workdocs":
        '''(experimental) Grants permission to update the specified attributes of the specified user, and grants or revokes administrative privileges to the Amazon WorkDocs site.

        Access Level: Write

        https://docs.aws.amazon.com/workdocs/latest/APIReference/API_UpdateUser.html

        :stability: experimental
        '''
        return typing.cast("Workdocs", jsii.invoke(self, "toUpdateUser", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8c071342b9add8072ba98959a364ca1764d2feaff8fa23c244e2c7df676a4382)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__47cb0fbb2cd6276dba53a7e761cc6dcfbac3b45755fe6b47d30a92b67ac9a164)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Worklink(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Worklink",
):
    '''(experimental) Statement provider for service `worklink <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworklink.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `worklink <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworklink.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ccc400871d4b6c37807dfa2ad89b7eaa261e735565290db7254128749769c9d9)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onFleet")
    def on_fleet(
        self,
        fleet_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Worklink":
        '''(experimental) Adds a resource of type fleet to the statement.

        https://docs.aws.amazon.com/worklink/latest/api/API_CreateFleet.html

        :param fleet_name: - Identifier for the fleetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1931973335f7e20699052944fbd759189229d623bc4ddf2fdfbff7a0f4d82fbb)
            check_type(argname="argument fleet_name", value=fleet_name, expected_type=type_hints["fleet_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Worklink", jsii.invoke(self, "onFleet", [fleet_name, account, partition]))

    @jsii.member(jsii_name="toAssociateDomain")
    def to_associate_domain(self) -> "Worklink":
        '''(experimental) Grants permission to associate a domain with an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_AssociateDomain.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toAssociateDomain", []))

    @jsii.member(jsii_name="toAssociateWebsiteAuthorizationProvider")
    def to_associate_website_authorization_provider(self) -> "Worklink":
        '''(experimental) Grants permission to associate a website authorization provider with an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_AssociateWebsiteAuthorizationProvider.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toAssociateWebsiteAuthorizationProvider", []))

    @jsii.member(jsii_name="toAssociateWebsiteCertificateAuthority")
    def to_associate_website_certificate_authority(self) -> "Worklink":
        '''(experimental) Grants permission to associate a website certificate authority with an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_AssociateWebsiteCertificateAuthority.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toAssociateWebsiteCertificateAuthority", []))

    @jsii.member(jsii_name="toCreateFleet")
    def to_create_fleet(self) -> "Worklink":
        '''(experimental) Grants permission to create an Amazon WorkLink fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/worklink/latest/api/API_CreateFleet.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toCreateFleet", []))

    @jsii.member(jsii_name="toDeleteFleet")
    def to_delete_fleet(self) -> "Worklink":
        '''(experimental) Grants permission to delete an Amazon WorkLink fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/worklink/latest/api/API_DeleteFleet.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDeleteFleet", []))

    @jsii.member(jsii_name="toDescribeAuditStreamConfiguration")
    def to_describe_audit_stream_configuration(self) -> "Worklink":
        '''(experimental) Grants permission to describe the audit stream configuration for an Amazon WorkLink fleet.

        Access Level: Read

        https://docs.aws.amazon.com/worklink/latest/api/API_DescribeAuditStreamConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDescribeAuditStreamConfiguration", []))

    @jsii.member(jsii_name="toDescribeCompanyNetworkConfiguration")
    def to_describe_company_network_configuration(self) -> "Worklink":
        '''(experimental) Grants permission to describe the company network configuration for an Amazon WorkLink fleet.

        Access Level: Read

        https://docs.aws.amazon.com/worklink/latest/api/API_DescribeCompanyNetworkConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDescribeCompanyNetworkConfiguration", []))

    @jsii.member(jsii_name="toDescribeDevice")
    def to_describe_device(self) -> "Worklink":
        '''(experimental) Grants permission to describe details of a device associated with an Amazon WorkLink fleet.

        Access Level: Read

        https://docs.aws.amazon.com/worklink/latest/api/API_DescribeDevice.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDescribeDevice", []))

    @jsii.member(jsii_name="toDescribeDevicePolicyConfiguration")
    def to_describe_device_policy_configuration(self) -> "Worklink":
        '''(experimental) Grants permission to describe the device policy configuration for an Amazon WorkLink fleet.

        Access Level: Read

        https://docs.aws.amazon.com/worklink/latest/api/API_DescribeDevicePolicyConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDescribeDevicePolicyConfiguration", []))

    @jsii.member(jsii_name="toDescribeDomain")
    def to_describe_domain(self) -> "Worklink":
        '''(experimental) Grants permission to describe details about a domain associated with an Amazon WorkLink fleet.

        Access Level: Read

        https://docs.aws.amazon.com/worklink/latest/api/API_DescribeDomain.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDescribeDomain", []))

    @jsii.member(jsii_name="toDescribeFleetMetadata")
    def to_describe_fleet_metadata(self) -> "Worklink":
        '''(experimental) Grants permission to describe metadata of an Amazon WorkLink fleet.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/worklink/latest/api/API_DescribeFleetMetadata.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDescribeFleetMetadata", []))

    @jsii.member(jsii_name="toDescribeIdentityProviderConfiguration")
    def to_describe_identity_provider_configuration(self) -> "Worklink":
        '''(experimental) Grants permission to describe the identity provider configuration for an Amazon WorkLink fleet.

        Access Level: Read

        https://docs.aws.amazon.com/worklink/latest/api/API_DescribeIdentityProviderConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDescribeIdentityProviderConfiguration", []))

    @jsii.member(jsii_name="toDescribeWebsiteCertificateAuthority")
    def to_describe_website_certificate_authority(self) -> "Worklink":
        '''(experimental) Grants permission to describe a website certificate authority associated with an Amazon WorkLink fleet.

        Access Level: Read

        https://docs.aws.amazon.com/worklink/latest/api/API_DescribeWebsiteCertificateAuthority.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDescribeWebsiteCertificateAuthority", []))

    @jsii.member(jsii_name="toDisassociateDomain")
    def to_disassociate_domain(self) -> "Worklink":
        '''(experimental) Grants permission to disassociate a domain from an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_DisassociateDomain.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDisassociateDomain", []))

    @jsii.member(jsii_name="toDisassociateWebsiteAuthorizationProvider")
    def to_disassociate_website_authorization_provider(self) -> "Worklink":
        '''(experimental) Grants permission to disassociate a website authorization provider from an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_DisassociateWebsiteAuthorizationProvider.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDisassociateWebsiteAuthorizationProvider", []))

    @jsii.member(jsii_name="toDisassociateWebsiteCertificateAuthority")
    def to_disassociate_website_certificate_authority(self) -> "Worklink":
        '''(experimental) Grants permission to disassociate a website certificate authority from an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_DisassociateWebsiteCertificateAuthority.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toDisassociateWebsiteCertificateAuthority", []))

    @jsii.member(jsii_name="toListDevices")
    def to_list_devices(self) -> "Worklink":
        '''(experimental) Grants permission to list the devices associated with an Amazon WorkLink fleet.

        Access Level: List

        https://docs.aws.amazon.com/worklink/latest/api/API_ListDevices.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toListDevices", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Worklink":
        '''(experimental) Grants permission to list the associated domains for an Amazon WorkLink fleet.

        Access Level: List

        https://docs.aws.amazon.com/worklink/latest/api/API_ListDomains.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toListFleets")
    def to_list_fleets(self) -> "Worklink":
        '''(experimental) Grants permission to list the Amazon WorkLink fleets associated with the account.

        Access Level: List

        https://docs.aws.amazon.com/worklink/latest/api/API_ListFleets.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toListFleets", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Worklink":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/worklink/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWebsiteAuthorizationProviders")
    def to_list_website_authorization_providers(self) -> "Worklink":
        '''(experimental) Grants permission to list the website authorization providers for an Amazon WorkLink fleet.

        Access Level: List

        https://docs.aws.amazon.com/worklink/latest/api/API_ListWebsiteAuthorizationProviders.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toListWebsiteAuthorizationProviders", []))

    @jsii.member(jsii_name="toListWebsiteCertificateAuthorities")
    def to_list_website_certificate_authorities(self) -> "Worklink":
        '''(experimental) Grants permission to list the website certificate authorities associated with an Amazon WorkLink fleet.

        Access Level: List

        https://docs.aws.amazon.com/worklink/latest/api/API_ListWebsiteCertificateAuthorities.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toListWebsiteCertificateAuthorities", []))

    @jsii.member(jsii_name="toRestoreDomainAccess")
    def to_restore_domain_access(self) -> "Worklink":
        '''(experimental) Grants permission to restore access to a domain associated with an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_RestoreDomainAccess.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toRestoreDomainAccess", []))

    @jsii.member(jsii_name="toRevokeDomainAccess")
    def to_revoke_domain_access(self) -> "Worklink":
        '''(experimental) Grants permission to revoke access to a domain associated with an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_RevokeDomainAccess.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toRevokeDomainAccess", []))

    @jsii.member(jsii_name="toSearchEntity")
    def to_search_entity(self) -> "Worklink":
        '''(experimental) Grants permission to list devices for an Amazon WorkLink fleet.

        Access Level: List

        https://docs.aws.amazon.com/worklink/latest/ag/manage-devices.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toSearchEntity", []))

    @jsii.member(jsii_name="toSignOutUser")
    def to_sign_out_user(self) -> "Worklink":
        '''(experimental) Grants permission to sign out a user from an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_SignOutUser.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toSignOutUser", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Worklink":
        '''(experimental) Grants permission to add one or more tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/worklink/latest/api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Worklink":
        '''(experimental) Grants permission to remove one or more tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/worklink/latest/api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAuditStreamConfiguration")
    def to_update_audit_stream_configuration(self) -> "Worklink":
        '''(experimental) Grants permission to update the audit stream configuration for an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_UpdateAuditStreamConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toUpdateAuditStreamConfiguration", []))

    @jsii.member(jsii_name="toUpdateCompanyNetworkConfiguration")
    def to_update_company_network_configuration(self) -> "Worklink":
        '''(experimental) Grants permission to update the company network configuration for an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_UpdateCompanyNetworkConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toUpdateCompanyNetworkConfiguration", []))

    @jsii.member(jsii_name="toUpdateDevicePolicyConfiguration")
    def to_update_device_policy_configuration(self) -> "Worklink":
        '''(experimental) Grants permission to update the device policy configuration for an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_UpdateDevicePolicyConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toUpdateDevicePolicyConfiguration", []))

    @jsii.member(jsii_name="toUpdateDomainMetadata")
    def to_update_domain_metadata(self) -> "Worklink":
        '''(experimental) Grants permission to update the metadata for a domain associated with an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_UpdateDomainMetadata.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toUpdateDomainMetadata", []))

    @jsii.member(jsii_name="toUpdateFleetMetadata")
    def to_update_fleet_metadata(self) -> "Worklink":
        '''(experimental) Grants permission to update the metadata of an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_UpdateFleetMetadata.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toUpdateFleetMetadata", []))

    @jsii.member(jsii_name="toUpdateIdentityProviderConfiguration")
    def to_update_identity_provider_configuration(self) -> "Worklink":
        '''(experimental) Grants permission to update the identity provider configuration for an Amazon WorkLink fleet.

        Access Level: Write

        https://docs.aws.amazon.com/worklink/latest/api/API_UpdateIdentityProviderConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Worklink", jsii.invoke(self, "toUpdateIdentityProviderConfiguration", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a6c01c0c3f9ee4b7e6aa112c6cace9558eff2d910cf7927a64b26377071bf3b3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__75ab9691d78a366a5238e5faf735d8bd45021577c1576ba97150caea474b835a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Workmail(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Workmail",
):
    '''(experimental) Statement provider for service `workmail <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkmail.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `workmail <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkmail.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0c568b6caa447269b891b728952efe8171314704d4d1b19b1ddf86a015715550)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onOrganization")
    def on_organization(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Workmail":
        '''(experimental) Adds a resource of type organization to the statement.

        https://docs.aws.amazon.com/workmail/latest/adminguide/organizations_overview.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8f3b2b435c16465d51d9170e257c53c7346cab0edc419020e1ba920f4eaf716a)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Workmail", jsii.invoke(self, "onOrganization", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toAddMembersToGroup")
    def to_add_members_to_group(self) -> "Workmail":
        '''(experimental) Grants permission to add a list of members (users or groups) to a group.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/groups_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toAddMembersToGroup", []))

    @jsii.member(jsii_name="toAssociateDelegateToResource")
    def to_associate_delegate_to_resource(self) -> "Workmail":
        '''(experimental) Grants permission to add a member (user or group) to the resource's set of delegates.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_AssociateDelegateToResource.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toAssociateDelegateToResource", []))

    @jsii.member(jsii_name="toAssociateMemberToGroup")
    def to_associate_member_to_group(self) -> "Workmail":
        '''(experimental) Grants permission to add a member (user or group) to the group's set.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_AssociateMemberToGroup.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toAssociateMemberToGroup", []))

    @jsii.member(jsii_name="toAssumeImpersonationRole")
    def to_assume_impersonation_role(self) -> "Workmail":
        '''(experimental) Grants permission to assume an impersonation role for the given Amazon WorkMail organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_AssumeImpersonationRole.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toAssumeImpersonationRole", []))

    @jsii.member(jsii_name="toCancelMailboxExportJob")
    def to_cancel_mailbox_export_job(self) -> "Workmail":
        '''(experimental) Grants permission to cancel a currently running mailbox export job.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_CancelMailboxExportJob.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCancelMailboxExportJob", []))

    @jsii.member(jsii_name="toCreateAlias")
    def to_create_alias(self) -> "Workmail":
        '''(experimental) Grants permission to add an alias to the set of a given member (user or group) of WorkMail.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateAlias.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateAlias", []))

    @jsii.member(jsii_name="toCreateAvailabilityConfiguration")
    def to_create_availability_configuration(self) -> "Workmail":
        '''(experimental) Grants permission to create an AvailabilityConfiguration for the given Amazon WorkMail organization and domain.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateAvailabilityConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateAvailabilityConfiguration", []))

    @jsii.member(jsii_name="toCreateGroup")
    def to_create_group(self) -> "Workmail":
        '''(experimental) Grants permission to create a group that can be used in WorkMail by calling the RegisterToWorkMail operation.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateGroup.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateGroup", []))

    @jsii.member(jsii_name="toCreateImpersonationRole")
    def to_create_impersonation_role(self) -> "Workmail":
        '''(experimental) Grants permission to create an impersonation role for the given Amazon WorkMail organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateImpersonationRole.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateImpersonationRole", []))

    @jsii.member(jsii_name="toCreateInboundMailFlowRule")
    def to_create_inbound_mail_flow_rule(self) -> "Workmail":
        '''(experimental) Grants permission to create an inbound email flow rule which will apply to all email sent to an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/create-email-rules.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateInboundMailFlowRule", []))

    @jsii.member(jsii_name="toCreateMailDomain")
    def to_create_mail_domain(self) -> "Workmail":
        '''(experimental) Grants permission to create a mail domain.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/add_domain.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateMailDomain", []))

    @jsii.member(jsii_name="toCreateMailUser")
    def to_create_mail_user(self) -> "Workmail":
        '''(experimental) Grants permission to create a user in the directory.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/manage-users.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateMailUser", []))

    @jsii.member(jsii_name="toCreateMobileDeviceAccessRule")
    def to_create_mobile_device_access_rule(self) -> "Workmail":
        '''(experimental) Grants permission to create a new mobile device access rule.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateMobileDeviceAccessRule.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateMobileDeviceAccessRule", []))

    @jsii.member(jsii_name="toCreateOrganization")
    def to_create_organization(self) -> "Workmail":
        '''(experimental) Grants permission to create a new Amazon WorkMail organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateOrganization.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateOrganization", []))

    @jsii.member(jsii_name="toCreateOutboundMailFlowRule")
    def to_create_outbound_mail_flow_rule(self) -> "Workmail":
        '''(experimental) Grants permission to create an outbound email flow rule which will apply to all email sent from an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/create-email-rules.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateOutboundMailFlowRule", []))

    @jsii.member(jsii_name="toCreateResource")
    def to_create_resource(self) -> "Workmail":
        '''(experimental) Grants permission to create a new WorkMail resource.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateResource.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateResource", []))

    @jsii.member(jsii_name="toCreateSmtpGateway")
    def to_create_smtp_gateway(self) -> "Workmail":
        '''(experimental) Grants permission to register an SMTP gateway to a WorkMail organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/smtp-gateway.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateSmtpGateway", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Workmail":
        '''(experimental) Grants permission to create a user, which can be enabled afterwards by calling the RegisterToWorkMail operation.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateUser.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toDeleteAccessControlRule")
    def to_delete_access_control_rule(self) -> "Workmail":
        '''(experimental) Grants permission to delete an access control rule.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteAccessControlRule.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteAccessControlRule", []))

    @jsii.member(jsii_name="toDeleteAlias")
    def to_delete_alias(self) -> "Workmail":
        '''(experimental) Grants permission to remove one or more specified aliases from a set of aliases for a given user.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteAlias.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteAlias", []))

    @jsii.member(jsii_name="toDeleteAvailabilityConfiguration")
    def to_delete_availability_configuration(self) -> "Workmail":
        '''(experimental) Grants permission to delete the AvailabilityConfiguration for the given Amazon WorkMail organization and domain.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteAvailabilityConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteAvailabilityConfiguration", []))

    @jsii.member(jsii_name="toDeleteEmailMonitoringConfiguration")
    def to_delete_email_monitoring_configuration(self) -> "Workmail":
        '''(experimental) Grants permission to delete the email monitoring configuration for an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteEmailMonitoringConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteEmailMonitoringConfiguration", []))

    @jsii.member(jsii_name="toDeleteGroup")
    def to_delete_group(self) -> "Workmail":
        '''(experimental) Grants permission to delete a group from WorkMail.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteGroup.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteGroup", []))

    @jsii.member(jsii_name="toDeleteImpersonationRole")
    def to_delete_impersonation_role(self) -> "Workmail":
        '''(experimental) Grants permission to delete an impersonation role for the given Amazon WorkMail organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteImpersonationRole.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteImpersonationRole", []))

    @jsii.member(jsii_name="toDeleteInboundMailFlowRule")
    def to_delete_inbound_mail_flow_rule(self) -> "Workmail":
        '''(experimental) Grants permission to remove an inbound email flow rule to no longer apply to emails sent to an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/remove-email-flow-rule.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteInboundMailFlowRule", []))

    @jsii.member(jsii_name="toDeleteMailboxPermissions")
    def to_delete_mailbox_permissions(self) -> "Workmail":
        '''(experimental) Grants permission to delete permissions granted to a member (user or group).

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteMailboxPermissions.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteMailboxPermissions", []))

    @jsii.member(jsii_name="toDeleteMailDomain")
    def to_delete_mail_domain(self) -> "Workmail":
        '''(experimental) Grants permission to remove an unused mail domain from an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/remove_domain.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteMailDomain", []))

    @jsii.member(jsii_name="toDeleteMobileDevice")
    def to_delete_mobile_device(self) -> "Workmail":
        '''(experimental) Grants permission to remove a mobile device from a user.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/manage-devices.html#remove_mobile_device

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteMobileDevice", []))

    @jsii.member(jsii_name="toDeleteMobileDeviceAccessOverride")
    def to_delete_mobile_device_access_override(self) -> "Workmail":
        '''(experimental) Grants permission to delete a mobile device access override.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteMobileDeviceAccessOverride.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteMobileDeviceAccessOverride", []))

    @jsii.member(jsii_name="toDeleteMobileDeviceAccessRule")
    def to_delete_mobile_device_access_rule(self) -> "Workmail":
        '''(experimental) Grants permission to delete a mobile device access rule.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteMobileDeviceAccessRule.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteMobileDeviceAccessRule", []))

    @jsii.member(jsii_name="toDeleteOrganization")
    def to_delete_organization(self) -> "Workmail":
        '''(experimental) Grants permission to delete an Amazon WorkMail organization and all underlying AWS resources managed by Amazon WorkMail as part of the organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteOrganization.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteOrganization", []))

    @jsii.member(jsii_name="toDeleteOutboundMailFlowRule")
    def to_delete_outbound_mail_flow_rule(self) -> "Workmail":
        '''(experimental) Grants permission to remove an outbound email flow rule so that it no longer applies to emails sent from an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/remove-email-flow-rule.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteOutboundMailFlowRule", []))

    @jsii.member(jsii_name="toDeleteResource")
    def to_delete_resource(self) -> "Workmail":
        '''(experimental) Grants permission to delete the specified resource.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteResource.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteResource", []))

    @jsii.member(jsii_name="toDeleteRetentionPolicy")
    def to_delete_retention_policy(self) -> "Workmail":
        '''(experimental) Grants permission to delete the retention policy based on the supplied organization and policy identifiers.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteRetentionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteRetentionPolicy", []))

    @jsii.member(jsii_name="toDeleteSmtpGateway")
    def to_delete_smtp_gateway(self) -> "Workmail":
        '''(experimental) Grants permission to remove an SMTP gateway from an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/smtp-gateway.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteSmtpGateway", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "Workmail":
        '''(experimental) Grants permission to delete a user from WorkMail and all subsequent systems.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDeregisterFromWorkMail")
    def to_deregister_from_work_mail(self) -> "Workmail":
        '''(experimental) Grants permission to mark a user, group, or resource as no longer used in WorkMail.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeregisterFromWorkMail.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeregisterFromWorkMail", []))

    @jsii.member(jsii_name="toDeregisterMailDomain")
    def to_deregister_mail_domain(self) -> "Workmail":
        '''(experimental) Grants permission to deregister a mail domain from an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeregisterMailDomain.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDeregisterMailDomain", []))

    @jsii.member(jsii_name="toDescribeDirectories")
    def to_describe_directories(self) -> "Workmail":
        '''(experimental) Grants permission to show a list of directories available for use in creating an organization.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/adminguide/add_new_organization.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeDirectories", []))

    @jsii.member(jsii_name="toDescribeEmailMonitoringConfiguration")
    def to_describe_email_monitoring_configuration(self) -> "Workmail":
        '''(experimental) Grants permission to retrieve the email monitoring configuration for an organization.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeEmailMonitoringConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeEmailMonitoringConfiguration", []))

    @jsii.member(jsii_name="toDescribeGroup")
    def to_describe_group(self) -> "Workmail":
        '''(experimental) Grants permission to read the details for a group.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeGroup.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeGroup", []))

    @jsii.member(jsii_name="toDescribeInboundDmarcSettings")
    def to_describe_inbound_dmarc_settings(self) -> "Workmail":
        '''(experimental) Grants permission to read the settings in a DMARC policy for a specified organization.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeInboundDmarcSettings.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeInboundDmarcSettings", []))

    @jsii.member(jsii_name="toDescribeInboundMailFlowRule")
    def to_describe_inbound_mail_flow_rule(self) -> "Workmail":
        '''(experimental) Grants permission to read the details of an inbound mail flow rule configured for an organization.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/email-flows.html#email-flows-rule-actions

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeInboundMailFlowRule", []))

    @jsii.member(jsii_name="toDescribeKmsKeys")
    def to_describe_kms_keys(self) -> "Workmail":
        '''(experimental) Grants permission to show a list of KMS Keys available for use in creating an organization.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/adminguide/add_new_organization.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeKmsKeys", []))

    @jsii.member(jsii_name="toDescribeMailboxExportJob")
    def to_describe_mailbox_export_job(self) -> "Workmail":
        '''(experimental) Grants permission to retrieve details of a mailbox export job.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeMailboxExportJob.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeMailboxExportJob", []))

    @jsii.member(jsii_name="toDescribeMailDomains")
    def to_describe_mail_domains(self) -> "Workmail":
        '''(experimental) Grants permission to show the details of all mail domains associated with the organization.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/adminguide/domains_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeMailDomains", []))

    @jsii.member(jsii_name="toDescribeMailGroups")
    def to_describe_mail_groups(self) -> "Workmail":
        '''(experimental) Grants permission to show the details of all groups associated with the organization.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/adminguide/groups_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeMailGroups", []))

    @jsii.member(jsii_name="toDescribeMailUsers")
    def to_describe_mail_users(self) -> "Workmail":
        '''(experimental) Grants permission to show the details of all users associated with the organization.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/adminguide/users_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeMailUsers", []))

    @jsii.member(jsii_name="toDescribeOrganization")
    def to_describe_organization(self) -> "Workmail":
        '''(experimental) Grants permission to read details of an organization.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeOrganization.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeOrganization", []))

    @jsii.member(jsii_name="toDescribeOrganizations")
    def to_describe_organizations(self) -> "Workmail":
        '''(experimental) Grants permission to show a summary of all organizations associated with the account.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/adminguide/organizations_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeOrganizations", []))

    @jsii.member(jsii_name="toDescribeOutboundMailFlowRule")
    def to_describe_outbound_mail_flow_rule(self) -> "Workmail":
        '''(experimental) Grants permission to read the details of an outbound mail flow rule configured for an organization.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/email-flows.html#email-flows-rule-outbound

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeOutboundMailFlowRule", []))

    @jsii.member(jsii_name="toDescribeResource")
    def to_describe_resource(self) -> "Workmail":
        '''(experimental) Grants permission to read the details for a resource.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeResource.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeResource", []))

    @jsii.member(jsii_name="toDescribeSmtpGateway")
    def to_describe_smtp_gateway(self) -> "Workmail":
        '''(experimental) Grants permission to read the details of an SMTP gateway registered to an organization.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/smtp-gateway.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeSmtpGateway", []))

    @jsii.member(jsii_name="toDescribeUser")
    def to_describe_user(self) -> "Workmail":
        '''(experimental) Grants permission to read details for a user.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeUser.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDescribeUser", []))

    @jsii.member(jsii_name="toDisableMailGroups")
    def to_disable_mail_groups(self) -> "Workmail":
        '''(experimental) Grants permission to disable a mail group when it is not being used, in order to allow it to be deleted.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/remove_group.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDisableMailGroups", []))

    @jsii.member(jsii_name="toDisableMailUsers")
    def to_disable_mail_users(self) -> "Workmail":
        '''(experimental) Grants permission to disable a user mailbox when it is no longer being used, in order to allow it to be deleted.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/manage-mailboxes.html#delete_user_mailbox

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDisableMailUsers", []))

    @jsii.member(jsii_name="toDisassociateDelegateFromResource")
    def to_disassociate_delegate_from_resource(self) -> "Workmail":
        '''(experimental) Grants permission to remove a member from the resource's set of delegates.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DisassociateDelegateFromResource.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDisassociateDelegateFromResource", []))

    @jsii.member(jsii_name="toDisassociateMemberFromGroup")
    def to_disassociate_member_from_group(self) -> "Workmail":
        '''(experimental) Grants permission to remove a member from a group.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_DisassociateMemberFromGroup.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toDisassociateMemberFromGroup", []))

    @jsii.member(jsii_name="toEnableMailDomain")
    def to_enable_mail_domain(self) -> "Workmail":
        '''(experimental) Grants permission to enable a mail domain in the organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/add_domain.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toEnableMailDomain", []))

    @jsii.member(jsii_name="toEnableMailGroups")
    def to_enable_mail_groups(self) -> "Workmail":
        '''(experimental) Grants permission to enable a mail group after it has been created to allow it to receive mail.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/enable_existing_group.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toEnableMailGroups", []))

    @jsii.member(jsii_name="toEnableMailUsers")
    def to_enable_mail_users(self) -> "Workmail":
        '''(experimental) Grants permission to enable a user's mailbox after it has been created to allow it to receive mail.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/manage-users.html#enable_existing_user

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toEnableMailUsers", []))

    @jsii.member(jsii_name="toGetAccessControlEffect")
    def to_get_access_control_effect(self) -> "Workmail":
        '''(experimental) Grants permission to get the effects of access control rules as they apply to a specified IPv4 address, access protocol action, or user ID.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_GetAccessControlEffect.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetAccessControlEffect", []))

    @jsii.member(jsii_name="toGetDefaultRetentionPolicy")
    def to_get_default_retention_policy(self) -> "Workmail":
        '''(experimental) Grants permission to retrieve the retention policy associated at an organizational level.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_GetDefaultRetentionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetDefaultRetentionPolicy", []))

    @jsii.member(jsii_name="toGetImpersonationRole")
    def to_get_impersonation_role(self) -> "Workmail":
        '''(experimental) Grants permission to retrieve an impersonation role for the given Amazon WorkMail organization.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_GetImpersonationRole.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetImpersonationRole", []))

    @jsii.member(jsii_name="toGetImpersonationRoleEffect")
    def to_get_impersonation_role_effect(self) -> "Workmail":
        '''(experimental) Grants permission to get the effect of the rules associated to an impersonation role for a specific user.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_GetImpersonationRoleEffect.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetImpersonationRoleEffect", []))

    @jsii.member(jsii_name="toGetJournalingRules")
    def to_get_journaling_rules(self) -> "Workmail":
        '''(experimental) Grants permission to read the configured journaling and fallback email addresses for email journaling.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/journaling_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetJournalingRules", []))

    @jsii.member(jsii_name="toGetMailboxDetails")
    def to_get_mailbox_details(self) -> "Workmail":
        '''(experimental) Grants permission to read the details of the user's mailbox.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_GetMailboxDetails.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetMailboxDetails", []))

    @jsii.member(jsii_name="toGetMailDomain")
    def to_get_mail_domain(self) -> "Workmail":
        '''(experimental) Grants permission to retrieve details of a given mail domain in an organization.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_GetMailDomain.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetMailDomain", []))

    @jsii.member(jsii_name="toGetMailDomainDetails")
    def to_get_mail_domain_details(self) -> "Workmail":
        '''(experimental) Grants permission to get the details of the mail domain.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/domains_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetMailDomainDetails", []))

    @jsii.member(jsii_name="toGetMailGroupDetails")
    def to_get_mail_group_details(self) -> "Workmail":
        '''(experimental) Grants permission to get the details of the mail group.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/groups_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetMailGroupDetails", []))

    @jsii.member(jsii_name="toGetMailUserDetails")
    def to_get_mail_user_details(self) -> "Workmail":
        '''(experimental) Grants permission to get the details of the user's mailbox and account.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/users_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetMailUserDetails", []))

    @jsii.member(jsii_name="toGetMobileDeviceAccessEffect")
    def to_get_mobile_device_access_effect(self) -> "Workmail":
        '''(experimental) Grants permission to simulate the effect of the mobile device access rules for the given attributes of a sample access event.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_GetMobileDeviceAccessEffect.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetMobileDeviceAccessEffect", []))

    @jsii.member(jsii_name="toGetMobileDeviceAccessOverride")
    def to_get_mobile_device_access_override(self) -> "Workmail":
        '''(experimental) Grants permission to retrieve a mobile device access override.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_GetMobileDeviceAccessOverride.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetMobileDeviceAccessOverride", []))

    @jsii.member(jsii_name="toGetMobileDeviceDetails")
    def to_get_mobile_device_details(self) -> "Workmail":
        '''(experimental) Grants permission to get the details of the mobile device.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/manage-devices.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetMobileDeviceDetails", []))

    @jsii.member(jsii_name="toGetMobileDevicesForUser")
    def to_get_mobile_devices_for_user(self) -> "Workmail":
        '''(experimental) Grants permission to get a list of the mobile devices associated with the user.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/manage-devices.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetMobileDevicesForUser", []))

    @jsii.member(jsii_name="toGetMobilePolicyDetails")
    def to_get_mobile_policy_details(self) -> "Workmail":
        '''(experimental) Grants permission to get the details of the mobile device policy associated with the organization.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/edit_organization_mobile_policy.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toGetMobilePolicyDetails", []))

    @jsii.member(jsii_name="toListAccessControlRules")
    def to_list_access_control_rules(self) -> "Workmail":
        '''(experimental) Grants permission to list the access control rules.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListAccessControlRules.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListAccessControlRules", []))

    @jsii.member(jsii_name="toListAliases")
    def to_list_aliases(self) -> "Workmail":
        '''(experimental) Grants permission to list the aliases associated with a given entity.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListAliases.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListAliases", []))

    @jsii.member(jsii_name="toListAvailabilityConfigurations")
    def to_list_availability_configurations(self) -> "Workmail":
        '''(experimental) Grants permission to list all the AvailabilityConfiguration's for the given Amazon WorkMail organization.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListAvailabilityConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListAvailabilityConfigurations", []))

    @jsii.member(jsii_name="toListGroupMembers")
    def to_list_group_members(self) -> "Workmail":
        '''(experimental) Grants permission to read an overview of the members of a group.

        Users and groups can be members of a group

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListGroupMembers.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListGroupMembers", []))

    @jsii.member(jsii_name="toListGroups")
    def to_list_groups(self) -> "Workmail":
        '''(experimental) Grants permission to list summaries of the organization's groups.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListGroups.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListGroups", []))

    @jsii.member(jsii_name="toListImpersonationRoles")
    def to_list_impersonation_roles(self) -> "Workmail":
        '''(experimental) Grants permission to list the impersonation roles for the given Amazon WorkMail organization.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListImpersonationRoles.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListImpersonationRoles", []))

    @jsii.member(jsii_name="toListInboundMailFlowRules")
    def to_list_inbound_mail_flow_rules(self) -> "Workmail":
        '''(experimental) Grants permission to list inbound mail flow rules configured for an organization.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/adminguide/email-flows.html#email-flows-rule-actions

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListInboundMailFlowRules", []))

    @jsii.member(jsii_name="toListMailboxExportJobs")
    def to_list_mailbox_export_jobs(self) -> "Workmail":
        '''(experimental) Grants permission to list mailbox export jobs.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListMailboxExportJobs.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListMailboxExportJobs", []))

    @jsii.member(jsii_name="toListMailboxPermissions")
    def to_list_mailbox_permissions(self) -> "Workmail":
        '''(experimental) Grants permission to list the mailbox permissions associated with a user, group, or resource mailbox.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListMailboxPermissions.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListMailboxPermissions", []))

    @jsii.member(jsii_name="toListMailDomains")
    def to_list_mail_domains(self) -> "Workmail":
        '''(experimental) Grants permission to list the mail domains for a given organization.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListMailDomains.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListMailDomains", []))

    @jsii.member(jsii_name="toListMembersInMailGroup")
    def to_list_members_in_mail_group(self) -> "Workmail":
        '''(experimental) Grants permission to get a list of all the members in a mail group.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/groups_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListMembersInMailGroup", []))

    @jsii.member(jsii_name="toListMobileDeviceAccessOverrides")
    def to_list_mobile_device_access_overrides(self) -> "Workmail":
        '''(experimental) Grants permission to list the mobile device access overrides.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListMobileDeviceAccessOverrides.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListMobileDeviceAccessOverrides", []))

    @jsii.member(jsii_name="toListMobileDeviceAccessRules")
    def to_list_mobile_device_access_rules(self) -> "Workmail":
        '''(experimental) Grants permission to list the mobile device access rules.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListMobileDeviceAccessRules.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListMobileDeviceAccessRules", []))

    @jsii.member(jsii_name="toListOrganizations")
    def to_list_organizations(self) -> "Workmail":
        '''(experimental) Grants permission to list the non-deleted organizations.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListOrganizations.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListOrganizations", []))

    @jsii.member(jsii_name="toListOutboundMailFlowRules")
    def to_list_outbound_mail_flow_rules(self) -> "Workmail":
        '''(experimental) Grants permission to list outbound mail flow rules configured for an organization.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/adminguide/email-flows.html#email-flows-rule-outbound

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListOutboundMailFlowRules", []))

    @jsii.member(jsii_name="toListResourceDelegates")
    def to_list_resource_delegates(self) -> "Workmail":
        '''(experimental) Grants permission to list the delegates associated with a resource.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListResourceDelegates.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListResourceDelegates", []))

    @jsii.member(jsii_name="toListResources")
    def to_list_resources(self) -> "Workmail":
        '''(experimental) Grants permission to list the organization's resources.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListResources.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListResources", []))

    @jsii.member(jsii_name="toListSmtpGateways")
    def to_list_smtp_gateways(self) -> "Workmail":
        '''(experimental) Grants permission to list SMTP gateways registered to the organization.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/adminguide/smtp-gateway.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListSmtpGateways", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Workmail":
        '''(experimental) Grants permission to list the tags applied to an Amazon WorkMail organization resource.

        Access Level: List

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListUsers")
    def to_list_users(self) -> "Workmail":
        '''(experimental) Grants permission to list the organization's users.

        Access Level: List

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListUsers.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toListUsers", []))

    @jsii.member(jsii_name="toPutAccessControlRule")
    def to_put_access_control_rule(self) -> "Workmail":
        '''(experimental) Grants permission to add a new access control rule.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_PutAccessControlRule.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toPutAccessControlRule", []))

    @jsii.member(jsii_name="toPutEmailMonitoringConfiguration")
    def to_put_email_monitoring_configuration(self) -> "Workmail":
        '''(experimental) Grants permission to add or update the email monitoring configuration for an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_PutEmailMonitoringConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toPutEmailMonitoringConfiguration", []))

    @jsii.member(jsii_name="toPutInboundDmarcSettings")
    def to_put_inbound_dmarc_settings(self) -> "Workmail":
        '''(experimental) Grants permission to enable or disable a DMARC policy for a given organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_PutInboundDmarcSettings.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toPutInboundDmarcSettings", []))

    @jsii.member(jsii_name="toPutMailboxPermissions")
    def to_put_mailbox_permissions(self) -> "Workmail":
        '''(experimental) Grants permission to set permissions for a user, group, or resource, replacing any existing permissions.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_PutMailboxPermissions.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toPutMailboxPermissions", []))

    @jsii.member(jsii_name="toPutMobileDeviceAccessOverride")
    def to_put_mobile_device_access_override(self) -> "Workmail":
        '''(experimental) Grants permission to add or update a mobile device access override.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_PutMobileDeviceAccessOverride.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toPutMobileDeviceAccessOverride", []))

    @jsii.member(jsii_name="toPutRetentionPolicy")
    def to_put_retention_policy(self) -> "Workmail":
        '''(experimental) Grants permission to add or update the retention policy.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_PutRetentionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toPutRetentionPolicy", []))

    @jsii.member(jsii_name="toRegisterMailDomain")
    def to_register_mail_domain(self) -> "Workmail":
        '''(experimental) Grants permission to register a new mail domain in an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_RegisterMailDomain.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toRegisterMailDomain", []))

    @jsii.member(jsii_name="toRegisterToWorkMail")
    def to_register_to_work_mail(self) -> "Workmail":
        '''(experimental) Grants permission to register an existing and disabled user, group, or resource for use by associating a mailbox and calendaring capabilities.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_RegisterToWorkMail.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toRegisterToWorkMail", []))

    @jsii.member(jsii_name="toRemoveMembersFromGroup")
    def to_remove_members_from_group(self) -> "Workmail":
        '''(experimental) Grants permission to remove members from a mail group.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/groups_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toRemoveMembersFromGroup", []))

    @jsii.member(jsii_name="toResetPassword")
    def to_reset_password(self) -> "Workmail":
        '''(experimental) Grants permission to allow the administrator to reset the password for a user.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_ResetPassword.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toResetPassword", []))

    @jsii.member(jsii_name="toResetUserPassword")
    def to_reset_user_password(self) -> "Workmail":
        '''(experimental) Grants permission to reset the password for a user's account.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/manage-users.html#reset_user_password

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toResetUserPassword", []))

    @jsii.member(jsii_name="toSearchMembers")
    def to_search_members(self) -> "Workmail":
        '''(experimental) Grants permission to perform a prefix search to find a specific user in a mail group.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/adminguide/groups_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toSearchMembers", []))

    @jsii.member(jsii_name="toSetAdmin")
    def to_set_admin(self) -> "Workmail":
        '''(experimental) Grants permission to mark a user as being an administrator.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/users_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toSetAdmin", []))

    @jsii.member(jsii_name="toSetDefaultMailDomain")
    def to_set_default_mail_domain(self) -> "Workmail":
        '''(experimental) Grants permission to set the default mail domain for the organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/default_domain.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toSetDefaultMailDomain", []))

    @jsii.member(jsii_name="toSetJournalingRules")
    def to_set_journaling_rules(self) -> "Workmail":
        '''(experimental) Grants permission to set journaling and fallback email addresses for email journaling.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/journaling_overview.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toSetJournalingRules", []))

    @jsii.member(jsii_name="toSetMailGroupDetails")
    def to_set_mail_group_details(self) -> "Workmail":
        '''(experimental) Grants permission to set the details of the mail group which has just been created.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/add_new_group.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toSetMailGroupDetails", []))

    @jsii.member(jsii_name="toSetMailUserDetails")
    def to_set_mail_user_details(self) -> "Workmail":
        '''(experimental) Grants permission to set the details for the user account which has just been created.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/manage-users.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toSetMailUserDetails", []))

    @jsii.member(jsii_name="toSetMobilePolicyDetails")
    def to_set_mobile_policy_details(self) -> "Workmail":
        '''(experimental) Grants permission to set the details of a mobile policy associated with the organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/edit_organization_mobile_policy.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toSetMobilePolicyDetails", []))

    @jsii.member(jsii_name="toStartMailboxExportJob")
    def to_start_mailbox_export_job(self) -> "Workmail":
        '''(experimental) Grants permission to start a new mailbox export job.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_StartMailboxExportJob.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toStartMailboxExportJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Workmail":
        '''(experimental) Grants permission to tag the specified Amazon WorkMail organization resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestAvailabilityConfiguration")
    def to_test_availability_configuration(self) -> "Workmail":
        '''(experimental) Grants permission to performs a test on an availability provider to ensure that access is allowed.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_TestAvailabilityConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toTestAvailabilityConfiguration", []))

    @jsii.member(jsii_name="toTestInboundMailFlowRules")
    def to_test_inbound_mail_flow_rules(self) -> "Workmail":
        '''(experimental) Grants permission to test what inbound rules will apply to an email with a given sender and recipient.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/test-email-flow-rule.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toTestInboundMailFlowRules", []))

    @jsii.member(jsii_name="toTestOutboundMailFlowRules")
    def to_test_outbound_mail_flow_rules(self) -> "Workmail":
        '''(experimental) Grants permission to test what outbound rules will apply to an email with a given sender and recipient.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/test-email-flow-rule.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toTestOutboundMailFlowRules", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Workmail":
        '''(experimental) Grants permission to untag the specified Amazon WorkMail organization resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAvailabilityConfiguration")
    def to_update_availability_configuration(self) -> "Workmail":
        '''(experimental) Grants permission to update an existing AvailabilityConfiguration for the given Amazon WorkMail organization and domain.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_UpdateAvailabilityConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toUpdateAvailabilityConfiguration", []))

    @jsii.member(jsii_name="toUpdateDefaultMailDomain")
    def to_update_default_mail_domain(self) -> "Workmail":
        '''(experimental) Grants permission to update which domain is the default domain for an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_UpdateDefaultMailDomain.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toUpdateDefaultMailDomain", []))

    @jsii.member(jsii_name="toUpdateImpersonationRole")
    def to_update_impersonation_role(self) -> "Workmail":
        '''(experimental) Grants permission to update an existing impersonation role for the given Amazon WorkMail organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_UpdateImpersonationRole.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toUpdateImpersonationRole", []))

    @jsii.member(jsii_name="toUpdateInboundMailFlowRule")
    def to_update_inbound_mail_flow_rule(self) -> "Workmail":
        '''(experimental) Grants permission to update the details of an inbound email flow rule which will apply to all email sent to an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/modify-email-flow-rule.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toUpdateInboundMailFlowRule", []))

    @jsii.member(jsii_name="toUpdateMailboxQuota")
    def to_update_mailbox_quota(self) -> "Workmail":
        '''(experimental) Grants permission to update the maximum size (in MB) of the user's mailbox.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_UpdateMailboxQuota.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toUpdateMailboxQuota", []))

    @jsii.member(jsii_name="toUpdateMobileDeviceAccessRule")
    def to_update_mobile_device_access_rule(self) -> "Workmail":
        '''(experimental) Grants permission to update a mobile device access rule.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_UpdateMobileDeviceAccessRule.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toUpdateMobileDeviceAccessRule", []))

    @jsii.member(jsii_name="toUpdateOutboundMailFlowRule")
    def to_update_outbound_mail_flow_rule(self) -> "Workmail":
        '''(experimental) Grants permission to update the details of an outbound email flow rule which will apply to all email sent from an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/modify-email-flow-rule.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toUpdateOutboundMailFlowRule", []))

    @jsii.member(jsii_name="toUpdatePrimaryEmailAddress")
    def to_update_primary_email_address(self) -> "Workmail":
        '''(experimental) Grants permission to update the primary email for a user, group, or resource.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_UpdatePrimaryEmailAddress.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toUpdatePrimaryEmailAddress", []))

    @jsii.member(jsii_name="toUpdateResource")
    def to_update_resource(self) -> "Workmail":
        '''(experimental) Grants permission to update details for the resource.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_UpdateResource.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toUpdateResource", []))

    @jsii.member(jsii_name="toUpdateSmtpGateway")
    def to_update_smtp_gateway(self) -> "Workmail":
        '''(experimental) Grants permission to update the details of an existing SMTP gateway registered to an organization.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/smtp-gateway.html

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toUpdateSmtpGateway", []))

    @jsii.member(jsii_name="toWipeMobileDevice")
    def to_wipe_mobile_device(self) -> "Workmail":
        '''(experimental) Grants permission to remotely wipe the mobile device associated with a user's account.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/adminguide/manage-devices.html#remote_wipe_device

        :stability: experimental
        '''
        return typing.cast("Workmail", jsii.invoke(self, "toWipeMobileDevice", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fed7fbbfe829918736b7fd9413b5779162aae8c1b9ac35c5ca81a759fb1c1123)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1d42c4c0f91c02d417a641aa7b585bbcbd243688d4ace5164ddcac183cb0e2a7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Workmailmessageflow(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Workmailmessageflow",
):
    '''(experimental) Statement provider for service `workmailmessageflow <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkmailmessageflow.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `workmailmessageflow <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkmailmessageflow.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5f419e5570579f2336a43aff56617ce1c67d1387208e22c66c3f91710bf66922)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onRawMessage")
    def on_raw_message(
        self,
        organization_id: builtins.str,
        context: builtins.str,
        message_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Workmailmessageflow":
        '''(experimental) Adds a resource of type RawMessage to the statement.

        https://docs.aws.amazon.com/workmail/latest/adminguide/lambda-content.html

        :param organization_id: - Identifier for the organizationId.
        :param context: - Identifier for the context.
        :param message_id: - Identifier for the messageId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a5377ac5004a0ec1928dda5895b493a87d3981a4615661fd6e43ac07c4503332)
            check_type(argname="argument organization_id", value=organization_id, expected_type=type_hints["organization_id"])
            check_type(argname="argument context", value=context, expected_type=type_hints["context"])
            check_type(argname="argument message_id", value=message_id, expected_type=type_hints["message_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Workmailmessageflow", jsii.invoke(self, "onRawMessage", [organization_id, context, message_id, account, region, partition]))

    @jsii.member(jsii_name="toGetRawMessageContent")
    def to_get_raw_message_content(self) -> "Workmailmessageflow":
        '''(experimental) Grants permission to read the content of email messages with the specified message ID.

        Access Level: Read

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_messageflow_GetRawMessageContent.html

        :stability: experimental
        '''
        return typing.cast("Workmailmessageflow", jsii.invoke(self, "toGetRawMessageContent", []))

    @jsii.member(jsii_name="toPutRawMessageContent")
    def to_put_raw_message_content(self) -> "Workmailmessageflow":
        '''(experimental) Grants permission to update the content of email messages with the specified message ID.

        Access Level: Write

        https://docs.aws.amazon.com/workmail/latest/APIReference/API_messageflow_PutRawMessageContent.html

        :stability: experimental
        '''
        return typing.cast("Workmailmessageflow", jsii.invoke(self, "toPutRawMessageContent", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__600553d9f2d1bc06ca5a2bfda3feb16f6c28ed128b995a27e6f6b63a0ee7b326)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e653f65927e798df47dbda6edbcc000edf48f0e9247d45254fa41c512683cdd9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Workspaces(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Workspaces",
):
    '''(experimental) Statement provider for service `workspaces <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkspaces.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `workspaces <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkspaces.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d3092bddf277c4ce1e5019210245efe86f7f671b0081180431a5c5eb8d9520c6)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifUserId")
    def if_user_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Workspaces":
        '''(experimental) Filters access by the ID of the Workspaces user.

        https://docs.aws.amazon.com/workspaces/latest/adminguide/external-identity-providers-setting-up-saml.html#external-identity-providers-embed-inline-policy-for-IAM-role

        Applies to actions:

        - .toStream()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0a1cb19cb5982fb7ba873423644cfd189bfb46a922fcf81455b2cd202fd9f864)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Workspaces", jsii.invoke(self, "ifUserId", [value, operator]))

    @jsii.member(jsii_name="onConnectionalias")
    def on_connectionalias(
        self,
        connection_alias_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Workspaces":
        '''(experimental) Adds a resource of type connectionalias to the statement.

        https://docs.aws.amazon.com/workspaces/latest/adminguide/cross-region-redirection.html

        :param connection_alias_id: - Identifier for the connectionAliasId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8c239b8b66ce23532b77380172127b049311fd7e91746950e13a128e5e556343)
            check_type(argname="argument connection_alias_id", value=connection_alias_id, expected_type=type_hints["connection_alias_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Workspaces", jsii.invoke(self, "onConnectionalias", [connection_alias_id, account, region, partition]))

    @jsii.member(jsii_name="onDirectoryid")
    def on_directoryid(
        self,
        directory_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Workspaces":
        '''(experimental) Adds a resource of type directoryid to the statement.

        https://docs.aws.amazon.com/workspaces/latest/adminguide/manage-workspaces-directory.html

        :param directory_id: - Identifier for the directoryId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eeacec8522feb087ee5ce0a81c07bd985465f2d9440f168f5afb4375d437c70a)
            check_type(argname="argument directory_id", value=directory_id, expected_type=type_hints["directory_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Workspaces", jsii.invoke(self, "onDirectoryid", [directory_id, account, region, partition]))

    @jsii.member(jsii_name="onWorkspacebundle")
    def on_workspacebundle(
        self,
        bundle_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Workspaces":
        '''(experimental) Adds a resource of type workspacebundle to the statement.

        https://docs.aws.amazon.com/workspaces/latest/adminguide/bundles.html

        :param bundle_id: - Identifier for the bundleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__001ecb4097f183b0da634b4bb2791beabb2b3316babeced6c92546e667fa7875)
            check_type(argname="argument bundle_id", value=bundle_id, expected_type=type_hints["bundle_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Workspaces", jsii.invoke(self, "onWorkspacebundle", [bundle_id, account, region, partition]))

    @jsii.member(jsii_name="onWorkspaceid")
    def on_workspaceid(
        self,
        workspace_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Workspaces":
        '''(experimental) Adds a resource of type workspaceid to the statement.

        https://docs.aws.amazon.com/workspaces/latest/adminguide/wsp_workspace_management.html

        :param workspace_id: - Identifier for the workspaceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__490219130220c8f40a43a3a965b89430aadbf6bb254e36d7668e51d92c8f7b26)
            check_type(argname="argument workspace_id", value=workspace_id, expected_type=type_hints["workspace_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Workspaces", jsii.invoke(self, "onWorkspaceid", [workspace_id, account, region, partition]))

    @jsii.member(jsii_name="onWorkspaceimage")
    def on_workspaceimage(
        self,
        image_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Workspaces":
        '''(experimental) Adds a resource of type workspaceimage to the statement.

        https://docs.aws.amazon.com/workspaces/latest/adminguide/bundles.html

        :param image_id: - Identifier for the imageId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__faaca0941e0bab4aabb95742e3dda54ca4f0a373e0ec0d1a4e0484c573517930)
            check_type(argname="argument image_id", value=image_id, expected_type=type_hints["image_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Workspaces", jsii.invoke(self, "onWorkspaceimage", [image_id, account, region, partition]))

    @jsii.member(jsii_name="onWorkspaceipgroup")
    def on_workspaceipgroup(
        self,
        group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Workspaces":
        '''(experimental) Adds a resource of type workspaceipgroup to the statement.

        https://docs.aws.amazon.com/workspaces/latest/adminguide/amazon-workspaces-ip-access-control-groups.html

        :param group_id: - Identifier for the groupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ab78926810be37a4513457d1efdebc0138017dc95924a6d000a0286ff38aaf87)
            check_type(argname="argument group_id", value=group_id, expected_type=type_hints["group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Workspaces", jsii.invoke(self, "onWorkspaceipgroup", [group_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateConnectionAlias")
    def to_associate_connection_alias(self) -> "Workspaces":
        '''(experimental) Grants permission to associate connection aliases with directories.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_AssociateConnectionAlias.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toAssociateConnectionAlias", []))

    @jsii.member(jsii_name="toAssociateIpGroups")
    def to_associate_ip_groups(self) -> "Workspaces":
        '''(experimental) Grants permission to associate IP access control groups with directories.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_AssociateIpGroups.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toAssociateIpGroups", []))

    @jsii.member(jsii_name="toAuthorizeIpRules")
    def to_authorize_ip_rules(self) -> "Workspaces":
        '''(experimental) Grants permission to add rules to IP access control groups.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_AuthorizeIpRules.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toAuthorizeIpRules", []))

    @jsii.member(jsii_name="toCopyWorkspaceImage")
    def to_copy_workspace_image(self) -> "Workspaces":
        '''(experimental) Grants permission to copy a WorkSpace image.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - workspaces:DescribeWorkspaceImages

        https://docs.aws.amazon.com/workspaces/latest/api/API_CopyWorkspaceImage.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toCopyWorkspaceImage", []))

    @jsii.member(jsii_name="toCreateConnectClientAddIn")
    def to_create_connect_client_add_in(self) -> "Workspaces":
        '''(experimental) Grants permission to create an Amazon Connect client add-in within a directory.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_CreateConnectClientAddIn.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toCreateConnectClientAddIn", []))

    @jsii.member(jsii_name="toCreateConnectionAlias")
    def to_create_connection_alias(self) -> "Workspaces":
        '''(experimental) Grants permission to create connection aliases for use with cross-Region redirection.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/workspaces/latest/api/API_CreateConnectionAlias.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toCreateConnectionAlias", []))

    @jsii.member(jsii_name="toCreateIpGroup")
    def to_create_ip_group(self) -> "Workspaces":
        '''(experimental) Grants permission to create IP access control groups.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/workspaces/latest/api/API_CreateIpGroup.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toCreateIpGroup", []))

    @jsii.member(jsii_name="toCreateStandbyWorkspaces")
    def to_create_standby_workspaces(self) -> "Workspaces":
        '''(experimental) Grants permission to create one or more Standby WorkSpaces.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/workspaces/latest/api/API_CreateStandbyWorkspaces.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toCreateStandbyWorkspaces", []))

    @jsii.member(jsii_name="toCreateTags")
    def to_create_tags(self) -> "Workspaces":
        '''(experimental) Grants permission to create tags for WorkSpaces resources.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/workspaces/latest/api/API_CreateTags.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toCreateTags", []))

    @jsii.member(jsii_name="toCreateUpdatedWorkspaceImage")
    def to_create_updated_workspace_image(self) -> "Workspaces":
        '''(experimental) Grants permission to create an updated WorkSpace image.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/workspaces/latest/api/API_CreateUpdatedWorkspaceImage.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toCreateUpdatedWorkspaceImage", []))

    @jsii.member(jsii_name="toCreateWorkspaceBundle")
    def to_create_workspace_bundle(self) -> "Workspaces":
        '''(experimental) Grants permission to create a WorkSpace bundle.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - workspaces:CreateTags

        https://docs.aws.amazon.com/workspaces/latest/api/API_CreateWorkspaceBundle.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toCreateWorkspaceBundle", []))

    @jsii.member(jsii_name="toCreateWorkspaceImage")
    def to_create_workspace_image(self) -> "Workspaces":
        '''(experimental) Grants permission to create a new WorkSpace image.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/workspaces/latest/api/API_CreateWorkspaceImage.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toCreateWorkspaceImage", []))

    @jsii.member(jsii_name="toCreateWorkspaces")
    def to_create_workspaces(self) -> "Workspaces":
        '''(experimental) Grants permission to create one or more WorkSpaces.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/workspaces/latest/api/API_CreateWorkspaces.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toCreateWorkspaces", []))

    @jsii.member(jsii_name="toDeleteClientBranding")
    def to_delete_client_branding(self) -> "Workspaces":
        '''(experimental) Grants permission to delete AWS WorkSpaces Client branding data within a directory.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_DeleteClientBranding.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDeleteClientBranding", []))

    @jsii.member(jsii_name="toDeleteConnectClientAddIn")
    def to_delete_connect_client_add_in(self) -> "Workspaces":
        '''(experimental) Grants permission to delete an Amazon Connect client add-in that is configured within a directory.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_DeleteConnectClientAddIn.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDeleteConnectClientAddIn", []))

    @jsii.member(jsii_name="toDeleteConnectionAlias")
    def to_delete_connection_alias(self) -> "Workspaces":
        '''(experimental) Grants permission to delete connection aliases.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_DeleteConnectionAlias.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDeleteConnectionAlias", []))

    @jsii.member(jsii_name="toDeleteIpGroup")
    def to_delete_ip_group(self) -> "Workspaces":
        '''(experimental) Grants permission to delete IP access control groups.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_DeleteIpGroup.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDeleteIpGroup", []))

    @jsii.member(jsii_name="toDeleteTags")
    def to_delete_tags(self) -> "Workspaces":
        '''(experimental) Grants permission to delete tags from WorkSpaces resources.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/workspaces/latest/api/API_DeleteTags.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDeleteTags", []))

    @jsii.member(jsii_name="toDeleteWorkspaceBundle")
    def to_delete_workspace_bundle(self) -> "Workspaces":
        '''(experimental) Grants permission to delete WorkSpace bundles.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_DeleteWorkspaceBundle.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDeleteWorkspaceBundle", []))

    @jsii.member(jsii_name="toDeleteWorkspaceImage")
    def to_delete_workspace_image(self) -> "Workspaces":
        '''(experimental) Grants permission to delete WorkSpace images.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_DeleteWorkspaceImage.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDeleteWorkspaceImage", []))

    @jsii.member(jsii_name="toDeregisterWorkspaceDirectory")
    def to_deregister_workspace_directory(self) -> "Workspaces":
        '''(experimental) Grants permission to deregister directories from use with Amazon WorkSpaces.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_DeregisterWorkspaceDirectory.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDeregisterWorkspaceDirectory", []))

    @jsii.member(jsii_name="toDescribeAccount")
    def to_describe_account(self) -> "Workspaces":
        '''(experimental) Grants permission to retrieve the configuration of Bring Your Own License (BYOL) for WorkSpaces accounts.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeAccount.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeAccount", []))

    @jsii.member(jsii_name="toDescribeAccountModifications")
    def to_describe_account_modifications(self) -> "Workspaces":
        '''(experimental) Grants permission to retrieve modifications to the configuration of Bring Your Own License (BYOL) for WorkSpaces accounts.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeAccountModifications.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeAccountModifications", []))

    @jsii.member(jsii_name="toDescribeClientBranding")
    def to_describe_client_branding(self) -> "Workspaces":
        '''(experimental) Grants permission to retrieve AWS WorkSpaces Client branding data within a directory.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeClientBranding.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeClientBranding", []))

    @jsii.member(jsii_name="toDescribeClientProperties")
    def to_describe_client_properties(self) -> "Workspaces":
        '''(experimental) Grants permission to retrieve information about WorkSpaces clients.

        Access Level: List

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeClientProperties.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeClientProperties", []))

    @jsii.member(jsii_name="toDescribeConnectClientAddIns")
    def to_describe_connect_client_add_ins(self) -> "Workspaces":
        '''(experimental) Grants permission to retrieve a list of Amazon Connect client add-ins that have been created.

        Access Level: List

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeConnectClientAddIns.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeConnectClientAddIns", []))

    @jsii.member(jsii_name="toDescribeConnectionAliases")
    def to_describe_connection_aliases(self) -> "Workspaces":
        '''(experimental) Grants permission to retrieve a list that describes the connection aliases used for cross-Region redirection.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeConnectionAliases.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeConnectionAliases", []))

    @jsii.member(jsii_name="toDescribeConnectionAliasPermissions")
    def to_describe_connection_alias_permissions(self) -> "Workspaces":
        '''(experimental) Grants permission to retrieve the permissions that the owners of connection aliases have granted to other AWS accounts for connection aliases.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeConnectionAliasPermissions.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeConnectionAliasPermissions", []))

    @jsii.member(jsii_name="toDescribeIpGroups")
    def to_describe_ip_groups(self) -> "Workspaces":
        '''(experimental) Grants permission to retrieve information about IP access control groups.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeIpGroups.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeIpGroups", []))

    @jsii.member(jsii_name="toDescribeTags")
    def to_describe_tags(self) -> "Workspaces":
        '''(experimental) Grants permission to describe the tags for WorkSpaces resources.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeTags.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeTags", []))

    @jsii.member(jsii_name="toDescribeWorkspaceBundles")
    def to_describe_workspace_bundles(self) -> "Workspaces":
        '''(experimental) Grants permission to obtain information about WorkSpace bundles.

        Access Level: List

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeWorkspaceBundles.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeWorkspaceBundles", []))

    @jsii.member(jsii_name="toDescribeWorkspaceDirectories")
    def to_describe_workspace_directories(self) -> "Workspaces":
        '''(experimental) Grants permission to retrieve information about directories that are registered with WorkSpaces.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeWorkspaceDirectories.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeWorkspaceDirectories", []))

    @jsii.member(jsii_name="toDescribeWorkspaceImagePermissions")
    def to_describe_workspace_image_permissions(self) -> "Workspaces":
        '''(experimental) Grants permission to retrieve information about WorkSpace image permissions.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeWorkspaceImagePermissions.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeWorkspaceImagePermissions", []))

    @jsii.member(jsii_name="toDescribeWorkspaceImages")
    def to_describe_workspace_images(self) -> "Workspaces":
        '''(experimental) Grants permission to retrieve information about WorkSpace images.

        Access Level: List

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeWorkspaceImages.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeWorkspaceImages", []))

    @jsii.member(jsii_name="toDescribeWorkspaces")
    def to_describe_workspaces(self) -> "Workspaces":
        '''(experimental) Grants permission to obtain information about WorkSpaces.

        Access Level: List

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeWorkspaces.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeWorkspaces", []))

    @jsii.member(jsii_name="toDescribeWorkspacesConnectionStatus")
    def to_describe_workspaces_connection_status(self) -> "Workspaces":
        '''(experimental) Grants permission to obtain the connection status of WorkSpaces.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeWorkspacesConnectionStatus.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeWorkspacesConnectionStatus", []))

    @jsii.member(jsii_name="toDescribeWorkspaceSnapshots")
    def to_describe_workspace_snapshots(self) -> "Workspaces":
        '''(experimental) Grants permission to retrieve information about WorkSpace snapshots.

        Access Level: List

        https://docs.aws.amazon.com/workspaces/latest/api/API_DescribeWorkspaceSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDescribeWorkspaceSnapshots", []))

    @jsii.member(jsii_name="toDisassociateConnectionAlias")
    def to_disassociate_connection_alias(self) -> "Workspaces":
        '''(experimental) Grants permission to disassociate connection aliases from directories.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_DisassociateConnectionAlias.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDisassociateConnectionAlias", []))

    @jsii.member(jsii_name="toDisassociateIpGroups")
    def to_disassociate_ip_groups(self) -> "Workspaces":
        '''(experimental) Grants permission to disassociate IP access control groups from directories.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_DisassociateIpGroups.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toDisassociateIpGroups", []))

    @jsii.member(jsii_name="toImportClientBranding")
    def to_import_client_branding(self) -> "Workspaces":
        '''(experimental) Grants permission to import AWS WorkSpaces Client branding data within a directory.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_ImportClientBranding.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toImportClientBranding", []))

    @jsii.member(jsii_name="toImportWorkspaceImage")
    def to_import_workspace_image(self) -> "Workspaces":
        '''(experimental) Grants permission to import Bring Your Own License (BYOL) images into Amazon WorkSpaces.

        Access Level: Write

        Dependent actions:

        - ec2:DescribeImages
        - ec2:ModifyImageAttribute

        https://docs.aws.amazon.com/workspaces/latest/api/API_ImportWorkspaceImage.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toImportWorkspaceImage", []))

    @jsii.member(jsii_name="toListAvailableManagementCidrRanges")
    def to_list_available_management_cidr_ranges(self) -> "Workspaces":
        '''(experimental) Grants permission to list the available CIDR ranges for enabling Bring Your Own License (BYOL) for WorkSpaces accounts.

        Access Level: List

        https://docs.aws.amazon.com/workspaces/latest/api/API_ListAvailableManagementCidrRanges.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toListAvailableManagementCidrRanges", []))

    @jsii.member(jsii_name="toMigrateWorkspace")
    def to_migrate_workspace(self) -> "Workspaces":
        '''(experimental) Grants permission to migrate WorkSpaces.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_MigrateWorkspace.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toMigrateWorkspace", []))

    @jsii.member(jsii_name="toModifyAccount")
    def to_modify_account(self) -> "Workspaces":
        '''(experimental) Grants permission to modify the configuration of Bring Your Own License (BYOL) for WorkSpaces accounts.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_ModifyAccount.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toModifyAccount", []))

    @jsii.member(jsii_name="toModifyCertificateBasedAuthProperties")
    def to_modify_certificate_based_auth_properties(self) -> "Workspaces":
        '''(experimental) Grants permission to modify the certificate-based authorization properties of a directory.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_ModifyCertificateBasedAuthProperties.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toModifyCertificateBasedAuthProperties", []))

    @jsii.member(jsii_name="toModifyClientProperties")
    def to_modify_client_properties(self) -> "Workspaces":
        '''(experimental) Grants permission to modify the properties of WorkSpaces clients.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_ModifyClientProperties.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toModifyClientProperties", []))

    @jsii.member(jsii_name="toModifySamlProperties")
    def to_modify_saml_properties(self) -> "Workspaces":
        '''(experimental) Grants permission to modify the SAML properties of a directory.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_ModifySamlProperties.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toModifySamlProperties", []))

    @jsii.member(jsii_name="toModifySelfservicePermissions")
    def to_modify_selfservice_permissions(self) -> "Workspaces":
        '''(experimental) Grants permission to modify the self-service WorkSpace management capabilities for your users.

        Access Level: Permissions management

        https://docs.aws.amazon.com/workspaces/latest/api/API_ModifySelfservicePermissions.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toModifySelfservicePermissions", []))

    @jsii.member(jsii_name="toModifyWorkspaceAccessProperties")
    def to_modify_workspace_access_properties(self) -> "Workspaces":
        '''(experimental) Grants permission to specify which devices and operating systems users can use to access their WorkSpaces.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_ModifyWorkspaceAccessProperties.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toModifyWorkspaceAccessProperties", []))

    @jsii.member(jsii_name="toModifyWorkspaceCreationProperties")
    def to_modify_workspace_creation_properties(self) -> "Workspaces":
        '''(experimental) Grants permission to modify the default properties used to create WorkSpaces.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_ModifyWorkspaceCreationProperties.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toModifyWorkspaceCreationProperties", []))

    @jsii.member(jsii_name="toModifyWorkspaceProperties")
    def to_modify_workspace_properties(self) -> "Workspaces":
        '''(experimental) Grants permission to modify WorkSpace properties, including the running mode and the AutoStop period.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_ModifyWorkspaceProperties.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toModifyWorkspaceProperties", []))

    @jsii.member(jsii_name="toModifyWorkspaceState")
    def to_modify_workspace_state(self) -> "Workspaces":
        '''(experimental) Grants permission to modify the state of WorkSpaces.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_ModifyWorkspaceState.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toModifyWorkspaceState", []))

    @jsii.member(jsii_name="toRebootWorkspaces")
    def to_reboot_workspaces(self) -> "Workspaces":
        '''(experimental) Grants permission to reboot WorkSpaces.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_RebootWorkspaces.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toRebootWorkspaces", []))

    @jsii.member(jsii_name="toRebuildWorkspaces")
    def to_rebuild_workspaces(self) -> "Workspaces":
        '''(experimental) Grants permission to rebuild WorkSpaces.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_RebuildWorkspaces.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toRebuildWorkspaces", []))

    @jsii.member(jsii_name="toRegisterWorkspaceDirectory")
    def to_register_workspace_directory(self) -> "Workspaces":
        '''(experimental) Grants permission to register directories for use with Amazon WorkSpaces.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/workspaces/latest/api/API_RegisterWorkspaceDirectory.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toRegisterWorkspaceDirectory", []))

    @jsii.member(jsii_name="toRestoreWorkspace")
    def to_restore_workspace(self) -> "Workspaces":
        '''(experimental) Grants permission to restore WorkSpaces.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_RestoreWorkspace.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toRestoreWorkspace", []))

    @jsii.member(jsii_name="toRevokeIpRules")
    def to_revoke_ip_rules(self) -> "Workspaces":
        '''(experimental) Grants permission to remove rules from IP access control groups.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_RevokeIpRules.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toRevokeIpRules", []))

    @jsii.member(jsii_name="toStartWorkspaces")
    def to_start_workspaces(self) -> "Workspaces":
        '''(experimental) Grants permission to start AutoStop WorkSpaces.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_StartWorkspaces.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toStartWorkspaces", []))

    @jsii.member(jsii_name="toStopWorkspaces")
    def to_stop_workspaces(self) -> "Workspaces":
        '''(experimental) Grants permission to stop AutoStop WorkSpaces.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_StopWorkspaces.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toStopWorkspaces", []))

    @jsii.member(jsii_name="toStream")
    def to_stream(self) -> "Workspaces":
        '''(experimental) Grants permission to federated users to sign in by using their existing credentials and stream their workspace.

        Access Level: Write

        Possible conditions:

        - .ifUserId()

        https://docs.aws.amazon.com/workspaces/latest/api/API_Stream.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toStream", []))

    @jsii.member(jsii_name="toTerminateWorkspaces")
    def to_terminate_workspaces(self) -> "Workspaces":
        '''(experimental) Grants permission to terminate WorkSpaces.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_TerminateWorkspaces.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toTerminateWorkspaces", []))

    @jsii.member(jsii_name="toUpdateConnectClientAddIn")
    def to_update_connect_client_add_in(self) -> "Workspaces":
        '''(experimental) Grants permission to update an Amazon Connect client add-in.

        Use this action to update the name and endpoint URL of an Amazon Connect client add-in

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_UpdateConnectClientAddIn.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toUpdateConnectClientAddIn", []))

    @jsii.member(jsii_name="toUpdateConnectionAliasPermission")
    def to_update_connection_alias_permission(self) -> "Workspaces":
        '''(experimental) Grants permission to share or unshare connection aliases with other accounts.

        Access Level: Permissions management

        https://docs.aws.amazon.com/workspaces/latest/api/API_UpdateConnectionAliasPermission.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toUpdateConnectionAliasPermission", []))

    @jsii.member(jsii_name="toUpdateRulesOfIpGroup")
    def to_update_rules_of_ip_group(self) -> "Workspaces":
        '''(experimental) Grants permission to replace rules for IP access control groups.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_UpdateRulesOfIpGroup.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toUpdateRulesOfIpGroup", []))

    @jsii.member(jsii_name="toUpdateWorkspaceBundle")
    def to_update_workspace_bundle(self) -> "Workspaces":
        '''(experimental) Grants permission to update the WorkSpace images used in WorkSpace bundles.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces/latest/api/API_UpdateWorkspaceBundle.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toUpdateWorkspaceBundle", []))

    @jsii.member(jsii_name="toUpdateWorkspaceImagePermission")
    def to_update_workspace_image_permission(self) -> "Workspaces":
        '''(experimental) Grants permission to share or unshare WorkSpace images with other accounts by specifying whether other accounts have permission to copy the image.

        Access Level: Permissions management

        https://docs.aws.amazon.com/workspaces/latest/api/API_UpdateWorkspaceImagePermission.html

        :stability: experimental
        '''
        return typing.cast("Workspaces", jsii.invoke(self, "toUpdateWorkspaceImagePermission", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__76d4929de6e689ae653bea2ded8a4ead4dbb6aca114c501f7eb1ba74af670f2b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__99e44628ae06653b277050ecb65f2c8f914e88e60b1afb08fa91276019f58aba)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class WorkspacesWeb(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.WorkspacesWeb",
):
    '''(experimental) Statement provider for service `workspaces-web <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkspacesweb.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `workspaces-web <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonworkspacesweb.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__efc186d55691f743ef561bf1fe3bca6cfe40b9755bfa98a33b09ef656307d020)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onBrowserSettings")
    def on_browser_settings(
        self,
        browser_settings_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WorkspacesWeb":
        '''(experimental) Adds a resource of type browserSettings to the statement.

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateBrowserSettings.html

        :param browser_settings_id: - Identifier for the browserSettingsId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__59e5b31136ff23090fb8c3fec04e4ef6b455e1e771e99995e32330357cd76eb4)
            check_type(argname="argument browser_settings_id", value=browser_settings_id, expected_type=type_hints["browser_settings_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "onBrowserSettings", [browser_settings_id, account, region, partition]))

    @jsii.member(jsii_name="onNetworkSettings")
    def on_network_settings(
        self,
        network_settings_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WorkspacesWeb":
        '''(experimental) Adds a resource of type networkSettings to the statement.

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateNetworkSettings.html

        :param network_settings_id: - Identifier for the networkSettingsId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7f2c39661f2548646dbfccf634d235b3bebbcc2710e3ad347848656caa83ff56)
            check_type(argname="argument network_settings_id", value=network_settings_id, expected_type=type_hints["network_settings_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "onNetworkSettings", [network_settings_id, account, region, partition]))

    @jsii.member(jsii_name="onPortal")
    def on_portal(
        self,
        portal_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WorkspacesWeb":
        '''(experimental) Adds a resource of type portal to the statement.

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreatePortal.html

        :param portal_id: - Identifier for the portalId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__503d724463b57ab890d71ce0795fe24d600c28ca00124c1a6485a13767fb5caa)
            check_type(argname="argument portal_id", value=portal_id, expected_type=type_hints["portal_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "onPortal", [portal_id, account, region, partition]))

    @jsii.member(jsii_name="onTrustStore")
    def on_trust_store(
        self,
        trust_store_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WorkspacesWeb":
        '''(experimental) Adds a resource of type trustStore to the statement.

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateTrustStore.html

        :param trust_store_id: - Identifier for the trustStoreId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__48e7f7a4dc6b183222f9be13688fb8ea3b6236c3521f7beed977b27e3d82ba88)
            check_type(argname="argument trust_store_id", value=trust_store_id, expected_type=type_hints["trust_store_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "onTrustStore", [trust_store_id, account, region, partition]))

    @jsii.member(jsii_name="onUserAccessLoggingSettings")
    def on_user_access_logging_settings(
        self,
        user_access_logging_settings_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WorkspacesWeb":
        '''(experimental) Adds a resource of type userAccessLoggingSettings to the statement.

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateUserAccessLoggingSettings.html

        :param user_access_logging_settings_id: - Identifier for the userAccessLoggingSettingsId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6de53e259cfc1abae9f35abf83edaa467436ce5a6565037cf1d5af3583c50d36)
            check_type(argname="argument user_access_logging_settings_id", value=user_access_logging_settings_id, expected_type=type_hints["user_access_logging_settings_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "onUserAccessLoggingSettings", [user_access_logging_settings_id, account, region, partition]))

    @jsii.member(jsii_name="onUserSettings")
    def on_user_settings(
        self,
        user_settings_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "WorkspacesWeb":
        '''(experimental) Adds a resource of type userSettings to the statement.

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateUserSettings.html

        :param user_settings_id: - Identifier for the userSettingsId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9fe894044ad917a7abba8a7cb50a08931e32b520918c968814c8f4789e3f912e)
            check_type(argname="argument user_settings_id", value=user_settings_id, expected_type=type_hints["user_settings_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "onUserSettings", [user_settings_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateBrowserSettings")
    def to_associate_browser_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to associate browser settings to web portals.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_AssociateBrowserSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toAssociateBrowserSettings", []))

    @jsii.member(jsii_name="toAssociateNetworkSettings")
    def to_associate_network_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to associate network settings to web portals.

        Access Level: Write

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:CreateNetworkInterfacePermission
        - ec2:CreateTags
        - ec2:DeleteNetworkInterface
        - ec2:DeleteNetworkInterfacePermission
        - ec2:ModifyNetworkInterfaceAttribute

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_AssociateNetworkSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toAssociateNetworkSettings", []))

    @jsii.member(jsii_name="toAssociateTrustStore")
    def to_associate_trust_store(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to associate trust stores with web portals.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_AssociateTrustStore.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toAssociateTrustStore", []))

    @jsii.member(jsii_name="toAssociateUserAccessLoggingSettings")
    def to_associate_user_access_logging_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to associate user access logging settings with web portals.

        Access Level: Write

        Dependent actions:

        - kinesis:PutRecord
        - kinesis:PutRecords

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_AssociateUserAccessLoggingSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toAssociateUserAccessLoggingSettings", []))

    @jsii.member(jsii_name="toAssociateUserSettings")
    def to_associate_user_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to associate user settings with web portals.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_AssociateUserSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toAssociateUserSettings", []))

    @jsii.member(jsii_name="toCreateBrowserSettings")
    def to_create_browser_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to create browser settings.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - kms:CreateGrant
        - kms:Decrypt
        - kms:DescribeKey
        - kms:GenerateDataKey

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateBrowserSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toCreateBrowserSettings", []))

    @jsii.member(jsii_name="toCreateIdentityProvider")
    def to_create_identity_provider(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to create identity providers.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateIdentityProvider.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toCreateIdentityProvider", []))

    @jsii.member(jsii_name="toCreateNetworkSettings")
    def to_create_network_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to create network settings.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateNetworkSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toCreateNetworkSettings", []))

    @jsii.member(jsii_name="toCreatePortal")
    def to_create_portal(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to create web portals.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - kms:CreateGrant
        - kms:Decrypt
        - kms:DescribeKey
        - kms:GenerateDataKey

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreatePortal.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toCreatePortal", []))

    @jsii.member(jsii_name="toCreateTrustStore")
    def to_create_trust_store(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to create trust stores.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateTrustStore.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toCreateTrustStore", []))

    @jsii.member(jsii_name="toCreateUserAccessLoggingSettings")
    def to_create_user_access_logging_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to create user access logging settings.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateUserAccessLoggingSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toCreateUserAccessLoggingSettings", []))

    @jsii.member(jsii_name="toCreateUserSettings")
    def to_create_user_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to create user settings.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateUserSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toCreateUserSettings", []))

    @jsii.member(jsii_name="toDeleteBrowserSettings")
    def to_delete_browser_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to delete browser settings.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DeleteBrowserSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toDeleteBrowserSettings", []))

    @jsii.member(jsii_name="toDeleteIdentityProvider")
    def to_delete_identity_provider(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to delete identity providers.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DeleteIdentityProvider.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toDeleteIdentityProvider", []))

    @jsii.member(jsii_name="toDeleteNetworkSettings")
    def to_delete_network_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to delete network settings.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DeleteNetworkSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toDeleteNetworkSettings", []))

    @jsii.member(jsii_name="toDeletePortal")
    def to_delete_portal(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to delete web portals.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DeletePortal.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toDeletePortal", []))

    @jsii.member(jsii_name="toDeleteTrustStore")
    def to_delete_trust_store(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to delete trust stores.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DeleteTrustStore.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toDeleteTrustStore", []))

    @jsii.member(jsii_name="toDeleteUserAccessLoggingSettings")
    def to_delete_user_access_logging_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to delete user access logging settings.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DeleteUserAccessLoggingSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toDeleteUserAccessLoggingSettings", []))

    @jsii.member(jsii_name="toDeleteUserSettings")
    def to_delete_user_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to delete user settings.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DeleteUserSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toDeleteUserSettings", []))

    @jsii.member(jsii_name="toDisassociateBrowserSettings")
    def to_disassociate_browser_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to disassociate browser settings from web portals.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DisassociateBrowserSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toDisassociateBrowserSettings", []))

    @jsii.member(jsii_name="toDisassociateNetworkSettings")
    def to_disassociate_network_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to disassociate network settings from web portals.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DisassociateNetworkSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toDisassociateNetworkSettings", []))

    @jsii.member(jsii_name="toDisassociateTrustStore")
    def to_disassociate_trust_store(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to disassociate trust stores from web portals.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DisassociateTrustStore.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toDisassociateTrustStore", []))

    @jsii.member(jsii_name="toDisassociateUserAccessLoggingSettings")
    def to_disassociate_user_access_logging_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to disassociate user access logging settings from web portals.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DisassociateUserAccessLoggingSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toDisassociateUserAccessLoggingSettings", []))

    @jsii.member(jsii_name="toDisassociateUserSettings")
    def to_disassociate_user_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to disassociate user settings from web portals.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DisassociateUserSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toDisassociateUserSettings", []))

    @jsii.member(jsii_name="toGetBrowserSettings")
    def to_get_browser_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to get details on browser settings.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetBrowserSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toGetBrowserSettings", []))

    @jsii.member(jsii_name="toGetIdentityProvider")
    def to_get_identity_provider(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to get details on identity providers.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetIdentityProvider.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toGetIdentityProvider", []))

    @jsii.member(jsii_name="toGetNetworkSettings")
    def to_get_network_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to get details on network settings.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetNetworkSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toGetNetworkSettings", []))

    @jsii.member(jsii_name="toGetPortal")
    def to_get_portal(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to get details on web portals.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetPortal.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toGetPortal", []))

    @jsii.member(jsii_name="toGetPortalServiceProviderMetadata")
    def to_get_portal_service_provider_metadata(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to get service provider metadata information for web portals.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetPortalServiceProviderMetadata.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toGetPortalServiceProviderMetadata", []))

    @jsii.member(jsii_name="toGetTrustStore")
    def to_get_trust_store(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to get details on trust stores.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetTrustStore.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toGetTrustStore", []))

    @jsii.member(jsii_name="toGetTrustStoreCertificate")
    def to_get_trust_store_certificate(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to get certificates from trust stores.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetTrustStoreCertificate.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toGetTrustStoreCertificate", []))

    @jsii.member(jsii_name="toGetUserAccessLoggingSettings")
    def to_get_user_access_logging_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to get details on user access logging settings.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetUserAccessLoggingSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toGetUserAccessLoggingSettings", []))

    @jsii.member(jsii_name="toGetUserSettings")
    def to_get_user_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to get details on user settings.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetUserSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toGetUserSettings", []))

    @jsii.member(jsii_name="toListBrowserSettings")
    def to_list_browser_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to list browser settings.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListBrowserSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toListBrowserSettings", []))

    @jsii.member(jsii_name="toListIdentityProviders")
    def to_list_identity_providers(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to list identity providers.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListIdentityProviders.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toListIdentityProviders", []))

    @jsii.member(jsii_name="toListNetworkSettings")
    def to_list_network_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to list network settings.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListNetworkSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toListNetworkSettings", []))

    @jsii.member(jsii_name="toListPortals")
    def to_list_portals(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to list web portals.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListPortals.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toListPortals", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTrustStoreCertificates")
    def to_list_trust_store_certificates(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to list certificates in a trust store.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListTrustStoreCertificates.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toListTrustStoreCertificates", []))

    @jsii.member(jsii_name="toListTrustStores")
    def to_list_trust_stores(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to list trust stores.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListTrustStores.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toListTrustStores", []))

    @jsii.member(jsii_name="toListUserAccessLoggingSettings")
    def to_list_user_access_logging_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to list user access logging settings.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListUserAccessLoggingSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toListUserAccessLoggingSettings", []))

    @jsii.member(jsii_name="toListUserSettings")
    def to_list_user_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to list user settings.

        Access Level: Read

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListUserSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toListUserSettings", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to add one or more tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to remove one or more tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateBrowserSettings")
    def to_update_browser_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to update browser settings.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_UpdateBrowserSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toUpdateBrowserSettings", []))

    @jsii.member(jsii_name="toUpdateIdentityProvider")
    def to_update_identity_provider(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to update identity provider.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_UpdateIdentityProvider.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toUpdateIdentityProvider", []))

    @jsii.member(jsii_name="toUpdateNetworkSettings")
    def to_update_network_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to update network settings.

        Access Level: Write

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:CreateNetworkInterfacePermission
        - ec2:CreateTags
        - ec2:DeleteNetworkInterface
        - ec2:DeleteNetworkInterfacePermission
        - ec2:ModifyNetworkInterfaceAttribute

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_UpdateNetworkSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toUpdateNetworkSettings", []))

    @jsii.member(jsii_name="toUpdatePortal")
    def to_update_portal(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to update web portals.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_UpdatePortal.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toUpdatePortal", []))

    @jsii.member(jsii_name="toUpdateTrustStore")
    def to_update_trust_store(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to update trust stores.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_UpdateTrustStore.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toUpdateTrustStore", []))

    @jsii.member(jsii_name="toUpdateUserAccessLoggingSettings")
    def to_update_user_access_logging_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to update user access logging settings.

        Access Level: Write

        Dependent actions:

        - kinesis:PutRecord
        - kinesis:PutRecords

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_UpdateUserAccessLoggingSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toUpdateUserAccessLoggingSettings", []))

    @jsii.member(jsii_name="toUpdateUserSettings")
    def to_update_user_settings(self) -> "WorkspacesWeb":
        '''(experimental) Grants permission to update user settings.

        Access Level: Write

        https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_UpdateUserSettings.html

        :stability: experimental
        '''
        return typing.cast("WorkspacesWeb", jsii.invoke(self, "toUpdateUserSettings", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__001770afb7e25007c66ecac23721c3dfcbc912e5c249e48fc5bf8fb605c1a5d1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__08fd0892d016f715141ce6fca0c1af7d5ba458df7f498db9bd2335e9855f5f0f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Xray(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Xray"):
    '''(experimental) Statement provider for service `xray <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `xray <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsx-ray.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e35d4a170f92992b1c7debc55baface5da8b4f4f1dc78d80f0691effaea13243)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onGroup")
    def on_group(
        self,
        group_name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Xray":
        '''(experimental) Adds a resource of type group to the statement.

        https://docs.aws.amazon.com/xray/latest/devguide/xray-concepts.html#xray-concepts-groups

        :param group_name: - Identifier for the groupName.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f23330e5ad1dcaed183f36f6dd17cabdfcaa1309014a30aa2b6f49839eb9f2b1)
            check_type(argname="argument group_name", value=group_name, expected_type=type_hints["group_name"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Xray", jsii.invoke(self, "onGroup", [group_name, id, account, region, partition]))

    @jsii.member(jsii_name="onSamplingRule")
    def on_sampling_rule(
        self,
        sampling_rule_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Xray":
        '''(experimental) Adds a resource of type sampling-rule to the statement.

        https://docs.aws.amazon.com/xray/latest/devguide/xray-concepts.html#xray-concepts-sampling

        :param sampling_rule_name: - Identifier for the samplingRuleName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4cf9f9da6ad703803a1bac604c6a365ac35c4da7c48082682348d5d2ad4399b5)
            check_type(argname="argument sampling_rule_name", value=sampling_rule_name, expected_type=type_hints["sampling_rule_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Xray", jsii.invoke(self, "onSamplingRule", [sampling_rule_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchGetTraces")
    def to_batch_get_traces(self) -> "Xray":
        '''(experimental) Grants permission to retrieve a list of traces specified by ID.

        Each trace is a collection of segment documents that originates from a single request. Use GetTraceSummaries to get a list of trace IDs

        Access Level: List

        https://docs.aws.amazon.com/xray/latest/api/API_BatchGetTraces.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toBatchGetTraces", []))

    @jsii.member(jsii_name="toBatchGetTraceSummaryById")
    def to_batch_get_trace_summary_by_id(self) -> "Xray":
        '''(experimental) Grants permission to retrieve metadata for a list of traces specified by ID.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-console

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toBatchGetTraceSummaryById", []))

    @jsii.member(jsii_name="toCreateGroup")
    def to_create_group(self) -> "Xray":
        '''(experimental) Grants permission to create a group resource with a name and a filter expression.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/xray/latest/api/API_CreateGroup.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toCreateGroup", []))

    @jsii.member(jsii_name="toCreateSamplingRule")
    def to_create_sampling_rule(self) -> "Xray":
        '''(experimental) Grants permission to create a rule to control sampling behavior for instrumented applications.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/xray/latest/api/API_CreateSamplingRule.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toCreateSamplingRule", []))

    @jsii.member(jsii_name="toDeleteGroup")
    def to_delete_group(self) -> "Xray":
        '''(experimental) Grants permission to delete a group resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/xray/latest/api/API_DeleteGroup.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toDeleteGroup", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "Xray":
        '''(experimental) Grants permission to delete resource policies.

        Access Level: Write

        https://docs.aws.amazon.com/xray/latest/api/API_DeleteResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteSamplingRule")
    def to_delete_sampling_rule(self) -> "Xray":
        '''(experimental) Grants permission to delete a sampling rule.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/xray/latest/api/API_DeleteSamplingRule.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toDeleteSamplingRule", []))

    @jsii.member(jsii_name="toGetDistinctTraceGraphs")
    def to_get_distinct_trace_graphs(self) -> "Xray":
        '''(experimental) Grants permission to retrieve distinct service graphs for one or more specific trace IDs.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.html#security_iam_id-based-policy-examples-console

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetDistinctTraceGraphs", []))

    @jsii.member(jsii_name="toGetEncryptionConfig")
    def to_get_encryption_config(self) -> "Xray":
        '''(experimental) Grants permission to retrieve the current encryption configuration for X-Ray data.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetEncryptionConfig.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetEncryptionConfig", []))

    @jsii.member(jsii_name="toGetGroup")
    def to_get_group(self) -> "Xray":
        '''(experimental) Grants permission to retrieve group resource details.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/xray/latest/api/API_GetGroup.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetGroup", []))

    @jsii.member(jsii_name="toGetGroups")
    def to_get_groups(self) -> "Xray":
        '''(experimental) Grants permission to retrieve all active group details.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetGroups.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetGroups", []))

    @jsii.member(jsii_name="toGetInsight")
    def to_get_insight(self) -> "Xray":
        '''(experimental) Grants permission to retrieve the details of a specific insight.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetInsight.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetInsight", []))

    @jsii.member(jsii_name="toGetInsightEvents")
    def to_get_insight_events(self) -> "Xray":
        '''(experimental) Grants permission to retrieve the events of a specific insight.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetInsightEvents.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetInsightEvents", []))

    @jsii.member(jsii_name="toGetInsightImpactGraph")
    def to_get_insight_impact_graph(self) -> "Xray":
        '''(experimental) Grants permission to retrieve the part of the service graph which is impacted for a specific insight.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetInsightImpactGraph.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetInsightImpactGraph", []))

    @jsii.member(jsii_name="toGetInsightSummaries")
    def to_get_insight_summaries(self) -> "Xray":
        '''(experimental) Grants permission to retrieve the summary of all insights for a group and time range with optional filters.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetInsightSummaries.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetInsightSummaries", []))

    @jsii.member(jsii_name="toGetSamplingRules")
    def to_get_sampling_rules(self) -> "Xray":
        '''(experimental) Grants permission to retrieve all sampling rules.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetSamplingRules.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetSamplingRules", []))

    @jsii.member(jsii_name="toGetSamplingStatisticSummaries")
    def to_get_sampling_statistic_summaries(self) -> "Xray":
        '''(experimental) Grants permission to retrieve information about recent sampling results for all sampling rules.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetSamplingStatisticSummaries.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetSamplingStatisticSummaries", []))

    @jsii.member(jsii_name="toGetSamplingTargets")
    def to_get_sampling_targets(self) -> "Xray":
        '''(experimental) Grants permission to request a sampling quota for rules that the service is using to sample requests.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetSamplingTargets.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetSamplingTargets", []))

    @jsii.member(jsii_name="toGetServiceGraph")
    def to_get_service_graph(self) -> "Xray":
        '''(experimental) Grants permission to retrieve a document that describes services that process incoming requests, and downstream services that they call as a result.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetServiceGraph.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetServiceGraph", []))

    @jsii.member(jsii_name="toGetTimeSeriesServiceStatistics")
    def to_get_time_series_service_statistics(self) -> "Xray":
        '''(experimental) Grants permission to retrieve an aggregation of service statistics defined by a specific time range bucketed into time intervals.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetTimeSeriesServiceStatistics.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetTimeSeriesServiceStatistics", []))

    @jsii.member(jsii_name="toGetTraceGraph")
    def to_get_trace_graph(self) -> "Xray":
        '''(experimental) Grants permission to retrieve a service graph for one or more specific trace IDs.

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetTraceGraph.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetTraceGraph", []))

    @jsii.member(jsii_name="toGetTraceSummaries")
    def to_get_trace_summaries(self) -> "Xray":
        '''(experimental) Grants permission to retrieve IDs and metadata for traces available for a specified time frame using an optional filter.

        To get the full traces, pass the trace IDs to BatchGetTraces

        Access Level: Read

        https://docs.aws.amazon.com/xray/latest/api/API_GetTraceSummaries.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toGetTraceSummaries", []))

    @jsii.member(jsii_name="toLink")
    def to_link(self) -> "Xray":
        '''(experimental) Grants permission to share X-Ray resources with a monitoring account.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Unified-Cross-Account-Setup.html#CloudWatch-Unified-Cross-Account-Setup-permissions

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toLink", []))

    @jsii.member(jsii_name="toListResourcePolicies")
    def to_list_resource_policies(self) -> "Xray":
        '''(experimental) Grants permission to list resource policies.

        Access Level: List

        https://docs.aws.amazon.com/xray/latest/api/API_ListResourcePolicies.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toListResourcePolicies", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Xray":
        '''(experimental) Grants permission to list tags for an X-Ray resource.

        Access Level: List

        https://docs.aws.amazon.com/xray/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutEncryptionConfig")
    def to_put_encryption_config(self) -> "Xray":
        '''(experimental) Grants permission to update the encryption configuration for X-Ray data.

        Access Level: Permissions management

        https://docs.aws.amazon.com/xray/latest/api/API_PutEncryptionConfig.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toPutEncryptionConfig", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "Xray":
        '''(experimental) Grants permission to create or update resource policies.

        Access Level: Write

        https://docs.aws.amazon.com/xray/latest/api/API_PutResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toPutTelemetryRecords")
    def to_put_telemetry_records(self) -> "Xray":
        '''(experimental) Grants permission to send AWS X-Ray daemon telemetry to the service.

        Access Level: Write

        https://docs.aws.amazon.com/xray/latest/api/API_PutTelemetryRecords.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toPutTelemetryRecords", []))

    @jsii.member(jsii_name="toPutTraceSegments")
    def to_put_trace_segments(self) -> "Xray":
        '''(experimental) Grants permission to upload segment documents to AWS X-Ray.

        The X-Ray SDK generates segment documents and sends them to the X-Ray daemon, which uploads them in batches

        Access Level: Write

        https://docs.aws.amazon.com/xray/latest/api/API_PutTraceSegments.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toPutTraceSegments", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Xray":
        '''(experimental) Grants permission to add tags to an X-Ray resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/xray/latest/api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Xray":
        '''(experimental) Grants permission to remove tags from an X-Ray resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/xray/latest/api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateGroup")
    def to_update_group(self) -> "Xray":
        '''(experimental) Grants permission to update a group resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/xray/latest/api/API_UpdateGroup.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toUpdateGroup", []))

    @jsii.member(jsii_name="toUpdateSamplingRule")
    def to_update_sampling_rule(self) -> "Xray":
        '''(experimental) Grants permission to modify a sampling rule's configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/xray/latest/api/API_UpdateSamplingRule.html

        :stability: experimental
        '''
        return typing.cast("Xray", jsii.invoke(self, "toUpdateSamplingRule", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2cabe5be09d9d1d4cb8ddd9f39751fea9789568e1a6c12e9f927168a58463168)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__414d1444afc4a7024552a1c70acf331917c22519e62d0ebd9e24957169a2ee19)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class A2c(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.A2c"):
    '''(experimental) Statement provider for service `a2c <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsapp2container.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `a2c <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsapp2container.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b6f56bd993a37ef8a332edc70fef8910cce29c2aafee4792ffed36990ea3b337)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toGetContainerizationJobDetails")
    def to_get_containerization_job_details(self) -> "A2c":
        '''(experimental) Grants permission to get the details of all Containerization jobs.

        Access Level: Read

        https://docs.aws.amazon.com/tk-dotnet-refactoring/latest/userguide/what-is-tk-dotnet-refactoring.html

        :stability: experimental
        '''
        return typing.cast("A2c", jsii.invoke(self, "toGetContainerizationJobDetails", []))

    @jsii.member(jsii_name="toGetDeploymentJobDetails")
    def to_get_deployment_job_details(self) -> "A2c":
        '''(experimental) Grants permission to get the details of all Deployment jobs.

        Access Level: Read

        https://docs.aws.amazon.com/tk-dotnet-refactoring/latest/userguide/what-is-tk-dotnet-refactoring.html

        :stability: experimental
        '''
        return typing.cast("A2c", jsii.invoke(self, "toGetDeploymentJobDetails", []))

    @jsii.member(jsii_name="toStartContainerizationJob")
    def to_start_containerization_job(self) -> "A2c":
        '''(experimental) Grants permission to start a Containerization job.

        Access Level: Write

        https://docs.aws.amazon.com/tk-dotnet-refactoring/latest/userguide/what-is-tk-dotnet-refactoring.html

        :stability: experimental
        '''
        return typing.cast("A2c", jsii.invoke(self, "toStartContainerizationJob", []))

    @jsii.member(jsii_name="toStartDeploymentJob")
    def to_start_deployment_job(self) -> "A2c":
        '''(experimental) Grants permission to start a Deploymnet job.

        Access Level: Write

        https://docs.aws.amazon.com/tk-dotnet-refactoring/latest/userguide/what-is-tk-dotnet-refactoring.html

        :stability: experimental
        '''
        return typing.cast("A2c", jsii.invoke(self, "toStartDeploymentJob", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__293e807f8ed7a3e0515719807411c6d56659d24cb7a66992b3fb04ea6609dce5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2f7d84967a9a626e41a42eeb67c998db62d9f5c08fafb3b3db6b313e609ec253)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class A4b(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.A4b"):
    '''(experimental) Statement provider for service `a4b <https://docs.aws.amazon.com/service-authorization/latest/reference/list_alexaforbusiness.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `a4b <https://docs.aws.amazon.com/service-authorization/latest/reference/list_alexaforbusiness.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__13441344ae15feb2b31bac0511b29587c2fe26c76ed11d74bb54154aa3f36976)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAmazonId")
    def if_amazon_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "A4b":
        '''(experimental) Filters actions based on the Amazon Id in the request.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_RegisterAVSDevice.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ee9413d08182379ed24854780242a621dc969ab0f106e5e7ae06a7519012f742)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("A4b", jsii.invoke(self, "ifAmazonId", [value, operator]))

    @jsii.member(jsii_name="ifFiltersDeviceType")
    def if_filters_device_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "A4b":
        '''(experimental) Filters actions based on the device type in the request.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SearchDevices.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__59f623d7397d5022baa9afa7e321d34ce63153fa58d2873faac275fbe881e501)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("A4b", jsii.invoke(self, "ifFiltersDeviceType", [value, operator]))

    @jsii.member(jsii_name="onAddressbook")
    def on_addressbook(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type addressbook to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_AddressBook.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0d9b016537980c7ae9a01012484cc2816dd298d0c41173956018af10e10a8f5a)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("A4b", jsii.invoke(self, "onAddressbook", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onConferenceprovider")
    def on_conferenceprovider(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type conferenceprovider to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ConferenceProvider.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9b1184a4215ebe98e4b3e39267bf6d5cc81bdc47b5b7e9cd0157b23ed3691328)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("A4b", jsii.invoke(self, "onConferenceprovider", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onContact")
    def on_contact(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type contact to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_Contact.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2c8bbc06d12a79834222c8bbff0239417eee19285e025f488acd8e7c30ee44da)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("A4b", jsii.invoke(self, "onContact", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onDevice")
    def on_device(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type device to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_Device.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__87e6369fa0e8b711d92d5f4c324bb8d020d382302ac9a136358bbcfa118b0fca)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("A4b", jsii.invoke(self, "onDevice", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onGateway")
    def on_gateway(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type gateway to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_Gateway.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5f61423be7e3b6bba3af206086d1c5f36e5b48af90fae061154c79133b631e77)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("A4b", jsii.invoke(self, "onGateway", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onGatewaygroup")
    def on_gatewaygroup(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type gatewaygroup to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GatewayGroup.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e7cc684688893a8cf5110fab6d6398f78a62f162449a3bc1e820aac70c613cf4)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("A4b", jsii.invoke(self, "onGatewaygroup", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onNetworkprofile")
    def on_networkprofile(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type networkprofile to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_NetworkProfile.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c8e2933437c495dfc30e6de6cff15b62e7bcb75259099b539aa01ba106a27fe2)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("A4b", jsii.invoke(self, "onNetworkprofile", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onProfile")
    def on_profile(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type profile to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_Profile.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__27d5defd9872a3b27b4313368e24f83c0bb94c1e6bd621c0daf4e10bbd8b9cfd)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("A4b", jsii.invoke(self, "onProfile", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onRoom")
    def on_room(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type room to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_Room.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__14862e1d4258a8e636002691d669835da7525a332c1e200824d65432ddab41c0)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("A4b", jsii.invoke(self, "onRoom", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onSchedule")
    def on_schedule(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type schedule to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_BusinessReportSchedule.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__31ca654324d0a38193a808f2b7cfefb561c692d8a63cef9209d1fe8bd61a85e6)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("A4b", jsii.invoke(self, "onSchedule", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onSkillgroup")
    def on_skillgroup(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type skillgroup to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SkillGroup.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f9938fd853430716733f4ffc645c596f12df264e7e724daf783352c7cc913ef9)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("A4b", jsii.invoke(self, "onSkillgroup", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onUser")
    def on_user(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "A4b":
        '''(experimental) Adds a resource of type user to the statement.

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UserData.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__02ebdf3f69b1ff6568b791f239d9bcd2dc9342c27300d10cd1af61125e3655b0)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("A4b", jsii.invoke(self, "onUser", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toApproveSkill")
    def to_approve_skill(self) -> "A4b":
        '''(experimental) Grants permission to associate a skill with the organization under the customer's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ApproveSkill.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toApproveSkill", []))

    @jsii.member(jsii_name="toAssociateContactWithAddressBook")
    def to_associate_contact_with_address_book(self) -> "A4b":
        '''(experimental) Grants permission to associate a contact with a given address book.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_AssociateContactWithAddressBook.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toAssociateContactWithAddressBook", []))

    @jsii.member(jsii_name="toAssociateDeviceWithNetworkProfile")
    def to_associate_device_with_network_profile(self) -> "A4b":
        '''(experimental) Grants permission to associate a device with the specified network profile.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_AssociateDeviceWithNetworkProfile.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toAssociateDeviceWithNetworkProfile", []))

    @jsii.member(jsii_name="toAssociateDeviceWithRoom")
    def to_associate_device_with_room(self) -> "A4b":
        '''(experimental) Grants permission to associate device with given room.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_AssociateDeviceWithRoom.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toAssociateDeviceWithRoom", []))

    @jsii.member(jsii_name="toAssociateSkillGroupWithRoom")
    def to_associate_skill_group_with_room(self) -> "A4b":
        '''(experimental) Grants permission to associate the skill group with given room.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_AssociateSkillGroupWithRoom.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toAssociateSkillGroupWithRoom", []))

    @jsii.member(jsii_name="toAssociateSkillWithSkillGroup")
    def to_associate_skill_with_skill_group(self) -> "A4b":
        '''(experimental) Grants permission to associate a skill with a skill group.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_AssociateSkillWithSkillGroup.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toAssociateSkillWithSkillGroup", []))

    @jsii.member(jsii_name="toAssociateSkillWithUsers")
    def to_associate_skill_with_users(self) -> "A4b":
        '''(experimental) Grants permission to make a private skill available for enrolled users to enable on their devices.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_AssociateSkillWithUsers.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toAssociateSkillWithUsers", []))

    @jsii.member(jsii_name="toCompleteRegistration")
    def to_complete_registration(self) -> "A4b":
        '''(experimental) Grants permission to complete the operation of registering an Alexa device.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/ag/manage-devices.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toCompleteRegistration", []))

    @jsii.member(jsii_name="toCreateAddressBook")
    def to_create_address_book(self) -> "A4b":
        '''(experimental) Grants permission to create an address book with the specified details.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_CreateAddressBook.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toCreateAddressBook", []))

    @jsii.member(jsii_name="toCreateBusinessReportSchedule")
    def to_create_business_report_schedule(self) -> "A4b":
        '''(experimental) Grants permission to create a recurring schedule for usage reports to deliver to the specified S3 location with a specified daily or weekly interval.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_CreateBusinessReportSchedule.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toCreateBusinessReportSchedule", []))

    @jsii.member(jsii_name="toCreateConferenceProvider")
    def to_create_conference_provider(self) -> "A4b":
        '''(experimental) Grants permission to add a new conference provider under the user's AWS account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_CreateConferenceProvider.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toCreateConferenceProvider", []))

    @jsii.member(jsii_name="toCreateContact")
    def to_create_contact(self) -> "A4b":
        '''(experimental) Grants permission to create a contact with the specified details.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_CreateContact.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toCreateContact", []))

    @jsii.member(jsii_name="toCreateGatewayGroup")
    def to_create_gateway_group(self) -> "A4b":
        '''(experimental) Grants permission to create a gateway group with the specified details.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_CreateGatewayGroup.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toCreateGatewayGroup", []))

    @jsii.member(jsii_name="toCreateNetworkProfile")
    def to_create_network_profile(self) -> "A4b":
        '''(experimental) Grants permission to create a network profile with the specified details.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_CreateNetworkProfile.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toCreateNetworkProfile", []))

    @jsii.member(jsii_name="toCreateProfile")
    def to_create_profile(self) -> "A4b":
        '''(experimental) Grants permission to create a new profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_CreateProfile.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toCreateProfile", []))

    @jsii.member(jsii_name="toCreateRoom")
    def to_create_room(self) -> "A4b":
        '''(experimental) Grants permission to create room with the specified details.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_CreateRoom.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toCreateRoom", []))

    @jsii.member(jsii_name="toCreateSkillGroup")
    def to_create_skill_group(self) -> "A4b":
        '''(experimental) Grants permission to create a skill group with given name and description.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_CreateSkillGroup.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toCreateSkillGroup", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "A4b":
        '''(experimental) Grants permission to create a user.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_CreateUser.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toDeleteAddressBook")
    def to_delete_address_book(self) -> "A4b":
        '''(experimental) Grants permission to delete an address book by the address book ARN.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteAddressBook.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteAddressBook", []))

    @jsii.member(jsii_name="toDeleteBusinessReportSchedule")
    def to_delete_business_report_schedule(self) -> "A4b":
        '''(experimental) Grants permission to delete the recurring report delivery schedule with the specified schedule ARN.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteBusinessReportSchedule.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteBusinessReportSchedule", []))

    @jsii.member(jsii_name="toDeleteConferenceProvider")
    def to_delete_conference_provider(self) -> "A4b":
        '''(experimental) Grants permission to delete a conference provider.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteConferenceProvider.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteConferenceProvider", []))

    @jsii.member(jsii_name="toDeleteContact")
    def to_delete_contact(self) -> "A4b":
        '''(experimental) Grants permission to delete a contact by the contact ARN.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteContact.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteContact", []))

    @jsii.member(jsii_name="toDeleteDevice")
    def to_delete_device(self) -> "A4b":
        '''(experimental) Grants permission to remove a device from Alexa For Business.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteDevice.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteDevice", []))

    @jsii.member(jsii_name="toDeleteDeviceUsageData")
    def to_delete_device_usage_data(self) -> "A4b":
        '''(experimental) Grants permission to delete the device's entire previous history of voice input data and associated response data.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteDeviceUsageData.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteDeviceUsageData", []))

    @jsii.member(jsii_name="toDeleteGatewayGroup")
    def to_delete_gateway_group(self) -> "A4b":
        '''(experimental) Grants permission to delete a gateway group.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteGatewayGroup.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteGatewayGroup", []))

    @jsii.member(jsii_name="toDeleteNetworkProfile")
    def to_delete_network_profile(self) -> "A4b":
        '''(experimental) Grants permission to delete a network profile by the network profile ARN.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteNetworkProfile.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteNetworkProfile", []))

    @jsii.member(jsii_name="toDeleteProfile")
    def to_delete_profile(self) -> "A4b":
        '''(experimental) Grants permission to delete profile by profile ARN.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteProfile.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteProfile", []))

    @jsii.member(jsii_name="toDeleteRoom")
    def to_delete_room(self) -> "A4b":
        '''(experimental) Grants permission to delete room.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteRoom.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteRoom", []))

    @jsii.member(jsii_name="toDeleteRoomSkillParameter")
    def to_delete_room_skill_parameter(self) -> "A4b":
        '''(experimental) Grants permission to delete a parameter from a skill and room.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteRoomSkillParameter.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteRoomSkillParameter", []))

    @jsii.member(jsii_name="toDeleteSkillAuthorization")
    def to_delete_skill_authorization(self) -> "A4b":
        '''(experimental) Grants permission to unlink a third-party account from a skill.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteSkillAuthorization.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteSkillAuthorization", []))

    @jsii.member(jsii_name="toDeleteSkillGroup")
    def to_delete_skill_group(self) -> "A4b":
        '''(experimental) Grants permission to delete skill group with skill group ARN.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteSkillGroup.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteSkillGroup", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "A4b":
        '''(experimental) Grants permission to delete a user.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDisassociateContactFromAddressBook")
    def to_disassociate_contact_from_address_book(self) -> "A4b":
        '''(experimental) Grants permission to disassociate a contact from a given address book.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DisassociateContactFromAddressBook.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDisassociateContactFromAddressBook", []))

    @jsii.member(jsii_name="toDisassociateDeviceFromRoom")
    def to_disassociate_device_from_room(self) -> "A4b":
        '''(experimental) Grants permission to disassociate device from its current room.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DisassociateDeviceFromRoom.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDisassociateDeviceFromRoom", []))

    @jsii.member(jsii_name="toDisassociateSkillFromSkillGroup")
    def to_disassociate_skill_from_skill_group(self) -> "A4b":
        '''(experimental) Grants permission to disassociate a skill from a skill group.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DisassociateSkillFromSkillGroup.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDisassociateSkillFromSkillGroup", []))

    @jsii.member(jsii_name="toDisassociateSkillFromUsers")
    def to_disassociate_skill_from_users(self) -> "A4b":
        '''(experimental) Grants permission to make a private skill unavailable for enrolled users and prevent them from enabling it on their devices.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DisassociateSkillFromUsers.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDisassociateSkillFromUsers", []))

    @jsii.member(jsii_name="toDisassociateSkillGroupFromRoom")
    def to_disassociate_skill_group_from_room(self) -> "A4b":
        '''(experimental) Grants permission to disassociate the skill group from given room.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_DisassociateSkillGroupFromRoom.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toDisassociateSkillGroupFromRoom", []))

    @jsii.member(jsii_name="toForgetSmartHomeAppliances")
    def to_forget_smart_home_appliances(self) -> "A4b":
        '''(experimental) Grants permission to forget smart home appliances associated to a room.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ForgetSmartHomeAppliances.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toForgetSmartHomeAppliances", []))

    @jsii.member(jsii_name="toGetAddressBook")
    def to_get_address_book(self) -> "A4b":
        '''(experimental) Grants permission to get the address book details by the address book ARN.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetAddressBook.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetAddressBook", []))

    @jsii.member(jsii_name="toGetConferencePreference")
    def to_get_conference_preference(self) -> "A4b":
        '''(experimental) Grants permission to retrieve the existing conference preferences.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetConferencePreference.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetConferencePreference", []))

    @jsii.member(jsii_name="toGetConferenceProvider")
    def to_get_conference_provider(self) -> "A4b":
        '''(experimental) Grants permission to get details about a specific conference provider.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetConferenceProvider.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetConferenceProvider", []))

    @jsii.member(jsii_name="toGetContact")
    def to_get_contact(self) -> "A4b":
        '''(experimental) Grants permission to get the contact details by the contact ARN.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetContact.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetContact", []))

    @jsii.member(jsii_name="toGetDevice")
    def to_get_device(self) -> "A4b":
        '''(experimental) Grants permission to get device details.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetDevice.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetDevice", []))

    @jsii.member(jsii_name="toGetGateway")
    def to_get_gateway(self) -> "A4b":
        '''(experimental) Grants permission to retrieve the details of a gateway.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetGateway.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetGateway", []))

    @jsii.member(jsii_name="toGetGatewayGroup")
    def to_get_gateway_group(self) -> "A4b":
        '''(experimental) Grants permission to retrieve the details of a gateway group.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetGatewayGroup.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetGatewayGroup", []))

    @jsii.member(jsii_name="toGetInvitationConfiguration")
    def to_get_invitation_configuration(self) -> "A4b":
        '''(experimental) Grants permission to retrieve the configured values for the user enrollment invitation email template.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetInvitationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetInvitationConfiguration", []))

    @jsii.member(jsii_name="toGetNetworkProfile")
    def to_get_network_profile(self) -> "A4b":
        '''(experimental) Grants permission to get the network profile details by the network profile ARN.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetNetworkProfile.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetNetworkProfile", []))

    @jsii.member(jsii_name="toGetProfile")
    def to_get_profile(self) -> "A4b":
        '''(experimental) Grants permission to get profile when provided with Profile ARN.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetProfile.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetProfile", []))

    @jsii.member(jsii_name="toGetRoom")
    def to_get_room(self) -> "A4b":
        '''(experimental) Grants permission to get room details.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetRoom.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetRoom", []))

    @jsii.member(jsii_name="toGetRoomSkillParameter")
    def to_get_room_skill_parameter(self) -> "A4b":
        '''(experimental) Grants permission to get an existing parameter that has been set for a skill and room.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetRoomSkillParameter.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetRoomSkillParameter", []))

    @jsii.member(jsii_name="toGetSkillGroup")
    def to_get_skill_group(self) -> "A4b":
        '''(experimental) Grants permission to get skill group details with skill group ARN.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_GetSkillGroup.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toGetSkillGroup", []))

    @jsii.member(jsii_name="toListBusinessReportSchedules")
    def to_list_business_report_schedules(self) -> "A4b":
        '''(experimental) Grants permission to list the details of the schedules that a user configured.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ListBusinessReportSchedules.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toListBusinessReportSchedules", []))

    @jsii.member(jsii_name="toListConferenceProviders")
    def to_list_conference_providers(self) -> "A4b":
        '''(experimental) Grants permission to list conference providers under a specific AWS account.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ListConferenceProviders.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toListConferenceProviders", []))

    @jsii.member(jsii_name="toListDeviceEvents")
    def to_list_device_events(self) -> "A4b":
        '''(experimental) Grants permission to list the device event history, including device connection status, for up to 30 days.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ListDeviceEvents.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toListDeviceEvents", []))

    @jsii.member(jsii_name="toListGatewayGroups")
    def to_list_gateway_groups(self) -> "A4b":
        '''(experimental) Grants permission to list gateway group summaries.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ListGatewayGroups.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toListGatewayGroups", []))

    @jsii.member(jsii_name="toListGateways")
    def to_list_gateways(self) -> "A4b":
        '''(experimental) Grants permission to list gateway summaries.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ListGateways.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toListGateways", []))

    @jsii.member(jsii_name="toListSkills")
    def to_list_skills(self) -> "A4b":
        '''(experimental) Grants permission to list skills.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ListSkills.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toListSkills", []))

    @jsii.member(jsii_name="toListSkillsStoreCategories")
    def to_list_skills_store_categories(self) -> "A4b":
        '''(experimental) Grants permission to list all categories in the Alexa skill store.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ListSkillsStoreCategories.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toListSkillsStoreCategories", []))

    @jsii.member(jsii_name="toListSkillsStoreSkillsByCategory")
    def to_list_skills_store_skills_by_category(self) -> "A4b":
        '''(experimental) Grants permission to list all skills in the Alexa skill store by category.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ListSkillsStoreSkillsByCategory.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toListSkillsStoreSkillsByCategory", []))

    @jsii.member(jsii_name="toListSmartHomeAppliances")
    def to_list_smart_home_appliances(self) -> "A4b":
        '''(experimental) Grants permission to list all of the smart home appliances associated with a room.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ListSmartHomeAppliances.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toListSmartHomeAppliances", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "A4b":
        '''(experimental) Grants permission to list all tags on a resource.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ListTags.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toPutConferencePreference")
    def to_put_conference_preference(self) -> "A4b":
        '''(experimental) Grants permission to set the conference preferences on a specific conference provider at the account level.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_PutConferencePreference.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toPutConferencePreference", []))

    @jsii.member(jsii_name="toPutDeviceSetupEvents")
    def to_put_device_setup_events(self) -> "A4b":
        '''(experimental) Grants permission to publish Alexa device setup events.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/ag/manage-devices.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toPutDeviceSetupEvents", []))

    @jsii.member(jsii_name="toPutInvitationConfiguration")
    def to_put_invitation_configuration(self) -> "A4b":
        '''(experimental) Grants permission to configure the email template for the user enrollment invitation with the specified attributes.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_PutInvitationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toPutInvitationConfiguration", []))

    @jsii.member(jsii_name="toPutRoomSkillParameter")
    def to_put_room_skill_parameter(self) -> "A4b":
        '''(experimental) Grants permission to put a room specific parameter for a skill.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_PutRoomSkillParameter.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toPutRoomSkillParameter", []))

    @jsii.member(jsii_name="toPutSkillAuthorization")
    def to_put_skill_authorization(self) -> "A4b":
        '''(experimental) Grants permission to link a user's account to a third-party skill provider.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_PutSkillAuthorization.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toPutSkillAuthorization", []))

    @jsii.member(jsii_name="toRegisterAVSDevice")
    def to_register_avs_device(self) -> "A4b":
        '''(experimental) Grants permission to register an Alexa-enabled device built by an Original Equipment Manufacturer (OEM) using Alexa Voice Service (AVS).

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_RegisterAVSDevice.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toRegisterAVSDevice", []))

    @jsii.member(jsii_name="toRegisterDevice")
    def to_register_device(self) -> "A4b":
        '''(experimental) Grants permission to register an Alexa device.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/ag/manage-devices.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toRegisterDevice", []))

    @jsii.member(jsii_name="toRejectSkill")
    def to_reject_skill(self) -> "A4b":
        '''(experimental) Grants permission to disassociate a skill from the organization under a user's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_RejectSkill.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toRejectSkill", []))

    @jsii.member(jsii_name="toResolveRoom")
    def to_resolve_room(self) -> "A4b":
        '''(experimental) Grants permission to resolve room information.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_ResolveRoom.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toResolveRoom", []))

    @jsii.member(jsii_name="toRevokeInvitation")
    def to_revoke_invitation(self) -> "A4b":
        '''(experimental) Grants permission to revoke an invitation.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_RevokeInvitation.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toRevokeInvitation", []))

    @jsii.member(jsii_name="toSearchAddressBooks")
    def to_search_address_books(self) -> "A4b":
        '''(experimental) Grants permission to search address books and list the ones that meet a set of filter and sort criteria.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SearchAddressBooks.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toSearchAddressBooks", []))

    @jsii.member(jsii_name="toSearchContacts")
    def to_search_contacts(self) -> "A4b":
        '''(experimental) Grants permission to search contacts and list the ones that meet a set of filter and sort criteria.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SearchContacts.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toSearchContacts", []))

    @jsii.member(jsii_name="toSearchDevices")
    def to_search_devices(self) -> "A4b":
        '''(experimental) Grants permission to search for devices.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SearchDevices.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toSearchDevices", []))

    @jsii.member(jsii_name="toSearchNetworkProfiles")
    def to_search_network_profiles(self) -> "A4b":
        '''(experimental) Grants permission to search network profiles and list the ones that meet a set of filter and sort criteria.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SearchNetworkProfiles.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toSearchNetworkProfiles", []))

    @jsii.member(jsii_name="toSearchProfiles")
    def to_search_profiles(self) -> "A4b":
        '''(experimental) Grants permission to search for profiles.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SearchProfiles.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toSearchProfiles", []))

    @jsii.member(jsii_name="toSearchRooms")
    def to_search_rooms(self) -> "A4b":
        '''(experimental) Grants permission to search for rooms.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SearchRooms.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toSearchRooms", []))

    @jsii.member(jsii_name="toSearchSkillGroups")
    def to_search_skill_groups(self) -> "A4b":
        '''(experimental) Grants permission to search for skill groups.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SearchSkillGroups.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toSearchSkillGroups", []))

    @jsii.member(jsii_name="toSearchUsers")
    def to_search_users(self) -> "A4b":
        '''(experimental) Grants permission to search for users.

        Access Level: List

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SearchUsers.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toSearchUsers", []))

    @jsii.member(jsii_name="toSendAnnouncement")
    def to_send_announcement(self) -> "A4b":
        '''(experimental) Grants permission to trigger an asynchronous flow to send text, SSML, or audio announcements to rooms that are identified by a search or filter.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SendAnnouncement.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toSendAnnouncement", []))

    @jsii.member(jsii_name="toSendInvitation")
    def to_send_invitation(self) -> "A4b":
        '''(experimental) Grants permission to send an invitation to a user.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_SendInvitation.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toSendInvitation", []))

    @jsii.member(jsii_name="toStartDeviceSync")
    def to_start_device_sync(self) -> "A4b":
        '''(experimental) Grants permission to restore the device and its account to its known, default settings by clearing all information and settings set by its previous users.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_StartDeviceSync.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toStartDeviceSync", []))

    @jsii.member(jsii_name="toStartSmartHomeApplianceDiscovery")
    def to_start_smart_home_appliance_discovery(self) -> "A4b":
        '''(experimental) Grants permission to initiate the discovery of any smart home appliances associated with the room.

        Access Level: Read

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_StartSmartHomeApplianceDiscovery.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toStartSmartHomeApplianceDiscovery", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "A4b":
        '''(experimental) Grants permission to add metadata tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "A4b":
        '''(experimental) Grants permission to remove metadata tags from a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAddressBook")
    def to_update_address_book(self) -> "A4b":
        '''(experimental) Grants permission to update address book details by the address book ARN.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UpdateAddressBook.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUpdateAddressBook", []))

    @jsii.member(jsii_name="toUpdateBusinessReportSchedule")
    def to_update_business_report_schedule(self) -> "A4b":
        '''(experimental) Grants permission to update the configuration of the report delivery schedule with the specified schedule ARN.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UpdateBusinessReportSchedule.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUpdateBusinessReportSchedule", []))

    @jsii.member(jsii_name="toUpdateConferenceProvider")
    def to_update_conference_provider(self) -> "A4b":
        '''(experimental) Grants permission to update an existing conference provider's settings.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UpdateConferenceProvider.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUpdateConferenceProvider", []))

    @jsii.member(jsii_name="toUpdateContact")
    def to_update_contact(self) -> "A4b":
        '''(experimental) Grants permission to update the contact details by the contact ARN.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UpdateContact.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUpdateContact", []))

    @jsii.member(jsii_name="toUpdateDevice")
    def to_update_device(self) -> "A4b":
        '''(experimental) Grants permission to update device name.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UpdateDevice.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUpdateDevice", []))

    @jsii.member(jsii_name="toUpdateGateway")
    def to_update_gateway(self) -> "A4b":
        '''(experimental) Grants permission to update the details of a gateway.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UpdateGateway.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUpdateGateway", []))

    @jsii.member(jsii_name="toUpdateGatewayGroup")
    def to_update_gateway_group(self) -> "A4b":
        '''(experimental) Grants permission to update the details of a gateway group.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UpdateGatewayGroup.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUpdateGatewayGroup", []))

    @jsii.member(jsii_name="toUpdateNetworkProfile")
    def to_update_network_profile(self) -> "A4b":
        '''(experimental) Grants permission to update a network profile by the network profile ARN.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UpdateNetworkProfile.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUpdateNetworkProfile", []))

    @jsii.member(jsii_name="toUpdateProfile")
    def to_update_profile(self) -> "A4b":
        '''(experimental) Grants permission to update an existing profile.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UpdateProfile.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUpdateProfile", []))

    @jsii.member(jsii_name="toUpdateRoom")
    def to_update_room(self) -> "A4b":
        '''(experimental) Grants permission to update room details.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UpdateRoom.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUpdateRoom", []))

    @jsii.member(jsii_name="toUpdateSkillGroup")
    def to_update_skill_group(self) -> "A4b":
        '''(experimental) Grants permission to update skill group details with skill group ARN.

        Access Level: Write

        https://docs.aws.amazon.com/a4b/latest/APIReference/API_UpdateSkillGroup.html

        :stability: experimental
        '''
        return typing.cast("A4b", jsii.invoke(self, "toUpdateSkillGroup", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d0931889f1df5a0e2f008f347d4b46026ffd713e22d8c01f2efa1d77916260d6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cc434cee142c2b37245693edb584daf54c9b2d778031dff7a33b6f5c0d99f44c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class AccessAnalyzer(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AccessAnalyzer",
):
    '''(experimental) Statement provider for service `access-analyzer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamaccessanalyzer.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `access-analyzer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamaccessanalyzer.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c508442e952f83e11b33b577e1c9089bde7d92c78c5ec344c22d373bc6d88826)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAnalyzer")
    def on_analyzer(
        self,
        analyzer_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AccessAnalyzer":
        '''(experimental) Adds a resource of type Analyzer to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-getting-started.html#permission-resources

        :param analyzer_name: - Identifier for the analyzerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__def17afa84dc76e42c2c29831d8054c997819f995dce8de81ed08c6b158d128d)
            check_type(argname="argument analyzer_name", value=analyzer_name, expected_type=type_hints["analyzer_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "onAnalyzer", [analyzer_name, account, region, partition]))

    @jsii.member(jsii_name="onArchiveRule")
    def on_archive_rule(
        self,
        analyzer_name: builtins.str,
        rule_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AccessAnalyzer":
        '''(experimental) Adds a resource of type ArchiveRule to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-getting-started.html#permission-resources

        :param analyzer_name: - Identifier for the analyzerName.
        :param rule_name: - Identifier for the ruleName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3966325b7bb408ef98191c31e6571d53c6e74e96e5fc12350d18eb3fa3ea6f83)
            check_type(argname="argument analyzer_name", value=analyzer_name, expected_type=type_hints["analyzer_name"])
            check_type(argname="argument rule_name", value=rule_name, expected_type=type_hints["rule_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "onArchiveRule", [analyzer_name, rule_name, account, region, partition]))

    @jsii.member(jsii_name="toApplyArchiveRule")
    def to_apply_archive_rule(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to apply an archive rule.

        Access Level: Write

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ApplyArchiveRule.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toApplyArchiveRule", []))

    @jsii.member(jsii_name="toCancelPolicyGeneration")
    def to_cancel_policy_generation(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to cancel a policy generation.

        Access Level: Write

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_CancelPolicyGeneration.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toCancelPolicyGeneration", []))

    @jsii.member(jsii_name="toCreateAccessPreview")
    def to_create_access_preview(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to create an access preview for the specified analyzer.

        Access Level: Write

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_CreateAccessPreview.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toCreateAccessPreview", []))

    @jsii.member(jsii_name="toCreateAnalyzer")
    def to_create_analyzer(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to create an analyzer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_CreateAnalyzer.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toCreateAnalyzer", []))

    @jsii.member(jsii_name="toCreateArchiveRule")
    def to_create_archive_rule(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to create an archive rule for the specified analyzer.

        Access Level: Write

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_CreateArchiveRule.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toCreateArchiveRule", []))

    @jsii.member(jsii_name="toDeleteAnalyzer")
    def to_delete_analyzer(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to delete the specified analyzer.

        Access Level: Write

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_DeleteAnalyzer.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toDeleteAnalyzer", []))

    @jsii.member(jsii_name="toDeleteArchiveRule")
    def to_delete_archive_rule(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to delete archive rules for the specified analyzer.

        Access Level: Write

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_DeleteArchiveRule.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toDeleteArchiveRule", []))

    @jsii.member(jsii_name="toGetAccessPreview")
    def to_get_access_preview(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve information about an access preview.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetAccessPreview.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toGetAccessPreview", []))

    @jsii.member(jsii_name="toGetAnalyzedResource")
    def to_get_analyzed_resource(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve information about an analyzed resource.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetAnalyzedResource.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toGetAnalyzedResource", []))

    @jsii.member(jsii_name="toGetAnalyzer")
    def to_get_analyzer(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve information about analyzers.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetAnalyzer.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toGetAnalyzer", []))

    @jsii.member(jsii_name="toGetArchiveRule")
    def to_get_archive_rule(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve information about archive rules for the specified analyzer.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetArchiveRule.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toGetArchiveRule", []))

    @jsii.member(jsii_name="toGetFinding")
    def to_get_finding(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve findings.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetFinding.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toGetFinding", []))

    @jsii.member(jsii_name="toGetGeneratedPolicy")
    def to_get_generated_policy(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve a policy that was generated using StartPolicyGeneration.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_GetGeneratedPolicy.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toGetGeneratedPolicy", []))

    @jsii.member(jsii_name="toListAccessPreviewFindings")
    def to_list_access_preview_findings(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve a list of findings from an access preview.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListAccessPreviewFindings.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toListAccessPreviewFindings", []))

    @jsii.member(jsii_name="toListAccessPreviews")
    def to_list_access_previews(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve a list of access previews.

        Access Level: List

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListAccessPreviews.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toListAccessPreviews", []))

    @jsii.member(jsii_name="toListAnalyzedResources")
    def to_list_analyzed_resources(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve a list of resources that have been analyzed.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListAnalyzedResources.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toListAnalyzedResources", []))

    @jsii.member(jsii_name="toListAnalyzers")
    def to_list_analyzers(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieves a list of analyzers.

        Access Level: List

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListAnalyzers.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toListAnalyzers", []))

    @jsii.member(jsii_name="toListArchiveRules")
    def to_list_archive_rules(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve a list of archive rules from an analyzer.

        Access Level: List

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListArchiveRules.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toListArchiveRules", []))

    @jsii.member(jsii_name="toListFindings")
    def to_list_findings(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve a list of findings from an analyzer.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListFindings.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toListFindings", []))

    @jsii.member(jsii_name="toListPolicyGenerations")
    def to_list_policy_generations(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to list all the recently started policy generations.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListPolicyGenerations.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toListPolicyGenerations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to retrieve a list of tags applied to a resource.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartPolicyGeneration")
    def to_start_policy_generation(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to start a policy generation.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_StartPolicyGeneration.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toStartPolicyGeneration", []))

    @jsii.member(jsii_name="toStartResourceScan")
    def to_start_resource_scan(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to start a scan of the policies applied to a resource.

        Access Level: Write

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_StartResourceScan.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toStartResourceScan", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to add a tag to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to remove a tag from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateArchiveRule")
    def to_update_archive_rule(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to modify an archive rule.

        Access Level: Write

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_UpdateArchiveRule.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toUpdateArchiveRule", []))

    @jsii.member(jsii_name="toUpdateFindings")
    def to_update_findings(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to modify findings.

        Access Level: Write

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_UpdateFindings.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toUpdateFindings", []))

    @jsii.member(jsii_name="toValidatePolicy")
    def to_validate_policy(self) -> "AccessAnalyzer":
        '''(experimental) Grants permission to validate a policy.

        Access Level: Read

        https://docs.aws.amazon.com/access-analyzer/latest/APIReference/API_ValidatePolicy.html

        :stability: experimental
        '''
        return typing.cast("AccessAnalyzer", jsii.invoke(self, "toValidatePolicy", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__80cfcc5aa8ad2a51cc8955c6fc363e722fa4e5783893e61bd723f05c6e61224d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__55fb80f32418a6c1bfdcc9b5a4fd8551f45f11e2b3aa383ad2768e1cf31bcc92)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Account(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Account"):
    '''(experimental) Statement provider for service `account <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsaccountmanagement.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `account <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsaccountmanagement.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5c17c311301760e2c2d1c0d2523eeeea9845dd7b4d3c4b60b204456862d6d5a9)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAccountResourceOrgPaths")
    def if_account_resource_org_paths(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Account":
        '''(experimental) Filters access by the resource path for an account in an organization.

        https://docs.aws.amazon.com/accounts/latest/reference/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2d4113bf6c22350636daf09d52135023cc940c2b229d32b6586f50696b150ca7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Account", jsii.invoke(self, "ifAccountResourceOrgPaths", [value, operator]))

    @jsii.member(jsii_name="ifAccountResourceOrgTags")
    def if_account_resource_org_tags(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Account":
        '''(experimental) Filters access by resource tags for an account in an organization.

        https://docs.aws.amazon.com/accounts/latest/reference/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6a80fa11b48527459e81d37c0b277dfa8b5ca4f5a8eb8846fd51e782e1ce866d)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Account", jsii.invoke(self, "ifAccountResourceOrgTags", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifAlternateContactTypes")
    def if_alternate_contact_types(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Account":
        '''(experimental) Filters access by alternate contact types.

        https://docs.aws.amazon.com/accounts/latest/reference/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toDeleteAlternateContact()
        - .toGetAlternateContact()
        - .toPutAlternateContact()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1b4db971664df27eb5d4d9217029889218946cf47b0e3e7d848ddbc484ac1d00)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Account", jsii.invoke(self, "ifAlternateContactTypes", [value, operator]))

    @jsii.member(jsii_name="ifTargetRegion")
    def if_target_region(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Account":
        '''(experimental) Filters access by a list of Regions. Enables or disables all the Regions specified here.

        https://docs.aws.amazon.com/accounts/latest/reference/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toDisableRegion()
        - .toEnableRegion()
        - .toGetRegionOptStatus()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a0430d0dcc2d5802a136678457a3eb67bf38f3a643d9b689a0e195264c34ab7f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Account", jsii.invoke(self, "ifTargetRegion", [value, operator]))

    @jsii.member(jsii_name="onAccount")
    def on_account(
        self,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Account":
        '''(experimental) Adds a resource of type account to the statement.

        https://docs.aws.amazon.com/accounts/latest/reference/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-resources

        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__20ecce0753eab78037ab489c52a2d213b797ece5b12eda5b140fe6050b2ade9b)
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Account", jsii.invoke(self, "onAccount", [account, partition]))

    @jsii.member(jsii_name="onAccountInOrganization")
    def on_account_in_organization(
        self,
        management_account_id: builtins.str,
        organization_id: builtins.str,
        member_account_id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Account":
        '''(experimental) Adds a resource of type accountInOrganization to the statement.

        https://docs.aws.amazon.com/accounts/latest/reference/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-resources

        :param management_account_id: - Identifier for the managementAccountId.
        :param organization_id: - Identifier for the organizationId.
        :param member_account_id: - Identifier for the memberAccountId.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__658fa090ce69908fd4b1087226e592b8cf51d3b73f4824589fd6cfa711ff3a26)
            check_type(argname="argument management_account_id", value=management_account_id, expected_type=type_hints["management_account_id"])
            check_type(argname="argument organization_id", value=organization_id, expected_type=type_hints["organization_id"])
            check_type(argname="argument member_account_id", value=member_account_id, expected_type=type_hints["member_account_id"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Account", jsii.invoke(self, "onAccountInOrganization", [management_account_id, organization_id, member_account_id, partition]))

    @jsii.member(jsii_name="toCloseAccount")
    def to_close_account(self) -> "Account":
        '''(experimental) Grants permission to close an account.

        Access Level: Write

        https://docs.aws.amazon.com/accounts/latest/reference/security_account-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Account", jsii.invoke(self, "toCloseAccount", []))

    @jsii.member(jsii_name="toDeleteAlternateContact")
    def to_delete_alternate_contact(self) -> "Account":
        '''(experimental) Grants permission to delete the alternate contacts for an account.

        Access Level: Write

        Possible conditions:

        - .ifAlternateContactTypes()

        https://docs.aws.amazon.com/accounts/latest/reference/API_DeleteAlternateContact.html

        :stability: experimental
        '''
        return typing.cast("Account", jsii.invoke(self, "toDeleteAlternateContact", []))

    @jsii.member(jsii_name="toDisableRegion")
    def to_disable_region(self) -> "Account":
        '''(experimental) Grants permission to disable use of a Region.

        Access Level: Write

        Possible conditions:

        - .ifTargetRegion()

        https://docs.aws.amazon.com/accounts/latest/reference/API_DisableRegion.html

        :stability: experimental
        '''
        return typing.cast("Account", jsii.invoke(self, "toDisableRegion", []))

    @jsii.member(jsii_name="toEnableRegion")
    def to_enable_region(self) -> "Account":
        '''(experimental) Grants permission to enable use of a Region.

        Access Level: Write

        Possible conditions:

        - .ifTargetRegion()

        https://docs.aws.amazon.com/accounts/latest/reference/API_EnableRegion.html

        :stability: experimental
        '''
        return typing.cast("Account", jsii.invoke(self, "toEnableRegion", []))

    @jsii.member(jsii_name="toGetAccountInformation")
    def to_get_account_information(self) -> "Account":
        '''(experimental) Grants permission to retrieve the account information for an account.

        Access Level: Read

        https://docs.aws.amazon.com/accounts/latest/reference/security_account-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Account", jsii.invoke(self, "toGetAccountInformation", []))

    @jsii.member(jsii_name="toGetAlternateContact")
    def to_get_alternate_contact(self) -> "Account":
        '''(experimental) Grants permission to retrieve the alternate contacts for an account.

        Access Level: Read

        Possible conditions:

        - .ifAlternateContactTypes()

        https://docs.aws.amazon.com/accounts/latest/reference/API_GetAlternateContact.html

        :stability: experimental
        '''
        return typing.cast("Account", jsii.invoke(self, "toGetAlternateContact", []))

    @jsii.member(jsii_name="toGetChallengeQuestions")
    def to_get_challenge_questions(self) -> "Account":
        '''(experimental) Grants permission to retrieve the challenge questions for an account.

        Access Level: Read

        https://docs.aws.amazon.com/accounts/latest/reference/security_account-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Account", jsii.invoke(self, "toGetChallengeQuestions", []))

    @jsii.member(jsii_name="toGetContactInformation")
    def to_get_contact_information(self) -> "Account":
        '''(experimental) Grants permission to retrieve the primary contact information for an account.

        Access Level: Read

        https://docs.aws.amazon.com/accounts/latest/reference/API_GetContactInformation.html

        :stability: experimental
        '''
        return typing.cast("Account", jsii.invoke(self, "toGetContactInformation", []))

    @jsii.member(jsii_name="toGetRegionOptStatus")
    def to_get_region_opt_status(self) -> "Account":
        '''(experimental) Grants permission to get the opt-in status of a Region.

        Access Level: Read

        Possible conditions:

        - .ifTargetRegion()

        https://docs.aws.amazon.com/accounts/latest/reference/API_GetRegionOptStatus.html

        :stability: experimental
        '''
        return typing.cast("Account", jsii.invoke(self, "toGetRegionOptStatus", []))

    @jsii.member(jsii_name="toListRegions")
    def to_list_regions(self) -> "Account":
        '''(experimental) Grants permission to list the available Regions.

        Access Level: List

        https://docs.aws.amazon.com/accounts/latest/reference/API_ListRegions.html

        :stability: experimental
        '''
        return typing.cast("Account", jsii.invoke(self, "toListRegions", []))

    @jsii.member(jsii_name="toPutAlternateContact")
    def to_put_alternate_contact(self) -> "Account":
        '''(experimental) Grants permission to modify the alternate contacts for an account.

        Access Level: Write

        Possible conditions:

        - .ifAlternateContactTypes()

        https://docs.aws.amazon.com/accounts/latest/reference/API_PutAlternateContact.html

        :stability: experimental
        '''
        return typing.cast("Account", jsii.invoke(self, "toPutAlternateContact", []))

    @jsii.member(jsii_name="toPutChallengeQuestions")
    def to_put_challenge_questions(self) -> "Account":
        '''(experimental) Grants permission to modify the challenge questions for an account.

        Access Level: Write

        https://docs.aws.amazon.com/accounts/latest/reference/security_account-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Account", jsii.invoke(self, "toPutChallengeQuestions", []))

    @jsii.member(jsii_name="toPutContactInformation")
    def to_put_contact_information(self) -> "Account":
        '''(experimental) Grants permission to update the primary contact information for an account.

        Access Level: Write

        https://docs.aws.amazon.com/accounts/latest/reference/API_PutContactInformation.html

        :stability: experimental
        '''
        return typing.cast("Account", jsii.invoke(self, "toPutContactInformation", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9623425cbb41370beae4f12e3300a7ca782eb88499c155da867371af571ccb95)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e7b68bdf0aa66a4bf71942c3bfb67d7ee26e2c41a319793e2b15828542f7d5e1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Acm(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Acm"):
    '''(experimental) Statement provider for service `acm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscertificatemanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `acm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscertificatemanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__24ba6dd8c4754efb8c5e417bc16cfdc8ba1a11bd477d3fe7e36b5f7146b57aed)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onCertificate")
    def on_certificate(
        self,
        certificate_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Acm":
        '''(experimental) Adds a resource of type certificate to the statement.

        https://docs.aws.amazon.com/acm/latest/userguide/authen-overview.html#acm-resources-operations

        :param certificate_id: - Identifier for the certificateId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a87bc246c32da7ea0b8d07ba116340aaea81ed8f9225dca5dd1cb8d1f1519993)
            check_type(argname="argument certificate_id", value=certificate_id, expected_type=type_hints["certificate_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Acm", jsii.invoke(self, "onCertificate", [certificate_id, account, region, partition]))

    @jsii.member(jsii_name="toAddTagsToCertificate")
    def to_add_tags_to_certificate(self) -> "Acm":
        '''(experimental) Grants permission to add one or more tags to a certificate.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/acm/latest/APIReference/API_AddTagsToCertificate.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toAddTagsToCertificate", []))

    @jsii.member(jsii_name="toDeleteCertificate")
    def to_delete_certificate(self) -> "Acm":
        '''(experimental) Grants permission to delete a certificate and its associated private key.

        Access Level: Write

        https://docs.aws.amazon.com/acm/latest/APIReference/API_DeleteCertificate.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toDeleteCertificate", []))

    @jsii.member(jsii_name="toDescribeCertificate")
    def to_describe_certificate(self) -> "Acm":
        '''(experimental) Grants permission to retreive a certificates and its metadata.

        Access Level: Read

        https://docs.aws.amazon.com/acm/latest/APIReference/API_DescribeCertificate.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toDescribeCertificate", []))

    @jsii.member(jsii_name="toExportCertificate")
    def to_export_certificate(self) -> "Acm":
        '''(experimental) Grants permission to export a private certificate issued by a private certificate authority (CA) for use anywhere.

        Access Level: Read

        https://docs.aws.amazon.com/acm/latest/APIReference/API_ExportCertificate.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toExportCertificate", []))

    @jsii.member(jsii_name="toGetAccountConfiguration")
    def to_get_account_configuration(self) -> "Acm":
        '''(experimental) Grants permission to retrieve account level configuration from AWS Certificate Manager.

        Access Level: Read

        https://docs.aws.amazon.com/acm/latest/APIReference/API_GetAccountConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toGetAccountConfiguration", []))

    @jsii.member(jsii_name="toGetCertificate")
    def to_get_certificate(self) -> "Acm":
        '''(experimental) Grants permission to retrieve a certificate and certificate chain for a certificate ARN.

        Access Level: Read

        https://docs.aws.amazon.com/acm/latest/APIReference/API_GetCertificate.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toGetCertificate", []))

    @jsii.member(jsii_name="toImportCertificate")
    def to_import_certificate(self) -> "Acm":
        '''(experimental) Grants permission to import a 3rd party certificate into AWS Certificate Manager (ACM).

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/acm/latest/APIReference/API_ImportCertificate.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toImportCertificate", []))

    @jsii.member(jsii_name="toListCertificates")
    def to_list_certificates(self) -> "Acm":
        '''(experimental) Grants permission to retrieve a list of the certificate ARNs and the domain name for each ARN.

        Access Level: List

        https://docs.aws.amazon.com/acm/latest/APIReference/API_ListCertificates.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toListCertificates", []))

    @jsii.member(jsii_name="toListTagsForCertificate")
    def to_list_tags_for_certificate(self) -> "Acm":
        '''(experimental) Grants permission to lists the tags that have been associated with a certificate.

        Access Level: Read

        https://docs.aws.amazon.com/acm/latest/APIReference/API_ListTagsForCertificate.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toListTagsForCertificate", []))

    @jsii.member(jsii_name="toPutAccountConfiguration")
    def to_put_account_configuration(self) -> "Acm":
        '''(experimental) Grants permission to update account level configuration in AWS Certificate Manager.

        Access Level: Write

        https://docs.aws.amazon.com/acm/latest/APIReference/API_PutAccountConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toPutAccountConfiguration", []))

    @jsii.member(jsii_name="toRemoveTagsFromCertificate")
    def to_remove_tags_from_certificate(self) -> "Acm":
        '''(experimental) Grants permission to remove one or more tags from a certificate.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/acm/latest/APIReference/API_RemoveTagsFromCertificate.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toRemoveTagsFromCertificate", []))

    @jsii.member(jsii_name="toRenewCertificate")
    def to_renew_certificate(self) -> "Acm":
        '''(experimental) Grants permission to renew an eligible private certificate.

        Access Level: Write

        https://docs.aws.amazon.com/acm/latest/APIReference/API_RenewCertificate.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toRenewCertificate", []))

    @jsii.member(jsii_name="toRequestCertificate")
    def to_request_certificate(self) -> "Acm":
        '''(experimental) Grants permission to requests a public or private certificate.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/acm/latest/APIReference/API_RequestCertificate.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toRequestCertificate", []))

    @jsii.member(jsii_name="toResendValidationEmail")
    def to_resend_validation_email(self) -> "Acm":
        '''(experimental) Grants permission to resend an email to request domain ownership validation.

        Access Level: Write

        https://docs.aws.amazon.com/acm/latest/APIReference/API_ResendValidationEmail.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toResendValidationEmail", []))

    @jsii.member(jsii_name="toUpdateCertificateOptions")
    def to_update_certificate_options(self) -> "Acm":
        '''(experimental) Grants permission to update a certificate configuration.

        Use this to specify whether to opt in to or out of certificate transparency logging

        Access Level: Write

        https://docs.aws.amazon.com/acm/latest/APIReference/API_UpdateCertificateOptions.html

        :stability: experimental
        '''
        return typing.cast("Acm", jsii.invoke(self, "toUpdateCertificateOptions", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7e47f6c3ab031539023288f643b7ca08f09c68689c1946e714ca47d721b06526)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__414e46502a3a2121a1332a5d50c165c0abeddc1bf0066f3024771c803011bfeb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class AcmPca(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.AcmPca"):
    '''(experimental) Statement provider for service `acm-pca <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsprivatecertificateauthority.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `acm-pca <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsprivatecertificateauthority.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__65bac14af6fc83741fda78224f9620dd16080ad902da1bcf88b4500795b60c3d)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifTemplateArn")
    def if_template_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "AcmPca":
        '''(experimental) Filters issue certificate requests based on the presence of TemplateArn in the request.

        https://docs.aws.amazon.com/privateca/latest/userguide/UsingTemplates.html#template-varieties

        Applies to actions:

        - .toIssueCertificate()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__78f4f95ccf07790708dd646b715161c300718dda4d3d92864dde43c7279935f6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("AcmPca", jsii.invoke(self, "ifTemplateArn", [value, operator]))

    @jsii.member(jsii_name="onCertificateAuthority")
    def on_certificate_authority(
        self,
        certificate_authority_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AcmPca":
        '''(experimental) Adds a resource of type certificate-authority to the statement.

        https://docs.aws.amazon.com/privateca/latest/userguide/authen-overview.html#acm-pca-resources-operations

        :param certificate_authority_id: - Identifier for the certificateAuthorityId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b0f029d43bed757a552ea15c38680f12de54e507eb01a088458df433f37814cb)
            check_type(argname="argument certificate_authority_id", value=certificate_authority_id, expected_type=type_hints["certificate_authority_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("AcmPca", jsii.invoke(self, "onCertificateAuthority", [certificate_authority_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateCertificateAuthority")
    def to_create_certificate_authority(self) -> "AcmPca":
        '''(experimental) Grants permission to create an AWS Private CA and its associated private key and configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthority.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toCreateCertificateAuthority", []))

    @jsii.member(jsii_name="toCreateCertificateAuthorityAuditReport")
    def to_create_certificate_authority_audit_report(self) -> "AcmPca":
        '''(experimental) Grants permission to create an audit report for an AWS Private CA.

        Access Level: Write

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreateCertificateAuthorityAuditReport.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toCreateCertificateAuthorityAuditReport", []))

    @jsii.member(jsii_name="toCreatePermission")
    def to_create_permission(self) -> "AcmPca":
        '''(experimental) Grants permission to create a permission for an AWS Private CA.

        Access Level: Permissions management

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_CreatePermission.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toCreatePermission", []))

    @jsii.member(jsii_name="toDeleteCertificateAuthority")
    def to_delete_certificate_authority(self) -> "AcmPca":
        '''(experimental) Grants permission to delete an AWS Private CA and its associated private key and configuration.

        Access Level: Write

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_DeleteCertificateAuthority.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toDeleteCertificateAuthority", []))

    @jsii.member(jsii_name="toDeletePermission")
    def to_delete_permission(self) -> "AcmPca":
        '''(experimental) Grants permission to delete a permission for an AWS Private CA.

        Access Level: Permissions management

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_DeletePermission.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toDeletePermission", []))

    @jsii.member(jsii_name="toDeletePolicy")
    def to_delete_policy(self) -> "AcmPca":
        '''(experimental) Grants permission to delete the policy for an AWS Private CA.

        Access Level: Permissions management

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_DeletePolicy.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toDeletePolicy", []))

    @jsii.member(jsii_name="toDescribeCertificateAuthority")
    def to_describe_certificate_authority(self) -> "AcmPca":
        '''(experimental) Grants permission to return a list of the configuration and status fields contained in the specified AWS Private CA.

        Access Level: Read

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_DescribeCertificateAuthority.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toDescribeCertificateAuthority", []))

    @jsii.member(jsii_name="toDescribeCertificateAuthorityAuditReport")
    def to_describe_certificate_authority_audit_report(self) -> "AcmPca":
        '''(experimental) Grants permission to return the status and information about an AWS Private CA audit report.

        Access Level: Read

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_DescribeCertificateAuthorityAuditReport.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toDescribeCertificateAuthorityAuditReport", []))

    @jsii.member(jsii_name="toGetCertificate")
    def to_get_certificate(self) -> "AcmPca":
        '''(experimental) Grants permission to retrieve an AWS Private CA certificate and certificate chain for the certificate authority specified by an ARN.

        Access Level: Read

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_GetCertificate.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toGetCertificate", []))

    @jsii.member(jsii_name="toGetCertificateAuthorityCertificate")
    def to_get_certificate_authority_certificate(self) -> "AcmPca":
        '''(experimental) Grants permission to retrieve an AWS Private CA certificate and certificate chain for the certificate authority specified by an ARN.

        Access Level: Read

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_GetCertificateAuthorityCertificate.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toGetCertificateAuthorityCertificate", []))

    @jsii.member(jsii_name="toGetCertificateAuthorityCsr")
    def to_get_certificate_authority_csr(self) -> "AcmPca":
        '''(experimental) Grants permission to retrieve an AWS Private CA certificate signing request (CSR) for the certificate-authority specified by an ARN.

        Access Level: Read

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_GetCertificateAuthorityCsr.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toGetCertificateAuthorityCsr", []))

    @jsii.member(jsii_name="toGetPolicy")
    def to_get_policy(self) -> "AcmPca":
        '''(experimental) Grants permission to retrieve the policy on an AWS Private CA.

        Access Level: Read

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_GetPolicy.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toGetPolicy", []))

    @jsii.member(jsii_name="toImportCertificateAuthorityCertificate")
    def to_import_certificate_authority_certificate(self) -> "AcmPca":
        '''(experimental) Grants permission to import an SSL/TLS certificate into AWS Private CA for use as the CA certificate of an AWS Private CA.

        Access Level: Write

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_ImportCertificateAuthorityCertificate.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toImportCertificateAuthorityCertificate", []))

    @jsii.member(jsii_name="toIssueCertificate")
    def to_issue_certificate(self) -> "AcmPca":
        '''(experimental) Grants permission to issue an AWS Private CA certificate.

        Access Level: Write

        Possible conditions:

        - .ifTemplateArn()

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_IssueCertificate.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toIssueCertificate", []))

    @jsii.member(jsii_name="toListCertificateAuthorities")
    def to_list_certificate_authorities(self) -> "AcmPca":
        '''(experimental) Grants permission to retrieve a list of the AWS Private CA certificate authority ARNs, and a summary of the status of each CA in the calling account.

        Access Level: List

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListCertificateAuthorities.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toListCertificateAuthorities", []))

    @jsii.member(jsii_name="toListPermissions")
    def to_list_permissions(self) -> "AcmPca":
        '''(experimental) Grants permission to list the permissions that have been applied to the AWS Private CA certificate authority.

        Access Level: Read

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListPermissions.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toListPermissions", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "AcmPca":
        '''(experimental) Grants permission to list the tags that have been applied to the AWS Private CA certificate authority.

        Access Level: Read

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_ListTags.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toPutPolicy")
    def to_put_policy(self) -> "AcmPca":
        '''(experimental) Grants permission to put a policy on an AWS Private CA.

        Access Level: Permissions management

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_PutPolicy.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toPutPolicy", []))

    @jsii.member(jsii_name="toRestoreCertificateAuthority")
    def to_restore_certificate_authority(self) -> "AcmPca":
        '''(experimental) Grants permission to restore an AWS Private CA from the deleted state to the state it was in when deleted.

        Access Level: Write

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_RestoreCertificateAuthority.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toRestoreCertificateAuthority", []))

    @jsii.member(jsii_name="toRevokeCertificate")
    def to_revoke_certificate(self) -> "AcmPca":
        '''(experimental) Grants permission to revoke a certificate issued by an AWS Private CA.

        Access Level: Write

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_RevokeCertificate.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toRevokeCertificate", []))

    @jsii.member(jsii_name="toTagCertificateAuthority")
    def to_tag_certificate_authority(self) -> "AcmPca":
        '''(experimental) Grants permission to add one or more tags to an AWS Private CA.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_TagCertificateAuthority.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toTagCertificateAuthority", []))

    @jsii.member(jsii_name="toUntagCertificateAuthority")
    def to_untag_certificate_authority(self) -> "AcmPca":
        '''(experimental) Grants permission to remove one or more tags from an AWS Private CA.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_UntagCertificateAuthority.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toUntagCertificateAuthority", []))

    @jsii.member(jsii_name="toUpdateCertificateAuthority")
    def to_update_certificate_authority(self) -> "AcmPca":
        '''(experimental) Grants permission to update the configuration of an AWS Private CA.

        Access Level: Write

        https://docs.aws.amazon.com/privateca/latest/APIReference/API_UpdateCertificateAuthority.html

        :stability: experimental
        '''
        return typing.cast("AcmPca", jsii.invoke(self, "toUpdateCertificateAuthority", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c0c199ede9d18871cdc3d542e69070c632f300b730810b75ca551eebb30da3ff)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a83cb111bf9c2b727aeb13aa3c2d850cccbf644868d1d0cf59ae59653d398e29)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Activate(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Activate",
):
    '''(experimental) Statement provider for service `activate <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsactivate.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `activate <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsactivate.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a4f5e3d2a87deed86d34c97b5834f1ca07472a67cdb17858162e6e7d7d6f0fa4)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toCreateForm")
    def to_create_form(self) -> "Activate":
        '''(experimental) Grants permission to submit an Activate application form.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Activate", jsii.invoke(self, "toCreateForm", []))

    @jsii.member(jsii_name="toGetAccountContact")
    def to_get_account_contact(self) -> "Activate":
        '''(experimental) Grants permission to get the AWS account contact information.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Activate", jsii.invoke(self, "toGetAccountContact", []))

    @jsii.member(jsii_name="toGetContentInfo")
    def to_get_content_info(self) -> "Activate":
        '''(experimental) Grants permission to get Activate tech posts and offer information.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Activate", jsii.invoke(self, "toGetContentInfo", []))

    @jsii.member(jsii_name="toGetCosts")
    def to_get_costs(self) -> "Activate":
        '''(experimental) Grants permission to get the AWS cost information.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Activate", jsii.invoke(self, "toGetCosts", []))

    @jsii.member(jsii_name="toGetCredits")
    def to_get_credits(self) -> "Activate":
        '''(experimental) Grants permission to get the AWS credit information.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Activate", jsii.invoke(self, "toGetCredits", []))

    @jsii.member(jsii_name="toGetMemberInfo")
    def to_get_member_info(self) -> "Activate":
        '''(experimental) Grants permission to get the Activate member information.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Activate", jsii.invoke(self, "toGetMemberInfo", []))

    @jsii.member(jsii_name="toGetProgram")
    def to_get_program(self) -> "Activate":
        '''(experimental) Grants permission to get an Activate program.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Activate", jsii.invoke(self, "toGetProgram", []))

    @jsii.member(jsii_name="toPutMemberInfo")
    def to_put_member_info(self) -> "Activate":
        '''(experimental) Grants permission to create or update the Activate member information.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Activate", jsii.invoke(self, "toPutMemberInfo", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f9b2b96a9f7b62c6843df00a8c03b5bfdef2ad154568579dedef4eb33d8eecc6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__929f9b83d5aeee90536f2a626fa09c282c24118a5192ac158197fc60b0f0cba4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Airflow(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Airflow"):
    '''(experimental) Statement provider for service `airflow <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedworkflowsforapacheairflow.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `airflow <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedworkflowsforapacheairflow.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bcec2e8f6965b483a4513523e089897405efc93c6c553d4b58bf018728c88264)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onEnvironment")
    def on_environment(
        self,
        environment_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Airflow":
        '''(experimental) Adds a resource of type environment to the statement.

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html#mwaa-resources

        :param environment_name: - Identifier for the environmentName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1bea05b15e3866937bdbc3a2ade2661b642009333c5a2e551931b6e476a2a7c7)
            check_type(argname="argument environment_name", value=environment_name, expected_type=type_hints["environment_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Airflow", jsii.invoke(self, "onEnvironment", [environment_name, account, region, partition]))

    @jsii.member(jsii_name="onRbacRole")
    def on_rbac_role(
        self,
        environment_name: builtins.str,
        role_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Airflow":
        '''(experimental) Adds a resource of type rbac-role to the statement.

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html#mwaa-resources

        :param environment_name: - Identifier for the environmentName.
        :param role_name: - Identifier for the roleName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__78e800396afc9c4999729b3fa2c61e214886af8f01453ef9f33a02d5ca14de79)
            check_type(argname="argument environment_name", value=environment_name, expected_type=type_hints["environment_name"])
            check_type(argname="argument role_name", value=role_name, expected_type=type_hints["role_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Airflow", jsii.invoke(self, "onRbacRole", [environment_name, role_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateCliToken")
    def to_create_cli_token(self) -> "Airflow":
        '''(experimental) Grants permission to create a short-lived token that allows a user to invoke Airflow CLI via an endpoint on the Apache Airflow Webserver.

        Access Level: Write

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toCreateCliToken", []))

    @jsii.member(jsii_name="toCreateEnvironment")
    def to_create_environment(self) -> "Airflow":
        '''(experimental) Grants permission to create an Amazon MWAA environment.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toCreateEnvironment", []))

    @jsii.member(jsii_name="toCreateWebLoginToken")
    def to_create_web_login_token(self) -> "Airflow":
        '''(experimental) Grants permission to create a short-lived token that allows a user to log into Apache Airflow web UI.

        Access Level: Write

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toCreateWebLoginToken", []))

    @jsii.member(jsii_name="toDeleteEnvironment")
    def to_delete_environment(self) -> "Airflow":
        '''(experimental) Grants permission to delete an Amazon MWAA environment.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toDeleteEnvironment", []))

    @jsii.member(jsii_name="toGetEnvironment")
    def to_get_environment(self) -> "Airflow":
        '''(experimental) Grants permission to view details about an Amazon MWAA environment.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toGetEnvironment", []))

    @jsii.member(jsii_name="toListEnvironments")
    def to_list_environments(self) -> "Airflow":
        '''(experimental) Grants permission to list the Amazon MWAA environments in your account.

        Access Level: List

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toListEnvironments", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Airflow":
        '''(experimental) Grants permission to lists tag for an Amazon MWAA environment.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPublishMetrics")
    def to_publish_metrics(self) -> "Airflow":
        '''(experimental) Grants permission to publish metrics for an Amazon MWAA environment.

        Access Level: Write

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toPublishMetrics", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Airflow":
        '''(experimental) Grants permission to tag an Amazon MWAA environment.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Airflow":
        '''(experimental) Grants permission to untag an Amazon MWAA environment.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateEnvironment")
    def to_update_environment(self) -> "Airflow":
        '''(experimental) Grants permission to modify an Amazon MWAA environment.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-actions-resources.html

        :stability: experimental
        '''
        return typing.cast("Airflow", jsii.invoke(self, "toUpdateEnvironment", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9933dd0ee11b91147ba7d39246fe175a102bae7e5438e1013344d486ca0c6167)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a921e0ff9493702085299da9ae1f65a92bd15811a3fa5be2cfa5762f8a8c8c7f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class All(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.All"):
    '''(experimental) Action provider for all services.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Action provider for all services.

        Use this provider to globally allow/deny actions, based on global conditions.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ff99b89bab8987008ce3c867eab18192d615ea08d588bfe5134b45c114b21027)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])


class Amplify(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Amplify"):
    '''(experimental) Statement provider for service `amplify <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsamplify.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `amplify <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsamplify.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ea911c20f41d8e05bcade090f28b9caeeabeaac6b198a1e6b9410999335d7e4b)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onApps")
    def on_apps(
        self,
        app_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplify":
        '''(experimental) Adds a resource of type apps to the statement.

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :param app_id: - Identifier for the appId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__63954fa7ebcaef07492f470ccd2d7773b2a9c09361d15004167dcc00c6a1f0be)
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Amplify", jsii.invoke(self, "onApps", [app_id, account, region, partition]))

    @jsii.member(jsii_name="onBranches")
    def on_branches(
        self,
        app_id: builtins.str,
        branch_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplify":
        '''(experimental) Adds a resource of type branches to the statement.

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :param app_id: - Identifier for the appId.
        :param branch_name: - Identifier for the branchName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3a03edd896ef5a245307ee843a4d20ebce2ade99f9f1442292c732057659bf3a)
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument branch_name", value=branch_name, expected_type=type_hints["branch_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Amplify", jsii.invoke(self, "onBranches", [app_id, branch_name, account, region, partition]))

    @jsii.member(jsii_name="onDomains")
    def on_domains(
        self,
        app_id: builtins.str,
        domain_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplify":
        '''(experimental) Adds a resource of type domains to the statement.

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :param app_id: - Identifier for the appId.
        :param domain_name: - Identifier for the domainName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8b7aace0e71bff1b3bb2d8015c652dde8589a8f07a2c7ab6a368ee37bdd285a8)
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Amplify", jsii.invoke(self, "onDomains", [app_id, domain_name, account, region, partition]))

    @jsii.member(jsii_name="onJobs")
    def on_jobs(
        self,
        app_id: builtins.str,
        branch_name: builtins.str,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplify":
        '''(experimental) Adds a resource of type jobs to the statement.

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :param app_id: - Identifier for the appId.
        :param branch_name: - Identifier for the branchName.
        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6b5f0ba2996067cd005925fb71f8ceaa815e9d9628f3a4779ed6a75c1e3dc86b)
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument branch_name", value=branch_name, expected_type=type_hints["branch_name"])
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Amplify", jsii.invoke(self, "onJobs", [app_id, branch_name, job_id, account, region, partition]))

    @jsii.member(jsii_name="onWebhooks")
    def on_webhooks(
        self,
        webhook_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplify":
        '''(experimental) Adds a resource of type webhooks to the statement.

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :param webhook_id: - Identifier for the webhookId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__058bcefea185bc195a9a76e0042a0c138ef0dd802368fd6e4491dbf2506c2705)
            check_type(argname="argument webhook_id", value=webhook_id, expected_type=type_hints["webhook_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Amplify", jsii.invoke(self, "onWebhooks", [webhook_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateApp")
    def to_create_app(self) -> "Amplify":
        '''(experimental) Grants permission to create a new Amplify App.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toCreateApp", []))

    @jsii.member(jsii_name="toCreateBackendEnvironment")
    def to_create_backend_environment(self) -> "Amplify":
        '''(experimental) Grants permission to create a new backend environment for an Amplify App.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toCreateBackendEnvironment", []))

    @jsii.member(jsii_name="toCreateBranch")
    def to_create_branch(self) -> "Amplify":
        '''(experimental) Grants permission to create a new Branch for an Amplify App.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toCreateBranch", []))

    @jsii.member(jsii_name="toCreateDeployment")
    def to_create_deployment(self) -> "Amplify":
        '''(experimental) Grants permission to create a deployment for manual deploy apps. (Apps are not connected to repository).

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toCreateDeployment", []))

    @jsii.member(jsii_name="toCreateDomainAssociation")
    def to_create_domain_association(self) -> "Amplify":
        '''(experimental) Grants permission to create a new DomainAssociation on an App.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toCreateDomainAssociation", []))

    @jsii.member(jsii_name="toCreateWebHook")
    def to_create_web_hook(self) -> "Amplify":
        '''(experimental) Grants permission to create a new webhook on an App.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toCreateWebHook", []))

    @jsii.member(jsii_name="toDeleteApp")
    def to_delete_app(self) -> "Amplify":
        '''(experimental) Grants permission to delete an existing Amplify App by appId.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toDeleteApp", []))

    @jsii.member(jsii_name="toDeleteBackendEnvironment")
    def to_delete_backend_environment(self) -> "Amplify":
        '''(experimental) Grants permission to delete a branch for an Amplify App.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toDeleteBackendEnvironment", []))

    @jsii.member(jsii_name="toDeleteBranch")
    def to_delete_branch(self) -> "Amplify":
        '''(experimental) Grants permission to delete a branch for an Amplify App.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toDeleteBranch", []))

    @jsii.member(jsii_name="toDeleteDomainAssociation")
    def to_delete_domain_association(self) -> "Amplify":
        '''(experimental) Grants permission to delete a DomainAssociation.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toDeleteDomainAssociation", []))

    @jsii.member(jsii_name="toDeleteJob")
    def to_delete_job(self) -> "Amplify":
        '''(experimental) Grants permission to delete a job, for an Amplify branch, part of Amplify App.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toDeleteJob", []))

    @jsii.member(jsii_name="toDeleteWebHook")
    def to_delete_web_hook(self) -> "Amplify":
        '''(experimental) Grants permission to delete a webhook by id.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toDeleteWebHook", []))

    @jsii.member(jsii_name="toGenerateAccessLogs")
    def to_generate_access_logs(self) -> "Amplify":
        '''(experimental) Grants permission to generate website access logs for a specific time range via a pre-signed URL.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toGenerateAccessLogs", []))

    @jsii.member(jsii_name="toGetApp")
    def to_get_app(self) -> "Amplify":
        '''(experimental) Grants permission to retrieve an existing Amplify App by appId.

        Access Level: Read

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toGetApp", []))

    @jsii.member(jsii_name="toGetArtifactUrl")
    def to_get_artifact_url(self) -> "Amplify":
        '''(experimental) Grants permission to retrieve artifact info that corresponds to a artifactId.

        Access Level: Read

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toGetArtifactUrl", []))

    @jsii.member(jsii_name="toGetBackendEnvironment")
    def to_get_backend_environment(self) -> "Amplify":
        '''(experimental) Grants permission to retrieve a backend environment for an Amplify App.

        Access Level: Read

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toGetBackendEnvironment", []))

    @jsii.member(jsii_name="toGetBranch")
    def to_get_branch(self) -> "Amplify":
        '''(experimental) Grants permission to retrieve a branch for an Amplify App.

        Access Level: Read

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toGetBranch", []))

    @jsii.member(jsii_name="toGetDomainAssociation")
    def to_get_domain_association(self) -> "Amplify":
        '''(experimental) Grants permission to retrieve domain info that corresponds to an appId and domainName.

        Access Level: Read

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toGetDomainAssociation", []))

    @jsii.member(jsii_name="toGetJob")
    def to_get_job(self) -> "Amplify":
        '''(experimental) Grants permission to get a job for a branch, part of an Amplify App.

        Access Level: Read

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toGetJob", []))

    @jsii.member(jsii_name="toGetWebHook")
    def to_get_web_hook(self) -> "Amplify":
        '''(experimental) Grants permission to retrieve webhook info that corresponds to a webhookId.

        Access Level: Read

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toGetWebHook", []))

    @jsii.member(jsii_name="toListApps")
    def to_list_apps(self) -> "Amplify":
        '''(experimental) Grants permission to list existing Amplify Apps.

        Access Level: List

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toListApps", []))

    @jsii.member(jsii_name="toListArtifacts")
    def to_list_artifacts(self) -> "Amplify":
        '''(experimental) Grants permission to list artifacts with an app, a branch, a job and an artifact type.

        Access Level: List

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toListArtifacts", []))

    @jsii.member(jsii_name="toListBackendEnvironments")
    def to_list_backend_environments(self) -> "Amplify":
        '''(experimental) Grants permission to list backend environments for an Amplify App.

        Access Level: List

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toListBackendEnvironments", []))

    @jsii.member(jsii_name="toListBranches")
    def to_list_branches(self) -> "Amplify":
        '''(experimental) Grants permission to list branches for an Amplify App.

        Access Level: List

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toListBranches", []))

    @jsii.member(jsii_name="toListDomainAssociations")
    def to_list_domain_associations(self) -> "Amplify":
        '''(experimental) Grants permission to list domains with an app.

        Access Level: List

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toListDomainAssociations", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Amplify":
        '''(experimental) Grants permission to list Jobs for a branch, part of an Amplify App.

        Access Level: List

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Amplify":
        '''(experimental) Grants permission to list tags for an AWS Amplify Console resource.

        Access Level: Read

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWebHooks")
    def to_list_web_hooks(self) -> "Amplify":
        '''(experimental) Grants permission to list webhooks on an App.

        Access Level: List

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toListWebHooks", []))

    @jsii.member(jsii_name="toStartDeployment")
    def to_start_deployment(self) -> "Amplify":
        '''(experimental) Grants permission to start a deployment for manual deploy apps. (Apps are not connected to repository).

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toStartDeployment", []))

    @jsii.member(jsii_name="toStartJob")
    def to_start_job(self) -> "Amplify":
        '''(experimental) Grants permission to start a new job for a branch, part of an Amplify App.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toStartJob", []))

    @jsii.member(jsii_name="toStopJob")
    def to_stop_job(self) -> "Amplify":
        '''(experimental) Grants permission to stop a job that is in progress, for an Amplify branch, part of Amplify App.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toStopJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Amplify":
        '''(experimental) Grants permission to tag an AWS Amplify Console resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Amplify":
        '''(experimental) Grants permission to remove a tag from an AWS Amplify Console resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApp")
    def to_update_app(self) -> "Amplify":
        '''(experimental) Grants permission to update an existing Amplify App.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toUpdateApp", []))

    @jsii.member(jsii_name="toUpdateBranch")
    def to_update_branch(self) -> "Amplify":
        '''(experimental) Grants permission to update a branch for an Amplify App.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toUpdateBranch", []))

    @jsii.member(jsii_name="toUpdateDomainAssociation")
    def to_update_domain_association(self) -> "Amplify":
        '''(experimental) Grants permission to update a DomainAssociation on an App.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toUpdateDomainAssociation", []))

    @jsii.member(jsii_name="toUpdateWebHook")
    def to_update_web_hook(self) -> "Amplify":
        '''(experimental) Grants permission to update a webhook.

        Access Level: Write

        https://docs.aws.amazon.com/amplify/latest/userguide/welcome.html

        :stability: experimental
        '''
        return typing.cast("Amplify", jsii.invoke(self, "toUpdateWebHook", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f278b570e92bc5658e303aa7216ef9b0027e41c728e0c2801ca0ed97bf4297cf)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4118b7dc616fce0eec06dc9075f4d60dbf7492bff6b048f3463ad447a202afd4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Amplifybackend(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Amplifybackend",
):
    '''(experimental) Statement provider for service `amplifybackend <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsamplifyadmin.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `amplifybackend <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsamplifyadmin.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f08bdba844c5347c58776c27f374869f36f41de21f84e06f7e944b1d5ec62d32)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onApi")
    def on_api(
        self,
        app_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplifybackend":
        '''(experimental) Adds a resource of type api to the statement.

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-api.html

        :param app_id: - Identifier for the appId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7b167fcbd32fb7ae90dc86f822083f646163da366e5d92d82a6aed69c91b435c)
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Amplifybackend", jsii.invoke(self, "onApi", [app_id, account, region, partition]))

    @jsii.member(jsii_name="onAuth")
    def on_auth(
        self,
        app_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplifybackend":
        '''(experimental) Adds a resource of type auth to the statement.

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-auth.html

        :param app_id: - Identifier for the appId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ef71bbeb950dd2b439644bc6a47a91132ef4fe54e697400114b3549c02c0001e)
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Amplifybackend", jsii.invoke(self, "onAuth", [app_id, account, region, partition]))

    @jsii.member(jsii_name="onBackend")
    def on_backend(
        self,
        app_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplifybackend":
        '''(experimental) Adds a resource of type backend to the statement.

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend.html

        :param app_id: - Identifier for the appId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__97a02b6a80d94f75533f05a18a0c3d7b05a7a22bce24e787b6d2388b26bd46f0)
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Amplifybackend", jsii.invoke(self, "onBackend", [app_id, account, region, partition]))

    @jsii.member(jsii_name="onConfig")
    def on_config(
        self,
        app_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplifybackend":
        '''(experimental) Adds a resource of type config to the statement.

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-config.html

        :param app_id: - Identifier for the appId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9819306678061ff5b7feda95bc3681c29039c76b754463723779239203241c4f)
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Amplifybackend", jsii.invoke(self, "onConfig", [app_id, account, region, partition]))

    @jsii.member(jsii_name="onEnvironment")
    def on_environment(
        self,
        app_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplifybackend":
        '''(experimental) Adds a resource of type environment to the statement.

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-api-backendenvironmentname-details.html

        :param app_id: - Identifier for the appId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d465a8a8cd292c8abe4798fc170da54a9d96c2d70c61b3cd77a4e60d17c11f24)
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Amplifybackend", jsii.invoke(self, "onEnvironment", [app_id, account, region, partition]))

    @jsii.member(jsii_name="onJob")
    def on_job(
        self,
        app_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplifybackend":
        '''(experimental) Adds a resource of type job to the statement.

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-job-backendenvironmentname.html

        :param app_id: - Identifier for the appId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a03b21dc1d3ca77be81a5e590493a69cff129947ab9e44dde37c7e4afe9cda7e)
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Amplifybackend", jsii.invoke(self, "onJob", [app_id, account, region, partition]))

    @jsii.member(jsii_name="onStorage")
    def on_storage(
        self,
        app_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplifybackend":
        '''(experimental) Adds a resource of type storage to the statement.

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-storage.html

        :param app_id: - Identifier for the appId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1baaa8002577f07c76371697803ac01138ef4b8a7e4a72602b43fea25e05daf8)
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Amplifybackend", jsii.invoke(self, "onStorage", [app_id, account, region, partition]))

    @jsii.member(jsii_name="onToken")
    def on_token(
        self,
        app_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplifybackend":
        '''(experimental) Adds a resource of type token to the statement.

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-token.html

        :param app_id: - Identifier for the appId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4f7d8c7078b2f48005e7b04042af64ab60e0cace254ba41cf40e0820045a4a7f)
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Amplifybackend", jsii.invoke(self, "onToken", [app_id, account, region, partition]))

    @jsii.member(jsii_name="toCloneBackend")
    def to_clone_backend(self) -> "Amplifybackend":
        '''(experimental) Grants permission to clone an existing Amplify Admin backend environment into a new Amplify Admin backend enviroment.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-environments-backendenvironmentname-clone.html#CloneBackend

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toCloneBackend", []))

    @jsii.member(jsii_name="toCreateBackend")
    def to_create_backend(self) -> "Amplifybackend":
        '''(experimental) Grants permission to create a new Amplify Admin backend environment by Amplify appId.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend.html#CreateBackend

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toCreateBackend", []))

    @jsii.member(jsii_name="toCreateBackendAPI")
    def to_create_backend_api(self) -> "Amplifybackend":
        '''(experimental) Grants permission to create an API for an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-api.html#CreateBackendAPI

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toCreateBackendAPI", []))

    @jsii.member(jsii_name="toCreateBackendAuth")
    def to_create_backend_auth(self) -> "Amplifybackend":
        '''(experimental) Grants permission to create an auth resource for an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-auth.html#CreateBackendAuth

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toCreateBackendAuth", []))

    @jsii.member(jsii_name="toCreateBackendConfig")
    def to_create_backend_config(self) -> "Amplifybackend":
        '''(experimental) Grants permission to create a new Amplify Admin backend config by Amplify appId.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-config.html#CreateBackendConfig

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toCreateBackendConfig", []))

    @jsii.member(jsii_name="toCreateBackendStorage")
    def to_create_backend_storage(self) -> "Amplifybackend":
        '''(experimental) Grants permission to create a backend storage resource.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-storage.html#CreateBackendStorage

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toCreateBackendStorage", []))

    @jsii.member(jsii_name="toCreateToken")
    def to_create_token(self) -> "Amplifybackend":
        '''(experimental) Grants permission to create an Amplify Admin challenge token by appId.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-challenge.html#CreateToken

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toCreateToken", []))

    @jsii.member(jsii_name="toDeleteBackend")
    def to_delete_backend(self) -> "Amplifybackend":
        '''(experimental) Grants permission to delete an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-environments-backendenvironmentname-remove.html#DeleteBackend

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toDeleteBackend", []))

    @jsii.member(jsii_name="toDeleteBackendAPI")
    def to_delete_backend_api(self) -> "Amplifybackend":
        '''(experimental) Grants permission to delete an API of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-api-backendenvironmentname-remove.html#DeleteBackendAPI

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toDeleteBackendAPI", []))

    @jsii.member(jsii_name="toDeleteBackendAuth")
    def to_delete_backend_auth(self) -> "Amplifybackend":
        '''(experimental) Grants permission to delete an auth resource of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-auth-backendenvironmentname-remove.html#DeleteBackendAuth

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toDeleteBackendAuth", []))

    @jsii.member(jsii_name="toDeleteBackendStorage")
    def to_delete_backend_storage(self) -> "Amplifybackend":
        '''(experimental) Grants permission to delete a backend storage resource.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-storage.html#DeleteBackendStorage

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toDeleteBackendStorage", []))

    @jsii.member(jsii_name="toDeleteToken")
    def to_delete_token(self) -> "Amplifybackend":
        '''(experimental) Grants permission to delete an Amplify Admin challenge token by appId.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-challenge-sessionid-remove.html#DeleteToken

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toDeleteToken", []))

    @jsii.member(jsii_name="toGenerateBackendAPIModels")
    def to_generate_backend_api_models(self) -> "Amplifybackend":
        '''(experimental) Grants permission to generate models for an API of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-api-backendenvironmentname-generatemodels.html#GenerateBackendAPIModels

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toGenerateBackendAPIModels", []))

    @jsii.member(jsii_name="toGetBackend")
    def to_get_backend(self) -> "Amplifybackend":
        '''(experimental) Grants permission to retrieve an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Read

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-details.html#GetBackend

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toGetBackend", []))

    @jsii.member(jsii_name="toGetBackendAPI")
    def to_get_backend_api(self) -> "Amplifybackend":
        '''(experimental) Grants permission to retrieve an API of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Read

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-api-backendenvironmentname-details.html#GetBackendAPI

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toGetBackendAPI", []))

    @jsii.member(jsii_name="toGetBackendAPIModels")
    def to_get_backend_api_models(self) -> "Amplifybackend":
        '''(experimental) Grants permission to retrieve models for an API of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Read

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-api-backendenvironmentname-getmodels.html#GetBackendAPIModels

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toGetBackendAPIModels", []))

    @jsii.member(jsii_name="toGetBackendAuth")
    def to_get_backend_auth(self) -> "Amplifybackend":
        '''(experimental) Grants permission to retrieve an auth resource of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Read

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-auth-backendenvironmentname-details.html#GetBackendAuth

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toGetBackendAuth", []))

    @jsii.member(jsii_name="toGetBackendJob")
    def to_get_backend_job(self) -> "Amplifybackend":
        '''(experimental) Grants permission to retrieve a job of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Read

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-job-backendenvironmentname-jobid.html#GetBackendJob

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toGetBackendJob", []))

    @jsii.member(jsii_name="toGetBackendStorage")
    def to_get_backend_storage(self) -> "Amplifybackend":
        '''(experimental) Grants permission to retrieve an existing backend storage resource.

        Access Level: Read

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-storage.html#GetBackendStorage

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toGetBackendStorage", []))

    @jsii.member(jsii_name="toGetToken")
    def to_get_token(self) -> "Amplifybackend":
        '''(experimental) Grants permission to retrieve an Amplify Admin challenge token by appId.

        Access Level: Read

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-challenge-sessionid.html#GetToken

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toGetToken", []))

    @jsii.member(jsii_name="toImportBackendAuth")
    def to_import_backend_auth(self) -> "Amplifybackend":
        '''(experimental) Grants permission to import an existing auth resource of an Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-auth-backendenvironmentname.html#ImportBackendAuth

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toImportBackendAuth", []))

    @jsii.member(jsii_name="toImportBackendStorage")
    def to_import_backend_storage(self) -> "Amplifybackend":
        '''(experimental) Grants permission to import an existing backend storage resource.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-storage.html#ImportBackendStorage

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toImportBackendStorage", []))

    @jsii.member(jsii_name="toListBackendJobs")
    def to_list_backend_jobs(self) -> "Amplifybackend":
        '''(experimental) Grants permission to retrieve the jobs of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: List

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-job-backendenvironmentname.html#ListBackendJobs

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toListBackendJobs", []))

    @jsii.member(jsii_name="toListS3Buckets")
    def to_list_s3_buckets(self) -> "Amplifybackend":
        '''(experimental) Grants permission to retrieve s3 buckets.

        Access Level: List

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-storage.html#ListS3Buckets

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toListS3Buckets", []))

    @jsii.member(jsii_name="toRemoveAllBackends")
    def to_remove_all_backends(self) -> "Amplifybackend":
        '''(experimental) Grants permission to delete all existing Amplify Admin backend environments by appId.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-remove.html#RemoveAllBackends

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toRemoveAllBackends", []))

    @jsii.member(jsii_name="toRemoveBackendConfig")
    def to_remove_backend_config(self) -> "Amplifybackend":
        '''(experimental) Grants permission to delete an Amplify Admin backend config by Amplify appId.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-config-remove.html#RemoveBackendConfig

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toRemoveBackendConfig", []))

    @jsii.member(jsii_name="toUpdateBackendAPI")
    def to_update_backend_api(self) -> "Amplifybackend":
        '''(experimental) Grants permission to update an API of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-api-backendenvironmentname.html#UpdateBackendAPI

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toUpdateBackendAPI", []))

    @jsii.member(jsii_name="toUpdateBackendAuth")
    def to_update_backend_auth(self) -> "Amplifybackend":
        '''(experimental) Grants permission to update an auth resource of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-auth-backendenvironmentname.html#UpdateBackendAuth

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toUpdateBackendAuth", []))

    @jsii.member(jsii_name="toUpdateBackendConfig")
    def to_update_backend_config(self) -> "Amplifybackend":
        '''(experimental) Grants permission to update an Amplify Admin backend config by Amplify appId.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-config-update.html#UpdateBackendConfig

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toUpdateBackendConfig", []))

    @jsii.member(jsii_name="toUpdateBackendJob")
    def to_update_backend_job(self) -> "Amplifybackend":
        '''(experimental) Grants permission to update a job of an existing Amplify Admin backend environment by appId and backendEnvironmentName.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-job-backendenvironmentname-jobid.html#UpdateBackendJob

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toUpdateBackendJob", []))

    @jsii.member(jsii_name="toUpdateBackendStorage")
    def to_update_backend_storage(self) -> "Amplifybackend":
        '''(experimental) Grants permission to update a backend storage resource.

        Access Level: Write

        https://docs.aws.amazon.com/amplify-admin-ui/latest/APIReference/backend-appid-storage.html#UpdateBackendStorage

        :stability: experimental
        '''
        return typing.cast("Amplifybackend", jsii.invoke(self, "toUpdateBackendStorage", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6d7064e8715fb3679274c4761247fa156a2c8a9e899afcd4bdf1ef809f5d9ac0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__38e5a4b0fc1105d8aa1690179e11d4819495690b9f0bd1b0ee43bf542ec1c78e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Amplifyuibuilder(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Amplifyuibuilder",
):
    '''(experimental) Statement provider for service `amplifyuibuilder <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsamplifyuibuilder.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `amplifyuibuilder <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsamplifyuibuilder.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ccd6c1bce3be16f11b06a3f2eebcc19f78343eaf1c6a9061daa0ceb644eef6b4)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifComponentResourceAppId")
    def if_component_resource_app_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Amplifyuibuilder":
        '''(experimental) Filters access by the app ID.

        https://docs.aws.amazon.com/amplify/latest/APIReference/API_App.html

        Applies to resource types:

        - ComponentResource

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__75b1bbbe185b01fc8b2da32c829089823788a29ef88de1a4769fb66f63a404e1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "ifComponentResourceAppId", [value, operator]))

    @jsii.member(jsii_name="ifComponentResourceEnvironmentName")
    def if_component_resource_environment_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Amplifyuibuilder":
        '''(experimental) Filters access by the backend environment name.

        https://docs.aws.amazon.com/amplify/latest/APIReference/API_BackendEnvironment.html

        Applies to resource types:

        - ComponentResource

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2198835387421d36ad5189f330e78f199f129991f0823d142db3d36cd679003a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "ifComponentResourceEnvironmentName", [value, operator]))

    @jsii.member(jsii_name="ifComponentResourceId")
    def if_component_resource_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Amplifyuibuilder":
        '''(experimental) Filters access by the component ID.

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_Component.html

        Applies to resource types:

        - ComponentResource

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b41d95d3b89bdbef78f460f50a8f681efcffebd867ae6aca4631c078dc0e29dd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "ifComponentResourceId", [value, operator]))

    @jsii.member(jsii_name="ifFormResourceAppId")
    def if_form_resource_app_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Amplifyuibuilder":
        '''(experimental) Filters access by the app ID.

        https://docs.aws.amazon.com/amplify/latest/APIReference/API_App.html

        Applies to resource types:

        - FormResource

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__44d26b1f9e981f3204c28d4f6ee7f29d3e3892de7f446df513137286c3a1ecd3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "ifFormResourceAppId", [value, operator]))

    @jsii.member(jsii_name="ifFormResourceEnvironmentName")
    def if_form_resource_environment_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Amplifyuibuilder":
        '''(experimental) Filters access by the backend environment name.

        https://docs.aws.amazon.com/amplify/latest/APIReference/API_BackendEnvironment.html

        Applies to resource types:

        - FormResource

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6cd0d8930d54d69df3069863a6109b8d8adc6010608a4903649a6e3251afa635)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "ifFormResourceEnvironmentName", [value, operator]))

    @jsii.member(jsii_name="ifFormResourceId")
    def if_form_resource_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Amplifyuibuilder":
        '''(experimental) Filters access by the form ID.

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_Form.html

        Applies to resource types:

        - FormResource

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7b14bf711ff738f63cc162fb8a66767620c6977871188b83b889ee71983eae80)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "ifFormResourceId", [value, operator]))

    @jsii.member(jsii_name="ifThemeResourceAppId")
    def if_theme_resource_app_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Amplifyuibuilder":
        '''(experimental) Filters access by the app ID.

        https://docs.aws.amazon.com/amplify/latest/APIReference/API_App.html

        Applies to resource types:

        - ThemeResource

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9b25ba382215dfb4a49c6cc4c906e44428157f90d03b9bd056859767ac718018)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "ifThemeResourceAppId", [value, operator]))

    @jsii.member(jsii_name="ifThemeResourceEnvironmentName")
    def if_theme_resource_environment_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Amplifyuibuilder":
        '''(experimental) Filters access by the backend environment name.

        https://docs.aws.amazon.com/amplify/latest/APIReference/API_BackendEnvironment.html

        Applies to resource types:

        - ThemeResource

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__78a059d51b059ac1febfe11340bf0cac46a841733f0875e2391e44392dbbb88d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "ifThemeResourceEnvironmentName", [value, operator]))

    @jsii.member(jsii_name="ifThemeResourceId")
    def if_theme_resource_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Amplifyuibuilder":
        '''(experimental) Filters access by the theme ID.

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_Theme.html

        Applies to resource types:

        - ThemeResource

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__baf6a88fd699183966ca738d1f713e6bc5edabc1afe4888055ac47fe77189fc2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "ifThemeResourceId", [value, operator]))

    @jsii.member(jsii_name="onComponentResource")
    def on_component_resource(
        self,
        app_id: builtins.str,
        environment_name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplifyuibuilder":
        '''(experimental) Adds a resource of type ComponentResource to the statement.

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_Component.html

        :param app_id: - Identifier for the appId.
        :param environment_name: - Identifier for the environmentName.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifComponentResourceAppId() - .ifComponentResourceEnvironmentName() - .ifComponentResourceId() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__46da67faec1c019e51464034f0393f055a492f983b39689247b3016b28b5e674)
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument environment_name", value=environment_name, expected_type=type_hints["environment_name"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "onComponentResource", [app_id, environment_name, id, account, region, partition]))

    @jsii.member(jsii_name="onFormResource")
    def on_form_resource(
        self,
        app_id: builtins.str,
        environment_name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplifyuibuilder":
        '''(experimental) Adds a resource of type FormResource to the statement.

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_Form.html

        :param app_id: - Identifier for the appId.
        :param environment_name: - Identifier for the environmentName.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifFormResourceAppId() - .ifFormResourceEnvironmentName() - .ifFormResourceId() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__233e0437fa0b92045799a763fe4b72e753472c5d477068afd238f88dc935c71c)
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument environment_name", value=environment_name, expected_type=type_hints["environment_name"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "onFormResource", [app_id, environment_name, id, account, region, partition]))

    @jsii.member(jsii_name="onThemeResource")
    def on_theme_resource(
        self,
        app_id: builtins.str,
        environment_name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Amplifyuibuilder":
        '''(experimental) Adds a resource of type ThemeResource to the statement.

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_Theme.html

        :param app_id: - Identifier for the appId.
        :param environment_name: - Identifier for the environmentName.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifThemeResourceAppId() - .ifThemeResourceEnvironmentName() - .ifThemeResourceId() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e0b25023fef03215d25dd149562b176f4a663c3941fa56851c4f0da860b8dd8b)
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument environment_name", value=environment_name, expected_type=type_hints["environment_name"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "onThemeResource", [app_id, environment_name, id, account, region, partition]))

    @jsii.member(jsii_name="toCreateComponent")
    def to_create_component(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to create a component.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - amplify:GetApp

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_CreateComponent.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toCreateComponent", []))

    @jsii.member(jsii_name="toCreateForm")
    def to_create_form(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to create a form.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - amplify:GetApp

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_CreateForm.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toCreateForm", []))

    @jsii.member(jsii_name="toCreateTheme")
    def to_create_theme(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to create a theme.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - amplify:GetApp

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_CreateTheme.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toCreateTheme", []))

    @jsii.member(jsii_name="toDeleteComponent")
    def to_delete_component(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to delete a component.

        Access Level: Write

        Dependent actions:

        - amplify:GetApp

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_DeleteComponent.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toDeleteComponent", []))

    @jsii.member(jsii_name="toDeleteForm")
    def to_delete_form(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to delete a form.

        Access Level: Write

        Dependent actions:

        - amplify:GetApp

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_DeleteForm.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toDeleteForm", []))

    @jsii.member(jsii_name="toDeleteTheme")
    def to_delete_theme(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to delete a theme.

        Access Level: Write

        Dependent actions:

        - amplify:GetApp

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_DeleteTheme.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toDeleteTheme", []))

    @jsii.member(jsii_name="toExportComponents")
    def to_export_components(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to export components.

        Access Level: Read

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_ExportComponents.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toExportComponents", []))

    @jsii.member(jsii_name="toExportForms")
    def to_export_forms(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to export forms.

        Access Level: Read

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_ExportForms.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toExportForms", []))

    @jsii.member(jsii_name="toExportThemes")
    def to_export_themes(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to export themes.

        Access Level: Read

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_ExportThemes.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toExportThemes", []))

    @jsii.member(jsii_name="toGetComponent")
    def to_get_component(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to get an existing component.

        Access Level: Read

        Dependent actions:

        - amplify:GetApp

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_GetComponent.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toGetComponent", []))

    @jsii.member(jsii_name="toGetForm")
    def to_get_form(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to get an existing form.

        Access Level: Read

        Dependent actions:

        - amplify:GetApp

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_GetForm.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toGetForm", []))

    @jsii.member(jsii_name="toGetMetadata")
    def to_get_metadata(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to get an existing metadata.

        Access Level: Read

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_GetMetadata.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toGetMetadata", []))

    @jsii.member(jsii_name="toGetTheme")
    def to_get_theme(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to get an existing theme.

        Access Level: Read

        Dependent actions:

        - amplify:GetApp

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_GetTheme.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toGetTheme", []))

    @jsii.member(jsii_name="toListComponents")
    def to_list_components(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to list components.

        Access Level: List

        Dependent actions:

        - amplify:GetApp

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_ListComponents.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toListComponents", []))

    @jsii.member(jsii_name="toListForms")
    def to_list_forms(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to list forms.

        Access Level: List

        Dependent actions:

        - amplify:GetApp

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_ListForms.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toListForms", []))

    @jsii.member(jsii_name="toListThemes")
    def to_list_themes(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to list themes.

        Access Level: List

        Dependent actions:

        - amplify:GetApp

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_ListThemes.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toListThemes", []))

    @jsii.member(jsii_name="toPutMetadataFlag")
    def to_put_metadata_flag(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to put an existing metadata.

        Access Level: Write

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_PutMetadataFlag.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toPutMetadataFlag", []))

    @jsii.member(jsii_name="toResetMetadataFlag")
    def to_reset_metadata_flag(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to reset an existing metadata.

        Access Level: Write

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_ResetMetadataFlag.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toResetMetadataFlag", []))

    @jsii.member(jsii_name="toUpdateComponent")
    def to_update_component(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to update a component.

        Access Level: Write

        Dependent actions:

        - amplify:GetApp

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_UpdateComponent.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toUpdateComponent", []))

    @jsii.member(jsii_name="toUpdateForm")
    def to_update_form(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to update a form.

        Access Level: Write

        Dependent actions:

        - amplify:GetApp

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_UpdateForm.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toUpdateForm", []))

    @jsii.member(jsii_name="toUpdateTheme")
    def to_update_theme(self) -> "Amplifyuibuilder":
        '''(experimental) Grants permission to update a theme.

        Access Level: Write

        Dependent actions:

        - amplify:GetApp

        https://docs.aws.amazon.com/amplifyuibuilder/latest/APIReference/API_UpdateTheme.html

        :stability: experimental
        '''
        return typing.cast("Amplifyuibuilder", jsii.invoke(self, "toUpdateTheme", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e4f81a4f95ccfcadbad31b84f45ef0f2aeed78e6b12ed2b78c480f786fb02c91)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6abedb2f0c63cdaa54b2fb3d151c30c39a1e792896808e5c517e363db03bd5c9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Aoss(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Aoss"):
    '''(experimental) Statement provider for service `aoss <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonopensearchserverless.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aoss <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonopensearchserverless.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e00bbc1f2534c43ad853bbf54a3ec0fdfd1e37e9dce348b9b52bfa94bba8c2bc)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifCollection")
    def if_collection(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Aoss":
        '''(experimental) Filters access by the collection name.

        https://docs.aws.amazon.com/opensearch-service/latest/developerguide/security-iam-serverless.html#security_iam_serverless-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2b82826c3b3d995a66dea55869d8b989e2364e488861756129bf14143c481364)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Aoss", jsii.invoke(self, "ifCollection", [value, operator]))

    @jsii.member(jsii_name="ifCollectionId")
    def if_collection_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Aoss":
        '''(experimental) Filters access by the identifier of the collection.

        https://docs.aws.amazon.com/opensearch-service/latest/developerguide/security-iam-serverless.html#security_iam_serverless-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a7416c4da0c335e30c5ec7d31adfa82b586c326a80e81d4899bc052473d41932)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Aoss", jsii.invoke(self, "ifCollectionId", [value, operator]))

    @jsii.member(jsii_name="ifIndex")
    def if_index(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Aoss":
        '''(experimental) Filters access by the index.

        https://docs.aws.amazon.com/opensearch-service/latest/developerguide/security-iam-serverless.html#security_iam_serverless-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ec91b36437a242d4e9726530cc0096509ff6f73ba4a34c4dcac802939877fbd1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Aoss", jsii.invoke(self, "ifIndex", [value, operator]))

    @jsii.member(jsii_name="onCollection")
    def on_collection(
        self,
        collection_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Aoss":
        '''(experimental) Adds a resource of type Collection to the statement.

        https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-overview.html

        :param collection_id: - Identifier for the collectionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0d6c43d0f943af100cee5781309a8d6c74089281588956b35271e05298392e64)
            check_type(argname="argument collection_id", value=collection_id, expected_type=type_hints["collection_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Aoss", jsii.invoke(self, "onCollection", [collection_id, account, region, partition]))

    @jsii.member(jsii_name="toBatchGetCollection")
    def to_batch_get_collection(self) -> "Aoss":
        '''(experimental) Grants permission to get attributes for one or more collections.

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_BatchGetCollection.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toBatchGetCollection", []))

    @jsii.member(jsii_name="toBatchGetVpcEndpoint")
    def to_batch_get_vpc_endpoint(self) -> "Aoss":
        '''(experimental) Grants permission to get attributes for one or more VPC endpoints.

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_BatchGetVpcEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toBatchGetVpcEndpoint", []))

    @jsii.member(jsii_name="toCreateAccessPolicy")
    def to_create_access_policy(self) -> "Aoss":
        '''(experimental) Grants permission to create a data access policy.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_CreateAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toCreateAccessPolicy", []))

    @jsii.member(jsii_name="toCreateCollection")
    def to_create_collection(self) -> "Aoss":
        '''(experimental) Grants permission to create a serverless collection.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_CreateCollection.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toCreateCollection", []))

    @jsii.member(jsii_name="toCreateSecurityConfig")
    def to_create_security_config(self) -> "Aoss":
        '''(experimental) Grants permission to create a serverless security configuration.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_CreateSecurityConfig.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toCreateSecurityConfig", []))

    @jsii.member(jsii_name="toCreateSecurityPolicy")
    def to_create_security_policy(self) -> "Aoss":
        '''(experimental) Grants permission to create a network or encryption policy.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_CreateSecurityPolicy.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toCreateSecurityPolicy", []))

    @jsii.member(jsii_name="toCreateVpcEndpoint")
    def to_create_vpc_endpoint(self) -> "Aoss":
        '''(experimental) Grants permission to create an OpenSearch-Serverless-managed interface VPC endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_CreateVpcEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toCreateVpcEndpoint", []))

    @jsii.member(jsii_name="toDeleteAccessPolicy")
    def to_delete_access_policy(self) -> "Aoss":
        '''(experimental) Grants permission to delete a data access policy.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_DeleteAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toDeleteAccessPolicy", []))

    @jsii.member(jsii_name="toDeleteCollection")
    def to_delete_collection(self) -> "Aoss":
        '''(experimental) Grants permission to delete a serverless collection.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_DeleteCollection.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toDeleteCollection", []))

    @jsii.member(jsii_name="toDeleteSecurityConfig")
    def to_delete_security_config(self) -> "Aoss":
        '''(experimental) Grants permission to delete a security configuration.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_DeleteSecurityConfig.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toDeleteSecurityConfig", []))

    @jsii.member(jsii_name="toDeleteSecurityPolicy")
    def to_delete_security_policy(self) -> "Aoss":
        '''(experimental) Grants permission to delete a security policy.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_DeleteSecurityPolicy.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toDeleteSecurityPolicy", []))

    @jsii.member(jsii_name="toDeleteVpcEndpoint")
    def to_delete_vpc_endpoint(self) -> "Aoss":
        '''(experimental) Grants permission to delete an OpenSearch Serverless-managed interface VPC endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_DeleteVpcEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toDeleteVpcEndpoint", []))

    @jsii.member(jsii_name="toGetAccessPolicy")
    def to_get_access_policy(self) -> "Aoss":
        '''(experimental) Grants permission to get information about a data access policy.

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_GetAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toGetAccessPolicy", []))

    @jsii.member(jsii_name="toGetAccountSettings")
    def to_get_account_settings(self) -> "Aoss":
        '''(experimental) Grants permission to get account settings, including capacity settings.

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_GetAccountSettings.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toGetAccountSettings", []))

    @jsii.member(jsii_name="toGetPoliciesStats")
    def to_get_policies_stats(self) -> "Aoss":
        '''(experimental) Grants permission to get statistis about the security policies in your account.

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_GetPoliciesStats.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toGetPoliciesStats", []))

    @jsii.member(jsii_name="toGetSecurityConfig")
    def to_get_security_config(self) -> "Aoss":
        '''(experimental) Grants permission to get information about a serverless security configuration.

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_GetSecurityConfig.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toGetSecurityConfig", []))

    @jsii.member(jsii_name="toGetSecurityPolicy")
    def to_get_security_policy(self) -> "Aoss":
        '''(experimental) Grants permission to get information about a security policy.

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_GetSecurityPolicy.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toGetSecurityPolicy", []))

    @jsii.member(jsii_name="toListAccessPolicies")
    def to_list_access_policies(self) -> "Aoss":
        '''(experimental) Grants permission to list data access policies.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_ListAccessPolicies.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toListAccessPolicies", []))

    @jsii.member(jsii_name="toListCollections")
    def to_list_collections(self) -> "Aoss":
        '''(experimental) Grants permission to list collections.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_ListCollections.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toListCollections", []))

    @jsii.member(jsii_name="toListSecurityConfigs")
    def to_list_security_configs(self) -> "Aoss":
        '''(experimental) Grants permission to list security configurations.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_ListSecurityConfigs.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toListSecurityConfigs", []))

    @jsii.member(jsii_name="toListSecurityPolicies")
    def to_list_security_policies(self) -> "Aoss":
        '''(experimental) Grants permission to list security policies.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_ListSecurityPolicies.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toListSecurityPolicies", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Aoss":
        '''(experimental) Grants permission to list tags for a collection.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListVpcEndpoints")
    def to_list_vpc_endpoints(self) -> "Aoss":
        '''(experimental) Grants permission to list OpenSearch Serverless-managed VPC endpoints.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_ListVpcEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toListVpcEndpoints", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Aoss":
        '''(experimental) Grants permission to tag a serverless collection.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Aoss":
        '''(experimental) Grants permission to remove tags from a collection.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAccessPolicy")
    def to_update_access_policy(self) -> "Aoss":
        '''(experimental) Grants permission to update a data access policy.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_UpdateAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toUpdateAccessPolicy", []))

    @jsii.member(jsii_name="toUpdateAccountSettings")
    def to_update_account_settings(self) -> "Aoss":
        '''(experimental) Grants permission to update account settings, including capacity settings.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_UpdateAccountSettings.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toUpdateAccountSettings", []))

    @jsii.member(jsii_name="toUpdateCollection")
    def to_update_collection(self) -> "Aoss":
        '''(experimental) Grants permission to update a collection.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_UpdateCollection.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toUpdateCollection", []))

    @jsii.member(jsii_name="toUpdateSecurityConfig")
    def to_update_security_config(self) -> "Aoss":
        '''(experimental) Grants permission to update a security configuration.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_UpdateSecurityConfig.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toUpdateSecurityConfig", []))

    @jsii.member(jsii_name="toUpdateSecurityPolicy")
    def to_update_security_policy(self) -> "Aoss":
        '''(experimental) Grants permission to update a security policy.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_UpdateSecurityPolicy.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toUpdateSecurityPolicy", []))

    @jsii.member(jsii_name="toUpdateVpcEndpoint")
    def to_update_vpc_endpoint(self) -> "Aoss":
        '''(experimental) Grants permission to update an OpenSearch Serverless-managed VPC endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/ServerlessAPIReference/API_UpdateVpcEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Aoss", jsii.invoke(self, "toUpdateVpcEndpoint", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c511dc3e544f9ea8bb929b3c4261e2b3f040d6fcd2634ed9410d9b21384ff3a9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0fb2afde9403f2cbee55b5eebfde57abb62c0eb5ab0e9e1c43be07706c63cd67)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Apigateway(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Apigateway",
):
    '''(experimental) Statement provider for service `apigateway <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonapigatewaymanagement.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `apigateway <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonapigatewaymanagement.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8ebbbeafc4e0b59d69d5d6bc74726b58fbf5bbc76e11257e15e59b89d4c238b0)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifRequestAccessLoggingDestination")
    def if_request_access_logging_destination(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by access log destination. Available during the CreateStage and UpdateStage operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Stage
        - Stages

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e1abd6bdf144f9d1e386c5542d1f01eaa63ccdb91de3fb3b1ce79457202c9992)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestAccessLoggingDestination", [value, operator]))

    @jsii.member(jsii_name="ifRequestAccessLoggingFormat")
    def if_request_access_logging_format(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by access log format. Available during the CreateStage and UpdateStage operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Stage
        - Stages

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8e154f64e3e6ee3374004a8538c12e2807e02ae5a8c15845e24d295e6a0e5bc7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestAccessLoggingFormat", [value, operator]))

    @jsii.member(jsii_name="ifRequestApiKeyRequired")
    def if_request_api_key_required(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access based on whether an API key is required or not.

        Available during the CreateMethod and PutMethod operations. Also available as a collection during import and reimport

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Method
        - RestApi
        - RestApis

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__496f4f522ccdd53e12bdd53f3625f8dd7019f6a720a7e1318fd13f6f5bd7fdff)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestApiKeyRequired", [value]))

    @jsii.member(jsii_name="ifRequestApiName")
    def if_request_api_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by API name. Available during the CreateRestApi and UpdateRestApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - RestApi
        - RestApis

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eff2e8fb19f11ce316ef048ef143a1e891cdbe8af0c19d44025f37f2c838760e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestApiName", [value, operator]))

    @jsii.member(jsii_name="ifRequestAuthorizerType")
    def if_request_authorizer_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by type of authorizer in the request, for example TOKEN, REQUEST, JWT.

        Available during CreateAuthorizer and UpdateAuthorizer. Also available during import and reimport as an ArrayOfString

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Authorizer
        - Authorizers
        - RestApi
        - RestApis

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__243cdf3a76be7d207e2b2f576e5a487517af95871d4400023661f4acb26641c2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestAuthorizerType", [value, operator]))

    @jsii.member(jsii_name="ifRequestAuthorizerUri")
    def if_request_authorizer_uri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by URI of a Lambda authorizer function.

        Available during CreateAuthorizer and UpdateAuthorizer. Also available during import and reimport as an ArrayOfString

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Authorizer
        - Authorizers
        - RestApi
        - RestApis

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f423256c906304daef0e5d3966a80e2d6b0331ce48ea15afd9b949f0d1cb31a0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestAuthorizerUri", [value, operator]))

    @jsii.member(jsii_name="ifRequestDisableExecuteApiEndpoint")
    def if_request_disable_execute_api_endpoint(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by status of the default execute-api endpoint. Available during the CreateRestApi and DeleteRestApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - RestApi
        - RestApis

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__170bbb198958bee1bb14dc8b23e75da0a813ac18f6bf8e338ec3ce4e6244cc9d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestDisableExecuteApiEndpoint", [value]))

    @jsii.member(jsii_name="ifRequestEndpointType")
    def if_request_endpoint_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by endpoint type. Available during the CreateDomainName, UpdateDomainName, CreateRestApi, and UpdateRestApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - DomainName
        - DomainNames
        - RestApi
        - RestApis

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a34335d6386d953d99b8e2c07de54da96d947d379110c9b8f248da711675c7c7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestEndpointType", [value, operator]))

    @jsii.member(jsii_name="ifRequestMtlsTrustStoreUri")
    def if_request_mtls_trust_store_uri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by URI of the truststore used for mutual TLS authentication. Available during the CreateDomainName and UpdateDomainName operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - DomainName
        - DomainNames

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6ee15b3ab8d867498b529f8de44ce103351bbbd91a9e0b97485fe7b34e72340d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestMtlsTrustStoreUri", [value, operator]))

    @jsii.member(jsii_name="ifRequestMtlsTrustStoreVersion")
    def if_request_mtls_trust_store_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by version of the truststore used for mutual TLS authentication. Available during the CreateDomainName and UpdateDomainName operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - DomainName
        - DomainNames

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c698928ec9fcffc162ef5bd0bf8d20fc6eb3e568ab01425f7eeac66fc30a82ba)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestMtlsTrustStoreVersion", [value, operator]))

    @jsii.member(jsii_name="ifRequestRouteAuthorizationType")
    def if_request_route_authorization_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by authorization type, for example NONE, AWS_IAM, CUSTOM, JWT, COGNITO_USER_POOLS.

        Available during the CreateMethod and PutMethod operations Also available as a collection during import

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Method
        - RestApi
        - RestApis

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__13f3958b3d8eea9ae1f88839546a48017d768e78a2123a128dd996f3cee18bea)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestRouteAuthorizationType", [value, operator]))

    @jsii.member(jsii_name="ifRequestSecurityPolicy")
    def if_request_security_policy(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by TLS version. Available during the CreateDomain and UpdateDomain operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - DomainName
        - DomainNames

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1c591120bad2c46dd59cf23ab5bf7824064f8c228a9f3c5d7f41d577497d12a2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestSecurityPolicy", [value, operator]))

    @jsii.member(jsii_name="ifRequestStageName")
    def if_request_stage_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by stage name of the deployment that you attempt to create. Available during the CreateDeployment operation.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Deployments

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__426aa4eb0900307633a93da2029b317a0fd019388f30a033bb6bbfa3166573a7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifRequestStageName", [value, operator]))

    @jsii.member(jsii_name="ifResourceAccessLoggingDestination")
    def if_resource_access_logging_destination(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by access log destination of the current Stage resource. Available during the UpdateStage and DeleteStage operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Stage

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3ff309c8203f19bde0991da5d6ba4141622622dce5592fef546f22d99cf3fdfd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceAccessLoggingDestination", [value, operator]))

    @jsii.member(jsii_name="ifResourceAccessLoggingFormat")
    def if_resource_access_logging_format(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by access log format of the current Stage resource. Available during the UpdateStage and DeleteStage operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Stage

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e48d9ae040177c94ee2efad9f3a53fb9aaff2df04fe74e46e8dc8f8be9f005fc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceAccessLoggingFormat", [value, operator]))

    @jsii.member(jsii_name="ifResourceApiKeyRequired")
    def if_resource_api_key_required(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access based on whether an API key is required or not for the existing Method resource.

        Available during the PutMethod and DeleteMethod operations. Also available as a collection during reimport

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Method
        - RestApi

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__131270a9e3a301d1ed34e0dfad9ddcfc378afde5792c23bcfb06892d37d44ee5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceApiKeyRequired", [value]))

    @jsii.member(jsii_name="ifResourceApiName")
    def if_resource_api_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by API name of the existing RestApi resource. Available during UpdateRestApi and DeleteRestApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - RestApi

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5e1cdfaef855d55a8b4eb3db2ac7baf50a8f02fe53b14d7961b2fde5e108acaa)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceApiName", [value, operator]))

    @jsii.member(jsii_name="ifResourceAuthorizerType")
    def if_resource_authorizer_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by the current type of authorizer, for example TOKEN, REQUEST, JWT.

        Available during UpdateAuthorizer and DeleteAuthorizer operations. Also available during reimport as an ArrayOfString

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Authorizer
        - RestApi

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__72bd78ff8d90809a0cb927da227ecb4b06163207fd640eca3fcf2c700906f1d8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceAuthorizerType", [value, operator]))

    @jsii.member(jsii_name="ifResourceAuthorizerUri")
    def if_resource_authorizer_uri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by URI of a Lambda authorizer function.

        Available during UpdateAuthorizer and DeleteAuthorizer operations. Also available during reimport as an ArrayOfString

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Authorizer
        - RestApi

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cf97ace412d97b5c8275e0bb990274ca4797c9ea5cdd65197888c53a354c032b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceAuthorizerUri", [value, operator]))

    @jsii.member(jsii_name="ifResourceDisableExecuteApiEndpoint")
    def if_resource_disable_execute_api_endpoint(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by status of the default execute-api endpoint of the current RestApi resource.

        Available during UpdateRestApi and DeleteRestApi operations

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - RestApi

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7b33b74fec50cb751ec71f836fb82039a2437cf5b747cb00fe18dbb90f43a0d5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceDisableExecuteApiEndpoint", [value]))

    @jsii.member(jsii_name="ifResourceEndpointType")
    def if_resource_endpoint_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by endpoint type. Available during the UpdateDomainName, DeleteDomainName, UpdateRestApi, and DeleteRestApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - DomainName
        - RestApi

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fd26974e035e10143c8b7bdb0a18179993ce90b9b3eaf652c5ec09278792463c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceEndpointType", [value, operator]))

    @jsii.member(jsii_name="ifResourceMtlsTrustStoreUri")
    def if_resource_mtls_trust_store_uri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by URI of the truststore used for mutual TLS authentication. Available during UpdateDomainName and DeleteDomainName operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - DomainName

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fe7ec74e6cdaad428532c6984969f13ea819eaf5ec9ea18ecbe9c9398d230f7e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceMtlsTrustStoreUri", [value, operator]))

    @jsii.member(jsii_name="ifResourceMtlsTrustStoreVersion")
    def if_resource_mtls_trust_store_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by version of the truststore used for mutual TLS authentication. Available during UpdateDomainName and DeleteDomainName operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - DomainName

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a961e33d9aa0aa90400f4f6eebc81d1c4692071817a71e2332f88a958eebd5d2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceMtlsTrustStoreVersion", [value, operator]))

    @jsii.member(jsii_name="ifResourceRouteAuthorizationType")
    def if_resource_route_authorization_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by authorization type of the existing Method resource, for example NONE, AWS_IAM, CUSTOM, JWT, COGNITO_USER_POOLS.

        Available during the PutMethod and DeleteMethod operations. Also available as a collection during reimport

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Method
        - RestApi

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__965bd539fdaf142fb7cade59e478c6e0a33114da88174bca3081194fc03f50b3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceRouteAuthorizationType", [value, operator]))

    @jsii.member(jsii_name="ifResourceSecurityPolicy")
    def if_resource_security_policy(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apigateway":
        '''(experimental) Filters access by TLS version. Available during UpdateDomain and DeleteDomain operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - DomainName

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ac62bc7e4a781b7750b43458ab5bf6d3ce436b71e2aa09243de1f766be6966c9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apigateway", jsii.invoke(self, "ifResourceSecurityPolicy", [value, operator]))

    @jsii.member(jsii_name="onAccount")
    def on_account(
        self,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Account to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__19101b0d132688fad53f64c99e7c3ce894d30b202c573b291200bdb33f27bd55)
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onAccount", [region, partition]))

    @jsii.member(jsii_name="onApiKey")
    def on_api_key(
        self,
        api_key_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type ApiKey to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_key_id: - Identifier for the apiKeyId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4a60808c06cc58cd35d249dec5df61ef9622b785d155fa50dce56dc3ab11291a)
            check_type(argname="argument api_key_id", value=api_key_id, expected_type=type_hints["api_key_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onApiKey", [api_key_id, region, partition]))

    @jsii.member(jsii_name="onApiKeys")
    def on_api_keys(
        self,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type ApiKeys to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1b34879670acbbc2dd01982378911022df5fa42aaad32ba447eb62913e9c13c3)
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onApiKeys", [region, partition]))

    @jsii.member(jsii_name="onAuthorizer")
    def on_authorizer(
        self,
        rest_api_id: builtins.str,
        authorizer_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Authorizer to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param authorizer_id: - Identifier for the authorizerId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifRequestAuthorizerType() - .ifRequestAuthorizerUri() - .ifResourceAuthorizerType() - .ifResourceAuthorizerUri() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4a89925e20065052691a4a071153fcae59c27b57e269a301accdceddd3e81ada)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument authorizer_id", value=authorizer_id, expected_type=type_hints["authorizer_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onAuthorizer", [rest_api_id, authorizer_id, region, partition]))

    @jsii.member(jsii_name="onAuthorizers")
    def on_authorizers(
        self,
        rest_api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Authorizers to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifRequestAuthorizerType() - .ifRequestAuthorizerUri() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0c4280c75822abe88c3d3f9e2ff636f3510f2e8297496399d93021b1ec4df1e5)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onAuthorizers", [rest_api_id, region, partition]))

    @jsii.member(jsii_name="onBasePathMapping")
    def on_base_path_mapping(
        self,
        domain_name: builtins.str,
        base_path: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type BasePathMapping to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param domain_name: - Identifier for the domainName.
        :param base_path: - Identifier for the basePath.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1fb08c5d1017d45449bcfab4ff8764fdb1baaab1c5a130da80634656bcde34e1)
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
            check_type(argname="argument base_path", value=base_path, expected_type=type_hints["base_path"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onBasePathMapping", [domain_name, base_path, region, partition]))

    @jsii.member(jsii_name="onBasePathMappings")
    def on_base_path_mappings(
        self,
        domain_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type BasePathMappings to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param domain_name: - Identifier for the domainName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bd9f866af965eb22f171a864411a45ff914b9d5175683825b05df0ae1c73e4a9)
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onBasePathMappings", [domain_name, region, partition]))

    @jsii.member(jsii_name="onClientCertificate")
    def on_client_certificate(
        self,
        client_certificate_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type ClientCertificate to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param client_certificate_id: - Identifier for the clientCertificateId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e01897062f32bc3ffeb9e26ee5d23565fc33aad36aad51170cdab6515e7eec39)
            check_type(argname="argument client_certificate_id", value=client_certificate_id, expected_type=type_hints["client_certificate_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onClientCertificate", [client_certificate_id, region, partition]))

    @jsii.member(jsii_name="onClientCertificates")
    def on_client_certificates(
        self,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type ClientCertificates to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__332d3ca346efb56c83fd6de312671b62f06430cc44f0c1f7f3460e2eb0ff0f75)
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onClientCertificates", [region, partition]))

    @jsii.member(jsii_name="onDeployment")
    def on_deployment(
        self,
        rest_api_id: builtins.str,
        deployment_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Deployment to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param deployment_id: - Identifier for the deploymentId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__91ad117a35a650dc2d239b47730bef05ef717e050d29445cb7161aa241b13d41)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument deployment_id", value=deployment_id, expected_type=type_hints["deployment_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onDeployment", [rest_api_id, deployment_id, region, partition]))

    @jsii.member(jsii_name="onDeployments")
    def on_deployments(
        self,
        rest_api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Deployments to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifRequestStageName()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__426151a92b6b24f9f04c768e2acd0c744b1295d592977dc9a0d4dd2d9eaea2f1)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onDeployments", [rest_api_id, region, partition]))

    @jsii.member(jsii_name="onDocumentationPart")
    def on_documentation_part(
        self,
        rest_api_id: builtins.str,
        documentation_part_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type DocumentationPart to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param documentation_part_id: - Identifier for the documentationPartId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__046d526adcd9a128cb902eafc98dfdf58974923d834330bcf6249460e8173ddd)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument documentation_part_id", value=documentation_part_id, expected_type=type_hints["documentation_part_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onDocumentationPart", [rest_api_id, documentation_part_id, region, partition]))

    @jsii.member(jsii_name="onDocumentationParts")
    def on_documentation_parts(
        self,
        rest_api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type DocumentationParts to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b3dcb623af80cd6e2be10337e4f28e5cd4574cb39a1594be3e28f5735a0a50c4)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onDocumentationParts", [rest_api_id, region, partition]))

    @jsii.member(jsii_name="onDocumentationVersion")
    def on_documentation_version(
        self,
        rest_api_id: builtins.str,
        documentation_version_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type DocumentationVersion to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param documentation_version_id: - Identifier for the documentationVersionId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__05a8e2fbda2a61689f1cbfa31dac31b71dfedf74173c6d1ba0749bd49fbf5c48)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument documentation_version_id", value=documentation_version_id, expected_type=type_hints["documentation_version_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onDocumentationVersion", [rest_api_id, documentation_version_id, region, partition]))

    @jsii.member(jsii_name="onDocumentationVersions")
    def on_documentation_versions(
        self,
        rest_api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type DocumentationVersions to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d4b5eb49540cab82a6f8f4b29e81f7941942bfa0f62df97affcd6f2963f4a8b2)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onDocumentationVersions", [rest_api_id, region, partition]))

    @jsii.member(jsii_name="onDomainName")
    def on_domain_name(
        self,
        domain_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type DomainName to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param domain_name: - Identifier for the domainName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifRequestEndpointType() - .ifRequestMtlsTrustStoreUri() - .ifRequestMtlsTrustStoreVersion() - .ifRequestSecurityPolicy() - .ifResourceEndpointType() - .ifResourceMtlsTrustStoreUri() - .ifResourceMtlsTrustStoreVersion() - .ifResourceSecurityPolicy() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__363941a8371385d6cf0218e42f35b74bb54997670af5c05ff01917d4757cee54)
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onDomainName", [domain_name, region, partition]))

    @jsii.member(jsii_name="onDomainNames")
    def on_domain_names(
        self,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type DomainNames to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifRequestEndpointType() - .ifRequestMtlsTrustStoreUri() - .ifRequestMtlsTrustStoreVersion() - .ifRequestSecurityPolicy() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__de3227d8970f49c36bea478dc5575ab2bcb190752e93c2c3349985e02705a516)
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onDomainNames", [region, partition]))

    @jsii.member(jsii_name="onGatewayResponse")
    def on_gateway_response(
        self,
        rest_api_id: builtins.str,
        response_type: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type GatewayResponse to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param response_type: - Identifier for the responseType.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b8908750e691a6423591a735cd8648aa8324fd1454f0f3a01c7ba09fd61bba40)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument response_type", value=response_type, expected_type=type_hints["response_type"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onGatewayResponse", [rest_api_id, response_type, region, partition]))

    @jsii.member(jsii_name="onGatewayResponses")
    def on_gateway_responses(
        self,
        rest_api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type GatewayResponses to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5cb75f467caa9c2302e4e84adb7b10f6fcc6f62f281bca9616a069772dd08f46)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onGatewayResponses", [rest_api_id, region, partition]))

    @jsii.member(jsii_name="onIntegration")
    def on_integration(
        self,
        rest_api_id: builtins.str,
        resource_id: builtins.str,
        http_method_type: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Integration to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param resource_id: - Identifier for the resourceId.
        :param http_method_type: - Identifier for the httpMethodType.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ca558505beac0e46bacc98f4a0b7ec78996f3b832964d1ec735b25a5ec784afa)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument http_method_type", value=http_method_type, expected_type=type_hints["http_method_type"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onIntegration", [rest_api_id, resource_id, http_method_type, region, partition]))

    @jsii.member(jsii_name="onIntegrationResponse")
    def on_integration_response(
        self,
        rest_api_id: builtins.str,
        resource_id: builtins.str,
        http_method_type: builtins.str,
        status_code: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type IntegrationResponse to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param resource_id: - Identifier for the resourceId.
        :param http_method_type: - Identifier for the httpMethodType.
        :param status_code: - Identifier for the statusCode.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fa2ce910848f7d7ecb091055337989b0b0bf0ecbbc68b8cd48bd682c7121f52b)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument http_method_type", value=http_method_type, expected_type=type_hints["http_method_type"])
            check_type(argname="argument status_code", value=status_code, expected_type=type_hints["status_code"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onIntegrationResponse", [rest_api_id, resource_id, http_method_type, status_code, region, partition]))

    @jsii.member(jsii_name="onMethod")
    def on_method(
        self,
        rest_api_id: builtins.str,
        resource_id: builtins.str,
        http_method_type: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Method to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param resource_id: - Identifier for the resourceId.
        :param http_method_type: - Identifier for the httpMethodType.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifRequestApiKeyRequired() - .ifRequestRouteAuthorizationType() - .ifResourceApiKeyRequired() - .ifResourceRouteAuthorizationType() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e17a4b45dd20045a8b784da4ee0826643aada43ffbbf6f8eec557ab46018d65a)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument http_method_type", value=http_method_type, expected_type=type_hints["http_method_type"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onMethod", [rest_api_id, resource_id, http_method_type, region, partition]))

    @jsii.member(jsii_name="onMethodResponse")
    def on_method_response(
        self,
        rest_api_id: builtins.str,
        resource_id: builtins.str,
        http_method_type: builtins.str,
        status_code: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type MethodResponse to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param resource_id: - Identifier for the resourceId.
        :param http_method_type: - Identifier for the httpMethodType.
        :param status_code: - Identifier for the statusCode.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__87f6dda7540c41fb1bc1f2d5d284900998d1d233ff2072cb31f7d37cdf3f9bb0)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument http_method_type", value=http_method_type, expected_type=type_hints["http_method_type"])
            check_type(argname="argument status_code", value=status_code, expected_type=type_hints["status_code"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onMethodResponse", [rest_api_id, resource_id, http_method_type, status_code, region, partition]))

    @jsii.member(jsii_name="onModel")
    def on_model(
        self,
        rest_api_id: builtins.str,
        model_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Model to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param model_name: - Identifier for the modelName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6f36110849cc875e77edab4eddb8d3dc5861a342f12861c2b2ced251f57a5928)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument model_name", value=model_name, expected_type=type_hints["model_name"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onModel", [rest_api_id, model_name, region, partition]))

    @jsii.member(jsii_name="onModels")
    def on_models(
        self,
        rest_api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Models to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8f9377317cac7f1b297a96f3c183d6049e4013a319525fb0668c711502ab3eb4)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onModels", [rest_api_id, region, partition]))

    @jsii.member(jsii_name="onRequestValidator")
    def on_request_validator(
        self,
        rest_api_id: builtins.str,
        request_validator_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type RequestValidator to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param request_validator_id: - Identifier for the requestValidatorId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__72b4964af9e0cc2b1448848ef28f632500504d27042d9835112b0fd7c991cd32)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument request_validator_id", value=request_validator_id, expected_type=type_hints["request_validator_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onRequestValidator", [rest_api_id, request_validator_id, region, partition]))

    @jsii.member(jsii_name="onRequestValidators")
    def on_request_validators(
        self,
        rest_api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type RequestValidators to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fb4af8fb0ac17c7b735da95080cbd3607d4698e70d28de46ec347c8d340c9552)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onRequestValidators", [rest_api_id, region, partition]))

    @jsii.member(jsii_name="onResource")
    def on_resource(
        self,
        rest_api_id: builtins.str,
        resource_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Resource to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param resource_id: - Identifier for the resourceId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__68aa0726c0b1f95c0628a37994b4b469bc42140f23cfd02cedb33152bbb191e2)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onResource", [rest_api_id, resource_id, region, partition]))

    @jsii.member(jsii_name="onResources")
    def on_resources(
        self,
        rest_api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Resources to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4543f8591ba6f60053f5e3fac414e676dec0bb545a0f364a3dc21e005ee2d70c)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onResources", [rest_api_id, region, partition]))

    @jsii.member(jsii_name="onRestApi")
    def on_rest_api(
        self,
        rest_api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type RestApi to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifRequestApiKeyRequired() - .ifRequestApiName() - .ifRequestAuthorizerType() - .ifRequestAuthorizerUri() - .ifRequestDisableExecuteApiEndpoint() - .ifRequestEndpointType() - .ifRequestRouteAuthorizationType() - .ifResourceApiKeyRequired() - .ifResourceApiName() - .ifResourceAuthorizerType() - .ifResourceAuthorizerUri() - .ifResourceDisableExecuteApiEndpoint() - .ifResourceEndpointType() - .ifResourceRouteAuthorizationType() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5ae016bc619fecec63a6425a7b31fbede844702e9e49e4c72e7f32658bb7f9a8)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onRestApi", [rest_api_id, region, partition]))

    @jsii.member(jsii_name="onRestApis")
    def on_rest_apis(
        self,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type RestApis to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifRequestApiKeyRequired() - .ifRequestApiName() - .ifRequestAuthorizerType() - .ifRequestAuthorizerUri() - .ifRequestDisableExecuteApiEndpoint() - .ifRequestEndpointType() - .ifRequestRouteAuthorizationType() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__20b32a794ac168cf103bf3b0f608ce309e722d923a7bc2e1990debd951c5588b)
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onRestApis", [region, partition]))

    @jsii.member(jsii_name="onSdk")
    def on_sdk(
        self,
        rest_api_id: builtins.str,
        stage_name: builtins.str,
        sdk_type: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Sdk to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param stage_name: - Identifier for the stageName.
        :param sdk_type: - Identifier for the sdkType.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b3f93ca368a95020db42711aaea8ccf28036c9a4421553db8b5e6aa8d8f50fd5)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument stage_name", value=stage_name, expected_type=type_hints["stage_name"])
            check_type(argname="argument sdk_type", value=sdk_type, expected_type=type_hints["sdk_type"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onSdk", [rest_api_id, stage_name, sdk_type, region, partition]))

    @jsii.member(jsii_name="onStage")
    def on_stage(
        self,
        rest_api_id: builtins.str,
        stage_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Stage to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param stage_name: - Identifier for the stageName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifRequestAccessLoggingDestination() - .ifRequestAccessLoggingFormat() - .ifResourceAccessLoggingDestination() - .ifResourceAccessLoggingFormat() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__87f38f114d98f71a821d80e92b64a5e3002d22a15b54a5447b83b93de2dff370)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument stage_name", value=stage_name, expected_type=type_hints["stage_name"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onStage", [rest_api_id, stage_name, region, partition]))

    @jsii.member(jsii_name="onStages")
    def on_stages(
        self,
        rest_api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Stages to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param rest_api_id: - Identifier for the restApiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifRequestAccessLoggingDestination() - .ifRequestAccessLoggingFormat() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c47398a9ff89394cdee149ec68802776a562af4269b65f433fe7c4c965f351cd)
            check_type(argname="argument rest_api_id", value=rest_api_id, expected_type=type_hints["rest_api_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onStages", [rest_api_id, region, partition]))

    @jsii.member(jsii_name="onTemplate")
    def on_template(
        self,
        model_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type Template to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param model_name: - Identifier for the modelName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9d11934907c3c1205bdde6a86960066b933776bb5c295beb3c6cc5a8d6f5b239)
            check_type(argname="argument model_name", value=model_name, expected_type=type_hints["model_name"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onTemplate", [model_name, region, partition]))

    @jsii.member(jsii_name="onUsagePlan")
    def on_usage_plan(
        self,
        usage_plan_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type UsagePlan to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param usage_plan_id: - Identifier for the usagePlanId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e6163f45342e821d12ac9e27a75631f0db6227afe22e28771df3501035c565a0)
            check_type(argname="argument usage_plan_id", value=usage_plan_id, expected_type=type_hints["usage_plan_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onUsagePlan", [usage_plan_id, region, partition]))

    @jsii.member(jsii_name="onUsagePlanKey")
    def on_usage_plan_key(
        self,
        usage_plan_id: builtins.str,
        id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type UsagePlanKey to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param usage_plan_id: - Identifier for the usagePlanId.
        :param id: - Identifier for the id.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a9620df8c6d34387b8ed19ddd32865ad639e7108c23a729a0f4194b825ed1115)
            check_type(argname="argument usage_plan_id", value=usage_plan_id, expected_type=type_hints["usage_plan_id"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onUsagePlanKey", [usage_plan_id, id, region, partition]))

    @jsii.member(jsii_name="onUsagePlanKeys")
    def on_usage_plan_keys(
        self,
        usage_plan_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type UsagePlanKeys to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param usage_plan_id: - Identifier for the usagePlanId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__402058ce44f53239fcbe13dd55a20dda6d418be7e9ce99d191c2e4ff02fbe017)
            check_type(argname="argument usage_plan_id", value=usage_plan_id, expected_type=type_hints["usage_plan_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onUsagePlanKeys", [usage_plan_id, region, partition]))

    @jsii.member(jsii_name="onUsagePlans")
    def on_usage_plans(
        self,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type UsagePlans to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dffc7647793ba2357394cff346e22e201d2ee23e148525f8fd0531d248bc7568)
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onUsagePlans", [region, partition]))

    @jsii.member(jsii_name="onVpcLink")
    def on_vpc_link(
        self,
        vpc_link_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type VpcLink to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param vpc_link_id: - Identifier for the vpcLinkId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a32822ff512477a8338629c450a902baee81c4c17e1fc80208d6ae86e92d0f8d)
            check_type(argname="argument vpc_link_id", value=vpc_link_id, expected_type=type_hints["vpc_link_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onVpcLink", [vpc_link_id, region, partition]))

    @jsii.member(jsii_name="onVpcLinks")
    def on_vpc_links(
        self,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apigateway":
        '''(experimental) Adds a resource of type VpcLinks to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f45b900336719d34007c783e8f3a3fe68cfc0059b8900b3f9b52f075a2b053b4)
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apigateway", jsii.invoke(self, "onVpcLinks", [region, partition]))

    @jsii.member(jsii_name="toAddCertificateToDomain")
    def to_add_certificate_to_domain(self) -> "Apigateway":
        '''(experimental) Grants permission to add certificates for mutual TLS authentication to a domain name.

        This is an additional authorization control for managing the DomainName resource due to the sensitive nature of mTLS

        Access Level: Permissions management

        https://docs.aws.amazon.com/apigateway/api-reference/ADD_CERTIFICATE_TO_DOMAIN.html

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "toAddCertificateToDomain", []))

    @jsii.member(jsii_name="toDELETE")
    def to_delete(self) -> "Apigateway":
        '''(experimental) Grants permission to delete a particular resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apigateway/api-reference/API_DELETE.html

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "toDELETE", []))

    @jsii.member(jsii_name="toGET")
    def to_get(self) -> "Apigateway":
        '''(experimental) Grants permission to read a particular resource.

        Access Level: Read

        https://docs.aws.amazon.com/apigateway/api-reference/API_GET.html

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "toGET", []))

    @jsii.member(jsii_name="toPATCH")
    def to_patch(self) -> "Apigateway":
        '''(experimental) Grants permission to update a particular resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apigateway/api-reference/API_PATCH.html

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "toPATCH", []))

    @jsii.member(jsii_name="toPOST")
    def to_post(self) -> "Apigateway":
        '''(experimental) Grants permission to create a particular resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apigateway/api-reference/API_POST.html

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "toPOST", []))

    @jsii.member(jsii_name="toPUT")
    def to_put(self) -> "Apigateway":
        '''(experimental) Grants permission to update a particular resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apigateway/api-reference/API_PUT.html

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "toPUT", []))

    @jsii.member(jsii_name="toRemoveCertificateFromDomain")
    def to_remove_certificate_from_domain(self) -> "Apigateway":
        '''(experimental) Grants permission to remove certificates for mutual TLS authentication from a domain name.

        This is an additional authorization control for managing the DomainName resource due to the sensitive nature of mTLS

        Access Level: Permissions management

        https://docs.aws.amazon.com/apigateway/api-reference/REMOVE_CERTIFICATE_FROM_DOMAIN.html

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "toRemoveCertificateFromDomain", []))

    @jsii.member(jsii_name="toSetWebACL")
    def to_set_web_acl(self) -> "Apigateway":
        '''(experimental) Grants permission set a WAF access control list (ACL).

        This is an additional authorization control for managing the Stage resource due to the sensitive nature of WebAcl's

        Access Level: Permissions management

        https://docs.aws.amazon.com/apigateway/api-reference/WEBACL_SET.html

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "toSetWebACL", []))

    @jsii.member(jsii_name="toUpdateRestApiPolicy")
    def to_update_rest_api_policy(self) -> "Apigateway":
        '''(experimental) Grants permission to manage the IAM resource policy for an API.

        This is an additional authorization control for managing an API due to the sensitive nature of the resource policy

        Access Level: Permissions management

        https://docs.aws.amazon.com/apigateway/api-reference/UPDATE_REST_API_POLICY.html

        :stability: experimental
        '''
        return typing.cast("Apigateway", jsii.invoke(self, "toUpdateRestApiPolicy", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__217d20332550f6b3d147479d8ceb14839d4b9e03abb059e913ef60e48cf1130e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__15d8cbbcf6660ea7c06d96ed7eb4195af76f654759e866e161cfe4834ff9a9e4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class ApigatewayV2(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ApigatewayV2",
):
    '''(experimental) Statement provider for service `apigateway-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonapigatewaymanagementv2.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `apigateway-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonapigatewaymanagementv2.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__162bac3663ea7b76c0f3f71fe148679fb838cd66b09f051186faf9258accc946)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifRequestAccessLoggingDestination")
    def if_request_access_logging_destination(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by access log destination. Available during the CreateStage and UpdateStage operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Stage
        - Stages

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cd3febcc9a528e4f08a42bb93fb717b69cc47fabe4d283028d661a9c32e2a154)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestAccessLoggingDestination", [value, operator]))

    @jsii.member(jsii_name="ifRequestAccessLoggingFormat")
    def if_request_access_logging_format(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by access log format. Available during the CreateStage and UpdateStage operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Stage
        - Stages

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6ad67a2cf47719cdd821e2e2e8911b3bfc2f8fd2da98560911d615603ce79dd0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestAccessLoggingFormat", [value, operator]))

    @jsii.member(jsii_name="ifRequestApiKeyRequired")
    def if_request_api_key_required(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by the requirement of API.

        Available during the CreateRoute and UpdateRoute operations. Also available as a collection during import and reimport

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Apis
        - Route
        - Routes

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f2c8e883a80faaa62e174d3d397271baf7dafa9cedf863772f1aa394f73fd103)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestApiKeyRequired", [value]))

    @jsii.member(jsii_name="ifRequestApiName")
    def if_request_api_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by API name. Available during the CreateApi and UpdateApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Apis

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__38df69008f65888580d7d0c8496f5df03929602baf291af9d0459994959ea599)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestApiName", [value, operator]))

    @jsii.member(jsii_name="ifRequestAuthorizerType")
    def if_request_authorizer_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by type of authorizer in the request, for example REQUEST or JWT.

        Available during CreateAuthorizer and UpdateAuthorizer. Also available during import and reimport as an ArrayOfString

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Apis
        - Authorizer
        - Authorizers

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9f2cf3a87804670d9c0e9833fd3c943cee758634a607dd8ea3a223e2ecc1def7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestAuthorizerType", [value, operator]))

    @jsii.member(jsii_name="ifRequestAuthorizerUri")
    def if_request_authorizer_uri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by URI of a Lambda authorizer function.

        Available during CreateAuthorizer and UpdateAuthorizer. Also available during import and reimport as an ArrayOfString

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Apis
        - Authorizer
        - Authorizers

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__58b717e4b90eb962265d173a7e6385424f85804033adb4da7b1c3e5f6c1904b9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestAuthorizerUri", [value, operator]))

    @jsii.member(jsii_name="ifRequestDisableExecuteApiEndpoint")
    def if_request_disable_execute_api_endpoint(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by status of the default execute-api endpoint. Available during the CreateApi and UpdateApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Apis

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__71c9c5d13cf415a09c8cfe9d7a752e324a8bff8ad24a81dbc9a9255b473f1f1f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestDisableExecuteApiEndpoint", [value]))

    @jsii.member(jsii_name="ifRequestEndpointType")
    def if_request_endpoint_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by endpoint type. Available during the CreateDomainName, UpdateDomainName, CreateApi, and UpdateApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Apis

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1dcb245da60ae1c7a3aa0b6cae032f38a6e38a20cb6b0497abf2695610311396)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestEndpointType", [value, operator]))

    @jsii.member(jsii_name="ifRequestMtlsTrustStoreUri")
    def if_request_mtls_trust_store_uri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by URI of the truststore used for mutual TLS authentication. Available during the CreateDomainName and UpdateDomainName operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3e333e1282cc63816442cdf0c062a2b53571c3396839146d7742642bdad2b5ce)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestMtlsTrustStoreUri", [value, operator]))

    @jsii.member(jsii_name="ifRequestMtlsTrustStoreVersion")
    def if_request_mtls_trust_store_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by version of the truststore used for mutual TLS authentication. Available during the CreateDomainName and UpdateDomainName operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d60bf840d85a95072aeb12350186ae28d6d286726dcb260a0bc5c5cebe9a1400)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestMtlsTrustStoreVersion", [value, operator]))

    @jsii.member(jsii_name="ifRequestRouteAuthorizationType")
    def if_request_route_authorization_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by authorization type, for example NONE, AWS_IAM, CUSTOM, JWT.

        Available during the CreateRoute and UpdateRoute operations. Also available as a collection during import

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Apis
        - Route
        - Routes

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6f16bf3120afb0c6261bf1a056e84080881ebac692631dadc50a21aa71b7487f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestRouteAuthorizationType", [value, operator]))

    @jsii.member(jsii_name="ifRequestSecurityPolicy")
    def if_request_security_policy(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by TLS version. Available during the CreateDomain and UpdateDomain operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__db7da52bb7aa34f4193848f7c22fbd1a894da606a93b1ac39dce447d9c8d7117)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestSecurityPolicy", [value, operator]))

    @jsii.member(jsii_name="ifRequestStageName")
    def if_request_stage_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by stage name of the deployment that you attempt to create. Available during the CreateDeployment operation.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Deployments

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__475bd1a97286269bc82fa76e8475bf5882af612ef55b1f34aa6f02ffa5d77328)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifRequestStageName", [value, operator]))

    @jsii.member(jsii_name="ifResourceAccessLoggingDestination")
    def if_resource_access_logging_destination(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by access log destination of the current Stage resource. Available during the UpdateStage and DeleteStage operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Stage

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__07c3eecd3648cff58000bb2ac0506bcdd6d6bc69a84cd7dbc1da792b706754fd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceAccessLoggingDestination", [value, operator]))

    @jsii.member(jsii_name="ifResourceAccessLoggingFormat")
    def if_resource_access_logging_format(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by access log format of the current Stage resource. Available during the UpdateStage and DeleteStage operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Stage

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__10542611edf0fbcb31db6b15037f0cad80448e6dc071cf34f45ba8fdce199d79)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceAccessLoggingFormat", [value, operator]))

    @jsii.member(jsii_name="ifResourceApiKeyRequired")
    def if_resource_api_key_required(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by the requirement of API key for the existing Route resource.

        Available during the UpdateRoute and DeleteRoute operations. Also available as a collection during reimport

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Route

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cffb7534a8d71c56802f44770be782ebfc87090be16bebffe86b65d2fae92fe3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceApiKeyRequired", [value]))

    @jsii.member(jsii_name="ifResourceApiName")
    def if_resource_api_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by API name. Available during the UpdateApi and DeleteApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__48fa34e53797932d0f64e2a6f0d33e504872fe6791a1d5369c068d7aa65ed856)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceApiName", [value, operator]))

    @jsii.member(jsii_name="ifResourceAuthorizerType")
    def if_resource_authorizer_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by the current type of authorizer, for example REQUEST or JWT.

        Available during UpdateAuthorizer and DeleteAuthorizer operations. Also available during import and reimport as an ArrayOfString

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Authorizer

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fe8ae24c9a4aac8917f1c4715d593665f2fffade87105699b771edb529dae18e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceAuthorizerType", [value, operator]))

    @jsii.member(jsii_name="ifResourceAuthorizerUri")
    def if_resource_authorizer_uri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by the URI of the current Lambda authorizer associated with the current API.

        Available during UpdateAuthorizer and DeleteAuthorizer. Also available as a collection during reimport

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Authorizer

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9c6cec87b5f535c9a5ddd6d3058d248ddfc7b82e7725854396514c2309a98a08)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceAuthorizerUri", [value, operator]))

    @jsii.member(jsii_name="ifResourceDisableExecuteApiEndpoint")
    def if_resource_disable_execute_api_endpoint(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by status of the default execute-api endpoint. Available during the UpdateApi and DeleteApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3c11148b2575111e6c50c6aaeaed60a386e6a1d56c808b889948a4904447c74e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceDisableExecuteApiEndpoint", [value]))

    @jsii.member(jsii_name="ifResourceEndpointType")
    def if_resource_endpoint_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by endpoint type. Available during the UpdateDomainName, DeleteDomainName, UpdateApi, and DeleteApi operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cf2a2e4fef82f996b5e70661b49ec446f0e10b66b57ebd44a11a8db3e554ec99)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceEndpointType", [value, operator]))

    @jsii.member(jsii_name="ifResourceMtlsTrustStoreUri")
    def if_resource_mtls_trust_store_uri(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by URI of the truststore used for mutual TLS authentication. Available during the UpdateDomainName and DeleteDomainName operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5f01aa1a862742121111dd0f20d87574024d0afeb7b1370359b579c2a9769b18)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceMtlsTrustStoreUri", [value, operator]))

    @jsii.member(jsii_name="ifResourceMtlsTrustStoreVersion")
    def if_resource_mtls_trust_store_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by version of the truststore used for mutual TLS authentication. Available during the UpdateDomainName and DeleteDomainName operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__94a8c3fa1357bde9a18a101a13ef03015b4cf4153a36a9e73b00dfa26c5ed395)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceMtlsTrustStoreVersion", [value, operator]))

    @jsii.member(jsii_name="ifResourceRouteAuthorizationType")
    def if_resource_route_authorization_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by authorization type of the existing Route resource, for example NONE, AWS_IAM, CUSTOM.

        Available during the UpdateRoute and DeleteRoute operations. Also available as a collection during reimport

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        Applies to resource types:

        - Api
        - Route

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fd0eec195f2bcf575f511c56f4405f01dc76335ea286610717885e1f1bbec181)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceRouteAuthorizationType", [value, operator]))

    @jsii.member(jsii_name="ifResourceSecurityPolicy")
    def if_resource_security_policy(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Filters access by TLS version. Available during the UpdateDomainName and DeleteDomainName operations.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7c940aa4bb08b9dde520d33362d3e4462db7df6bd0d10283c198435a3e0aab76)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "ifResourceSecurityPolicy", [value, operator]))

    @jsii.member(jsii_name="onAccessLogSettings")
    def on_access_log_settings(
        self,
        api_id: builtins.str,
        stage_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type AccessLogSettings to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param stage_name: - Identifier for the stageName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9dd6c989d2b2d9a61040fdfdadf8f6710bc65e71b01a039253b55975c807f7e7)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument stage_name", value=stage_name, expected_type=type_hints["stage_name"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onAccessLogSettings", [api_id, stage_name, region, partition]))

    @jsii.member(jsii_name="onApi")
    def on_api(
        self,
        api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Api to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifRequestApiKeyRequired() - .ifRequestApiName() - .ifRequestAuthorizerType() - .ifRequestAuthorizerUri() - .ifRequestDisableExecuteApiEndpoint() - .ifRequestEndpointType() - .ifRequestRouteAuthorizationType() - .ifResourceApiKeyRequired() - .ifResourceApiName() - .ifResourceAuthorizerType() - .ifResourceAuthorizerUri() - .ifResourceDisableExecuteApiEndpoint() - .ifResourceEndpointType() - .ifResourceRouteAuthorizationType() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c7fb108ed5d19ad41fd059a3f934759a8fa65bec9839ad2fa061b0f59b37009f)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onApi", [api_id, region, partition]))

    @jsii.member(jsii_name="onApiMapping")
    def on_api_mapping(
        self,
        domain_name: builtins.str,
        api_mapping_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type ApiMapping to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param domain_name: - Identifier for the domainName.
        :param api_mapping_id: - Identifier for the apiMappingId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dcd3b84690412d4b5c877b6ac71323bc68a04568bee0738d610bda830ecf4314)
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
            check_type(argname="argument api_mapping_id", value=api_mapping_id, expected_type=type_hints["api_mapping_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onApiMapping", [domain_name, api_mapping_id, region, partition]))

    @jsii.member(jsii_name="onApiMappings")
    def on_api_mappings(
        self,
        domain_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type ApiMappings to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param domain_name: - Identifier for the domainName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__54419893159495b115616bb7478c3196c652c943d01dc1b272b0d23a6faf85ac)
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onApiMappings", [domain_name, region, partition]))

    @jsii.member(jsii_name="onApis")
    def on_apis(
        self,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Apis to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifRequestApiKeyRequired() - .ifRequestApiName() - .ifRequestAuthorizerType() - .ifRequestAuthorizerUri() - .ifRequestDisableExecuteApiEndpoint() - .ifRequestEndpointType() - .ifRequestRouteAuthorizationType() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__059a7c810618804b2e7723d9a473d6ec4ecc67e6ef55067798dfbaf67a817aa3)
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onApis", [region, partition]))

    @jsii.member(jsii_name="onAuthorizer")
    def on_authorizer(
        self,
        api_id: builtins.str,
        authorizer_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Authorizer to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param authorizer_id: - Identifier for the authorizerId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifRequestAuthorizerType() - .ifRequestAuthorizerUri() - .ifResourceAuthorizerType() - .ifResourceAuthorizerUri() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__10c72e7e45626a6802c8e6ae7f167f630ad169b0ceddb44f217963f84d5f0239)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument authorizer_id", value=authorizer_id, expected_type=type_hints["authorizer_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onAuthorizer", [api_id, authorizer_id, region, partition]))

    @jsii.member(jsii_name="onAuthorizers")
    def on_authorizers(
        self,
        api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Authorizers to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifRequestAuthorizerType() - .ifRequestAuthorizerUri() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__98df183e076ca640cd855de2be0335ebc974a4c6a06bc21e936e0f2a4885bfe9)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onAuthorizers", [api_id, region, partition]))

    @jsii.member(jsii_name="onAuthorizersCache")
    def on_authorizers_cache(
        self,
        api_id: builtins.str,
        stage_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type AuthorizersCache to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param stage_name: - Identifier for the stageName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c03d207407dcbeed81c56cb08fdfedd77d4a44ec182269035b9c50bdf012585a)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument stage_name", value=stage_name, expected_type=type_hints["stage_name"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onAuthorizersCache", [api_id, stage_name, region, partition]))

    @jsii.member(jsii_name="onCors")
    def on_cors(
        self,
        api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Cors to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ae2639bcf4aeace347f6ac8711f29b0265f3634ae1cd96eec5ef4abd0731201f)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onCors", [api_id, region, partition]))

    @jsii.member(jsii_name="onDeployment")
    def on_deployment(
        self,
        api_id: builtins.str,
        deployment_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Deployment to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param deployment_id: - Identifier for the deploymentId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3f933b3ad9f66e250b8ab8af6b2aa60a6eb2209dc2d4d2bf2c3aa7db404fe71e)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument deployment_id", value=deployment_id, expected_type=type_hints["deployment_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onDeployment", [api_id, deployment_id, region, partition]))

    @jsii.member(jsii_name="onDeployments")
    def on_deployments(
        self,
        api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Deployments to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifRequestStageName() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e96f1056477858682e6a0ea0538d5d7a78906a264ecaaf7d7e7143686e7e3779)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onDeployments", [api_id, region, partition]))

    @jsii.member(jsii_name="onExportedAPI")
    def on_exported_api(
        self,
        api_id: builtins.str,
        specification: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type ExportedAPI to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param specification: - Identifier for the specification.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a4bc210600213b4877e16d6a1711b1143e83dfdd0a07e4d825af3d10998ac0c5)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument specification", value=specification, expected_type=type_hints["specification"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onExportedAPI", [api_id, specification, region, partition]))

    @jsii.member(jsii_name="onIntegration")
    def on_integration(
        self,
        api_id: builtins.str,
        integration_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Integration to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param integration_id: - Identifier for the integrationId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__110bab2befe477badd8332fda042663aa66eb33f930ba190ea47b9a1f9b353a1)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument integration_id", value=integration_id, expected_type=type_hints["integration_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onIntegration", [api_id, integration_id, region, partition]))

    @jsii.member(jsii_name="onIntegrationResponse")
    def on_integration_response(
        self,
        api_id: builtins.str,
        integration_id: builtins.str,
        integration_response_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type IntegrationResponse to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param integration_id: - Identifier for the integrationId.
        :param integration_response_id: - Identifier for the integrationResponseId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d42f66f1dca015bdefbf07ac889a5832cb87ead9894c32760ea536f891921028)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument integration_id", value=integration_id, expected_type=type_hints["integration_id"])
            check_type(argname="argument integration_response_id", value=integration_response_id, expected_type=type_hints["integration_response_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onIntegrationResponse", [api_id, integration_id, integration_response_id, region, partition]))

    @jsii.member(jsii_name="onIntegrationResponses")
    def on_integration_responses(
        self,
        api_id: builtins.str,
        integration_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type IntegrationResponses to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param integration_id: - Identifier for the integrationId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6a4e27128f4f4c919da57777195aae1b31f40623632f48545ac1c33803d46608)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument integration_id", value=integration_id, expected_type=type_hints["integration_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onIntegrationResponses", [api_id, integration_id, region, partition]))

    @jsii.member(jsii_name="onIntegrations")
    def on_integrations(
        self,
        api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Integrations to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__476204a91c84492d5e0049b92851ab20b5f9652ab8a7048da023030aa0803f9a)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onIntegrations", [api_id, region, partition]))

    @jsii.member(jsii_name="onModel")
    def on_model(
        self,
        api_id: builtins.str,
        model_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Model to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param model_id: - Identifier for the modelId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__47b208ebef6d6aedaf37ba93c189a521494fbce7c62c33ad65a8245e8f136dbd)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument model_id", value=model_id, expected_type=type_hints["model_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onModel", [api_id, model_id, region, partition]))

    @jsii.member(jsii_name="onModels")
    def on_models(
        self,
        api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Models to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9e136e453e3b2e8facb6dba7b9c410116dab94c9a97038359db0e00fbcb0b5c9)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onModels", [api_id, region, partition]))

    @jsii.member(jsii_name="onModelTemplate")
    def on_model_template(
        self,
        api_id: builtins.str,
        model_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type ModelTemplate to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param model_id: - Identifier for the modelId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__34f13e2f32e452dad13ac5707b4a034f83bbb8ddbccbd263acb3b073c5c62599)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument model_id", value=model_id, expected_type=type_hints["model_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onModelTemplate", [api_id, model_id, region, partition]))

    @jsii.member(jsii_name="onRoute")
    def on_route(
        self,
        api_id: builtins.str,
        route_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Route to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param route_id: - Identifier for the routeId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifRequestApiKeyRequired() - .ifRequestRouteAuthorizationType() - .ifResourceApiKeyRequired() - .ifResourceRouteAuthorizationType() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__30665e138686e37e2d6b3d3776eb2adc4a445a60dd85de95da0fc5936ce15ee0)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument route_id", value=route_id, expected_type=type_hints["route_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onRoute", [api_id, route_id, region, partition]))

    @jsii.member(jsii_name="onRouteRequestParameter")
    def on_route_request_parameter(
        self,
        api_id: builtins.str,
        route_id: builtins.str,
        request_parameter_key: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type RouteRequestParameter to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param route_id: - Identifier for the routeId.
        :param request_parameter_key: - Identifier for the requestParameterKey.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b29bd368726b0003306e61167f021c83a67dd284d97d71ecd582c8f3654f34da)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument route_id", value=route_id, expected_type=type_hints["route_id"])
            check_type(argname="argument request_parameter_key", value=request_parameter_key, expected_type=type_hints["request_parameter_key"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onRouteRequestParameter", [api_id, route_id, request_parameter_key, region, partition]))

    @jsii.member(jsii_name="onRouteResponse")
    def on_route_response(
        self,
        api_id: builtins.str,
        route_id: builtins.str,
        route_response_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type RouteResponse to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param route_id: - Identifier for the routeId.
        :param route_response_id: - Identifier for the routeResponseId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ed5a71c4cd972a20f11385d382fecd7e69276ed8cfeea6c423284b25cb9678e5)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument route_id", value=route_id, expected_type=type_hints["route_id"])
            check_type(argname="argument route_response_id", value=route_response_id, expected_type=type_hints["route_response_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onRouteResponse", [api_id, route_id, route_response_id, region, partition]))

    @jsii.member(jsii_name="onRouteResponses")
    def on_route_responses(
        self,
        api_id: builtins.str,
        route_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type RouteResponses to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param route_id: - Identifier for the routeId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d0372da6265413676bff0118aab197024f196ad5f2e52d3d25457155d6d75593)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument route_id", value=route_id, expected_type=type_hints["route_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onRouteResponses", [api_id, route_id, region, partition]))

    @jsii.member(jsii_name="onRoutes")
    def on_routes(
        self,
        api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Routes to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifRequestApiKeyRequired() - .ifRequestRouteAuthorizationType() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c5c9925bb3185d1da88ccd42d5e784d7c3e15fc4503c5bc76b60e05891d004cf)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onRoutes", [api_id, region, partition]))

    @jsii.member(jsii_name="onRouteSettings")
    def on_route_settings(
        self,
        api_id: builtins.str,
        stage_name: builtins.str,
        route_key: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type RouteSettings to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param stage_name: - Identifier for the stageName.
        :param route_key: - Identifier for the routeKey.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1dcd8f0efa602fcb0bc4af80af97342d0e4a778be0674e04b37693627ef43be3)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument stage_name", value=stage_name, expected_type=type_hints["stage_name"])
            check_type(argname="argument route_key", value=route_key, expected_type=type_hints["route_key"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onRouteSettings", [api_id, stage_name, route_key, region, partition]))

    @jsii.member(jsii_name="onStage")
    def on_stage(
        self,
        api_id: builtins.str,
        stage_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Stage to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param stage_name: - Identifier for the stageName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifRequestAccessLoggingDestination() - .ifRequestAccessLoggingFormat() - .ifResourceAccessLoggingDestination() - .ifResourceAccessLoggingFormat() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b6ba0d5f2d0bcc3b2545446f156cd5951a68804eff8aff8692b8e91055c2bd3e)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument stage_name", value=stage_name, expected_type=type_hints["stage_name"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onStage", [api_id, stage_name, region, partition]))

    @jsii.member(jsii_name="onStages")
    def on_stages(
        self,
        api_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApigatewayV2":
        '''(experimental) Adds a resource of type Stages to the statement.

        https://docs.aws.amazon.com/apigateway/latest/developerguide/security_iam_service-with-iam.html

        :param api_id: - Identifier for the apiId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifRequestAccessLoggingDestination() - .ifRequestAccessLoggingFormat() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0f84c06459f93734b0a7fbc3f4d9984fbce7e5896522c47d162f780734531e6a)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApigatewayV2", jsii.invoke(self, "onStages", [api_id, region, partition]))

    @jsii.member(jsii_name="toDELETE")
    def to_delete(self) -> "ApigatewayV2":
        '''(experimental) Grants permission to delete a particular resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apigatewayv2/latest/api-reference/API_DELETE.html

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "toDELETE", []))

    @jsii.member(jsii_name="toGET")
    def to_get(self) -> "ApigatewayV2":
        '''(experimental) Grants permission to read a particular resource.

        Access Level: Read

        https://docs.aws.amazon.com/apigatewayv2/latest/api-reference/API_GET.html

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "toGET", []))

    @jsii.member(jsii_name="toPATCH")
    def to_patch(self) -> "ApigatewayV2":
        '''(experimental) Grants permission to update a particular resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apigatewayv2/latest/api-reference/API_PATCH.html

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "toPATCH", []))

    @jsii.member(jsii_name="toPOST")
    def to_post(self) -> "ApigatewayV2":
        '''(experimental) Grants permission to create a particular resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apigatewayv2/latest/api-reference/API_POST.html

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "toPOST", []))

    @jsii.member(jsii_name="toPUT")
    def to_put(self) -> "ApigatewayV2":
        '''(experimental) Grants permission to update a particular resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apigatewayv2/latest/api-reference/API_PUT.html

        :stability: experimental
        '''
        return typing.cast("ApigatewayV2", jsii.invoke(self, "toPUT", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d006759582fbdc7548cdc784626d126146bdd00dd153754a58cd8c4d6859ed28)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3809f971b7d9af7ed5b0e7b9daf5409aa5206be44ca8395060cfd99903092857)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class AppIntegrations(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AppIntegrations",
):
    '''(experimental) Statement provider for service `app-integrations <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonappintegrations.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `app-integrations <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonappintegrations.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c9926cf5f981207ebee79296cc2bd3103df3f2061b909e2290b5c4a8944320b3)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDataIntegration")
    def on_data_integration(
        self,
        data_integration_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AppIntegrations":
        '''(experimental) Adds a resource of type data-integration to the statement.

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_DataIntegrationSummary.html

        :param data_integration_id: - Identifier for the dataIntegrationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7aa8bb8c326cd7fd88aaa6e6d1f4b3ee63cf29bfeca59325fdeb8465bf9bbd70)
            check_type(argname="argument data_integration_id", value=data_integration_id, expected_type=type_hints["data_integration_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("AppIntegrations", jsii.invoke(self, "onDataIntegration", [data_integration_id, account, region, partition]))

    @jsii.member(jsii_name="onDataIntegrationAssociation")
    def on_data_integration_association(
        self,
        data_integration_id: builtins.str,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AppIntegrations":
        '''(experimental) Adds a resource of type data-integration-association to the statement.

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_DataIntegrationAssociationSummary.html

        :param data_integration_id: - Identifier for the dataIntegrationId.
        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9595fc5853dbec715becc14317a9dcdaaee95e994176ebfe0917635d3503abe8)
            check_type(argname="argument data_integration_id", value=data_integration_id, expected_type=type_hints["data_integration_id"])
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("AppIntegrations", jsii.invoke(self, "onDataIntegrationAssociation", [data_integration_id, resource_id, account, region, partition]))

    @jsii.member(jsii_name="onEventIntegration")
    def on_event_integration(
        self,
        event_integration_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AppIntegrations":
        '''(experimental) Adds a resource of type event-integration to the statement.

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_EventIntegration.html

        :param event_integration_name: - Identifier for the eventIntegrationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dd4b72e727905d7a0ef3ed3238ddd9211c1da15cde744e964219609b3a790f98)
            check_type(argname="argument event_integration_name", value=event_integration_name, expected_type=type_hints["event_integration_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("AppIntegrations", jsii.invoke(self, "onEventIntegration", [event_integration_name, account, region, partition]))

    @jsii.member(jsii_name="onEventIntegrationAssociation")
    def on_event_integration_association(
        self,
        event_integration_name: builtins.str,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AppIntegrations":
        '''(experimental) Adds a resource of type event-integration-association to the statement.

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_EventIntegrationAssociation.html

        :param event_integration_name: - Identifier for the eventIntegrationName.
        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1ae0177bf6fc8f5dbdebb2853255877d8de5dc8362c1934f2b925d4feb852e60)
            check_type(argname="argument event_integration_name", value=event_integration_name, expected_type=type_hints["event_integration_name"])
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("AppIntegrations", jsii.invoke(self, "onEventIntegrationAssociation", [event_integration_name, resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateDataIntegration")
    def to_create_data_integration(self) -> "AppIntegrations":
        '''(experimental) Grants permission to create a new DataIntegration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - appflow:DeleteFlow
        - appflow:DescribeConnectorProfiles
        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy
        - kms:CreateGrant

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_CreateDataIntegration.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toCreateDataIntegration", []))

    @jsii.member(jsii_name="toCreateDataIntegrationAssociation")
    def to_create_data_integration_association(self) -> "AppIntegrations":
        '''(experimental) Grants permission to create a DataIntegrationAssociation.

        Access Level: Write

        Dependent actions:

        - appflow:CreateFlow
        - appflow:DeleteFlow
        - appflow:DescribeConnectorEntity
        - appflow:DescribeConnectorProfiles
        - appflow:TagResource
        - appflow:UseConnectorProfile

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_CreateDataIntegrationAssociation.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toCreateDataIntegrationAssociation", []))

    @jsii.member(jsii_name="toCreateEventIntegration")
    def to_create_event_integration(self) -> "AppIntegrations":
        '''(experimental) Grants permission to create a new EventIntegration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_CreateEventIntegration.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toCreateEventIntegration", []))

    @jsii.member(jsii_name="toCreateEventIntegrationAssociation")
    def to_create_event_integration_association(self) -> "AppIntegrations":
        '''(experimental) Grants permission to create an EventIntegrationAssociation.

        Access Level: Write

        Dependent actions:

        - events:PutRule
        - events:PutTargets

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_CreateEventIntegrationAssociation.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toCreateEventIntegrationAssociation", []))

    @jsii.member(jsii_name="toDeleteDataIntegration")
    def to_delete_data_integration(self) -> "AppIntegrations":
        '''(experimental) Grants permission to delete a DataIntegration.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_DeleteDataIntegration.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toDeleteDataIntegration", []))

    @jsii.member(jsii_name="toDeleteDataIntegrationAssociation")
    def to_delete_data_integration_association(self) -> "AppIntegrations":
        '''(experimental) Grants permission to delete a DataIntegrationAssociation.

        Access Level: Write

        Dependent actions:

        - appflow:CreateFlow
        - appflow:DeleteFlow
        - appflow:DescribeConnectorEntity
        - appflow:DescribeConnectorProfiles
        - appflow:StopFlow
        - appflow:TagResource
        - appflow:UseConnectorProfile

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_DeleteDataIntegrationAssociation.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toDeleteDataIntegrationAssociation", []))

    @jsii.member(jsii_name="toDeleteEventIntegration")
    def to_delete_event_integration(self) -> "AppIntegrations":
        '''(experimental) Grants permission to delete an EventIntegration.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_DeleteEventIntegration.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toDeleteEventIntegration", []))

    @jsii.member(jsii_name="toDeleteEventIntegrationAssociation")
    def to_delete_event_integration_association(self) -> "AppIntegrations":
        '''(experimental) Grants permission to delete an EventIntegrationAssociation.

        Access Level: Write

        Dependent actions:

        - events:DeleteRule
        - events:ListTargetsByRule
        - events:RemoveTargets

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_DeleteEventIntegrationAssociation.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toDeleteEventIntegrationAssociation", []))

    @jsii.member(jsii_name="toGetDataIntegration")
    def to_get_data_integration(self) -> "AppIntegrations":
        '''(experimental) Grants permission to view details about DataIntegrations.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_GetDataIntegration.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toGetDataIntegration", []))

    @jsii.member(jsii_name="toGetEventIntegration")
    def to_get_event_integration(self) -> "AppIntegrations":
        '''(experimental) Grants permission to view details about EventIntegrations.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_GetEventIntegration.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toGetEventIntegration", []))

    @jsii.member(jsii_name="toListDataIntegrationAssociations")
    def to_list_data_integration_associations(self) -> "AppIntegrations":
        '''(experimental) Grants permission to list DataIntegrationAssociations.

        Access Level: List

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_ListDataIntegrationAssociations.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toListDataIntegrationAssociations", []))

    @jsii.member(jsii_name="toListDataIntegrations")
    def to_list_data_integrations(self) -> "AppIntegrations":
        '''(experimental) Grants permission to list DataIntegrations.

        Access Level: List

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_ListDataIntegrations.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toListDataIntegrations", []))

    @jsii.member(jsii_name="toListEventIntegrationAssociations")
    def to_list_event_integration_associations(self) -> "AppIntegrations":
        '''(experimental) Grants permission to list EventIntegrationAssociations.

        Access Level: Read

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_ListEventIntegrationAssociations

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toListEventIntegrationAssociations", []))

    @jsii.member(jsii_name="toListEventIntegrations")
    def to_list_event_integrations(self) -> "AppIntegrations":
        '''(experimental) Grants permission to list EventIntegrations.

        Access Level: List

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_ListEventIntegrations.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toListEventIntegrations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "AppIntegrations":
        '''(experimental) Grants permission to lists tag for an Amazon AppIntegration resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "AppIntegrations":
        '''(experimental) Grants permission to tag an Amazon AppIntegration resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "AppIntegrations":
        '''(experimental) Grants permission to untag an Amazon AppIntegration resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDataIntegration")
    def to_update_data_integration(self) -> "AppIntegrations":
        '''(experimental) Grants permission to modify a DataIntegration.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_UpdateDataIntegration.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toUpdateDataIntegration", []))

    @jsii.member(jsii_name="toUpdateEventIntegration")
    def to_update_event_integration(self) -> "AppIntegrations":
        '''(experimental) Grants permission to modify an EventIntegration.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_UpdateEventIntegration.html

        :stability: experimental
        '''
        return typing.cast("AppIntegrations", jsii.invoke(self, "toUpdateEventIntegration", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__68b2f2ca86f92a8a5cab573f39a814a7de96fdddb6f5e1efb18f2ff09c6aac6c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__142c403fb9b552c3516dbcb6aa615cfa6897757c8ade1381db40f2a118ec7b63)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Appconfig(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Appconfig",
):
    '''(experimental) Statement provider for service `appconfig <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsappconfig.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `appconfig <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsappconfig.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1b0fc92e0a00e566b5db144719ee19770931bc488bc4e90e26b0038e4b98a0d3)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        application_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appconfig":
        '''(experimental) Adds a resource of type application to the statement.

        https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-creating-application.html

        :param application_id: - Identifier for the applicationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__01204a7bdc16481b05ffe497673d0522288d7d33866bf7e7dd091cde339f03d3)
            check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appconfig", jsii.invoke(self, "onApplication", [application_id, account, region, partition]))

    @jsii.member(jsii_name="onConfiguration")
    def on_configuration(
        self,
        application_id: builtins.str,
        environment_id: builtins.str,
        configuration_profile_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appconfig":
        '''(experimental) Adds a resource of type configuration to the statement.

        https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-retrieving-the-configuration.html

        :param application_id: - Identifier for the applicationId.
        :param environment_id: - Identifier for the environmentId.
        :param configuration_profile_id: - Identifier for the configurationProfileId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6bf0ca4e2b4d2022fa8d68af69ab1fb5e99416936d8ab94627fe3ba7a24c2e38)
            check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
            check_type(argname="argument environment_id", value=environment_id, expected_type=type_hints["environment_id"])
            check_type(argname="argument configuration_profile_id", value=configuration_profile_id, expected_type=type_hints["configuration_profile_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appconfig", jsii.invoke(self, "onConfiguration", [application_id, environment_id, configuration_profile_id, account, region, partition]))

    @jsii.member(jsii_name="onConfigurationprofile")
    def on_configurationprofile(
        self,
        application_id: builtins.str,
        configuration_profile_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appconfig":
        '''(experimental) Adds a resource of type configurationprofile to the statement.

        https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-creating-configuration-and-profile.html

        :param application_id: - Identifier for the applicationId.
        :param configuration_profile_id: - Identifier for the configurationProfileId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d701e53ac3c5997e321f39e49859eedea8b723316cd14adc7bde8f61bf710b5c)
            check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
            check_type(argname="argument configuration_profile_id", value=configuration_profile_id, expected_type=type_hints["configuration_profile_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appconfig", jsii.invoke(self, "onConfigurationprofile", [application_id, configuration_profile_id, account, region, partition]))

    @jsii.member(jsii_name="onDeployment")
    def on_deployment(
        self,
        application_id: builtins.str,
        environment_id: builtins.str,
        deployment_number: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appconfig":
        '''(experimental) Adds a resource of type deployment to the statement.

        https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-deploying.html

        :param application_id: - Identifier for the applicationId.
        :param environment_id: - Identifier for the environmentId.
        :param deployment_number: - Identifier for the deploymentNumber.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4c7604a94e5400ab73e8b7b9bcf003925b42dd7289015543f5c2a53e93bf3c96)
            check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
            check_type(argname="argument environment_id", value=environment_id, expected_type=type_hints["environment_id"])
            check_type(argname="argument deployment_number", value=deployment_number, expected_type=type_hints["deployment_number"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appconfig", jsii.invoke(self, "onDeployment", [application_id, environment_id, deployment_number, account, region, partition]))

    @jsii.member(jsii_name="onDeploymentstrategy")
    def on_deploymentstrategy(
        self,
        deployment_strategy_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appconfig":
        '''(experimental) Adds a resource of type deploymentstrategy to the statement.

        https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-creating-deployment-strategy.html

        :param deployment_strategy_id: - Identifier for the deploymentStrategyId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3ad5d87825ca6835ace538493e6e2cfbd9272fa9b7a3eae925bd0776bcad0379)
            check_type(argname="argument deployment_strategy_id", value=deployment_strategy_id, expected_type=type_hints["deployment_strategy_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appconfig", jsii.invoke(self, "onDeploymentstrategy", [deployment_strategy_id, account, region, partition]))

    @jsii.member(jsii_name="onEnvironment")
    def on_environment(
        self,
        application_id: builtins.str,
        environment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appconfig":
        '''(experimental) Adds a resource of type environment to the statement.

        https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-creating-environment.html

        :param application_id: - Identifier for the applicationId.
        :param environment_id: - Identifier for the environmentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__af30dc999d3ecfa5d6322c5e6c4b5b3f487194fae7cb976635fe28616988e461)
            check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
            check_type(argname="argument environment_id", value=environment_id, expected_type=type_hints["environment_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appconfig", jsii.invoke(self, "onEnvironment", [application_id, environment_id, account, region, partition]))

    @jsii.member(jsii_name="onExtension")
    def on_extension(
        self,
        extension_id: builtins.str,
        extension_version_number: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appconfig":
        '''(experimental) Adds a resource of type extension to the statement.

        https://docs.aws.amazon.com/appconfig/latest/userguide/working-with-appconfig-extensions.html

        :param extension_id: - Identifier for the extensionId.
        :param extension_version_number: - Identifier for the extensionVersionNumber.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1d7380a7c1532cf848799aa7d0061063c5f03d691c7c61ba4eba5627291a3bd9)
            check_type(argname="argument extension_id", value=extension_id, expected_type=type_hints["extension_id"])
            check_type(argname="argument extension_version_number", value=extension_version_number, expected_type=type_hints["extension_version_number"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appconfig", jsii.invoke(self, "onExtension", [extension_id, extension_version_number, account, region, partition]))

    @jsii.member(jsii_name="onExtensionassociation")
    def on_extensionassociation(
        self,
        extension_association_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appconfig":
        '''(experimental) Adds a resource of type extensionassociation to the statement.

        https://docs.aws.amazon.com/appconfig/latest/userguide/working-with-appconfig-extensions.html

        :param extension_association_id: - Identifier for the extensionAssociationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f802ee9b053464c7d720c181642ae93831bb204602117cbb80f8c385a97b804b)
            check_type(argname="argument extension_association_id", value=extension_association_id, expected_type=type_hints["extension_association_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appconfig", jsii.invoke(self, "onExtensionassociation", [extension_association_id, account, region, partition]))

    @jsii.member(jsii_name="onHostedconfigurationversion")
    def on_hostedconfigurationversion(
        self,
        application_id: builtins.str,
        configuration_profile_id: builtins.str,
        version_number: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appconfig":
        '''(experimental) Adds a resource of type hostedconfigurationversion to the statement.

        https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-creating-configuration-and-profile.html

        :param application_id: - Identifier for the applicationId.
        :param configuration_profile_id: - Identifier for the configurationProfileId.
        :param version_number: - Identifier for the versionNumber.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1a1dc7eea77d9a85cd4a3ba8bb66595b0e85419d017b8a424c7f4089fa61ac05)
            check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
            check_type(argname="argument configuration_profile_id", value=configuration_profile_id, expected_type=type_hints["configuration_profile_id"])
            check_type(argname="argument version_number", value=version_number, expected_type=type_hints["version_number"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appconfig", jsii.invoke(self, "onHostedconfigurationversion", [application_id, configuration_profile_id, version_number, account, region, partition]))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "Appconfig":
        '''(experimental) Grants permission to create an application.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toCreateConfigurationProfile")
    def to_create_configuration_profile(self) -> "Appconfig":
        '''(experimental) Grants permission to create a configuration profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_CreateConfigurationProfile.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toCreateConfigurationProfile", []))

    @jsii.member(jsii_name="toCreateDeploymentStrategy")
    def to_create_deployment_strategy(self) -> "Appconfig":
        '''(experimental) Grants permission to create a deployment strategy.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_CreateDeploymentStrategy.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toCreateDeploymentStrategy", []))

    @jsii.member(jsii_name="toCreateEnvironment")
    def to_create_environment(self) -> "Appconfig":
        '''(experimental) Grants permission to create an environment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_CreateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toCreateEnvironment", []))

    @jsii.member(jsii_name="toCreateExtension")
    def to_create_extension(self) -> "Appconfig":
        '''(experimental) Grants permission to create an extension.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_CreateExtension.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toCreateExtension", []))

    @jsii.member(jsii_name="toCreateExtensionAssociation")
    def to_create_extension_association(self) -> "Appconfig":
        '''(experimental) Grants permission to create an extension association.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_CreateExtensionAssociation.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toCreateExtensionAssociation", []))

    @jsii.member(jsii_name="toCreateHostedConfigurationVersion")
    def to_create_hosted_configuration_version(self) -> "Appconfig":
        '''(experimental) Grants permission to create a hosted configuration version.

        Access Level: Write

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_CreateHostedConfigurationVersion.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toCreateHostedConfigurationVersion", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "Appconfig":
        '''(experimental) Grants permission to delete an application.

        Access Level: Write

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toDeleteConfigurationProfile")
    def to_delete_configuration_profile(self) -> "Appconfig":
        '''(experimental) Grants permission to delete a configuration profile.

        Access Level: Write

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_DeleteConfigurationProfile.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toDeleteConfigurationProfile", []))

    @jsii.member(jsii_name="toDeleteDeploymentStrategy")
    def to_delete_deployment_strategy(self) -> "Appconfig":
        '''(experimental) Grants permission to delete a deployment strategy.

        Access Level: Write

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_DeleteDeploymentStrategy.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toDeleteDeploymentStrategy", []))

    @jsii.member(jsii_name="toDeleteEnvironment")
    def to_delete_environment(self) -> "Appconfig":
        '''(experimental) Grants permission to delete an environment.

        Access Level: Write

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_DeleteEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toDeleteEnvironment", []))

    @jsii.member(jsii_name="toDeleteExtension")
    def to_delete_extension(self) -> "Appconfig":
        '''(experimental) Grants permission to delete an extension.

        Access Level: Write

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_DeleteExtension.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toDeleteExtension", []))

    @jsii.member(jsii_name="toDeleteExtensionAssociation")
    def to_delete_extension_association(self) -> "Appconfig":
        '''(experimental) Grants permission to delete an extension association.

        Access Level: Write

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_DeleteExtensionAssociation.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toDeleteExtensionAssociation", []))

    @jsii.member(jsii_name="toDeleteHostedConfigurationVersion")
    def to_delete_hosted_configuration_version(self) -> "Appconfig":
        '''(experimental) Grants permission to delete a hosted configuration version.

        Access Level: Write

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_DeleteHostedConfigurationVersion.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toDeleteHostedConfigurationVersion", []))

    @jsii.member(jsii_name="toGetApplication")
    def to_get_application(self) -> "Appconfig":
        '''(experimental) Grants permission to view details about an application.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_GetApplication.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toGetApplication", []))

    @jsii.member(jsii_name="toGetConfiguration")
    def to_get_configuration(self) -> "Appconfig":
        '''(experimental) Grants permission to view details about a configuration.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_GetConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toGetConfiguration", []))

    @jsii.member(jsii_name="toGetConfigurationProfile")
    def to_get_configuration_profile(self) -> "Appconfig":
        '''(experimental) Grants permission to view details about a configuration profile.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_GetConfigurationProfile.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toGetConfigurationProfile", []))

    @jsii.member(jsii_name="toGetDeployment")
    def to_get_deployment(self) -> "Appconfig":
        '''(experimental) Grants permission to view details about a deployment.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_GetDeployment.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toGetDeployment", []))

    @jsii.member(jsii_name="toGetDeploymentStrategy")
    def to_get_deployment_strategy(self) -> "Appconfig":
        '''(experimental) Grants permission to view details about a deployment strategy.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_GetDeploymentStrategy.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toGetDeploymentStrategy", []))

    @jsii.member(jsii_name="toGetEnvironment")
    def to_get_environment(self) -> "Appconfig":
        '''(experimental) Grants permission to view details about an environment.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_GetEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toGetEnvironment", []))

    @jsii.member(jsii_name="toGetExtension")
    def to_get_extension(self) -> "Appconfig":
        '''(experimental) Grants permission to view details about an extension.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_GetExtension.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toGetExtension", []))

    @jsii.member(jsii_name="toGetExtensionAssociation")
    def to_get_extension_association(self) -> "Appconfig":
        '''(experimental) Grants permission to view details about an extension association.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_GetExtensionAssociation.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toGetExtensionAssociation", []))

    @jsii.member(jsii_name="toGetHostedConfigurationVersion")
    def to_get_hosted_configuration_version(self) -> "Appconfig":
        '''(experimental) Grants permission to view details about a hosted configuration version.

        Access Level: Read

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_GetHostedConfigurationVersion.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toGetHostedConfigurationVersion", []))

    @jsii.member(jsii_name="toGetLatestConfiguration")
    def to_get_latest_configuration(self) -> "Appconfig":
        '''(experimental) Grants permission to retrieve a deployed configuration.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_appconfigdata_GetLatestConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toGetLatestConfiguration", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "Appconfig":
        '''(experimental) Grants permission to list the applications in your account.

        Access Level: List

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_ListApplications.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListConfigurationProfiles")
    def to_list_configuration_profiles(self) -> "Appconfig":
        '''(experimental) Grants permission to list the configuration profiles for an application.

        Access Level: List

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_ListConfigurationProfiles.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toListConfigurationProfiles", []))

    @jsii.member(jsii_name="toListDeployments")
    def to_list_deployments(self) -> "Appconfig":
        '''(experimental) Grants permission to list the deployments for an environment.

        Access Level: List

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_ListDeployments.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toListDeployments", []))

    @jsii.member(jsii_name="toListDeploymentStrategies")
    def to_list_deployment_strategies(self) -> "Appconfig":
        '''(experimental) Grants permission to list the deployment strategies for your account.

        Access Level: List

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_ListDeploymentStrategies.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toListDeploymentStrategies", []))

    @jsii.member(jsii_name="toListEnvironments")
    def to_list_environments(self) -> "Appconfig":
        '''(experimental) Grants permission to list the environments for an application.

        Access Level: List

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_ListEnvironments.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toListEnvironments", []))

    @jsii.member(jsii_name="toListExtensionAssociations")
    def to_list_extension_associations(self) -> "Appconfig":
        '''(experimental) Grants permission to list the extension associations in your account.

        Access Level: List

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_ListExtensionAssociations.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toListExtensionAssociations", []))

    @jsii.member(jsii_name="toListExtensions")
    def to_list_extensions(self) -> "Appconfig":
        '''(experimental) Grants permission to list the extensions in your account.

        Access Level: List

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_ListExtensions.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toListExtensions", []))

    @jsii.member(jsii_name="toListHostedConfigurationVersions")
    def to_list_hosted_configuration_versions(self) -> "Appconfig":
        '''(experimental) Grants permission to list the hosted configuration versions for a configuration profile.

        Access Level: List

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_ListHostedConfigurationVersions.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toListHostedConfigurationVersions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Appconfig":
        '''(experimental) Grants permission to view a list of resource tags for a specified resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartConfigurationSession")
    def to_start_configuration_session(self) -> "Appconfig":
        '''(experimental) Grants permission to start a configuration session.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_appconfigdata_StartConfigurationSession.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toStartConfigurationSession", []))

    @jsii.member(jsii_name="toStartDeployment")
    def to_start_deployment(self) -> "Appconfig":
        '''(experimental) Grants permission to initiate a deployment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_StartDeployment.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toStartDeployment", []))

    @jsii.member(jsii_name="toStopDeployment")
    def to_stop_deployment(self) -> "Appconfig":
        '''(experimental) Grants permission to stop a deployment.

        Access Level: Write

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_StopDeployment.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toStopDeployment", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Appconfig":
        '''(experimental) Grants permission to tag an appconfig resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Appconfig":
        '''(experimental) Grants permission to untag an appconfig resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "Appconfig":
        '''(experimental) Grants permission to modify an application.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toUpdateApplication", []))

    @jsii.member(jsii_name="toUpdateConfigurationProfile")
    def to_update_configuration_profile(self) -> "Appconfig":
        '''(experimental) Grants permission to modify a configuration profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_UpdateConfigurationProfile.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toUpdateConfigurationProfile", []))

    @jsii.member(jsii_name="toUpdateDeploymentStrategy")
    def to_update_deployment_strategy(self) -> "Appconfig":
        '''(experimental) Grants permission to modify a deployment strategy.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_UpdateDeploymentStrategy.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toUpdateDeploymentStrategy", []))

    @jsii.member(jsii_name="toUpdateEnvironment")
    def to_update_environment(self) -> "Appconfig":
        '''(experimental) Grants permission to modify an environment.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_UpdateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toUpdateEnvironment", []))

    @jsii.member(jsii_name="toUpdateExtension")
    def to_update_extension(self) -> "Appconfig":
        '''(experimental) Grants permission to modify an extension.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_UpdateExtension.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toUpdateExtension", []))

    @jsii.member(jsii_name="toUpdateExtensionAssociation")
    def to_update_extension_association(self) -> "Appconfig":
        '''(experimental) Grants permission to modify an extension association.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_UpdateExtensionAssociation.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toUpdateExtensionAssociation", []))

    @jsii.member(jsii_name="toValidateConfiguration")
    def to_validate_configuration(self) -> "Appconfig":
        '''(experimental) Grants permission to validate a configuration.

        Access Level: Write

        https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_ValidateConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Appconfig", jsii.invoke(self, "toValidateConfiguration", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6887af4652baa4390f010798103d67ffe035184f2b61507a9fba632a5d71c06e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__df9124c221f4f06dcb3a49f2529daabbe7261a13994ef4e1766cfbf6df725a93)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Appflow(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Appflow"):
    '''(experimental) Statement provider for service `appflow <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonappflow.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `appflow <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonappflow.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b3305388be7b1e308485da23992f4035b9c88e79d465695e9889cf9c0a153f62)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onConnector")
    def on_connector(
        self,
        connector_label: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appflow":
        '''(experimental) Adds a resource of type connector to the statement.

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_ConnectorDefinition.html

        :param connector_label: - Identifier for the connectorLabel.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__332581ec4b84f4cb7aa150ddb8b64b961a14aa07b39dbc4afaaf726da9012705)
            check_type(argname="argument connector_label", value=connector_label, expected_type=type_hints["connector_label"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appflow", jsii.invoke(self, "onConnector", [connector_label, account, region, partition]))

    @jsii.member(jsii_name="onConnectorprofile")
    def on_connectorprofile(
        self,
        profile_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appflow":
        '''(experimental) Adds a resource of type connectorprofile to the statement.

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_ConnectorProfile.html

        :param profile_name: - Identifier for the profileName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9e9e2ee3ef82186f440555af5c3120b69f2a258271a00cd7f84ab1374ed21d31)
            check_type(argname="argument profile_name", value=profile_name, expected_type=type_hints["profile_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appflow", jsii.invoke(self, "onConnectorprofile", [profile_name, account, region, partition]))

    @jsii.member(jsii_name="onFlow")
    def on_flow(
        self,
        flow_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appflow":
        '''(experimental) Adds a resource of type flow to the statement.

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_FlowDefinition.html

        :param flow_name: - Identifier for the flowName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8c7f60e20cd4e471b5d253bdb0388fb8da15af5f26026b70a3886706b6e20edb)
            check_type(argname="argument flow_name", value=flow_name, expected_type=type_hints["flow_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appflow", jsii.invoke(self, "onFlow", [flow_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateConnectorProfile")
    def to_create_connector_profile(self) -> "Appflow":
        '''(experimental) Grants permission to create a login profile to be used with Amazon AppFlow flows.

        Access Level: Write

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_CreateConnectorProfile.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toCreateConnectorProfile", []))

    @jsii.member(jsii_name="toCreateFlow")
    def to_create_flow(self) -> "Appflow":
        '''(experimental) Grants permission to create an Amazon AppFlow flow.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_CreateFlow.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toCreateFlow", []))

    @jsii.member(jsii_name="toDeleteConnectorProfile")
    def to_delete_connector_profile(self) -> "Appflow":
        '''(experimental) Grants permission to delete a login profile configured in Amazon AppFlow.

        Access Level: Write

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_DescribeConnectorProfiles.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDeleteConnectorProfile", []))

    @jsii.member(jsii_name="toDeleteFlow")
    def to_delete_flow(self) -> "Appflow":
        '''(experimental) Grants permission to delete an Amazon AppFlow flow.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_DeleteFlow.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDeleteFlow", []))

    @jsii.member(jsii_name="toDescribeConnector")
    def to_describe_connector(self) -> "Appflow":
        '''(experimental) Grants permission to describe a connector registered in Amazon AppFlow.

        Access Level: Read

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_DescribeConnector.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDescribeConnector", []))

    @jsii.member(jsii_name="toDescribeConnectorEntity")
    def to_describe_connector_entity(self) -> "Appflow":
        '''(experimental) Grants permission to describe all fields for an object in a login profile configured in Amazon AppFlow.

        Access Level: Read

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_DescribeConnectorEntity.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDescribeConnectorEntity", []))

    @jsii.member(jsii_name="toDescribeConnectorFields")
    def to_describe_connector_fields(self) -> "Appflow":
        '''(experimental) Grants permission to describe all fields for an object in a login profile configured in Amazon AppFlow (Console Only).

        Access Level: Read

        https://docs.aws.amazon.com/appflow/latest/userguide/identity-access-management.html#appflow-api-actions

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDescribeConnectorFields", []))

    @jsii.member(jsii_name="toDescribeConnectorProfiles")
    def to_describe_connector_profiles(self) -> "Appflow":
        '''(experimental) Grants permission to describe all login profiles configured in Amazon AppFlow.

        Access Level: Read

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_DescribeConnectorProfiles.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDescribeConnectorProfiles", []))

    @jsii.member(jsii_name="toDescribeConnectors")
    def to_describe_connectors(self) -> "Appflow":
        '''(experimental) Grants permission to describe all connectors supported by Amazon AppFlow.

        Access Level: Read

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_DescribeConnectors.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDescribeConnectors", []))

    @jsii.member(jsii_name="toDescribeFlow")
    def to_describe_flow(self) -> "Appflow":
        '''(experimental) Grants permission to describe a specific flow configured in Amazon AppFlow.

        Access Level: Read

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_DescribeFlow.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDescribeFlow", []))

    @jsii.member(jsii_name="toDescribeFlowExecution")
    def to_describe_flow_execution(self) -> "Appflow":
        '''(experimental) Grants permission to describe all flow executions for a flow configured in Amazon AppFlow (Console Only).

        Access Level: Read

        https://docs.aws.amazon.com/appflow/latest/userguide/identity-access-management.html#appflow-api-actions

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDescribeFlowExecution", []))

    @jsii.member(jsii_name="toDescribeFlowExecutionRecords")
    def to_describe_flow_execution_records(self) -> "Appflow":
        '''(experimental) Grants permission to describe all flow executions for a flow configured in Amazon AppFlow.

        Access Level: Read

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_DescribeFlowExecutionRecords.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDescribeFlowExecutionRecords", []))

    @jsii.member(jsii_name="toDescribeFlows")
    def to_describe_flows(self) -> "Appflow":
        '''(experimental) Grants permission to describe all flows configured in Amazon AppFlow (Console Only).

        Access Level: Read

        https://docs.aws.amazon.com/appflow/latest/userguide/identity-access-management.html#appflow-api-actions

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toDescribeFlows", []))

    @jsii.member(jsii_name="toListConnectorEntities")
    def to_list_connector_entities(self) -> "Appflow":
        '''(experimental) Grants permission to list all objects for a login profile configured in Amazon AppFlow.

        Access Level: List

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_ListConnectorEntities.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toListConnectorEntities", []))

    @jsii.member(jsii_name="toListConnectorFields")
    def to_list_connector_fields(self) -> "Appflow":
        '''(experimental) Grants permission to list all objects for a login profile configured in Amazon AppFlow (Console Only).

        Access Level: Read

        https://docs.aws.amazon.com/appflow/latest/userguide/identity-access-management.html#appflow-api-actions

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toListConnectorFields", []))

    @jsii.member(jsii_name="toListConnectors")
    def to_list_connectors(self) -> "Appflow":
        '''(experimental) Grants permission to list all connectors supported in Amazon AppFlow.

        Access Level: List

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_ListConnectors.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toListConnectors", []))

    @jsii.member(jsii_name="toListFlows")
    def to_list_flows(self) -> "Appflow":
        '''(experimental) Grants permission to list all flows configured in Amazon AppFlow.

        Access Level: List

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_ListFlows.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toListFlows", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Appflow":
        '''(experimental) Grants permission to list tags for a flow.

        Access Level: Read

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRegisterConnector")
    def to_register_connector(self) -> "Appflow":
        '''(experimental) Grants permission to register an Amazon AppFlow connector.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_RegisterConnector.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toRegisterConnector", []))

    @jsii.member(jsii_name="toRunFlow")
    def to_run_flow(self) -> "Appflow":
        '''(experimental) Grants permission to run a flow configured in Amazon AppFlow (Console Only).

        Access Level: Write

        https://docs.aws.amazon.com/appflow/latest/userguide/identity-access-management.html#appflow-api-actions

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toRunFlow", []))

    @jsii.member(jsii_name="toStartFlow")
    def to_start_flow(self) -> "Appflow":
        '''(experimental) Grants permission to activate (for scheduled and event-triggered flows) or run (for on-demand flows) a flow configured in Amazon AppFlow.

        Access Level: Write

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_StartFlow.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toStartFlow", []))

    @jsii.member(jsii_name="toStopFlow")
    def to_stop_flow(self) -> "Appflow":
        '''(experimental) Grants permission to deactivate a scheduled or event-triggered flow configured in Amazon AppFlow.

        Access Level: Write

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_StopFlow.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toStopFlow", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Appflow":
        '''(experimental) Grants permission to tag a flow.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUnRegisterConnector")
    def to_un_register_connector(self) -> "Appflow":
        '''(experimental) Grants permission to un-register a connector in Amazon AppFlow.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_UnregisterConnector.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toUnRegisterConnector", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Appflow":
        '''(experimental) Grants permission to untag a flow.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateConnectorProfile")
    def to_update_connector_profile(self) -> "Appflow":
        '''(experimental) Grants permission to update a login profile configured in Amazon AppFlow.

        Access Level: Write

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_UpdateConnectorProfile.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toUpdateConnectorProfile", []))

    @jsii.member(jsii_name="toUpdateConnectorRegistration")
    def to_update_connector_registration(self) -> "Appflow":
        '''(experimental) Grants permission to update a registered connector configured in Amazon AppFlow.

        Access Level: Write

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_UpdateConnectorRegistration.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toUpdateConnectorRegistration", []))

    @jsii.member(jsii_name="toUpdateFlow")
    def to_update_flow(self) -> "Appflow":
        '''(experimental) Grants permission to update a flow configured in Amazon AppFlow.

        Access Level: Write

        https://docs.aws.amazon.com/appflow/1.0/APIReference/API_UpdateFlow.html

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toUpdateFlow", []))

    @jsii.member(jsii_name="toUseConnectorProfile")
    def to_use_connector_profile(self) -> "Appflow":
        '''(experimental) Grants permission to use a connector profile while creating a flow in Amazon AppFlow.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Appflow", jsii.invoke(self, "toUseConnectorProfile", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__10c24b2a44823c48dd0c34799649e0e53a5965636c0bb8c83a873da276ef3a3d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a1427c2ea350922058118251549824e2feb14cfde303de57e521c0c45584a7c7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class ApplicationAutoscaling(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ApplicationAutoscaling",
):
    '''(experimental) Statement provider for service `application-autoscaling <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsapplicationautoscaling.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `application-autoscaling <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsapplicationautoscaling.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6ecd8537bd40fbffeeb2ef302df60889ef0c77e6fe156c792d3ec289ef2f2adb)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifScalableDimension")
    def if_scalable_dimension(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApplicationAutoscaling":
        '''(experimental) Filters access by the scalable dimension that is passed in the request.

        https://docs.aws.amazon.com/autoscaling/application/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toDeleteScalingPolicy()
        - .toDeleteScheduledAction()
        - .toDeregisterScalableTarget()
        - .toPutScalingPolicy()
        - .toPutScheduledAction()
        - .toRegisterScalableTarget()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__04ff9a10af37e74df7970e714b5f5c2cc26efc0c2f71935330fec0307d0b3b31)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "ifScalableDimension", [value, operator]))

    @jsii.member(jsii_name="ifServiceNamespace")
    def if_service_namespace(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ApplicationAutoscaling":
        '''(experimental) Filters access by the service namespace that is passed in the request.

        https://docs.aws.amazon.com/autoscaling/application/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toDeleteScalingPolicy()
        - .toDeleteScheduledAction()
        - .toDeregisterScalableTarget()
        - .toPutScalingPolicy()
        - .toPutScheduledAction()
        - .toRegisterScalableTarget()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6a1a75b19c81684a999bb17b7347b58df68105355b0bbbe8f8100c0831c70ebd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "ifServiceNamespace", [value, operator]))

    @jsii.member(jsii_name="onScalableTarget")
    def on_scalable_target(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ApplicationAutoscaling":
        '''(experimental) Adds a resource of type ScalableTarget to the statement.

        https://docs.aws.amazon.com/autoscaling/application/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-resources

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__43954ab7c2752f34413a65b938f09aee94924a616ca3f6fb4776099bbe80c1d6)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "onScalableTarget", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toDeleteScalingPolicy")
    def to_delete_scaling_policy(self) -> "ApplicationAutoscaling":
        '''(experimental) Grants permission to delete a scaling policy.

        Access Level: Write

        Possible conditions:

        - .ifServiceNamespace()
        - .ifScalableDimension()

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_DeleteScalingPolicy.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toDeleteScalingPolicy", []))

    @jsii.member(jsii_name="toDeleteScheduledAction")
    def to_delete_scheduled_action(self) -> "ApplicationAutoscaling":
        '''(experimental) Grants permission to delete a scheduled action.

        Access Level: Write

        Possible conditions:

        - .ifServiceNamespace()
        - .ifScalableDimension()

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_DeleteScheduledAction.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toDeleteScheduledAction", []))

    @jsii.member(jsii_name="toDeregisterScalableTarget")
    def to_deregister_scalable_target(self) -> "ApplicationAutoscaling":
        '''(experimental) Grants permission to deregister a scalable target.

        Access Level: Write

        Possible conditions:

        - .ifServiceNamespace()
        - .ifScalableDimension()

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_DeregisterScalableTarget.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toDeregisterScalableTarget", []))

    @jsii.member(jsii_name="toDescribeScalableTargets")
    def to_describe_scalable_targets(self) -> "ApplicationAutoscaling":
        '''(experimental) Grants permission to describe one or more scalable targets in the specified namespace.

        Access Level: Read

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_DescribeScalableTargets.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toDescribeScalableTargets", []))

    @jsii.member(jsii_name="toDescribeScalingActivities")
    def to_describe_scaling_activities(self) -> "ApplicationAutoscaling":
        '''(experimental) Grants permission to describe a set of scaling activities or all scaling activities in the specified namespace.

        Access Level: Read

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_DescribeScalingActivities.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toDescribeScalingActivities", []))

    @jsii.member(jsii_name="toDescribeScalingPolicies")
    def to_describe_scaling_policies(self) -> "ApplicationAutoscaling":
        '''(experimental) Grants permission to describe a set of scaling policies or all scaling policies in the specified namespace.

        Access Level: Read

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_DescribeScalingPolicies.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toDescribeScalingPolicies", []))

    @jsii.member(jsii_name="toDescribeScheduledActions")
    def to_describe_scheduled_actions(self) -> "ApplicationAutoscaling":
        '''(experimental) Grants permission to describe a set of scheduled actions or all scheduled actions in the specified namespace.

        Access Level: Read

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_DescribeScheduledActions.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toDescribeScheduledActions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "ApplicationAutoscaling":
        '''(experimental) Grants permission to list tags for a scalable target.

        Access Level: Tagging

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutScalingPolicy")
    def to_put_scaling_policy(self) -> "ApplicationAutoscaling":
        '''(experimental) Grants permission to create and update a scaling policy for a scalable target.

        Access Level: Write

        Possible conditions:

        - .ifServiceNamespace()
        - .ifScalableDimension()

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_PutScalingPolicy.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toPutScalingPolicy", []))

    @jsii.member(jsii_name="toPutScheduledAction")
    def to_put_scheduled_action(self) -> "ApplicationAutoscaling":
        '''(experimental) Grants permission to create and update a scheduled action for a scalable target.

        Access Level: Write

        Possible conditions:

        - .ifServiceNamespace()
        - .ifScalableDimension()

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_PutScheduledAction.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toPutScheduledAction", []))

    @jsii.member(jsii_name="toRegisterScalableTarget")
    def to_register_scalable_target(self) -> "ApplicationAutoscaling":
        '''(experimental) Grants permission to register AWS or custom resources as scalable targets with Application Auto Scaling and to update configuration parameters used to manage a scalable target.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifServiceNamespace()
        - .ifScalableDimension()

        Dependent actions:

        - application-autoscaling:TagResource

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_RegisterScalableTarget.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toRegisterScalableTarget", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "ApplicationAutoscaling":
        '''(experimental) Grants permission to tag a scalable target.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "ApplicationAutoscaling":
        '''(experimental) Grants permission to remove tags from a scalable target.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/autoscaling/application/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("ApplicationAutoscaling", jsii.invoke(self, "toUntagResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7d8787fcc02a2ac02610bf3f04c6133d6eecfcc14bb4d42ef0f710e59ab4f7f3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__28a4131aeaeb874a8294b62abffeba2bd9e73a195d3e61a026395c13e496489f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class ApplicationCostProfiler(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ApplicationCostProfiler",
):
    '''(experimental) Statement provider for service `application-cost-profiler <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsapplicationcostprofilerservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `application-cost-profiler <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsapplicationcostprofilerservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5dedd149e25fa4944d1a65d54c7db0afe4b57542f33e7462fab5ab28a93829af)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toDeleteReportDefinition")
    def to_delete_report_definition(self) -> "ApplicationCostProfiler":
        '''(experimental) Grants permission to delete the configuration with specific Application Cost Profiler Report thereby effectively disabling report generation.

        Access Level: Write

        https://docs.aws.amazon.com/application-cost-profiler/latest/APIReference/API_DeleteReportDefinition.html

        :stability: experimental
        '''
        return typing.cast("ApplicationCostProfiler", jsii.invoke(self, "toDeleteReportDefinition", []))

    @jsii.member(jsii_name="toGetReportDefinition")
    def to_get_report_definition(self) -> "ApplicationCostProfiler":
        '''(experimental) Grants permission to fetch the configuration with specific Application Cost Profiler Report request.

        Access Level: Read

        https://docs.aws.amazon.com/application-cost-profiler/latest/APIReference/API_GetReportDefinition.html

        :stability: experimental
        '''
        return typing.cast("ApplicationCostProfiler", jsii.invoke(self, "toGetReportDefinition", []))

    @jsii.member(jsii_name="toImportApplicationUsage")
    def to_import_application_usage(self) -> "ApplicationCostProfiler":
        '''(experimental) Grants permission to import the application usage from S3.

        Access Level: Write

        https://docs.aws.amazon.com/application-cost-profiler/latest/APIReference/API_ImportApplicationUsage.html

        :stability: experimental
        '''
        return typing.cast("ApplicationCostProfiler", jsii.invoke(self, "toImportApplicationUsage", []))

    @jsii.member(jsii_name="toListReportDefinitions")
    def to_list_report_definitions(self) -> "ApplicationCostProfiler":
        '''(experimental) Grants permission to get a list of the different Application Cost Profiler Report configurations they have created.

        Access Level: Read

        https://docs.aws.amazon.com/application-cost-profiler/latest/APIReference/API_ListReportDefinitions.html

        :stability: experimental
        '''
        return typing.cast("ApplicationCostProfiler", jsii.invoke(self, "toListReportDefinitions", []))

    @jsii.member(jsii_name="toPutReportDefinition")
    def to_put_report_definition(self) -> "ApplicationCostProfiler":
        '''(experimental) Grants permission to create Application Cost Profiler Report configurations.

        Access Level: Write

        https://docs.aws.amazon.com/application-cost-profiler/latest/APIReference/API_PutReportDefinition.html

        :stability: experimental
        '''
        return typing.cast("ApplicationCostProfiler", jsii.invoke(self, "toPutReportDefinition", []))

    @jsii.member(jsii_name="toUpdateReportDefinition")
    def to_update_report_definition(self) -> "ApplicationCostProfiler":
        '''(experimental) Grants permission to update an existing Application Cost Profiler Report configuration.

        Access Level: Write

        https://docs.aws.amazon.com/application-cost-profiler/latest/APIReference/API_UpdateReportDefinition.html

        :stability: experimental
        '''
        return typing.cast("ApplicationCostProfiler", jsii.invoke(self, "toUpdateReportDefinition", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c1bc7d64e2a867a010736a8bc937fb9db4b74019ad2b953b9919ac1d994154b3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__433cbaca2e2f965257b8983be3dd0eef4d6106134e2aaf8c8156e163abf1a6cb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Applicationinsights(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Applicationinsights",
):
    '''(experimental) Statement provider for service `applicationinsights <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchapplicationinsights.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `applicationinsights <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchapplicationinsights.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ed51515cbddff5435fc829fb556f3a505ab996984a7bc9999ac9c97b9ab0572f)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "Applicationinsights":
        '''(experimental) Grants permission to create an application from a resource group.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toCreateComponent")
    def to_create_component(self) -> "Applicationinsights":
        '''(experimental) Grants permission to create a component from a group of resources.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_CreateComponent.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toCreateComponent", []))

    @jsii.member(jsii_name="toCreateLogPattern")
    def to_create_log_pattern(self) -> "Applicationinsights":
        '''(experimental) Grants permission to create log a pattern.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_CreateLogPattern.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toCreateLogPattern", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "Applicationinsights":
        '''(experimental) Grants permission to delete an application.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toDeleteComponent")
    def to_delete_component(self) -> "Applicationinsights":
        '''(experimental) Grants permission to delete a component.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_DeleteComponent.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDeleteComponent", []))

    @jsii.member(jsii_name="toDeleteLogPattern")
    def to_delete_log_pattern(self) -> "Applicationinsights":
        '''(experimental) Grants permission to delete a log pattern.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_DeleteLogPattern.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDeleteLogPattern", []))

    @jsii.member(jsii_name="toDescribeApplication")
    def to_describe_application(self) -> "Applicationinsights":
        '''(experimental) Grants permission to describe an application.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_DescribeApplication.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDescribeApplication", []))

    @jsii.member(jsii_name="toDescribeComponent")
    def to_describe_component(self) -> "Applicationinsights":
        '''(experimental) Grants permission to describe a component.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_DescribeComponent.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDescribeComponent", []))

    @jsii.member(jsii_name="toDescribeComponentConfiguration")
    def to_describe_component_configuration(self) -> "Applicationinsights":
        '''(experimental) Grants permission to describe a component's configuration.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_DescribeComponentConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDescribeComponentConfiguration", []))

    @jsii.member(jsii_name="toDescribeComponentConfigurationRecommendation")
    def to_describe_component_configuration_recommendation(
        self,
    ) -> "Applicationinsights":
        '''(experimental) Grants permission to describe the recommended application component configuration.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_DescribeComponentConfigurationRecommendation.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDescribeComponentConfigurationRecommendation", []))

    @jsii.member(jsii_name="toDescribeLogPattern")
    def to_describe_log_pattern(self) -> "Applicationinsights":
        '''(experimental) Grants permission to describe a log pattern.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_DescribeLogPattern.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDescribeLogPattern", []))

    @jsii.member(jsii_name="toDescribeObservation")
    def to_describe_observation(self) -> "Applicationinsights":
        '''(experimental) Grants permission to describe an observation.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_DescribeObservation.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDescribeObservation", []))

    @jsii.member(jsii_name="toDescribeProblem")
    def to_describe_problem(self) -> "Applicationinsights":
        '''(experimental) Grants permission to describe a problem.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_DescribeProblem.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDescribeProblem", []))

    @jsii.member(jsii_name="toDescribeProblemObservations")
    def to_describe_problem_observations(self) -> "Applicationinsights":
        '''(experimental) Grants permission to describe the observation in a problem.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_DescribeProblemObservations.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toDescribeProblemObservations", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "Applicationinsights":
        '''(experimental) Grants permission to list all applications.

        Access Level: List

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_ListApplications.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListComponents")
    def to_list_components(self) -> "Applicationinsights":
        '''(experimental) Grants permission to list an application's components.

        Access Level: List

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_ListComponents.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toListComponents", []))

    @jsii.member(jsii_name="toListConfigurationHistory")
    def to_list_configuration_history(self) -> "Applicationinsights":
        '''(experimental) Grants permission to list configuration history.

        Access Level: List

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_ListConfigurationHistory.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toListConfigurationHistory", []))

    @jsii.member(jsii_name="toListLogPatterns")
    def to_list_log_patterns(self) -> "Applicationinsights":
        '''(experimental) Grants permission to list log patterns.

        Access Level: List

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_ListLogPatterns.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toListLogPatterns", []))

    @jsii.member(jsii_name="toListLogPatternSets")
    def to_list_log_pattern_sets(self) -> "Applicationinsights":
        '''(experimental) Grants permission to list log pattern sets for an application.

        Access Level: List

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_ListLogPatternSets.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toListLogPatternSets", []))

    @jsii.member(jsii_name="toListProblems")
    def to_list_problems(self) -> "Applicationinsights":
        '''(experimental) Grants permission to list the problems in an application.

        Access Level: List

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_ListProblems.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toListProblems", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Applicationinsights":
        '''(experimental) Grants permission to list tags for the resource.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Applicationinsights":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Applicationinsights":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "Applicationinsights":
        '''(experimental) Grants permission to update an application.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toUpdateApplication", []))

    @jsii.member(jsii_name="toUpdateComponent")
    def to_update_component(self) -> "Applicationinsights":
        '''(experimental) Grants permission to update a component.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_UpdateComponent.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toUpdateComponent", []))

    @jsii.member(jsii_name="toUpdateComponentConfiguration")
    def to_update_component_configuration(self) -> "Applicationinsights":
        '''(experimental) Grants permission to update a component's configuration.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_UpdateComponentConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toUpdateComponentConfiguration", []))

    @jsii.member(jsii_name="toUpdateLogPattern")
    def to_update_log_pattern(self) -> "Applicationinsights":
        '''(experimental) Grants permission to update a log pattern.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatch/latest/APIReference/API_UpdateLogPattern.html

        :stability: experimental
        '''
        return typing.cast("Applicationinsights", jsii.invoke(self, "toUpdateLogPattern", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8ab3267f15e22799e09f78750eb53d17fcc6f1bfc328712e884702e00e8aa568)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f10f7de83b233d176bc29386c449ca1c896376a24d7ccd3be2a2b6115174242f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Appmesh(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Appmesh"):
    '''(experimental) Statement provider for service `appmesh <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsappmesh.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `appmesh <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsappmesh.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3f3896667f675b74ec7dc3169055afbbf76f7424102b707f0049b19e711f06cf)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onGatewayRoute")
    def on_gateway_route(
        self,
        mesh_name: builtins.str,
        virtual_gateway_name: builtins.str,
        gateway_route_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appmesh":
        '''(experimental) Adds a resource of type gatewayRoute to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_gateways.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_gateway_name: - Identifier for the virtualGatewayName.
        :param gateway_route_name: - Identifier for the gatewayRouteName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ee8275e553b46d33cc318aeddb03b11925c0c7d8bf475b7422e22534ec1d9044)
            check_type(argname="argument mesh_name", value=mesh_name, expected_type=type_hints["mesh_name"])
            check_type(argname="argument virtual_gateway_name", value=virtual_gateway_name, expected_type=type_hints["virtual_gateway_name"])
            check_type(argname="argument gateway_route_name", value=gateway_route_name, expected_type=type_hints["gateway_route_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appmesh", jsii.invoke(self, "onGatewayRoute", [mesh_name, virtual_gateway_name, gateway_route_name, account, region, partition]))

    @jsii.member(jsii_name="onMesh")
    def on_mesh(
        self,
        mesh_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appmesh":
        '''(experimental) Adds a resource of type mesh to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/meshes.html

        :param mesh_name: - Identifier for the meshName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__76eb5f0336ddb6e28fc01334c4ddc937e4d3166dac5f1e5702bdc525dc0fc8cb)
            check_type(argname="argument mesh_name", value=mesh_name, expected_type=type_hints["mesh_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appmesh", jsii.invoke(self, "onMesh", [mesh_name, account, region, partition]))

    @jsii.member(jsii_name="onRoute")
    def on_route(
        self,
        mesh_name: builtins.str,
        virtual_router_name: builtins.str,
        route_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appmesh":
        '''(experimental) Adds a resource of type route to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/routes.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_router_name: - Identifier for the virtualRouterName.
        :param route_name: - Identifier for the routeName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__50c7f80412376467c8cd5c87107bfea747d733a2c967d8184c265286a55c06e2)
            check_type(argname="argument mesh_name", value=mesh_name, expected_type=type_hints["mesh_name"])
            check_type(argname="argument virtual_router_name", value=virtual_router_name, expected_type=type_hints["virtual_router_name"])
            check_type(argname="argument route_name", value=route_name, expected_type=type_hints["route_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appmesh", jsii.invoke(self, "onRoute", [mesh_name, virtual_router_name, route_name, account, region, partition]))

    @jsii.member(jsii_name="onVirtualGateway")
    def on_virtual_gateway(
        self,
        mesh_name: builtins.str,
        virtual_gateway_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appmesh":
        '''(experimental) Adds a resource of type virtualGateway to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_gateways.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_gateway_name: - Identifier for the virtualGatewayName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e935895973dac7a90eb45a095806590ffe6299629fe7eb836401463e49322ec7)
            check_type(argname="argument mesh_name", value=mesh_name, expected_type=type_hints["mesh_name"])
            check_type(argname="argument virtual_gateway_name", value=virtual_gateway_name, expected_type=type_hints["virtual_gateway_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appmesh", jsii.invoke(self, "onVirtualGateway", [mesh_name, virtual_gateway_name, account, region, partition]))

    @jsii.member(jsii_name="onVirtualNode")
    def on_virtual_node(
        self,
        mesh_name: builtins.str,
        virtual_node_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appmesh":
        '''(experimental) Adds a resource of type virtualNode to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_nodes.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_node_name: - Identifier for the virtualNodeName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__94734bf404122eda2b8ba34a44f59b95dad66809861c6682a2939e6e372e9a8f)
            check_type(argname="argument mesh_name", value=mesh_name, expected_type=type_hints["mesh_name"])
            check_type(argname="argument virtual_node_name", value=virtual_node_name, expected_type=type_hints["virtual_node_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appmesh", jsii.invoke(self, "onVirtualNode", [mesh_name, virtual_node_name, account, region, partition]))

    @jsii.member(jsii_name="onVirtualRouter")
    def on_virtual_router(
        self,
        mesh_name: builtins.str,
        virtual_router_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appmesh":
        '''(experimental) Adds a resource of type virtualRouter to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_routers.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_router_name: - Identifier for the virtualRouterName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9820fef83c88f5c16a278004b8c04c8dcf496bc7626334a09b621ae70d40867b)
            check_type(argname="argument mesh_name", value=mesh_name, expected_type=type_hints["mesh_name"])
            check_type(argname="argument virtual_router_name", value=virtual_router_name, expected_type=type_hints["virtual_router_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appmesh", jsii.invoke(self, "onVirtualRouter", [mesh_name, virtual_router_name, account, region, partition]))

    @jsii.member(jsii_name="onVirtualService")
    def on_virtual_service(
        self,
        mesh_name: builtins.str,
        virtual_service_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appmesh":
        '''(experimental) Adds a resource of type virtualService to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_services.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_service_name: - Identifier for the virtualServiceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__faafceefcad372cc857bae82a10e6a7324734d81502b4670804e3c44f68f7a5d)
            check_type(argname="argument mesh_name", value=mesh_name, expected_type=type_hints["mesh_name"])
            check_type(argname="argument virtual_service_name", value=virtual_service_name, expected_type=type_hints["virtual_service_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appmesh", jsii.invoke(self, "onVirtualService", [mesh_name, virtual_service_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateGatewayRoute")
    def to_create_gateway_route(self) -> "Appmesh":
        '''(experimental) Grants permission to create a gateway route that is associated with a virtual gateway.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toCreateGatewayRoute", []))

    @jsii.member(jsii_name="toCreateMesh")
    def to_create_mesh(self) -> "Appmesh":
        '''(experimental) Grants permission to create a service mesh.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateMesh.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toCreateMesh", []))

    @jsii.member(jsii_name="toCreateRoute")
    def to_create_route(self) -> "Appmesh":
        '''(experimental) Grants permission to create a route that is associated with a virtual router.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateRoute.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toCreateRoute", []))

    @jsii.member(jsii_name="toCreateVirtualGateway")
    def to_create_virtual_gateway(self) -> "Appmesh":
        '''(experimental) Grants permission to create a virtual gateway within a service mesh.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateVirtualGateway.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toCreateVirtualGateway", []))

    @jsii.member(jsii_name="toCreateVirtualNode")
    def to_create_virtual_node(self) -> "Appmesh":
        '''(experimental) Grants permission to create a virtual node within a service mesh.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateVirtualNode.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toCreateVirtualNode", []))

    @jsii.member(jsii_name="toCreateVirtualRouter")
    def to_create_virtual_router(self) -> "Appmesh":
        '''(experimental) Grants permission to create a virtual router within a service mesh.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateVirtualRouter.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toCreateVirtualRouter", []))

    @jsii.member(jsii_name="toCreateVirtualService")
    def to_create_virtual_service(self) -> "Appmesh":
        '''(experimental) Grants permission to create a virtual service within a service mesh.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateVirtualService.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toCreateVirtualService", []))

    @jsii.member(jsii_name="toDeleteGatewayRoute")
    def to_delete_gateway_route(self) -> "Appmesh":
        '''(experimental) Grants permission to delete an existing gateway route.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDeleteGatewayRoute", []))

    @jsii.member(jsii_name="toDeleteMesh")
    def to_delete_mesh(self) -> "Appmesh":
        '''(experimental) Grants permission to delete an existing service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteMesh.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDeleteMesh", []))

    @jsii.member(jsii_name="toDeleteRoute")
    def to_delete_route(self) -> "Appmesh":
        '''(experimental) Grants permission to delete an existing route.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteRoute.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDeleteRoute", []))

    @jsii.member(jsii_name="toDeleteVirtualGateway")
    def to_delete_virtual_gateway(self) -> "Appmesh":
        '''(experimental) Grants permission to delete an existing virtual gateway.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteVirtualGateway.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDeleteVirtualGateway", []))

    @jsii.member(jsii_name="toDeleteVirtualNode")
    def to_delete_virtual_node(self) -> "Appmesh":
        '''(experimental) Grants permission to delete an existing virtual node.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteVirtualNode.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDeleteVirtualNode", []))

    @jsii.member(jsii_name="toDeleteVirtualRouter")
    def to_delete_virtual_router(self) -> "Appmesh":
        '''(experimental) Grants permission to delete an existing virtual router.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteVirtualRouter.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDeleteVirtualRouter", []))

    @jsii.member(jsii_name="toDeleteVirtualService")
    def to_delete_virtual_service(self) -> "Appmesh":
        '''(experimental) Grants permission to delete an existing virtual service.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteVirtualService.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDeleteVirtualService", []))

    @jsii.member(jsii_name="toDescribeGatewayRoute")
    def to_describe_gateway_route(self) -> "Appmesh":
        '''(experimental) Grants permission to describe an existing gateway route.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDescribeGatewayRoute", []))

    @jsii.member(jsii_name="toDescribeMesh")
    def to_describe_mesh(self) -> "Appmesh":
        '''(experimental) Grants permission to describe an existing service mesh.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeMesh.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDescribeMesh", []))

    @jsii.member(jsii_name="toDescribeRoute")
    def to_describe_route(self) -> "Appmesh":
        '''(experimental) Grants permission to describe an existing route.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeRoute.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDescribeRoute", []))

    @jsii.member(jsii_name="toDescribeVirtualGateway")
    def to_describe_virtual_gateway(self) -> "Appmesh":
        '''(experimental) Grants permission to describe an existing virtual gateway.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeVirtualGateway.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDescribeVirtualGateway", []))

    @jsii.member(jsii_name="toDescribeVirtualNode")
    def to_describe_virtual_node(self) -> "Appmesh":
        '''(experimental) Grants permission to describe an existing virtual node.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeVirtualNode.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDescribeVirtualNode", []))

    @jsii.member(jsii_name="toDescribeVirtualRouter")
    def to_describe_virtual_router(self) -> "Appmesh":
        '''(experimental) Grants permission to describe an existing virtual router.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeVirtualRouter.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDescribeVirtualRouter", []))

    @jsii.member(jsii_name="toDescribeVirtualService")
    def to_describe_virtual_service(self) -> "Appmesh":
        '''(experimental) Grants permission to describe an existing virtual service.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeVirtualService.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toDescribeVirtualService", []))

    @jsii.member(jsii_name="toListGatewayRoutes")
    def to_list_gateway_routes(self) -> "Appmesh":
        '''(experimental) Grants permission to list existing gateway routes in a service mesh.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListGatewayRoutes.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toListGatewayRoutes", []))

    @jsii.member(jsii_name="toListMeshes")
    def to_list_meshes(self) -> "Appmesh":
        '''(experimental) Grants permission to list existing service meshes.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListMeshes.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toListMeshes", []))

    @jsii.member(jsii_name="toListRoutes")
    def to_list_routes(self) -> "Appmesh":
        '''(experimental) Grants permission to list existing routes in a service mesh.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListRoutes.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toListRoutes", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Appmesh":
        '''(experimental) Grants permission to list the tags for an App Mesh resource.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListVirtualGateways")
    def to_list_virtual_gateways(self) -> "Appmesh":
        '''(experimental) Grants permission to list existing virtual gateways in a service mesh.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListVirtualGateways.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toListVirtualGateways", []))

    @jsii.member(jsii_name="toListVirtualNodes")
    def to_list_virtual_nodes(self) -> "Appmesh":
        '''(experimental) Grants permission to list existing virtual nodes.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListVirtualNodes.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toListVirtualNodes", []))

    @jsii.member(jsii_name="toListVirtualRouters")
    def to_list_virtual_routers(self) -> "Appmesh":
        '''(experimental) Grants permission to list existing virtual routers in a service mesh.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListVirtualRouters.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toListVirtualRouters", []))

    @jsii.member(jsii_name="toListVirtualServices")
    def to_list_virtual_services(self) -> "Appmesh":
        '''(experimental) Grants permission to list existing virtual services in a service mesh.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListVirtualServices.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toListVirtualServices", []))

    @jsii.member(jsii_name="toStreamAggregatedResources")
    def to_stream_aggregated_resources(self) -> "Appmesh":
        '''(experimental) Grants permission to receive streamed resources for an App Mesh endpoint (VirtualNode/VirtualGateway).

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/userguide/envoy.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toStreamAggregatedResources", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Appmesh":
        '''(experimental) Grants permission to tag a resource with a specified resourceArn.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Appmesh":
        '''(experimental) Grants permission to delete a tag from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateGatewayRoute")
    def to_update_gateway_route(self) -> "Appmesh":
        '''(experimental) Grants permission to update an existing gateway route for a specified service mesh and virtual gateway.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toUpdateGatewayRoute", []))

    @jsii.member(jsii_name="toUpdateMesh")
    def to_update_mesh(self) -> "Appmesh":
        '''(experimental) Grants permission to update an existing service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateMesh.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toUpdateMesh", []))

    @jsii.member(jsii_name="toUpdateRoute")
    def to_update_route(self) -> "Appmesh":
        '''(experimental) Grants permission to update an existing route for a specified service mesh and virtual router.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateRoute.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toUpdateRoute", []))

    @jsii.member(jsii_name="toUpdateVirtualGateway")
    def to_update_virtual_gateway(self) -> "Appmesh":
        '''(experimental) Grants permission to update an existing virtual gateway in a specified service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateVirtualGateway.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toUpdateVirtualGateway", []))

    @jsii.member(jsii_name="toUpdateVirtualNode")
    def to_update_virtual_node(self) -> "Appmesh":
        '''(experimental) Grants permission to update an existing virtual node in a specified service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateVirtualNode.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toUpdateVirtualNode", []))

    @jsii.member(jsii_name="toUpdateVirtualRouter")
    def to_update_virtual_router(self) -> "Appmesh":
        '''(experimental) Grants permission to update an existing virtual router in a specified service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateVirtualRouter.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toUpdateVirtualRouter", []))

    @jsii.member(jsii_name="toUpdateVirtualService")
    def to_update_virtual_service(self) -> "Appmesh":
        '''(experimental) Grants permission to update an existing virtual service in a specified service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateVirtualService.html

        :stability: experimental
        '''
        return typing.cast("Appmesh", jsii.invoke(self, "toUpdateVirtualService", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__46162400107251a17c23d80401f45537247a0f9f6c5ab8c50f7226578790ed87)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d198eea514e71884f8bf92d2c80a4f39efd31053e16d6a91b6e8471b7b2feb48)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class AppmeshPreview(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AppmeshPreview",
):
    '''(experimental) Statement provider for service `appmesh-preview <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsappmeshpreview.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `appmesh-preview <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsappmeshpreview.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__54e65157c5e57312ba86ed1f7abd3646dc401e14fc703bfc49b8a45525e6462d)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onGatewayRoute")
    def on_gateway_route(
        self,
        mesh_name: builtins.str,
        virtual_gateway_name: builtins.str,
        gateway_route_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AppmeshPreview":
        '''(experimental) Adds a resource of type gatewayRoute to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_gateways.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_gateway_name: - Identifier for the virtualGatewayName.
        :param gateway_route_name: - Identifier for the gatewayRouteName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__85f668a69191ecd617b7231f9dec8f7dcfed76b5e2f26114d95d5556e1860cf4)
            check_type(argname="argument mesh_name", value=mesh_name, expected_type=type_hints["mesh_name"])
            check_type(argname="argument virtual_gateway_name", value=virtual_gateway_name, expected_type=type_hints["virtual_gateway_name"])
            check_type(argname="argument gateway_route_name", value=gateway_route_name, expected_type=type_hints["gateway_route_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("AppmeshPreview", jsii.invoke(self, "onGatewayRoute", [mesh_name, virtual_gateway_name, gateway_route_name, account, region, partition]))

    @jsii.member(jsii_name="onMesh")
    def on_mesh(
        self,
        mesh_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AppmeshPreview":
        '''(experimental) Adds a resource of type mesh to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/meshes.html

        :param mesh_name: - Identifier for the meshName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d8d2a6bd5f8feefb2493a58daa3c00724864378ba150a5dc76612b912acaac0b)
            check_type(argname="argument mesh_name", value=mesh_name, expected_type=type_hints["mesh_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("AppmeshPreview", jsii.invoke(self, "onMesh", [mesh_name, account, region, partition]))

    @jsii.member(jsii_name="onRoute")
    def on_route(
        self,
        mesh_name: builtins.str,
        virtual_router_name: builtins.str,
        route_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AppmeshPreview":
        '''(experimental) Adds a resource of type route to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/routes.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_router_name: - Identifier for the virtualRouterName.
        :param route_name: - Identifier for the routeName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__577e836a38cfb38796a80fc6a5658d6827bc75cf00924c6d3fd2688cb5da95f4)
            check_type(argname="argument mesh_name", value=mesh_name, expected_type=type_hints["mesh_name"])
            check_type(argname="argument virtual_router_name", value=virtual_router_name, expected_type=type_hints["virtual_router_name"])
            check_type(argname="argument route_name", value=route_name, expected_type=type_hints["route_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("AppmeshPreview", jsii.invoke(self, "onRoute", [mesh_name, virtual_router_name, route_name, account, region, partition]))

    @jsii.member(jsii_name="onVirtualGateway")
    def on_virtual_gateway(
        self,
        mesh_name: builtins.str,
        virtual_gateway_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AppmeshPreview":
        '''(experimental) Adds a resource of type virtualGateway to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_gateways.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_gateway_name: - Identifier for the virtualGatewayName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e95013551bf58e5db471d5dc349869146d9ea74ddcc4c2029aed56ef4cbfb319)
            check_type(argname="argument mesh_name", value=mesh_name, expected_type=type_hints["mesh_name"])
            check_type(argname="argument virtual_gateway_name", value=virtual_gateway_name, expected_type=type_hints["virtual_gateway_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("AppmeshPreview", jsii.invoke(self, "onVirtualGateway", [mesh_name, virtual_gateway_name, account, region, partition]))

    @jsii.member(jsii_name="onVirtualNode")
    def on_virtual_node(
        self,
        mesh_name: builtins.str,
        virtual_node_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AppmeshPreview":
        '''(experimental) Adds a resource of type virtualNode to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_nodes.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_node_name: - Identifier for the virtualNodeName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__812dd472cf52dbf4becd7685b57bd295b67b4409c5d91bb7e15938a10e54d9c5)
            check_type(argname="argument mesh_name", value=mesh_name, expected_type=type_hints["mesh_name"])
            check_type(argname="argument virtual_node_name", value=virtual_node_name, expected_type=type_hints["virtual_node_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("AppmeshPreview", jsii.invoke(self, "onVirtualNode", [mesh_name, virtual_node_name, account, region, partition]))

    @jsii.member(jsii_name="onVirtualRouter")
    def on_virtual_router(
        self,
        mesh_name: builtins.str,
        virtual_router_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AppmeshPreview":
        '''(experimental) Adds a resource of type virtualRouter to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_routers.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_router_name: - Identifier for the virtualRouterName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d02485ff73b35b64ad763b2a7a98d8365a71120213d34bf7c372df4df0cca74b)
            check_type(argname="argument mesh_name", value=mesh_name, expected_type=type_hints["mesh_name"])
            check_type(argname="argument virtual_router_name", value=virtual_router_name, expected_type=type_hints["virtual_router_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("AppmeshPreview", jsii.invoke(self, "onVirtualRouter", [mesh_name, virtual_router_name, account, region, partition]))

    @jsii.member(jsii_name="onVirtualService")
    def on_virtual_service(
        self,
        mesh_name: builtins.str,
        virtual_service_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AppmeshPreview":
        '''(experimental) Adds a resource of type virtualService to the statement.

        https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual_services.html

        :param mesh_name: - Identifier for the meshName.
        :param virtual_service_name: - Identifier for the virtualServiceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__00eadc8e9a52e0b148f00966ae485eb3b41b7b1e634a5be22eccbd87a76aba08)
            check_type(argname="argument mesh_name", value=mesh_name, expected_type=type_hints["mesh_name"])
            check_type(argname="argument virtual_service_name", value=virtual_service_name, expected_type=type_hints["virtual_service_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("AppmeshPreview", jsii.invoke(self, "onVirtualService", [mesh_name, virtual_service_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateGatewayRoute")
    def to_create_gateway_route(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to create a gateway route that is associated with a virtual gateway.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toCreateGatewayRoute", []))

    @jsii.member(jsii_name="toCreateMesh")
    def to_create_mesh(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to create a service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateMesh.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toCreateMesh", []))

    @jsii.member(jsii_name="toCreateRoute")
    def to_create_route(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to create a route that is associated with a virtual router.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateRoute.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toCreateRoute", []))

    @jsii.member(jsii_name="toCreateVirtualGateway")
    def to_create_virtual_gateway(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to create a virtual gateway within a service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateVirtualGateway.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toCreateVirtualGateway", []))

    @jsii.member(jsii_name="toCreateVirtualNode")
    def to_create_virtual_node(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to create a virtual node within a service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateVirtualNode.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toCreateVirtualNode", []))

    @jsii.member(jsii_name="toCreateVirtualRouter")
    def to_create_virtual_router(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to create a virtual router within a service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateVirtualRouter.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toCreateVirtualRouter", []))

    @jsii.member(jsii_name="toCreateVirtualService")
    def to_create_virtual_service(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to create a virtual service within a service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_CreateVirtualService.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toCreateVirtualService", []))

    @jsii.member(jsii_name="toDeleteGatewayRoute")
    def to_delete_gateway_route(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to delete an existing gateway route.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDeleteGatewayRoute", []))

    @jsii.member(jsii_name="toDeleteMesh")
    def to_delete_mesh(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to delete an existing service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteMesh.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDeleteMesh", []))

    @jsii.member(jsii_name="toDeleteRoute")
    def to_delete_route(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to delete an existing route.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteRoute.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDeleteRoute", []))

    @jsii.member(jsii_name="toDeleteVirtualGateway")
    def to_delete_virtual_gateway(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to delete an existing virtual gateway.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteVirtualGateway.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDeleteVirtualGateway", []))

    @jsii.member(jsii_name="toDeleteVirtualNode")
    def to_delete_virtual_node(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to delete an existing virtual node.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteVirtualNode.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDeleteVirtualNode", []))

    @jsii.member(jsii_name="toDeleteVirtualRouter")
    def to_delete_virtual_router(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to delete an existing virtual router.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteVirtualRouter.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDeleteVirtualRouter", []))

    @jsii.member(jsii_name="toDeleteVirtualService")
    def to_delete_virtual_service(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to delete an existing virtual service.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DeleteVirtualService.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDeleteVirtualService", []))

    @jsii.member(jsii_name="toDescribeGatewayRoute")
    def to_describe_gateway_route(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to describe an existing gateway route.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDescribeGatewayRoute", []))

    @jsii.member(jsii_name="toDescribeMesh")
    def to_describe_mesh(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to describe an existing service mesh.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeMesh.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDescribeMesh", []))

    @jsii.member(jsii_name="toDescribeRoute")
    def to_describe_route(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to describe an existing route.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeRoute.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDescribeRoute", []))

    @jsii.member(jsii_name="toDescribeVirtualGateway")
    def to_describe_virtual_gateway(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to describe an existing virtual gateway.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeVirtualGateway.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDescribeVirtualGateway", []))

    @jsii.member(jsii_name="toDescribeVirtualNode")
    def to_describe_virtual_node(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to describe an existing virtual node.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeVirtualNode.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDescribeVirtualNode", []))

    @jsii.member(jsii_name="toDescribeVirtualRouter")
    def to_describe_virtual_router(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to describe an existing virtual router.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeVirtualRouter.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDescribeVirtualRouter", []))

    @jsii.member(jsii_name="toDescribeVirtualService")
    def to_describe_virtual_service(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to describe an existing virtual service.

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_DescribeVirtualService.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toDescribeVirtualService", []))

    @jsii.member(jsii_name="toListGatewayRoutes")
    def to_list_gateway_routes(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to list existing gateway routes in a service mesh.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListGatewayRoutes.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toListGatewayRoutes", []))

    @jsii.member(jsii_name="toListMeshes")
    def to_list_meshes(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to list existing service meshes.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListMeshes.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toListMeshes", []))

    @jsii.member(jsii_name="toListRoutes")
    def to_list_routes(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to list existing routes in a service mesh.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListRoutes.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toListRoutes", []))

    @jsii.member(jsii_name="toListVirtualGateways")
    def to_list_virtual_gateways(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to list existing virtual gateways in a service mesh.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListVirtualGateways.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toListVirtualGateways", []))

    @jsii.member(jsii_name="toListVirtualNodes")
    def to_list_virtual_nodes(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to list existing virtual nodes.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListVirtualNodes.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toListVirtualNodes", []))

    @jsii.member(jsii_name="toListVirtualRouters")
    def to_list_virtual_routers(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to list existing virtual routers in a service mesh.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListVirtualRouters.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toListVirtualRouters", []))

    @jsii.member(jsii_name="toListVirtualServices")
    def to_list_virtual_services(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to list existing virtual services in a service mesh.

        Access Level: List

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_ListVirtualServices.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toListVirtualServices", []))

    @jsii.member(jsii_name="toStreamAggregatedResources")
    def to_stream_aggregated_resources(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to receive streamed resources for an App Mesh endpoint (VirtualNode/VirtualGateway).

        Access Level: Read

        https://docs.aws.amazon.com/app-mesh/latest/userguide/envoy.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toStreamAggregatedResources", []))

    @jsii.member(jsii_name="toUpdateGatewayRoute")
    def to_update_gateway_route(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to update an existing gateway route for a specified service mesh and virtual gateway.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toUpdateGatewayRoute", []))

    @jsii.member(jsii_name="toUpdateMesh")
    def to_update_mesh(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to update an existing service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateMesh.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toUpdateMesh", []))

    @jsii.member(jsii_name="toUpdateRoute")
    def to_update_route(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to update an existing route for a specified service mesh and virtual router.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateRoute.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toUpdateRoute", []))

    @jsii.member(jsii_name="toUpdateVirtualGateway")
    def to_update_virtual_gateway(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to update an existing virtual gateway in a specified service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateVirtualGateway.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toUpdateVirtualGateway", []))

    @jsii.member(jsii_name="toUpdateVirtualNode")
    def to_update_virtual_node(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to update an existing virtual node in a specified service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateVirtualNode.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toUpdateVirtualNode", []))

    @jsii.member(jsii_name="toUpdateVirtualRouter")
    def to_update_virtual_router(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to update an existing virtual router in a specified service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateVirtualRouter.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toUpdateVirtualRouter", []))

    @jsii.member(jsii_name="toUpdateVirtualService")
    def to_update_virtual_service(self) -> "AppmeshPreview":
        '''(experimental) Grants permission to update an existing virtual service in a specified service mesh.

        Access Level: Write

        https://docs.aws.amazon.com/app-mesh/latest/APIReference/API_UpdateVirtualService.html

        :stability: experimental
        '''
        return typing.cast("AppmeshPreview", jsii.invoke(self, "toUpdateVirtualService", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a1581764176cb0097162139ad9e4cdbd27ec61a1f583a958713b4c1a0083e21a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c0ccaab39fcf3257c5f270e69dee28317260a150394a9497dc7acf327c749e4e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Apprunner(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Apprunner",
):
    '''(experimental) Statement provider for service `apprunner <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsapprunner.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `apprunner <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsapprunner.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e9595ff4dffb0ecdea0dfcfc06c96c49a298c61b892a3146786d4ee1e3ffe352)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAutoScalingConfigurationArn")
    def if_auto_scaling_configuration_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apprunner":
        '''(experimental) Filters access by the CreateService and UpdateService actions based on the ARN of an associated AutoScalingConfiguration resource.

        Applies to actions:

        - .toCreateService()
        - .toUpdateService()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dd31126a9212663e996a5458750e69e83b47475f540da4560884a9818f86f465)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apprunner", jsii.invoke(self, "ifAutoScalingConfigurationArn", [value, operator]))

    @jsii.member(jsii_name="ifConnectionArn")
    def if_connection_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apprunner":
        '''(experimental) Filters access by the CreateService and UpdateService actions based on the ARN of an associated Connection resource.

        Applies to actions:

        - .toCreateService()
        - .toUpdateService()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5ed6b97af5b532cd1678f1d55049d00438afdfb1dd1bf0118541c52a5353544f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apprunner", jsii.invoke(self, "ifConnectionArn", [value, operator]))

    @jsii.member(jsii_name="ifObservabilityConfigurationArn")
    def if_observability_configuration_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apprunner":
        '''(experimental) Filters access by the CreateService and UpdateService actions based on the ARN of an associated ObservabilityConfiguration resource.

        Applies to actions:

        - .toCreateService()
        - .toUpdateService()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f385994ab993b9ed9a5dfbfe4a8d846a6e66a055e54d2782fd001f1e2a5049ef)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apprunner", jsii.invoke(self, "ifObservabilityConfigurationArn", [value, operator]))

    @jsii.member(jsii_name="ifServiceArn")
    def if_service_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apprunner":
        '''(experimental) Filters access by the CreateVpcIngressConnection action based on the ARN of an associated Service resource.

        Applies to actions:

        - .toCreateVpcIngressConnection()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8f5c44c85f7913f68a49d76a664e841db237e8d7dcea5b46fde8a8d0794f0d35)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apprunner", jsii.invoke(self, "ifServiceArn", [value, operator]))

    @jsii.member(jsii_name="ifVpcConnectorArn")
    def if_vpc_connector_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apprunner":
        '''(experimental) Filters access by the CreateService and UpdateService actions based on the ARN of an associated VpcConnector resource.

        Applies to actions:

        - .toCreateService()
        - .toUpdateService()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__388d497328b3dc4d7dfb230113ae27fc428829885f684cd165eede48e98b4b7c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apprunner", jsii.invoke(self, "ifVpcConnectorArn", [value, operator]))

    @jsii.member(jsii_name="ifVpcEndpointId")
    def if_vpc_endpoint_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apprunner":
        '''(experimental) Filters access by the CreateVpcIngressConnection and UpdateVpcIngressConnection actions based on the VPC Endpoint in the request.

        Applies to actions:

        - .toCreateVpcIngressConnection()
        - .toUpdateVpcIngressConnection()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__faf2c04fc4f53be0753f795e89645ff331d9bffed9191d1c37db431e11dbb04f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apprunner", jsii.invoke(self, "ifVpcEndpointId", [value, operator]))

    @jsii.member(jsii_name="ifVpcId")
    def if_vpc_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Apprunner":
        '''(experimental) Filters access by the CreateVpcIngressConnection and UpdateVpcIngressConnection actions based on the VPC in the request.

        Applies to actions:

        - .toCreateVpcIngressConnection()
        - .toUpdateVpcIngressConnection()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c39ef32a072d833a835a7ac305ffa65742d6f5162f56bf55d9561d72ff3c8522)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Apprunner", jsii.invoke(self, "ifVpcId", [value, operator]))

    @jsii.member(jsii_name="onAutoscalingconfiguration")
    def on_autoscalingconfiguration(
        self,
        autoscaling_configuration_name: builtins.str,
        autoscaling_configuration_version: builtins.str,
        autoscaling_configuration_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apprunner":
        '''(experimental) Adds a resource of type autoscalingconfiguration to the statement.

        :param autoscaling_configuration_name: - Identifier for the autoscalingConfigurationName.
        :param autoscaling_configuration_version: - Identifier for the autoscalingConfigurationVersion.
        :param autoscaling_configuration_id: - Identifier for the autoscalingConfigurationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__16b0c7f9d973d55831d7e89c6ac299827d8518c07ac0c284bfd7cd876ea15dc7)
            check_type(argname="argument autoscaling_configuration_name", value=autoscaling_configuration_name, expected_type=type_hints["autoscaling_configuration_name"])
            check_type(argname="argument autoscaling_configuration_version", value=autoscaling_configuration_version, expected_type=type_hints["autoscaling_configuration_version"])
            check_type(argname="argument autoscaling_configuration_id", value=autoscaling_configuration_id, expected_type=type_hints["autoscaling_configuration_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apprunner", jsii.invoke(self, "onAutoscalingconfiguration", [autoscaling_configuration_name, autoscaling_configuration_version, autoscaling_configuration_id, account, region, partition]))

    @jsii.member(jsii_name="onConnection")
    def on_connection(
        self,
        connection_name: builtins.str,
        connection_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apprunner":
        '''(experimental) Adds a resource of type connection to the statement.

        :param connection_name: - Identifier for the connectionName.
        :param connection_id: - Identifier for the connectionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__84cda51accb2bd933993ce154d6b053c1acd344751e98dd8d5267b4a93b1cf79)
            check_type(argname="argument connection_name", value=connection_name, expected_type=type_hints["connection_name"])
            check_type(argname="argument connection_id", value=connection_id, expected_type=type_hints["connection_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apprunner", jsii.invoke(self, "onConnection", [connection_name, connection_id, account, region, partition]))

    @jsii.member(jsii_name="onObservabilityconfiguration")
    def on_observabilityconfiguration(
        self,
        observability_configuration_name: builtins.str,
        observability_configuration_version: builtins.str,
        observability_configuration_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apprunner":
        '''(experimental) Adds a resource of type observabilityconfiguration to the statement.

        :param observability_configuration_name: - Identifier for the observabilityConfigurationName.
        :param observability_configuration_version: - Identifier for the observabilityConfigurationVersion.
        :param observability_configuration_id: - Identifier for the observabilityConfigurationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5ecee0997521bcd1d8afe3c99bc2a2ee2e30c5ff56587015cddd5a9d202679bf)
            check_type(argname="argument observability_configuration_name", value=observability_configuration_name, expected_type=type_hints["observability_configuration_name"])
            check_type(argname="argument observability_configuration_version", value=observability_configuration_version, expected_type=type_hints["observability_configuration_version"])
            check_type(argname="argument observability_configuration_id", value=observability_configuration_id, expected_type=type_hints["observability_configuration_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apprunner", jsii.invoke(self, "onObservabilityconfiguration", [observability_configuration_name, observability_configuration_version, observability_configuration_id, account, region, partition]))

    @jsii.member(jsii_name="onService")
    def on_service(
        self,
        service_name: builtins.str,
        service_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apprunner":
        '''(experimental) Adds a resource of type service to the statement.

        :param service_name: - Identifier for the serviceName.
        :param service_id: - Identifier for the serviceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e9054fb4a954d46b87371df7193f4b813690cfc29874c4c74d1aeb8e39afb681)
            check_type(argname="argument service_name", value=service_name, expected_type=type_hints["service_name"])
            check_type(argname="argument service_id", value=service_id, expected_type=type_hints["service_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apprunner", jsii.invoke(self, "onService", [service_name, service_id, account, region, partition]))

    @jsii.member(jsii_name="onVpcconnector")
    def on_vpcconnector(
        self,
        vpc_connector_name: builtins.str,
        vpc_connector_version: builtins.str,
        vpc_connector_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apprunner":
        '''(experimental) Adds a resource of type vpcconnector to the statement.

        :param vpc_connector_name: - Identifier for the vpcConnectorName.
        :param vpc_connector_version: - Identifier for the vpcConnectorVersion.
        :param vpc_connector_id: - Identifier for the vpcConnectorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2ac3123ec7debf49055e8bf0b8b96ea665bfbe5dc4f3ba2d2b3768f67c053f3e)
            check_type(argname="argument vpc_connector_name", value=vpc_connector_name, expected_type=type_hints["vpc_connector_name"])
            check_type(argname="argument vpc_connector_version", value=vpc_connector_version, expected_type=type_hints["vpc_connector_version"])
            check_type(argname="argument vpc_connector_id", value=vpc_connector_id, expected_type=type_hints["vpc_connector_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apprunner", jsii.invoke(self, "onVpcconnector", [vpc_connector_name, vpc_connector_version, vpc_connector_id, account, region, partition]))

    @jsii.member(jsii_name="onVpcingressconnection")
    def on_vpcingressconnection(
        self,
        vpc_ingress_connection_name: builtins.str,
        vpc_ingress_connection_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apprunner":
        '''(experimental) Adds a resource of type vpcingressconnection to the statement.

        :param vpc_ingress_connection_name: - Identifier for the vpcIngressConnectionName.
        :param vpc_ingress_connection_id: - Identifier for the vpcIngressConnectionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c9d598b2d0f8cc49214d7e245416b2b0020f23a75cb77905d1ceb5d91de31065)
            check_type(argname="argument vpc_ingress_connection_name", value=vpc_ingress_connection_name, expected_type=type_hints["vpc_ingress_connection_name"])
            check_type(argname="argument vpc_ingress_connection_id", value=vpc_ingress_connection_id, expected_type=type_hints["vpc_ingress_connection_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apprunner", jsii.invoke(self, "onVpcingressconnection", [vpc_ingress_connection_name, vpc_ingress_connection_id, account, region, partition]))

    @jsii.member(jsii_name="onWebacl")
    def on_webacl(
        self,
        scope: builtins.str,
        name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Apprunner":
        '''(experimental) Adds a resource of type webacl to the statement.

        :param scope: - Identifier for the scope.
        :param name: - Identifier for the name.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1fdc41673edac5293ee8f8d68068e91fe8bfcd730f02f35e7b1575827beabff5)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Apprunner", jsii.invoke(self, "onWebacl", [scope, name, id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateCustomDomain")
    def to_associate_custom_domain(self) -> "Apprunner":
        '''(experimental) Grants permission to associate your own domain name with the AWS App Runner subdomain URL of your App Runner service.

        Access Level: Write

        https://docs.aws.amazon.com/apprunner/latest/api/API_AssociateCustomDomain.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toAssociateCustomDomain", []))

    @jsii.member(jsii_name="toAssociateWebAcl")
    def to_associate_web_acl(self) -> "Apprunner":
        '''(experimental) Grants permission to associate the service with an AWS WAF web ACL.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toAssociateWebAcl", []))

    @jsii.member(jsii_name="toCreateAutoScalingConfiguration")
    def to_create_auto_scaling_configuration(self) -> "Apprunner":
        '''(experimental) Grants permission to create an AWS App Runner automatic scaling configuration resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apprunner/latest/api/API_CreateAutoScalingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toCreateAutoScalingConfiguration", []))

    @jsii.member(jsii_name="toCreateConnection")
    def to_create_connection(self) -> "Apprunner":
        '''(experimental) Grants permission to create an AWS App Runner connection resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apprunner/latest/api/API_CreateConnection.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toCreateConnection", []))

    @jsii.member(jsii_name="toCreateObservabilityConfiguration")
    def to_create_observability_configuration(self) -> "Apprunner":
        '''(experimental) Grants permission to create an AWS App Runner observability configuration resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apprunner/latest/api/API_CreateObservabilityConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toCreateObservabilityConfiguration", []))

    @jsii.member(jsii_name="toCreateService")
    def to_create_service(self) -> "Apprunner":
        '''(experimental) Grants permission to create an AWS App Runner service resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifConnectionArn()
        - .ifAutoScalingConfigurationArn()
        - .ifObservabilityConfigurationArn()
        - .ifVpcConnectorArn()

        https://docs.aws.amazon.com/apprunner/latest/api/API_CreateService.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toCreateService", []))

    @jsii.member(jsii_name="toCreateVpcConnector")
    def to_create_vpc_connector(self) -> "Apprunner":
        '''(experimental) Grants permission to create an AWS App Runner VPC connector resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apprunner/latest/api/API_CreateVpcConnector.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toCreateVpcConnector", []))

    @jsii.member(jsii_name="toCreateVpcIngressConnection")
    def to_create_vpc_ingress_connection(self) -> "Apprunner":
        '''(experimental) Grants permission to create an AWS App Runner VpcIngressConnection resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifServiceArn()
        - .ifVpcId()
        - .ifVpcEndpointId()

        https://docs.aws.amazon.com/apprunner/latest/api/API_CreateVpcIngressConnection.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toCreateVpcIngressConnection", []))

    @jsii.member(jsii_name="toDeleteAutoScalingConfiguration")
    def to_delete_auto_scaling_configuration(self) -> "Apprunner":
        '''(experimental) Grants permission to delete an AWS App Runner automatic scaling configuration resource.

        Access Level: Write

        https://docs.aws.amazon.com/apprunner/latest/api/API_DeleteAutoScalingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toDeleteAutoScalingConfiguration", []))

    @jsii.member(jsii_name="toDeleteConnection")
    def to_delete_connection(self) -> "Apprunner":
        '''(experimental) Grants permission to delete an AWS App Runner connection resource.

        Access Level: Write

        https://docs.aws.amazon.com/apprunner/latest/api/API_DeleteConnection.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toDeleteConnection", []))

    @jsii.member(jsii_name="toDeleteObservabilityConfiguration")
    def to_delete_observability_configuration(self) -> "Apprunner":
        '''(experimental) Grants permission to delete an AWS App Runner observability configuration resource.

        Access Level: Write

        https://docs.aws.amazon.com/apprunner/latest/api/API_DeleteObservabilityConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toDeleteObservabilityConfiguration", []))

    @jsii.member(jsii_name="toDeleteService")
    def to_delete_service(self) -> "Apprunner":
        '''(experimental) Grants permission to delete an AWS App Runner service resource.

        Access Level: Write

        https://docs.aws.amazon.com/apprunner/latest/api/API_DeleteService.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toDeleteService", []))

    @jsii.member(jsii_name="toDeleteVpcConnector")
    def to_delete_vpc_connector(self) -> "Apprunner":
        '''(experimental) Grants permission to delete an AWS App Runner VPC connector resource.

        Access Level: Write

        https://docs.aws.amazon.com/apprunner/latest/api/API_DeleteVpcConnector.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toDeleteVpcConnector", []))

    @jsii.member(jsii_name="toDeleteVpcIngressConnection")
    def to_delete_vpc_ingress_connection(self) -> "Apprunner":
        '''(experimental) Grants permission to delete an AWS App Runner VpcIngressConnection resource.

        Access Level: Write

        https://docs.aws.amazon.com/apprunner/latest/api/API_DeleteVpcIngressConnection.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toDeleteVpcIngressConnection", []))

    @jsii.member(jsii_name="toDescribeAutoScalingConfiguration")
    def to_describe_auto_scaling_configuration(self) -> "Apprunner":
        '''(experimental) Grants permission to retrieve the description of an AWS App Runner automatic scaling configuration resource.

        Access Level: Read

        https://docs.aws.amazon.com/apprunner/latest/api/API_DescribeAutoScalingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toDescribeAutoScalingConfiguration", []))

    @jsii.member(jsii_name="toDescribeCustomDomains")
    def to_describe_custom_domains(self) -> "Apprunner":
        '''(experimental) Grants permission to retrieve descriptions of custom domain names associated with an AWS App Runner service.

        Access Level: Read

        https://docs.aws.amazon.com/apprunner/latest/api/API_DescribeCustomDomains.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toDescribeCustomDomains", []))

    @jsii.member(jsii_name="toDescribeObservabilityConfiguration")
    def to_describe_observability_configuration(self) -> "Apprunner":
        '''(experimental) Grants permission to retrieve the description of an AWS App Runner observability configuration resource.

        Access Level: Read

        https://docs.aws.amazon.com/apprunner/latest/api/API_DescribeObservabilityConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toDescribeObservabilityConfiguration", []))

    @jsii.member(jsii_name="toDescribeOperation")
    def to_describe_operation(self) -> "Apprunner":
        '''(experimental) Grants permission to retrieve the description of an operation that occurred on an AWS App Runner service.

        Access Level: Read

        https://docs.aws.amazon.com/apprunner/latest/api/API_DescribeOperation.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toDescribeOperation", []))

    @jsii.member(jsii_name="toDescribeService")
    def to_describe_service(self) -> "Apprunner":
        '''(experimental) Grants permission to retrieve the description of an AWS App Runner service resource.

        Access Level: Read

        https://docs.aws.amazon.com/apprunner/latest/api/API_DescribeService.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toDescribeService", []))

    @jsii.member(jsii_name="toDescribeVpcConnector")
    def to_describe_vpc_connector(self) -> "Apprunner":
        '''(experimental) Grants permission to retrieve the description of an AWS App Runner VPC connector resource.

        Access Level: Read

        https://docs.aws.amazon.com/apprunner/latest/api/API_DescribeVpcConnector.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toDescribeVpcConnector", []))

    @jsii.member(jsii_name="toDescribeVpcIngressConnection")
    def to_describe_vpc_ingress_connection(self) -> "Apprunner":
        '''(experimental) Grants permission to retrieve the description of an AWS App Runner VpcIngressConnection resource.

        Access Level: Read

        https://docs.aws.amazon.com/apprunner/latest/api/API_DescribeVpcIngressConnection.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toDescribeVpcIngressConnection", []))

    @jsii.member(jsii_name="toDescribeWebAclForService")
    def to_describe_web_acl_for_service(self) -> "Apprunner":
        '''(experimental) Grants permission to get the AWS WAF web ACL that is associated with an AWS App Runner service.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toDescribeWebAclForService", []))

    @jsii.member(jsii_name="toDisassociateCustomDomain")
    def to_disassociate_custom_domain(self) -> "Apprunner":
        '''(experimental) Grants permission to disassociate a custom domain name from an AWS App Runner service.

        Access Level: Write

        https://docs.aws.amazon.com/apprunner/latest/api/API_DisassociateCustomDomain.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toDisassociateCustomDomain", []))

    @jsii.member(jsii_name="toDisassociateWebAcl")
    def to_disassociate_web_acl(self) -> "Apprunner":
        '''(experimental) Grants permission to disassociate the service with an AWS WAF web ACL.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toDisassociateWebAcl", []))

    @jsii.member(jsii_name="toListAssociatedServicesForWebAcl")
    def to_list_associated_services_for_web_acl(self) -> "Apprunner":
        '''(experimental) Grants permission to list the services that are associated with an AWS WAF web ACL.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toListAssociatedServicesForWebAcl", []))

    @jsii.member(jsii_name="toListAutoScalingConfigurations")
    def to_list_auto_scaling_configurations(self) -> "Apprunner":
        '''(experimental) Grants permission to retrieve a list of AWS App Runner automatic scaling configurations in your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/apprunner/latest/api/API_ListAutoScalingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toListAutoScalingConfigurations", []))

    @jsii.member(jsii_name="toListConnections")
    def to_list_connections(self) -> "Apprunner":
        '''(experimental) Grants permission to retrieve a list of AWS App Runner connections in your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/apprunner/latest/api/API_ListConnections.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toListConnections", []))

    @jsii.member(jsii_name="toListObservabilityConfigurations")
    def to_list_observability_configurations(self) -> "Apprunner":
        '''(experimental) Grants permission to retrieve a list of AWS App Runner observability configurations in your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/apprunner/latest/api/API_ListObservabilityConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toListObservabilityConfigurations", []))

    @jsii.member(jsii_name="toListOperations")
    def to_list_operations(self) -> "Apprunner":
        '''(experimental) Grants permission to retrieve a list of operations that occurred on an AWS App Runner service resource.

        Access Level: List

        https://docs.aws.amazon.com/apprunner/latest/api/API_ListOperations.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toListOperations", []))

    @jsii.member(jsii_name="toListServices")
    def to_list_services(self) -> "Apprunner":
        '''(experimental) Grants permission to retrieve a list of running AWS App Runner services in your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/apprunner/latest/api/API_ListServices.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toListServices", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Apprunner":
        '''(experimental) Grants permission to list tags associated with an AWS App Runner resource.

        Access Level: Read

        https://docs.aws.amazon.com/apprunner/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListVpcConnectors")
    def to_list_vpc_connectors(self) -> "Apprunner":
        '''(experimental) Grants permission to retrieve a list of AWS App Runner VPC connectors in your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/apprunner/latest/api/API_ListVpcConnectors.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toListVpcConnectors", []))

    @jsii.member(jsii_name="toListVpcIngressConnections")
    def to_list_vpc_ingress_connections(self) -> "Apprunner":
        '''(experimental) Grants permission to retrieve a list of AWS App Runner VpcIngressConnections in your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/apprunner/latest/api/API_ListVpcConnections.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toListVpcIngressConnections", []))

    @jsii.member(jsii_name="toPauseService")
    def to_pause_service(self) -> "Apprunner":
        '''(experimental) Grants permission to pause an active AWS App Runner service.

        Access Level: Write

        https://docs.aws.amazon.com/apprunner/latest/api/API_PauseService.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toPauseService", []))

    @jsii.member(jsii_name="toResumeService")
    def to_resume_service(self) -> "Apprunner":
        '''(experimental) Grants permission to resume an active AWS App Runner service.

        Access Level: Write

        https://docs.aws.amazon.com/apprunner/latest/api/API_ResumeService.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toResumeService", []))

    @jsii.member(jsii_name="toStartDeployment")
    def to_start_deployment(self) -> "Apprunner":
        '''(experimental) Grants permission to initiate a manual deployemnt to an AWS App Runner service.

        Access Level: Write

        https://docs.aws.amazon.com/apprunner/latest/api/API_StartDeployment.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toStartDeployment", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Apprunner":
        '''(experimental) Grants permission to add tags to, or update tag values of, an AWS App Runner resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/apprunner/latest/api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Apprunner":
        '''(experimental) Grants permission to remove tags from an AWS App Runner resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/apprunner/latest/api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateService")
    def to_update_service(self) -> "Apprunner":
        '''(experimental) Grants permission to update an AWS App Runner service resource.

        Access Level: Write

        Possible conditions:

        - .ifConnectionArn()
        - .ifAutoScalingConfigurationArn()
        - .ifObservabilityConfigurationArn()
        - .ifVpcConnectorArn()

        https://docs.aws.amazon.com/apprunner/latest/api/API_UpdateService.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toUpdateService", []))

    @jsii.member(jsii_name="toUpdateVpcIngressConnection")
    def to_update_vpc_ingress_connection(self) -> "Apprunner":
        '''(experimental) Grants permission to update an AWS App Runner VpcIngressConnection resource.

        Access Level: Write

        Possible conditions:

        - .ifVpcId()
        - .ifVpcEndpointId()

        https://docs.aws.amazon.com/apprunner/latest/api/API_UpdateVpcIngressConnection.html

        :stability: experimental
        '''
        return typing.cast("Apprunner", jsii.invoke(self, "toUpdateVpcIngressConnection", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__aa7fb12d43ea38700ce1b8b06e544edc07b88404c85eded8044df2ab6a645eb4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f90d42871fbbd85b35972f156c1b02e6893d354bc15beea8001be6b5ebd9f366)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Appstream(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Appstream",
):
    '''(experimental) Statement provider for service `appstream <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonappstream2.0.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `appstream <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonappstream2.0.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__749e0202b8407078ee17407a347aef00f0b92c0a321d458d6edd2c33bf18b12a)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifUserId")
    def if_user_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Appstream":
        '''(experimental) Filters access by the ID of the AppStream 2.0 user.

        https://docs.aws.amazon.com/appstream2/latest/developerguide/external-identity-providers-setting-up-saml.html#external-identity-providers-embed-inline-policy-for-IAM-role

        Applies to actions:

        - .toStream()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__da1d5d9832a671010a714855b6e8db84d657052adc486f23ed34f89fb3d8f045)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Appstream", jsii.invoke(self, "ifUserId", [value, operator]))

    @jsii.member(jsii_name="onAppBlock")
    def on_app_block(
        self,
        app_block_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appstream":
        '''(experimental) Adds a resource of type app-block to the statement.

        https://docs.aws.amazon.com/appstream2/latest/developerguide/what-is-appstream.html#what-is-concepts

        :param app_block_name: - Identifier for the appBlockName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3a0d4c92a435bea06e78cf2ecfb08787945e138904839ba43cb17394e84ee8aa)
            check_type(argname="argument app_block_name", value=app_block_name, expected_type=type_hints["app_block_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appstream", jsii.invoke(self, "onAppBlock", [app_block_name, account, region, partition]))

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        application_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appstream":
        '''(experimental) Adds a resource of type application to the statement.

        https://docs.aws.amazon.com/appstream2/latest/developerguide/what-is-appstream.html#what-is-concepts

        :param application_name: - Identifier for the applicationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__62958b129705fb34011bdad6827fb09957c4fe9a8a8e779054d55b4687005cf0)
            check_type(argname="argument application_name", value=application_name, expected_type=type_hints["application_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appstream", jsii.invoke(self, "onApplication", [application_name, account, region, partition]))

    @jsii.member(jsii_name="onFleet")
    def on_fleet(
        self,
        fleet_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appstream":
        '''(experimental) Adds a resource of type fleet to the statement.

        https://docs.aws.amazon.com/appstream2/latest/developerguide/what-is-appstream.html#what-is-concepts

        :param fleet_name: - Identifier for the fleetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__af996f80f7c4eb95ea0e21b6715935a5a014d3e162844432dda0b5fc458a6a8d)
            check_type(argname="argument fleet_name", value=fleet_name, expected_type=type_hints["fleet_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appstream", jsii.invoke(self, "onFleet", [fleet_name, account, region, partition]))

    @jsii.member(jsii_name="onImage")
    def on_image(
        self,
        image_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appstream":
        '''(experimental) Adds a resource of type image to the statement.

        https://docs.aws.amazon.com/appstream2/latest/developerguide/what-is-appstream.html#what-is-concepts

        :param image_name: - Identifier for the imageName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6159b1f40c366aeb13ba9b8c3ece3d8bc84c0d0afb7639147f034df4155fd641)
            check_type(argname="argument image_name", value=image_name, expected_type=type_hints["image_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appstream", jsii.invoke(self, "onImage", [image_name, account, region, partition]))

    @jsii.member(jsii_name="onImageBuilder")
    def on_image_builder(
        self,
        image_builder_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appstream":
        '''(experimental) Adds a resource of type image-builder to the statement.

        https://docs.aws.amazon.com/appstream2/latest/developerguide/what-is-appstream.html#what-is-concepts

        :param image_builder_name: - Identifier for the imageBuilderName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__54f378f2a66875933411438130bb355dcdc555dde6f6bddad99906c7d8955e91)
            check_type(argname="argument image_builder_name", value=image_builder_name, expected_type=type_hints["image_builder_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appstream", jsii.invoke(self, "onImageBuilder", [image_builder_name, account, region, partition]))

    @jsii.member(jsii_name="onStack")
    def on_stack(
        self,
        stack_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appstream":
        '''(experimental) Adds a resource of type stack to the statement.

        https://docs.aws.amazon.com/appstream2/latest/developerguide/what-is-appstream.html#what-is-concepts

        :param stack_name: - Identifier for the stackName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ea1ccf82fe1b8c26e24328fc06928f9410e3b773fb79d3e46fc90efb21e6e1e7)
            check_type(argname="argument stack_name", value=stack_name, expected_type=type_hints["stack_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appstream", jsii.invoke(self, "onStack", [stack_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateApplicationFleet")
    def to_associate_application_fleet(self) -> "Appstream":
        '''(experimental) Grants permission to associate the specified application with the fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_AssociateApplicationFleet.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toAssociateApplicationFleet", []))

    @jsii.member(jsii_name="toAssociateApplicationToEntitlement")
    def to_associate_application_to_entitlement(self) -> "Appstream":
        '''(experimental) Grants permission to associate the specified application to the specified entitlement.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_AssociateApplicationToEntitlement.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toAssociateApplicationToEntitlement", []))

    @jsii.member(jsii_name="toAssociateFleet")
    def to_associate_fleet(self) -> "Appstream":
        '''(experimental) Grants permission to associate the specified fleet with the specified stack.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_AssociateFleet.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toAssociateFleet", []))

    @jsii.member(jsii_name="toBatchAssociateUserStack")
    def to_batch_associate_user_stack(self) -> "Appstream":
        '''(experimental) Grants permission to associate the specified users with the specified stacks.

        Users in a user pool cannot be assigned to stacks with fleets that are joined to an Active Directory domain

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_BatchAssociateUserStack.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toBatchAssociateUserStack", []))

    @jsii.member(jsii_name="toBatchDisassociateUserStack")
    def to_batch_disassociate_user_stack(self) -> "Appstream":
        '''(experimental) Grants permission to disassociate the specified users from the specified stacks.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_BatchDisassociateUserStack.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toBatchDisassociateUserStack", []))

    @jsii.member(jsii_name="toCopyImage")
    def to_copy_image(self) -> "Appstream":
        '''(experimental) Grants permission to copy the specified image within the same Region or to a new Region within the same AWS account.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CopyImage.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCopyImage", []))

    @jsii.member(jsii_name="toCreateAppBlock")
    def to_create_app_block(self) -> "Appstream":
        '''(experimental) Grants permission to create an app block.

        App blocks store details about the virtual hard disk that contains the files for the application in an S3 bucket. It also stores the setup script with details about how to mount the virtual hard disk. App blocks are only supported for Elastic fleets

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateAppBlock.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCreateAppBlock", []))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "Appstream":
        '''(experimental) Grants permission to create an application within customer account.

        Applications store the details about how to launch applications on streaming instances. This is only supported for Elastic fleets

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toCreateDirectoryConfig")
    def to_create_directory_config(self) -> "Appstream":
        '''(experimental) Grants permission to create a Directory Config object in AppStream 2.0. This object includes the configuration information required to join fleets and image builders to Microsoft Active Directory domains.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateDirectoryConfig.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCreateDirectoryConfig", []))

    @jsii.member(jsii_name="toCreateEntitlement")
    def to_create_entitlement(self) -> "Appstream":
        '''(experimental) Grants permission to create an entitlement to control access to applications based on user attributes.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateEntitlement.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCreateEntitlement", []))

    @jsii.member(jsii_name="toCreateFleet")
    def to_create_fleet(self) -> "Appstream":
        '''(experimental) Grants permission to create a fleet.

        A fleet is a group of streaming instances from which applications are launched and streamed to users

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateFleet.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCreateFleet", []))

    @jsii.member(jsii_name="toCreateImageBuilder")
    def to_create_image_builder(self) -> "Appstream":
        '''(experimental) Grants permission to create an image builder.

        An image builder is a virtual machine that is used to create an image

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateImageBuilder.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCreateImageBuilder", []))

    @jsii.member(jsii_name="toCreateImageBuilderStreamingURL")
    def to_create_image_builder_streaming_url(self) -> "Appstream":
        '''(experimental) Grants permission to create a URL to start an image builder streaming session.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateImageBuilderStreamingURL.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCreateImageBuilderStreamingURL", []))

    @jsii.member(jsii_name="toCreateStack")
    def to_create_stack(self) -> "Appstream":
        '''(experimental) Grants permission to create a stack to start streaming applications to users.

        A stack consists of an associated fleet, user access policies, and storage configurations

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateStack.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCreateStack", []))

    @jsii.member(jsii_name="toCreateStreamingURL")
    def to_create_streaming_url(self) -> "Appstream":
        '''(experimental) Grants permission to create a temporary URL to start an AppStream 2.0 streaming session for the specified user. A streaming URL enables application streaming to be tested without user setup.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateStreamingURL.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCreateStreamingURL", []))

    @jsii.member(jsii_name="toCreateUpdatedImage")
    def to_create_updated_image(self) -> "Appstream":
        '''(experimental) Grants permission to update an existing image within customer account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateUpdatedImage.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCreateUpdatedImage", []))

    @jsii.member(jsii_name="toCreateUsageReportSubscription")
    def to_create_usage_report_subscription(self) -> "Appstream":
        '''(experimental) Grants permission to create a usage report subscription. Usage reports are generated daily.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateUsageReportSubscription.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCreateUsageReportSubscription", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Appstream":
        '''(experimental) Grants permission to create a new user in the user pool.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateUser.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toDeleteAppBlock")
    def to_delete_app_block(self) -> "Appstream":
        '''(experimental) Grants permission to delete the specified app block.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DeleteAppBlock.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDeleteAppBlock", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "Appstream":
        '''(experimental) Grants permission to delete the specified application.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toDeleteDirectoryConfig")
    def to_delete_directory_config(self) -> "Appstream":
        '''(experimental) Grants permission to delete the specified Directory Config object from AppStream 2.0. This object includes the configuration information required to join fleets and image builders to Microsoft Active Directory domains.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DeleteDirectoryConfig.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDeleteDirectoryConfig", []))

    @jsii.member(jsii_name="toDeleteEntitlement")
    def to_delete_entitlement(self) -> "Appstream":
        '''(experimental) Grants permission to delete the specified entitlement.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DeleteEntitlement.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDeleteEntitlement", []))

    @jsii.member(jsii_name="toDeleteFleet")
    def to_delete_fleet(self) -> "Appstream":
        '''(experimental) Grants permission to delete the specified fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DeleteFleet.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDeleteFleet", []))

    @jsii.member(jsii_name="toDeleteImage")
    def to_delete_image(self) -> "Appstream":
        '''(experimental) Grants permission to delete the specified image. An image cannot be deleted when it is in use.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DeleteImage.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDeleteImage", []))

    @jsii.member(jsii_name="toDeleteImageBuilder")
    def to_delete_image_builder(self) -> "Appstream":
        '''(experimental) Grants permission to delete the specified image builder and release capacity.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DeleteImageBuilder.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDeleteImageBuilder", []))

    @jsii.member(jsii_name="toDeleteImagePermissions")
    def to_delete_image_permissions(self) -> "Appstream":
        '''(experimental) Grants permission to delete permissions for the specified private image.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DeleteImagePermissions.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDeleteImagePermissions", []))

    @jsii.member(jsii_name="toDeleteStack")
    def to_delete_stack(self) -> "Appstream":
        '''(experimental) Grants permission to delete the specified stack.

        After the stack is deleted, the application streaming environment provided by the stack is no longer available to users. Also, any reservations made for application streaming sessions for the stack are released

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DeleteStack.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDeleteStack", []))

    @jsii.member(jsii_name="toDeleteUsageReportSubscription")
    def to_delete_usage_report_subscription(self) -> "Appstream":
        '''(experimental) Grants permission to disable usage report generation.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DeleteUsageReportSubscription.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDeleteUsageReportSubscription", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "Appstream":
        '''(experimental) Grants permission to delete a user from the user pool.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDescribeAppBlocks")
    def to_describe_app_blocks(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes one or more specified app blocks, if the app block arns are provided.

        Otherwise, all app blocks in the account are described

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeAppBlocks.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeAppBlocks", []))

    @jsii.member(jsii_name="toDescribeApplicationFleetAssociations")
    def to_describe_application_fleet_associations(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve the associations that are associated with the specified application or fleet.

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeApplicationFleetAssociations.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeApplicationFleetAssociations", []))

    @jsii.member(jsii_name="toDescribeApplications")
    def to_describe_applications(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes one or more specified applications, if the application arns are provided.

        Otherwise, all applications in the account are described

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeApplications.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeApplications", []))

    @jsii.member(jsii_name="toDescribeDirectoryConfigs")
    def to_describe_directory_configs(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes one or more specified Directory Config objects for AppStream 2.0, if the names for these objects are provided. Otherwise, all Directory Config objects in the account are described. This object includes the configuration information required to join fleets and image builders to Microsoft Active Directory domains.

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeDirectoryConfigs.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeDirectoryConfigs", []))

    @jsii.member(jsii_name="toDescribeEntitlements")
    def to_describe_entitlements(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve one or all entitlements for the specified stack.

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeEntitlements.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeEntitlements", []))

    @jsii.member(jsii_name="toDescribeFleets")
    def to_describe_fleets(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes one or more specified fleets, if the fleet names are provided.

        Otherwise, all fleets in the account are described

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeFleets.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeFleets", []))

    @jsii.member(jsii_name="toDescribeImageBuilders")
    def to_describe_image_builders(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes one or more specified image builders, if the image builder names are provided.

        Otherwise, all image builders in the account are described

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeImageBuilders.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeImageBuilders", []))

    @jsii.member(jsii_name="toDescribeImagePermissions")
    def to_describe_image_permissions(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes the permissions for shared AWS account IDs on a private image that you own.

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeImagePermissions.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeImagePermissions", []))

    @jsii.member(jsii_name="toDescribeImages")
    def to_describe_images(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes one or more specified images, if the image names or image ARNs are provided.

        Otherwise, all images in the account are described

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeImages.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeImages", []))

    @jsii.member(jsii_name="toDescribeSessions")
    def to_describe_sessions(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes the streaming sessions for the specified stack and fleet.

        If a user ID is provided for the stack and fleet, only the streaming sessions for that user are described

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeSessions.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeSessions", []))

    @jsii.member(jsii_name="toDescribeStacks")
    def to_describe_stacks(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes one or more specified stacks, if the stack names are provided.

        Otherwise, all stacks in the account are described

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeStacks.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeStacks", []))

    @jsii.member(jsii_name="toDescribeUsageReportSubscriptions")
    def to_describe_usage_report_subscriptions(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes one or more usage report subscriptions.

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeUsageReportSubscriptions.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeUsageReportSubscriptions", []))

    @jsii.member(jsii_name="toDescribeUsers")
    def to_describe_users(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes users in the user pool.

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeUsers.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeUsers", []))

    @jsii.member(jsii_name="toDescribeUserStackAssociations")
    def to_describe_user_stack_associations(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list that describes the UserStackAssociation objects.

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DescribeUserStackAssociations.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDescribeUserStackAssociations", []))

    @jsii.member(jsii_name="toDisableUser")
    def to_disable_user(self) -> "Appstream":
        '''(experimental) Grants permission to disable the specified user in the user pool. This action does not delete the user.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DisableUser.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDisableUser", []))

    @jsii.member(jsii_name="toDisassociateApplicationFleet")
    def to_disassociate_application_fleet(self) -> "Appstream":
        '''(experimental) Grants permission to disassociate the specified application from the specified fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DisassociateApplicationFleet.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDisassociateApplicationFleet", []))

    @jsii.member(jsii_name="toDisassociateApplicationFromEntitlement")
    def to_disassociate_application_from_entitlement(self) -> "Appstream":
        '''(experimental) Grants permission to disassociate the specified application from the specified entitlement.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DisassociateApplicationFromEntitlement.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDisassociateApplicationFromEntitlement", []))

    @jsii.member(jsii_name="toDisassociateFleet")
    def to_disassociate_fleet(self) -> "Appstream":
        '''(experimental) Grants permission to disassociate the specified fleet from the specified stack.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_DisassociateFleet.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toDisassociateFleet", []))

    @jsii.member(jsii_name="toEnableUser")
    def to_enable_user(self) -> "Appstream":
        '''(experimental) Grants permission to enable a user in the user pool.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_EnableUser.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toEnableUser", []))

    @jsii.member(jsii_name="toExpireSession")
    def to_expire_session(self) -> "Appstream":
        '''(experimental) Grants permission to immediately stop the specified streaming session.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_ExpireSession.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toExpireSession", []))

    @jsii.member(jsii_name="toListAssociatedFleets")
    def to_list_associated_fleets(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve the name of the fleet that is associated with the specified stack.

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_ListAssociatedFleets.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toListAssociatedFleets", []))

    @jsii.member(jsii_name="toListAssociatedStacks")
    def to_list_associated_stacks(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve the name of the stack with which the specified fleet is associated.

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_ListAssociatedStacks.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toListAssociatedStacks", []))

    @jsii.member(jsii_name="toListEntitledApplications")
    def to_list_entitled_applications(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve the applications that are associated with the specified entitlement.

        Access Level: List

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_ListEntitledApplications.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toListEntitledApplications", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Appstream":
        '''(experimental) Grants permission to retrieve a list of all tags for the specified AppStream 2.0 resource. The following resources can be tagged: Image builders, images, fleets, and stacks.

        Access Level: Read

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartFleet")
    def to_start_fleet(self) -> "Appstream":
        '''(experimental) Grants permission to start the specified fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_StartFleet.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toStartFleet", []))

    @jsii.member(jsii_name="toStartImageBuilder")
    def to_start_image_builder(self) -> "Appstream":
        '''(experimental) Grants permission to start the specified image builder.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_StartImageBuilder.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toStartImageBuilder", []))

    @jsii.member(jsii_name="toStopFleet")
    def to_stop_fleet(self) -> "Appstream":
        '''(experimental) Grants permission to stop the specified fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_StopFleet.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toStopFleet", []))

    @jsii.member(jsii_name="toStopImageBuilder")
    def to_stop_image_builder(self) -> "Appstream":
        '''(experimental) Grants permission to stop the specified image builder.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_StopImageBuilder.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toStopImageBuilder", []))

    @jsii.member(jsii_name="toStream")
    def to_stream(self) -> "Appstream":
        '''(experimental) Grants permission to federated users to sign in by using their existing credentials and stream applications from the specified stack.

        Access Level: Write

        Possible conditions:

        - .ifUserId()

        https://docs.aws.amazon.com/appstream2/latest/developerguide/external-identity-providers-setting-up-saml.html#external-identity-providers-embed-inline-policy-for-IAM-role

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toStream", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Appstream":
        '''(experimental) Grants permission to add or overwrite one or more tags for the specified AppStream 2.0 resource. The following resources can be tagged: Image builders, images, fleets, stacks, app blocks and applications.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Appstream":
        '''(experimental) Grants permission to disassociate one or more tags from the specified AppStream 2.0 resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "Appstream":
        '''(experimental) Grants permission to update the specified fields for the specified application.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toUpdateApplication", []))

    @jsii.member(jsii_name="toUpdateDirectoryConfig")
    def to_update_directory_config(self) -> "Appstream":
        '''(experimental) Grants permission to update the specified Directory Config object in AppStream 2.0. This object includes the configuration information required to join fleets and image builders to Microsoft Active Directory domains.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_UpdateDirectoryConfig.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toUpdateDirectoryConfig", []))

    @jsii.member(jsii_name="toUpdateEntitlement")
    def to_update_entitlement(self) -> "Appstream":
        '''(experimental) Grants permission to update the specified fields for the specified entitlement.

        Access Level: Write

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_UpdateEntitlement.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toUpdateEntitlement", []))

    @jsii.member(jsii_name="toUpdateFleet")
    def to_update_fleet(self) -> "Appstream":
        '''(experimental) Grants permission to update the specified fleet.

        All attributes except the fleet name can be updated when the fleet is in the STOPPED state

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_UpdateFleet.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toUpdateFleet", []))

    @jsii.member(jsii_name="toUpdateImagePermissions")
    def to_update_image_permissions(self) -> "Appstream":
        '''(experimental) Grants permission to add or update permissions for the specified private image.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_UpdateImagePermissions.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toUpdateImagePermissions", []))

    @jsii.member(jsii_name="toUpdateStack")
    def to_update_stack(self) -> "Appstream":
        '''(experimental) Grants permission to update the specified fields for the specified stack.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appstream2/latest/APIReference/API_UpdateStack.html

        :stability: experimental
        '''
        return typing.cast("Appstream", jsii.invoke(self, "toUpdateStack", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__85318f579ad1dacf7682f7c5896e16724a4c475ac19cd53d6388a847faaa5bcd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6ee8fbf51caf0bd163834debe4a7b1138953cff0415b340e0d6b52121b6cce35)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Appsync(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Appsync"):
    '''(experimental) Statement provider for service `appsync <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsappsync.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `appsync <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsappsync.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__05e8edb3ab0c2823541fae7532d344af567a63b3becd72f111c7e60e73a8b55c)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDatasource")
    def on_datasource(
        self,
        graph_qlapi_id: builtins.str,
        datasource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appsync":
        '''(experimental) Adds a resource of type datasource to the statement.

        https://docs.aws.amazon.com/appsync/latest/devguide/attaching-a-data-source.html

        :param graph_qlapi_id: - Identifier for the graphQLAPIId.
        :param datasource_name: - Identifier for the datasourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__54e93badf3829e4f8db8844f89afc64c077f79e44a89a501aee4d511ee61eb59)
            check_type(argname="argument graph_qlapi_id", value=graph_qlapi_id, expected_type=type_hints["graph_qlapi_id"])
            check_type(argname="argument datasource_name", value=datasource_name, expected_type=type_hints["datasource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appsync", jsii.invoke(self, "onDatasource", [graph_qlapi_id, datasource_name, account, region, partition]))

    @jsii.member(jsii_name="onDomain")
    def on_domain(
        self,
        domain_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appsync":
        '''(experimental) Adds a resource of type domain to the statement.

        https://docs.aws.amazon.com/appsync/latest/devguide/custom-domain-name.html

        :param domain_name: - Identifier for the domainName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__84840affdce4947261ab847bf8ae12e6f24de0fc3c7a495a20d4366cfa44076c)
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appsync", jsii.invoke(self, "onDomain", [domain_name, account, region, partition]))

    @jsii.member(jsii_name="onField")
    def on_field(
        self,
        graph_qlapi_id: builtins.str,
        type_name: builtins.str,
        field_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appsync":
        '''(experimental) Adds a resource of type field to the statement.

        https://docs.aws.amazon.com/appsync/latest/devguide/configuring-resolvers.html

        :param graph_qlapi_id: - Identifier for the graphQLAPIId.
        :param type_name: - Identifier for the typeName.
        :param field_name: - Identifier for the fieldName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f90a6978b1f150b7e74c581a0df10f6f43cd46b0c150f5162dcc9232262285b7)
            check_type(argname="argument graph_qlapi_id", value=graph_qlapi_id, expected_type=type_hints["graph_qlapi_id"])
            check_type(argname="argument type_name", value=type_name, expected_type=type_hints["type_name"])
            check_type(argname="argument field_name", value=field_name, expected_type=type_hints["field_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appsync", jsii.invoke(self, "onField", [graph_qlapi_id, type_name, field_name, account, region, partition]))

    @jsii.member(jsii_name="onFunction")
    def on_function(
        self,
        graph_qlapi_id: builtins.str,
        function_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appsync":
        '''(experimental) Adds a resource of type function to the statement.

        https://docs.aws.amazon.com/appsync/latest/devguide/pipeline-resolvers.html

        :param graph_qlapi_id: - Identifier for the graphQLAPIId.
        :param function_id: - Identifier for the functionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__98a638809341cd41cfc318bd981b71ae6b5588b44c3e3f656833387be1e97f85)
            check_type(argname="argument graph_qlapi_id", value=graph_qlapi_id, expected_type=type_hints["graph_qlapi_id"])
            check_type(argname="argument function_id", value=function_id, expected_type=type_hints["function_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appsync", jsii.invoke(self, "onFunction", [graph_qlapi_id, function_id, account, region, partition]))

    @jsii.member(jsii_name="onGraphqlapi")
    def on_graphqlapi(
        self,
        graph_qlapi_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appsync":
        '''(experimental) Adds a resource of type graphqlapi to the statement.

        https://docs.aws.amazon.com/appsync/latest/devguide/designing-a-graphql-api.html

        :param graph_qlapi_id: - Identifier for the graphQLAPIId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d814e29815fdbd16ce197c190fad643ce77a1d485981fa7ff592e0d5222a81db)
            check_type(argname="argument graph_qlapi_id", value=graph_qlapi_id, expected_type=type_hints["graph_qlapi_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appsync", jsii.invoke(self, "onGraphqlapi", [graph_qlapi_id, account, region, partition]))

    @jsii.member(jsii_name="onType")
    def on_type(
        self,
        graph_qlapi_id: builtins.str,
        type_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Appsync":
        '''(experimental) Adds a resource of type type to the statement.

        https://docs.aws.amazon.com/appsync/latest/devguide/designing-your-schema.html#adding-a-root-query-type

        :param graph_qlapi_id: - Identifier for the graphQLAPIId.
        :param type_name: - Identifier for the typeName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__808ace7caf386f1233845c8d50988aaaa45b0cad1efe4793ffe64fd753bfeae3)
            check_type(argname="argument graph_qlapi_id", value=graph_qlapi_id, expected_type=type_hints["graph_qlapi_id"])
            check_type(argname="argument type_name", value=type_name, expected_type=type_hints["type_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Appsync", jsii.invoke(self, "onType", [graph_qlapi_id, type_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateApi")
    def to_associate_api(self) -> "Appsync":
        '''(experimental) Grants permission to attach a GraphQL API to a custom domain name in AppSync.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_AssociateApi.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toAssociateApi", []))

    @jsii.member(jsii_name="toCreateApiCache")
    def to_create_api_cache(self) -> "Appsync":
        '''(experimental) Grants permission to create an API cache in AppSync.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_CreateApiCache.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toCreateApiCache", []))

    @jsii.member(jsii_name="toCreateApiKey")
    def to_create_api_key(self) -> "Appsync":
        '''(experimental) Grants permission to create a unique key that you can distribute to clients who are executing your API.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_CreateApiKey.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toCreateApiKey", []))

    @jsii.member(jsii_name="toCreateDataSource")
    def to_create_data_source(self) -> "Appsync":
        '''(experimental) Grants permission to create a data source.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_CreateDataSource.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toCreateDataSource", []))

    @jsii.member(jsii_name="toCreateDomainName")
    def to_create_domain_name(self) -> "Appsync":
        '''(experimental) Grants permission to create a custom domain name in AppSync.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_CreateDomainName.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toCreateDomainName", []))

    @jsii.member(jsii_name="toCreateFunction")
    def to_create_function(self) -> "Appsync":
        '''(experimental) Grants permission to create a new function.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_CreateFunction.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toCreateFunction", []))

    @jsii.member(jsii_name="toCreateGraphqlApi")
    def to_create_graphql_api(self) -> "Appsync":
        '''(experimental) Grants permission to create a GraphQL API, which is the top level AppSync resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_CreateGraphqlApi.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toCreateGraphqlApi", []))

    @jsii.member(jsii_name="toCreateResolver")
    def to_create_resolver(self) -> "Appsync":
        '''(experimental) Grants permission to create a resolver.

        A resolver converts incoming requests into a format that a data source can understand, and converts the data source's responses into GraphQL

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_CreateResolver.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toCreateResolver", []))

    @jsii.member(jsii_name="toCreateType")
    def to_create_type(self) -> "Appsync":
        '''(experimental) Grants permission to create a type.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_CreateType.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toCreateType", []))

    @jsii.member(jsii_name="toDeleteApiCache")
    def to_delete_api_cache(self) -> "Appsync":
        '''(experimental) Grants permission to delete an API cache in AppSync.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_DeleteApiCache.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toDeleteApiCache", []))

    @jsii.member(jsii_name="toDeleteApiKey")
    def to_delete_api_key(self) -> "Appsync":
        '''(experimental) Grants permission to delete an API key.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_DeleteApiKey.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toDeleteApiKey", []))

    @jsii.member(jsii_name="toDeleteDataSource")
    def to_delete_data_source(self) -> "Appsync":
        '''(experimental) Grants permission to delete a data source.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_DeleteDataSource.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toDeleteDataSource", []))

    @jsii.member(jsii_name="toDeleteDomainName")
    def to_delete_domain_name(self) -> "Appsync":
        '''(experimental) Grants permission to delete a custom domain name in AppSync.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_DeleteDomainName.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toDeleteDomainName", []))

    @jsii.member(jsii_name="toDeleteFunction")
    def to_delete_function(self) -> "Appsync":
        '''(experimental) Grants permission to delete a function.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_DeleteFunction.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toDeleteFunction", []))

    @jsii.member(jsii_name="toDeleteGraphqlApi")
    def to_delete_graphql_api(self) -> "Appsync":
        '''(experimental) Grants permission to delete a GraphQL Api. This will also clean up every AppSync resource below that API.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_DeleteGraphqlApi.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toDeleteGraphqlApi", []))

    @jsii.member(jsii_name="toDeleteResolver")
    def to_delete_resolver(self) -> "Appsync":
        '''(experimental) Grants permission to delete a resolver.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_DeleteResolver.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toDeleteResolver", []))

    @jsii.member(jsii_name="toDeleteType")
    def to_delete_type(self) -> "Appsync":
        '''(experimental) Grants permission to delete a type.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_DeleteType.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toDeleteType", []))

    @jsii.member(jsii_name="toDisassociateApi")
    def to_disassociate_api(self) -> "Appsync":
        '''(experimental) Grants permission to detach a GraphQL API to a custom domain name in AppSync.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_DisassociateApi.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toDisassociateApi", []))

    @jsii.member(jsii_name="toEvaluateCode")
    def to_evaluate_code(self) -> "Appsync":
        '''(experimental) Grants permission to evaluate code with a runtime and context.

        Access Level: Read

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_EvaluateCode.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toEvaluateCode", []))

    @jsii.member(jsii_name="toEvaluateMappingTemplate")
    def to_evaluate_mapping_template(self) -> "Appsync":
        '''(experimental) Grants permission to evaluate template mapping.

        Access Level: Read

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_EvaluateMappingTemplate.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toEvaluateMappingTemplate", []))

    @jsii.member(jsii_name="toFlushApiCache")
    def to_flush_api_cache(self) -> "Appsync":
        '''(experimental) Grants permission to flush an API cache in AppSync.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_FlushApiCache.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toFlushApiCache", []))

    @jsii.member(jsii_name="toGetApiAssociation")
    def to_get_api_association(self) -> "Appsync":
        '''(experimental) Grants permission to read custom domain name - GraphQL API association details in AppSync.

        Access Level: Read

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetApiAssociation.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toGetApiAssociation", []))

    @jsii.member(jsii_name="toGetApiCache")
    def to_get_api_cache(self) -> "Appsync":
        '''(experimental) Grants permission to read information about an API cache in AppSync.

        Access Level: Read

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetApiCache.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toGetApiCache", []))

    @jsii.member(jsii_name="toGetDataSource")
    def to_get_data_source(self) -> "Appsync":
        '''(experimental) Grants permission to retrieve a data source.

        Access Level: Read

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetDataSource.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toGetDataSource", []))

    @jsii.member(jsii_name="toGetDomainName")
    def to_get_domain_name(self) -> "Appsync":
        '''(experimental) Grants permission to read information about a custom domain name in AppSync.

        Access Level: Read

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetDomainName.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toGetDomainName", []))

    @jsii.member(jsii_name="toGetFunction")
    def to_get_function(self) -> "Appsync":
        '''(experimental) Grants permission to retrieve a function.

        Access Level: Read

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetFunction.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toGetFunction", []))

    @jsii.member(jsii_name="toGetGraphqlApi")
    def to_get_graphql_api(self) -> "Appsync":
        '''(experimental) Grants permission to retrieve a GraphQL API.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetGraphqlApi.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toGetGraphqlApi", []))

    @jsii.member(jsii_name="toGetIntrospectionSchema")
    def to_get_introspection_schema(self) -> "Appsync":
        '''(experimental) Grants permission to retrieve the introspection schema for a GraphQL API.

        Access Level: Read

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetIntrospectionSchema.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toGetIntrospectionSchema", []))

    @jsii.member(jsii_name="toGetResolver")
    def to_get_resolver(self) -> "Appsync":
        '''(experimental) Grants permission to retrieve a resolver.

        Access Level: Read

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetResolver.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toGetResolver", []))

    @jsii.member(jsii_name="toGetSchemaCreationStatus")
    def to_get_schema_creation_status(self) -> "Appsync":
        '''(experimental) Grants permission to retrieve the current status of a schema creation operation.

        Access Level: Read

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetSchemaCreationStatus.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toGetSchemaCreationStatus", []))

    @jsii.member(jsii_name="toGetType")
    def to_get_type(self) -> "Appsync":
        '''(experimental) Grants permission to retrieve a type.

        Access Level: Read

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetType.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toGetType", []))

    @jsii.member(jsii_name="toGraphQL")
    def to_graph_ql(self) -> "Appsync":
        '''(experimental) Grants permission to send a GraphQL query to a GraphQL API.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/devguide/using-your-api.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toGraphQL", []))

    @jsii.member(jsii_name="toListApiKeys")
    def to_list_api_keys(self) -> "Appsync":
        '''(experimental) Grants permission to list the API keys for a given API.

        Access Level: List

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListApiKeys.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toListApiKeys", []))

    @jsii.member(jsii_name="toListDataSources")
    def to_list_data_sources(self) -> "Appsync":
        '''(experimental) Grants permission to list the data sources for a given API.

        Access Level: List

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListDataSources.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toListDataSources", []))

    @jsii.member(jsii_name="toListDomainNames")
    def to_list_domain_names(self) -> "Appsync":
        '''(experimental) Grants permission to enumerate custom domain names in AppSync.

        Access Level: List

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListDomainNames.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toListDomainNames", []))

    @jsii.member(jsii_name="toListFunctions")
    def to_list_functions(self) -> "Appsync":
        '''(experimental) Grants permission to list the functions for a given API.

        Access Level: List

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListFunctions.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toListFunctions", []))

    @jsii.member(jsii_name="toListGraphqlApis")
    def to_list_graphql_apis(self) -> "Appsync":
        '''(experimental) Grants permission to list GraphQL APIs.

        Access Level: List

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListGraphqlApis.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toListGraphqlApis", []))

    @jsii.member(jsii_name="toListResolvers")
    def to_list_resolvers(self) -> "Appsync":
        '''(experimental) Grants permission to list the resolvers for a given API and type.

        Access Level: List

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListResolvers.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toListResolvers", []))

    @jsii.member(jsii_name="toListResolversByFunction")
    def to_list_resolvers_by_function(self) -> "Appsync":
        '''(experimental) Grants permission to list the resolvers that are associated with a specific function.

        Access Level: List

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListResolversByFunction.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toListResolversByFunction", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Appsync":
        '''(experimental) Grants permission to list the tags for a resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTypes")
    def to_list_types(self) -> "Appsync":
        '''(experimental) Grants permission to list the types for a given API.

        Access Level: List

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListTypes.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toListTypes", []))

    @jsii.member(jsii_name="toSetWebACL")
    def to_set_web_acl(self) -> "Appsync":
        '''(experimental) Grants permission to set a web ACL.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_SetWebACL.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toSetWebACL", []))

    @jsii.member(jsii_name="toStartSchemaCreation")
    def to_start_schema_creation(self) -> "Appsync":
        '''(experimental) Grants permission to add a new schema to your GraphQL API.

        This operation is asynchronous - GetSchemaCreationStatus can show when it has completed

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_StartSchemaCreation.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toStartSchemaCreation", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Appsync":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Appsync":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApiCache")
    def to_update_api_cache(self) -> "Appsync":
        '''(experimental) Grants permission to update an API cache in AppSync.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_UpdateApiCache.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toUpdateApiCache", []))

    @jsii.member(jsii_name="toUpdateApiKey")
    def to_update_api_key(self) -> "Appsync":
        '''(experimental) Grants permission to update an API key for a given API.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_UpdateApiKey.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toUpdateApiKey", []))

    @jsii.member(jsii_name="toUpdateDataSource")
    def to_update_data_source(self) -> "Appsync":
        '''(experimental) Grants permission to update a data source.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_UpdateDataSource.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toUpdateDataSource", []))

    @jsii.member(jsii_name="toUpdateDomainName")
    def to_update_domain_name(self) -> "Appsync":
        '''(experimental) Grants permission to update a custom domain name in AppSync.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_UpdateDomainName.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toUpdateDomainName", []))

    @jsii.member(jsii_name="toUpdateFunction")
    def to_update_function(self) -> "Appsync":
        '''(experimental) Grants permission to update an existing function.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_UpdateFunction.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toUpdateFunction", []))

    @jsii.member(jsii_name="toUpdateGraphqlApi")
    def to_update_graphql_api(self) -> "Appsync":
        '''(experimental) Grants permission to update a GraphQL API.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_UpdateGraphqlApi.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toUpdateGraphqlApi", []))

    @jsii.member(jsii_name="toUpdateResolver")
    def to_update_resolver(self) -> "Appsync":
        '''(experimental) Grants permission to update a resolver.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_UpdateResolver.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toUpdateResolver", []))

    @jsii.member(jsii_name="toUpdateType")
    def to_update_type(self) -> "Appsync":
        '''(experimental) Grants permission to update a type.

        Access Level: Write

        https://docs.aws.amazon.com/appsync/latest/APIReference/API_UpdateType.html

        :stability: experimental
        '''
        return typing.cast("Appsync", jsii.invoke(self, "toUpdateType", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__37d4b4b21f78cd20dd2cde1e2214f984f66721f64e909bef52c573e24223aee4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f383a2e1c5cfc40d97046c8c82f4c06c054cb9384b05924d0a80db963be86c80)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Aps(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Aps"):
    '''(experimental) Statement provider for service `aps <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedserviceforprometheus.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aps <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedserviceforprometheus.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__362247d0c8a74ddc335e115a6abebd8b20f8199f97220deab96c95a5794c90d5)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onRulegroupsnamespace")
    def on_rulegroupsnamespace(
        self,
        workspace_id: builtins.str,
        namespace: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Aps":
        '''(experimental) Adds a resource of type rulegroupsnamespace to the statement.

        https://docs.aws.amazon.com/prometheus/latest/userguide/security-iam.html

        :param workspace_id: - Identifier for the workspaceId.
        :param namespace: - Identifier for the namespace.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__86619506e245456ca45aa088c5404744faf1e58bd77cc9647042d5e7255294f3)
            check_type(argname="argument workspace_id", value=workspace_id, expected_type=type_hints["workspace_id"])
            check_type(argname="argument namespace", value=namespace, expected_type=type_hints["namespace"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Aps", jsii.invoke(self, "onRulegroupsnamespace", [workspace_id, namespace, account, region, partition]))

    @jsii.member(jsii_name="onWorkspace")
    def on_workspace(
        self,
        workspace_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Aps":
        '''(experimental) Adds a resource of type workspace to the statement.

        https://docs.aws.amazon.com/prometheus/latest/userguide/security-iam.html

        :param workspace_id: - Identifier for the workspaceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e06bcbbad0bc9f17f3d2ed0719a1fb75143628bbf1981959149d0f6481e75d37)
            check_type(argname="argument workspace_id", value=workspace_id, expected_type=type_hints["workspace_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Aps", jsii.invoke(self, "onWorkspace", [workspace_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateAlertManagerAlerts")
    def to_create_alert_manager_alerts(self) -> "Aps":
        '''(experimental) Grants permission to create alerts.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-CreateAlertManagerAlerts

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toCreateAlertManagerAlerts", []))

    @jsii.member(jsii_name="toCreateAlertManagerDefinition")
    def to_create_alert_manager_definition(self) -> "Aps":
        '''(experimental) Grants permission to create an alert manager definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-CreateAlertManagerDefinition

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toCreateAlertManagerDefinition", []))

    @jsii.member(jsii_name="toCreateLoggingConfiguration")
    def to_create_logging_configuration(self) -> "Aps":
        '''(experimental) Grants permission to create a logging configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-CreateLoggingConfiguration

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toCreateLoggingConfiguration", []))

    @jsii.member(jsii_name="toCreateRuleGroupsNamespace")
    def to_create_rule_groups_namespace(self) -> "Aps":
        '''(experimental) Grants permission to create a rule groups namespace.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-CreateRuleGroupsNamespace

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toCreateRuleGroupsNamespace", []))

    @jsii.member(jsii_name="toCreateWorkspace")
    def to_create_workspace(self) -> "Aps":
        '''(experimental) Grants permission to create a workspace.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-CreateWorkspace

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toCreateWorkspace", []))

    @jsii.member(jsii_name="toDeleteAlertManagerDefinition")
    def to_delete_alert_manager_definition(self) -> "Aps":
        '''(experimental) Grants permission to delete an alert manager definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-DeleteAlertManagerDefinition

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toDeleteAlertManagerDefinition", []))

    @jsii.member(jsii_name="toDeleteAlertManagerSilence")
    def to_delete_alert_manager_silence(self) -> "Aps":
        '''(experimental) Grants permission to delete a silence.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-DeleteAlertManagerSilence

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toDeleteAlertManagerSilence", []))

    @jsii.member(jsii_name="toDeleteLoggingConfiguration")
    def to_delete_logging_configuration(self) -> "Aps":
        '''(experimental) Grants permission to delete a logging configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-DeleteLoggingConfiguration

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toDeleteLoggingConfiguration", []))

    @jsii.member(jsii_name="toDeleteRuleGroupsNamespace")
    def to_delete_rule_groups_namespace(self) -> "Aps":
        '''(experimental) Grants permission to delete a rule groups namespace.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-DeleteRuleGroupsNamespace

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toDeleteRuleGroupsNamespace", []))

    @jsii.member(jsii_name="toDeleteWorkspace")
    def to_delete_workspace(self) -> "Aps":
        '''(experimental) Grants permission to delete a workspace.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-DeleteWorkspace

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toDeleteWorkspace", []))

    @jsii.member(jsii_name="toDescribeAlertManagerDefinition")
    def to_describe_alert_manager_definition(self) -> "Aps":
        '''(experimental) Grants permission to describe an alert manager definition.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-DescribeAlertManagerDefinition

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toDescribeAlertManagerDefinition", []))

    @jsii.member(jsii_name="toDescribeLoggingConfiguration")
    def to_describe_logging_configuration(self) -> "Aps":
        '''(experimental) Grants permission to describe a logging configuration.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-DescribeLoggingConfiguration

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toDescribeLoggingConfiguration", []))

    @jsii.member(jsii_name="toDescribeRuleGroupsNamespace")
    def to_describe_rule_groups_namespace(self) -> "Aps":
        '''(experimental) Grants permission to describe a rule groups namespace.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-DescribeRuleGroupsNamespace

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toDescribeRuleGroupsNamespace", []))

    @jsii.member(jsii_name="toDescribeWorkspace")
    def to_describe_workspace(self) -> "Aps":
        '''(experimental) Grants permission to describe a workspace.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-DescribeWorkspace

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toDescribeWorkspace", []))

    @jsii.member(jsii_name="toGetAlertManagerSilence")
    def to_get_alert_manager_silence(self) -> "Aps":
        '''(experimental) Grants permission to get a silence.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-GetAlertManagerSilence

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toGetAlertManagerSilence", []))

    @jsii.member(jsii_name="toGetAlertManagerStatus")
    def to_get_alert_manager_status(self) -> "Aps":
        '''(experimental) Grants permission to get current status of an alertmanager.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-GetAlertManagerStatus

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toGetAlertManagerStatus", []))

    @jsii.member(jsii_name="toGetLabels")
    def to_get_labels(self) -> "Aps":
        '''(experimental) Grants permission to retrieve AMP workspace labels.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-GetLabels

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toGetLabels", []))

    @jsii.member(jsii_name="toGetMetricMetadata")
    def to_get_metric_metadata(self) -> "Aps":
        '''(experimental) Grants permission to retrieve the metadata for AMP workspace metrics.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-GetMetricMetadata

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toGetMetricMetadata", []))

    @jsii.member(jsii_name="toGetSeries")
    def to_get_series(self) -> "Aps":
        '''(experimental) Grants permission to retrieve AMP workspace time series data.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-GetSeries

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toGetSeries", []))

    @jsii.member(jsii_name="toListAlertManagerAlertGroups")
    def to_list_alert_manager_alert_groups(self) -> "Aps":
        '''(experimental) Grants permission to list groups.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-ListAlertManagerAlertGroups

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toListAlertManagerAlertGroups", []))

    @jsii.member(jsii_name="toListAlertManagerAlerts")
    def to_list_alert_manager_alerts(self) -> "Aps":
        '''(experimental) Grants permission to list alerts.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-ListAlertManagerAlerts

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toListAlertManagerAlerts", []))

    @jsii.member(jsii_name="toListAlertManagerReceivers")
    def to_list_alert_manager_receivers(self) -> "Aps":
        '''(experimental) Grants permission to list receivers.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-ListAlertManagerReceivers

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toListAlertManagerReceivers", []))

    @jsii.member(jsii_name="toListAlertManagerSilences")
    def to_list_alert_manager_silences(self) -> "Aps":
        '''(experimental) Grants permission to list silences.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-ListAlertManagerSilences

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toListAlertManagerSilences", []))

    @jsii.member(jsii_name="toListAlerts")
    def to_list_alerts(self) -> "Aps":
        '''(experimental) Grants permission to list active alerts.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-ListAlerts

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toListAlerts", []))

    @jsii.member(jsii_name="toListRuleGroupsNamespaces")
    def to_list_rule_groups_namespaces(self) -> "Aps":
        '''(experimental) Grants permission to list rule groups namespaces.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-ListRuleGroupsNamespaces

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toListRuleGroupsNamespaces", []))

    @jsii.member(jsii_name="toListRules")
    def to_list_rules(self) -> "Aps":
        '''(experimental) Grants permission to list alerting and recording rules.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-ListRules

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toListRules", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Aps":
        '''(experimental) Grants permission to list tags on an AMP resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-ListTagsForResource

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWorkspaces")
    def to_list_workspaces(self) -> "Aps":
        '''(experimental) Grants permission to list workspaces.

        Access Level: List

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-ListWorkspaces

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toListWorkspaces", []))

    @jsii.member(jsii_name="toPutAlertManagerDefinition")
    def to_put_alert_manager_definition(self) -> "Aps":
        '''(experimental) Grants permission to update an alert manager definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-PutAlertManagerDefinition

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toPutAlertManagerDefinition", []))

    @jsii.member(jsii_name="toPutAlertManagerSilences")
    def to_put_alert_manager_silences(self) -> "Aps":
        '''(experimental) Grants permission to create or update a silence.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-PutAlertManagerSilences

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toPutAlertManagerSilences", []))

    @jsii.member(jsii_name="toPutRuleGroupsNamespace")
    def to_put_rule_groups_namespace(self) -> "Aps":
        '''(experimental) Grants permission to update a rule groups namespace.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-PutRuleGroupsNamespace

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toPutRuleGroupsNamespace", []))

    @jsii.member(jsii_name="toQueryMetrics")
    def to_query_metrics(self) -> "Aps":
        '''(experimental) Grants permission to run a query on AMP workspace metrics.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-QueryMetrics

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toQueryMetrics", []))

    @jsii.member(jsii_name="toRemoteWrite")
    def to_remote_write(self) -> "Aps":
        '''(experimental) Grants permission to perform a remote write operation to initiate the streaming of metrics to AMP workspace.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-RemoteWrite

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toRemoteWrite", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Aps":
        '''(experimental) Grants permission to tag an AMP resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-TagResource

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Aps":
        '''(experimental) Grants permission to untag an AMP resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-UntagResource

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateLoggingConfiguration")
    def to_update_logging_configuration(self) -> "Aps":
        '''(experimental) Grants permission to update a logging configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-UpdateLoggingConfiguration

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toUpdateLoggingConfiguration", []))

    @jsii.member(jsii_name="toUpdateWorkspaceAlias")
    def to_update_workspace_alias(self) -> "Aps":
        '''(experimental) Grants permission to modify the alias of existing AMP workspace.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/prometheus/latest/userguide/AMP-APIReference.html#AMP-APIReference-UpdateWorkspaceAlias

        :stability: experimental
        '''
        return typing.cast("Aps", jsii.invoke(self, "toUpdateWorkspaceAlias", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0570745ec844545a58382bd5b4289951d851d9a7adf5f89b06813df18516b4ff)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__554b6f1b4b621ac06e7f2485852ba315bc3537b4bb5df66605c75dc246b4602b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class ArcZonalShift(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ArcZonalShift",
):
    '''(experimental) Statement provider for service `arc-zonal-shift <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53applicationrecoverycontroller-zonalshift.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `arc-zonal-shift <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53applicationrecoverycontroller-zonalshift.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d1d606cb53403633aca4b41b606e1ff2c81dc2f9b9382efb5beed57e00269b31)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifElasticloadbalancingResourceTag")
    def if_elasticloadbalancing_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ArcZonalShift":
        '''(experimental) Filters access by the tags associated with the managed resource.

        https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html#elb-condition-keys

        Applies to actions:

        - .toCancelZonalShift()
        - .toGetManagedResource()
        - .toStartZonalShift()
        - .toUpdateZonalShift()

        Applies to resource types:

        - ALB
        - NLB

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c460714b8283435f93847336eed02d3a2a6b4c81f0e95ad128a0a90ee056b590)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ArcZonalShift", jsii.invoke(self, "ifElasticloadbalancingResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onALB")
    def on_alb(
        self,
        load_balancer_name: builtins.str,
        load_balancer_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ArcZonalShift":
        '''(experimental) Adds a resource of type ALB to the statement.

        https://docs.aws.amazon.com/r53recovery/latest/dg/arc-zonal-shift.resource-types.html

        :param load_balancer_name: - Identifier for the loadBalancerName.
        :param load_balancer_id: - Identifier for the loadBalancerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifElasticloadbalancingResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8a853ce4b0d960cfbea94256ba18d22c89753cb8a309f540689a0b3800894f40)
            check_type(argname="argument load_balancer_name", value=load_balancer_name, expected_type=type_hints["load_balancer_name"])
            check_type(argname="argument load_balancer_id", value=load_balancer_id, expected_type=type_hints["load_balancer_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ArcZonalShift", jsii.invoke(self, "onALB", [load_balancer_name, load_balancer_id, account, region, partition]))

    @jsii.member(jsii_name="onNLB")
    def on_nlb(
        self,
        load_balancer_name: builtins.str,
        load_balancer_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ArcZonalShift":
        '''(experimental) Adds a resource of type NLB to the statement.

        https://docs.aws.amazon.com/r53recovery/latest/dg/arc-zonal-shift.resource-types.html

        :param load_balancer_name: - Identifier for the loadBalancerName.
        :param load_balancer_id: - Identifier for the loadBalancerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifElasticloadbalancingResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__774009c0d8e97117e62c2e98bd307d91202a8f8e1d7ee17f12cebf5129a3e676)
            check_type(argname="argument load_balancer_name", value=load_balancer_name, expected_type=type_hints["load_balancer_name"])
            check_type(argname="argument load_balancer_id", value=load_balancer_id, expected_type=type_hints["load_balancer_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ArcZonalShift", jsii.invoke(self, "onNLB", [load_balancer_name, load_balancer_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelZonalShift")
    def to_cancel_zonal_shift(self) -> "ArcZonalShift":
        '''(experimental) Grants permission to cancel an active zonal shift.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifElasticloadbalancingResourceTag()

        https://docs.aws.amazon.com/arc-zonal-shift/latest/api/API_CancelZonalShift.html

        :stability: experimental
        '''
        return typing.cast("ArcZonalShift", jsii.invoke(self, "toCancelZonalShift", []))

    @jsii.member(jsii_name="toGetManagedResource")
    def to_get_managed_resource(self) -> "ArcZonalShift":
        '''(experimental) Grants permission to get information about a managed resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifElasticloadbalancingResourceTag()

        https://docs.aws.amazon.com/arc-zonal-shift/latest/api/API_GetManagedResource.html

        :stability: experimental
        '''
        return typing.cast("ArcZonalShift", jsii.invoke(self, "toGetManagedResource", []))

    @jsii.member(jsii_name="toListManagedResources")
    def to_list_managed_resources(self) -> "ArcZonalShift":
        '''(experimental) Grants permission to list managed resources.

        Access Level: List

        https://docs.aws.amazon.com/arc-zonal-shift/latest/api/API_ListManagedResources.html

        :stability: experimental
        '''
        return typing.cast("ArcZonalShift", jsii.invoke(self, "toListManagedResources", []))

    @jsii.member(jsii_name="toListZonalShifts")
    def to_list_zonal_shifts(self) -> "ArcZonalShift":
        '''(experimental) Grants permission to list zonal shifts.

        Access Level: List

        https://docs.aws.amazon.com/arc-zonal-shift/latest/api/API_ListZonalShifts.html

        :stability: experimental
        '''
        return typing.cast("ArcZonalShift", jsii.invoke(self, "toListZonalShifts", []))

    @jsii.member(jsii_name="toStartZonalShift")
    def to_start_zonal_shift(self) -> "ArcZonalShift":
        '''(experimental) Grants permission to start a zonal shift.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifElasticloadbalancingResourceTag()

        https://docs.aws.amazon.com/arc-zonal-shift/latest/api/API_StartZonalShift.html

        :stability: experimental
        '''
        return typing.cast("ArcZonalShift", jsii.invoke(self, "toStartZonalShift", []))

    @jsii.member(jsii_name="toUpdateZonalShift")
    def to_update_zonal_shift(self) -> "ArcZonalShift":
        '''(experimental) Grants permission to update an existing zonal shift.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifElasticloadbalancingResourceTag()

        https://docs.aws.amazon.com/arc-zonal-shift/latest/api/API_UpdateZonalShift.html

        :stability: experimental
        '''
        return typing.cast("ArcZonalShift", jsii.invoke(self, "toUpdateZonalShift", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__476a177721635eebe476780e074b8c37261cedfcdad746583e4f8dd5cabf8095)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__882236aa42000dbe3cd463fb4943d6df6e0ca27be8e1086f85e64671e21dbecd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Arsenal(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Arsenal"):
    '''(experimental) Statement provider for service `arsenal <https://docs.aws.amazon.com/service-authorization/latest/reference/list_applicationdiscoveryarsenal.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `arsenal <https://docs.aws.amazon.com/service-authorization/latest/reference/list_applicationdiscoveryarsenal.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1948b5b186d263a12a3da163c22d25b36bee8acaba4f41086a25478efad8fc89)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toRegisterOnPremisesAgent")
    def to_register_on_premises_agent(self) -> "Arsenal":
        '''(experimental) Grants permission to register AWS provided data collectors to the Application Discovery Service.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/userguide/setting-up.html

        :stability: experimental
        '''
        return typing.cast("Arsenal", jsii.invoke(self, "toRegisterOnPremisesAgent", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__806547cef3b3d00ce57dff57e65c98e7a8c3ed6a37e3d916f64168a2760822a6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f0f16fe3ece206ff0707072e98204cd67056e49bfca575f1832887c00997e71f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Artifact(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Artifact",
):
    '''(experimental) Statement provider for service `artifact <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsartifact.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `artifact <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsartifact.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cb0b1fb32634a090fd1f58c8eec5ac9932f4d827e1739df9219fe634daa22426)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAgreement")
    def on_agreement(
        self,
        resource_name: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Artifact":
        '''(experimental) Adds a resource of type agreement to the statement.

        https://docs.aws.amazon.com/artifact/latest/ug/managing-agreements.html

        :param resource_name: - Identifier for the resourceName.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d303204878d1a778df94b4b1a52cae8676876268580defbeeb062beb8f79680b)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Artifact", jsii.invoke(self, "onAgreement", [resource_name, partition]))

    @jsii.member(jsii_name="onCustomerAgreement")
    def on_customer_agreement(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Artifact":
        '''(experimental) Adds a resource of type customer-agreement to the statement.

        https://docs.aws.amazon.com/artifact/latest/ug/managing-agreements.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b575816bf0c7d22fa82a5c9df70d20bd675eb3d1a313d1d281b3d2dbcd12654e)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Artifact", jsii.invoke(self, "onCustomerAgreement", [resource_name, account, partition]))

    @jsii.member(jsii_name="onReport")
    def on_report(
        self,
        resource_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Artifact":
        '''(experimental) Adds a resource of type report to the statement.

        https://docs.aws.amazon.com/artifact/latest/ug/what-is-aws-artifact.html

        :param resource_name: - Identifier for the resourceName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c6f4477cbfe291790ffd04a8dfbf0d585fd86ef6cf469e7339963940ea896103)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Artifact", jsii.invoke(self, "onReport", [resource_name, region, partition]))

    @jsii.member(jsii_name="onReportPackage")
    def on_report_package(
        self,
        resource_name: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Artifact":
        '''(experimental) Adds a resource of type report-package to the statement.

        https://docs.aws.amazon.com/artifact/latest/ug/what-is-aws-artifact.html

        :param resource_name: - Identifier for the resourceName.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6ef2d03b7f872ec7a6909ba9aa2364031a1fa1a3d9b81c7ca064cd72cfdb0581)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Artifact", jsii.invoke(self, "onReportPackage", [resource_name, partition]))

    @jsii.member(jsii_name="toAcceptAgreement")
    def to_accept_agreement(self) -> "Artifact":
        '''(experimental) Grants permission to accept an AWS agreement that has not yet been accepted by the customer account.

        Access Level: Write

        https://docs.aws.amazon.com/artifact/latest/ug/managing-agreements.html

        :stability: experimental
        '''
        return typing.cast("Artifact", jsii.invoke(self, "toAcceptAgreement", []))

    @jsii.member(jsii_name="toDownloadAgreement")
    def to_download_agreement(self) -> "Artifact":
        '''(experimental) Grants permission to download an AWS agreement that has not yet been accepted or a customer agreement that has been accepted by the customer account.

        Access Level: Read

        https://docs.aws.amazon.com/artifact/latest/ug/managing-agreements.html

        :stability: experimental
        '''
        return typing.cast("Artifact", jsii.invoke(self, "toDownloadAgreement", []))

    @jsii.member(jsii_name="toGet")
    def to_get(self) -> "Artifact":
        '''(experimental) Grants permission to download an AWS compliance report package.

        Access Level: Read

        https://docs.aws.amazon.com/artifact/latest/ug/getting-started.html

        :stability: experimental
        '''
        return typing.cast("Artifact", jsii.invoke(self, "toGet", []))

    @jsii.member(jsii_name="toGetReport")
    def to_get_report(self) -> "Artifact":
        '''(experimental) Grants permission to download a report.

        Access Level: Read

        https://docs.aws.amazon.com/artifact/latest/ug/getting-started.html

        :stability: experimental
        '''
        return typing.cast("Artifact", jsii.invoke(self, "toGetReport", []))

    @jsii.member(jsii_name="toGetReportMetadata")
    def to_get_report_metadata(self) -> "Artifact":
        '''(experimental) Grants permission to download metadata associated with a report.

        Access Level: Read

        https://docs.aws.amazon.com/artifact/latest/ug/getting-started.html

        :stability: experimental
        '''
        return typing.cast("Artifact", jsii.invoke(self, "toGetReportMetadata", []))

    @jsii.member(jsii_name="toGetTermForReport")
    def to_get_term_for_report(self) -> "Artifact":
        '''(experimental) Grants permission to download a term associated with a report.

        Access Level: Read

        https://docs.aws.amazon.com/artifact/latest/ug/getting-started.html

        :stability: experimental
        '''
        return typing.cast("Artifact", jsii.invoke(self, "toGetTermForReport", []))

    @jsii.member(jsii_name="toListReports")
    def to_list_reports(self) -> "Artifact":
        '''(experimental) Grants permission to list reports in your account.

        Access Level: List

        https://docs.aws.amazon.com/artifact/latest/ug/getting-started.html

        :stability: experimental
        '''
        return typing.cast("Artifact", jsii.invoke(self, "toListReports", []))

    @jsii.member(jsii_name="toTerminateAgreement")
    def to_terminate_agreement(self) -> "Artifact":
        '''(experimental) Grants permission to terminate a customer agreement that was previously accepted by the customer account.

        Access Level: Write

        https://docs.aws.amazon.com/artifact/latest/ug/managing-agreements.html

        :stability: experimental
        '''
        return typing.cast("Artifact", jsii.invoke(self, "toTerminateAgreement", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__096226c075785a76a9d46d8d1a579d54032c19aca28078d599a23a4c66f5d314)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__87d09455e8891ea771de5006659548d93476a4003ae02000d21eef979b2a07e1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Athena(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Athena"):
    '''(experimental) Statement provider for service `athena <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonathena.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `athena <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonathena.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f518ca5228e37f93c03a0b7e4f4dc8925fa2af269b227f20e46d6877519948ec)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDatacatalog")
    def on_datacatalog(
        self,
        data_catalog_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Athena":
        '''(experimental) Adds a resource of type datacatalog to the statement.

        https://docs.aws.amazon.com/athena/latest/ug/datacatalogs-example-policies.html

        :param data_catalog_name: - Identifier for the dataCatalogName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a1b80850c6723a4b917b1678fd37f3c7b890f7c6f4f102d15d8c23e808e5720e)
            check_type(argname="argument data_catalog_name", value=data_catalog_name, expected_type=type_hints["data_catalog_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Athena", jsii.invoke(self, "onDatacatalog", [data_catalog_name, account, region, partition]))

    @jsii.member(jsii_name="onWorkgroup")
    def on_workgroup(
        self,
        work_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Athena":
        '''(experimental) Adds a resource of type workgroup to the statement.

        https://docs.aws.amazon.com/athena/latest/ug/example-policies-workgroup.html

        :param work_group_name: - Identifier for the workGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5e1d1cdd90471f662ed01482d252b16eb445bcf5cc146bd05c2bacd4e66a6fe0)
            check_type(argname="argument work_group_name", value=work_group_name, expected_type=type_hints["work_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Athena", jsii.invoke(self, "onWorkgroup", [work_group_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchGetNamedQuery")
    def to_batch_get_named_query(self) -> "Athena":
        '''(experimental) Grants permission to get information about one or more named queries.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_BatchGetNamedQuery.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toBatchGetNamedQuery", []))

    @jsii.member(jsii_name="toBatchGetPreparedStatement")
    def to_batch_get_prepared_statement(self) -> "Athena":
        '''(experimental) Grants permission to get information about one or more prepared statements.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_BatchGetPreparedStatement.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toBatchGetPreparedStatement", []))

    @jsii.member(jsii_name="toBatchGetQueryExecution")
    def to_batch_get_query_execution(self) -> "Athena":
        '''(experimental) Grants permission to get information about one or more query executions.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_BatchGetQueryExecution.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toBatchGetQueryExecution", []))

    @jsii.member(jsii_name="toCreateDataCatalog")
    def to_create_data_catalog(self) -> "Athena":
        '''(experimental) Grants permission to create a datacatalog.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/athena/latest/APIReference/API_CreateDataCatalog.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toCreateDataCatalog", []))

    @jsii.member(jsii_name="toCreateNamedQuery")
    def to_create_named_query(self) -> "Athena":
        '''(experimental) Grants permission to create a named query.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_CreateNamedQuery.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toCreateNamedQuery", []))

    @jsii.member(jsii_name="toCreateNotebook")
    def to_create_notebook(self) -> "Athena":
        '''(experimental) Grants permission to create a notebook.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_CreateNotebook.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toCreateNotebook", []))

    @jsii.member(jsii_name="toCreatePreparedStatement")
    def to_create_prepared_statement(self) -> "Athena":
        '''(experimental) Grants permission to create a prepared statement.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_CreatePreparedStatement.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toCreatePreparedStatement", []))

    @jsii.member(jsii_name="toCreatePresignedNotebookUrl")
    def to_create_presigned_notebook_url(self) -> "Athena":
        '''(experimental) Grants permission to create a presigned notebook url.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_CreatePresignedNotebookUrl.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toCreatePresignedNotebookUrl", []))

    @jsii.member(jsii_name="toCreateWorkGroup")
    def to_create_work_group(self) -> "Athena":
        '''(experimental) Grants permission to create a workgroup.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/athena/latest/APIReference/API_CreateWorkGroup.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toCreateWorkGroup", []))

    @jsii.member(jsii_name="toDeleteDataCatalog")
    def to_delete_data_catalog(self) -> "Athena":
        '''(experimental) Grants permission to delete a datacatalog.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_DeleteDataCatalog.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toDeleteDataCatalog", []))

    @jsii.member(jsii_name="toDeleteNamedQuery")
    def to_delete_named_query(self) -> "Athena":
        '''(experimental) Grants permission to delete a named query specified.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_DeleteNamedQuery.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toDeleteNamedQuery", []))

    @jsii.member(jsii_name="toDeleteNotebook")
    def to_delete_notebook(self) -> "Athena":
        '''(experimental) Grants permission to delete a notebook.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_DeleteNotebook.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toDeleteNotebook", []))

    @jsii.member(jsii_name="toDeletePreparedStatement")
    def to_delete_prepared_statement(self) -> "Athena":
        '''(experimental) Grants permission to delete a prepared statement specified.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_DeletePreparedStatement.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toDeletePreparedStatement", []))

    @jsii.member(jsii_name="toDeleteWorkGroup")
    def to_delete_work_group(self) -> "Athena":
        '''(experimental) Grants permission to delete a workgroup.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_DeleteWorkGroup.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toDeleteWorkGroup", []))

    @jsii.member(jsii_name="toExportNotebook")
    def to_export_notebook(self) -> "Athena":
        '''(experimental) Grants permission to export a notebook.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ExportNotebook.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toExportNotebook", []))

    @jsii.member(jsii_name="toGetCalculationExecution")
    def to_get_calculation_execution(self) -> "Athena":
        '''(experimental) Grants permission to get a calculation execution.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetCalculationExecution.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetCalculationExecution", []))

    @jsii.member(jsii_name="toGetCalculationExecutionCode")
    def to_get_calculation_execution_code(self) -> "Athena":
        '''(experimental) Grants permission to get a calculation execution code.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetCalculationExecutionCode.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetCalculationExecutionCode", []))

    @jsii.member(jsii_name="toGetCalculationExecutionStatus")
    def to_get_calculation_execution_status(self) -> "Athena":
        '''(experimental) Grants permission to get a calculation execution status.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetCalculationExecutionStatus.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetCalculationExecutionStatus", []))

    @jsii.member(jsii_name="toGetDatabase")
    def to_get_database(self) -> "Athena":
        '''(experimental) Grants permission to get a database for a given datacatalog.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetDatabase.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetDatabase", []))

    @jsii.member(jsii_name="toGetDataCatalog")
    def to_get_data_catalog(self) -> "Athena":
        '''(experimental) Grants permission to get a datacatalog.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetDataCatalog.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetDataCatalog", []))

    @jsii.member(jsii_name="toGetNamedQuery")
    def to_get_named_query(self) -> "Athena":
        '''(experimental) Grants permission to get information about the specified named query.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetNamedQuery.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetNamedQuery", []))

    @jsii.member(jsii_name="toGetNotebookMetadata")
    def to_get_notebook_metadata(self) -> "Athena":
        '''(experimental) Grants permission to get notebook metadata.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetNotebookMetadata.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetNotebookMetadata", []))

    @jsii.member(jsii_name="toGetPreparedStatement")
    def to_get_prepared_statement(self) -> "Athena":
        '''(experimental) Grants permission to get information about the specified prepared statement.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetPreparedStatement.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetPreparedStatement", []))

    @jsii.member(jsii_name="toGetQueryExecution")
    def to_get_query_execution(self) -> "Athena":
        '''(experimental) Grants permission to get information about the specified query execution.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetQueryExecution.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetQueryExecution", []))

    @jsii.member(jsii_name="toGetQueryResults")
    def to_get_query_results(self) -> "Athena":
        '''(experimental) Grants permission to get the query results.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetQueryResults.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetQueryResults", []))

    @jsii.member(jsii_name="toGetQueryResultsStream")
    def to_get_query_results_stream(self) -> "Athena":
        '''(experimental) Grants permission to get the query results stream.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/ug/connect-with-previous-jdbc.html#jdbc-prev-version-policies

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetQueryResultsStream", []))

    @jsii.member(jsii_name="toGetQueryRuntimeStatistics")
    def to_get_query_runtime_statistics(self) -> "Athena":
        '''(experimental) Grants permission to get runtime statistics for the specified query execution.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetQueryRuntimeStatistics.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetQueryRuntimeStatistics", []))

    @jsii.member(jsii_name="toGetSession")
    def to_get_session(self) -> "Athena":
        '''(experimental) Grants permission to get a session.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetSession.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetSession", []))

    @jsii.member(jsii_name="toGetSessionStatus")
    def to_get_session_status(self) -> "Athena":
        '''(experimental) Grants permission to get a session status.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetSessionStatus.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetSessionStatus", []))

    @jsii.member(jsii_name="toGetTableMetadata")
    def to_get_table_metadata(self) -> "Athena":
        '''(experimental) Grants permission to get a metadata about a table for a given datacatalog.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetTableMetadata.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetTableMetadata", []))

    @jsii.member(jsii_name="toGetWorkGroup")
    def to_get_work_group(self) -> "Athena":
        '''(experimental) Grants permission to get a workgroup.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_GetWorkGroup.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toGetWorkGroup", []))

    @jsii.member(jsii_name="toImportNotebook")
    def to_import_notebook(self) -> "Athena":
        '''(experimental) Grants permission to import a notebook.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ImportNotebook.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toImportNotebook", []))

    @jsii.member(jsii_name="toListApplicationDPUSizes")
    def to_list_application_dpu_sizes(self) -> "Athena":
        '''(experimental) Grants permission to return a list of ApplicationRuntimeIds.

        Access Level: List

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListApplicationDPUSizes.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListApplicationDPUSizes", []))

    @jsii.member(jsii_name="toListCalculationExecutions")
    def to_list_calculation_executions(self) -> "Athena":
        '''(experimental) Grants permission to return a list of calculation executions.

        Access Level: List

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListCalculationExecutions.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListCalculationExecutions", []))

    @jsii.member(jsii_name="toListDatabases")
    def to_list_databases(self) -> "Athena":
        '''(experimental) Grants permission to return a list of databases for a given datacatalog.

        Access Level: List

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListDatabases.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListDatabases", []))

    @jsii.member(jsii_name="toListDataCatalogs")
    def to_list_data_catalogs(self) -> "Athena":
        '''(experimental) Grants permission to return a list of datacatalogs for the specified AWS account.

        Access Level: List

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListDataCatalogs.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListDataCatalogs", []))

    @jsii.member(jsii_name="toListEngineVersions")
    def to_list_engine_versions(self) -> "Athena":
        '''(experimental) Grants permission to return a list of athena engine versions for the specified AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListEngineVersions.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListEngineVersions", []))

    @jsii.member(jsii_name="toListExecutors")
    def to_list_executors(self) -> "Athena":
        '''(experimental) Grants permission to return a list of executors.

        Access Level: List

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListExecutors.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListExecutors", []))

    @jsii.member(jsii_name="toListNamedQueries")
    def to_list_named_queries(self) -> "Athena":
        '''(experimental) Grants permission to return a list of named queries in Amazon Athena for the specified AWS account.

        Access Level: List

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListNamedQueries.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListNamedQueries", []))

    @jsii.member(jsii_name="toListNotebookMetadata")
    def to_list_notebook_metadata(self) -> "Athena":
        '''(experimental) Grants permission to return a list of notebooks for a given workgroup.

        Access Level: List

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListNotebookMetadata.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListNotebookMetadata", []))

    @jsii.member(jsii_name="toListNotebookSessions")
    def to_list_notebook_sessions(self) -> "Athena":
        '''(experimental) Grants permission to return a list of sessions for a given notebook.

        Access Level: List

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListNotebookSessions.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListNotebookSessions", []))

    @jsii.member(jsii_name="toListPreparedStatements")
    def to_list_prepared_statements(self) -> "Athena":
        '''(experimental) Grants permission to return a list of prepared statements for the specified workgroup.

        Access Level: List

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListPreparedStatements.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListPreparedStatements", []))

    @jsii.member(jsii_name="toListQueryExecutions")
    def to_list_query_executions(self) -> "Athena":
        '''(experimental) Grants permission to return a list of query executions for the specified AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListQueryExecutions.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListQueryExecutions", []))

    @jsii.member(jsii_name="toListSessions")
    def to_list_sessions(self) -> "Athena":
        '''(experimental) Grants permission to return a list of sessions for a given workgroup.

        Access Level: List

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListSessions.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListSessions", []))

    @jsii.member(jsii_name="toListTableMetadata")
    def to_list_table_metadata(self) -> "Athena":
        '''(experimental) Grants permission to return a list of table metadata in a database for a given datacatalog.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListTableMetadata.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListTableMetadata", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Athena":
        '''(experimental) Grants permission to return a list of tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWorkGroups")
    def to_list_work_groups(self) -> "Athena":
        '''(experimental) Grants permission to return a list of workgroups for the specified AWS account.

        Access Level: List

        https://docs.aws.amazon.com/athena/latest/APIReference/API_ListWorkGroups.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toListWorkGroups", []))

    @jsii.member(jsii_name="toStartCalculationExecution")
    def to_start_calculation_execution(self) -> "Athena":
        '''(experimental) Grants permission to start a calculation execution.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_StartCalculationExecution.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toStartCalculationExecution", []))

    @jsii.member(jsii_name="toStartQueryExecution")
    def to_start_query_execution(self) -> "Athena":
        '''(experimental) Grants permission to start a query execution using an SQL query provided as a string.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_StartQueryExecution.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toStartQueryExecution", []))

    @jsii.member(jsii_name="toStartSession")
    def to_start_session(self) -> "Athena":
        '''(experimental) Grants permission to start a session.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_StartSession.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toStartSession", []))

    @jsii.member(jsii_name="toStopCalculationExecution")
    def to_stop_calculation_execution(self) -> "Athena":
        '''(experimental) Grants permission to stop a calculation execution.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_StopCalculationExecution.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toStopCalculationExecution", []))

    @jsii.member(jsii_name="toStopQueryExecution")
    def to_stop_query_execution(self) -> "Athena":
        '''(experimental) Grants permission to stop the specified query execution.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_StopQueryExecution.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toStopQueryExecution", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Athena":
        '''(experimental) Grants permission to add a tag to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/athena/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTerminateSession")
    def to_terminate_session(self) -> "Athena":
        '''(experimental) Grants permission to terminate a session.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_TerminateSession.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toTerminateSession", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Athena":
        '''(experimental) Grants permission to remove a tag from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/athena/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDataCatalog")
    def to_update_data_catalog(self) -> "Athena":
        '''(experimental) Grants permission to update a datacatalog.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_UpdateDataCatalog.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toUpdateDataCatalog", []))

    @jsii.member(jsii_name="toUpdateNamedQuery")
    def to_update_named_query(self) -> "Athena":
        '''(experimental) Grants permission to update a named query specified.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_UpdateNamedQuery.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toUpdateNamedQuery", []))

    @jsii.member(jsii_name="toUpdateNotebook")
    def to_update_notebook(self) -> "Athena":
        '''(experimental) Grants permission to update a notebook.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_UpdateNotebook.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toUpdateNotebook", []))

    @jsii.member(jsii_name="toUpdateNotebookMetadata")
    def to_update_notebook_metadata(self) -> "Athena":
        '''(experimental) Grants permission to update notebook metadata.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_UpdateNotebookMetadata.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toUpdateNotebookMetadata", []))

    @jsii.member(jsii_name="toUpdatePreparedStatement")
    def to_update_prepared_statement(self) -> "Athena":
        '''(experimental) Grants permission to update a prepared statement.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_UpdatePreparedStatement.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toUpdatePreparedStatement", []))

    @jsii.member(jsii_name="toUpdateWorkGroup")
    def to_update_work_group(self) -> "Athena":
        '''(experimental) Grants permission to update a workgroup.

        Access Level: Write

        https://docs.aws.amazon.com/athena/latest/APIReference/API_UpdateWorkGroup.html

        :stability: experimental
        '''
        return typing.cast("Athena", jsii.invoke(self, "toUpdateWorkGroup", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5f214c324ad7e33b477c006f5bbed334ad582d11486c57f0ba5b7edc9e7143fd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8604b861112646539e15078c214413d5b1e040cde5107442d9efe6f958600ac7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Auditmanager(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Auditmanager",
):
    '''(experimental) Statement provider for service `auditmanager <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsauditmanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `auditmanager <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsauditmanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5cef04f403e3f94aef8a1e7b1d8ff52a2dee8ea48389f31759979e617184d428)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAssessment")
    def on_assessment(
        self,
        assessment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Auditmanager":
        '''(experimental) Adds a resource of type assessment to the statement.

        https://docs.aws.amazon.com/audit-manager/latest/userguide/API_Assessment.html

        :param assessment_id: - Identifier for the assessmentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5ad7b0ead2d7c41b7e4dafe55050e7cbe8368a0632ae1718b81062d619ced52d)
            check_type(argname="argument assessment_id", value=assessment_id, expected_type=type_hints["assessment_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Auditmanager", jsii.invoke(self, "onAssessment", [assessment_id, account, region, partition]))

    @jsii.member(jsii_name="onAssessmentControlSet")
    def on_assessment_control_set(
        self,
        assessment_id: builtins.str,
        control_set_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Auditmanager":
        '''(experimental) Adds a resource of type assessmentControlSet to the statement.

        https://docs.aws.amazon.com/audit-manager/latest/userguide/API_AssessmentControlSet.html

        :param assessment_id: - Identifier for the assessmentId.
        :param control_set_id: - Identifier for the controlSetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__68a6c131a91c4a5ca4872411c02136ab7346c500f970fff0f837153f4b431873)
            check_type(argname="argument assessment_id", value=assessment_id, expected_type=type_hints["assessment_id"])
            check_type(argname="argument control_set_id", value=control_set_id, expected_type=type_hints["control_set_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Auditmanager", jsii.invoke(self, "onAssessmentControlSet", [assessment_id, control_set_id, account, region, partition]))

    @jsii.member(jsii_name="onAssessmentFramework")
    def on_assessment_framework(
        self,
        assessment_framework_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Auditmanager":
        '''(experimental) Adds a resource of type assessmentFramework to the statement.

        https://docs.aws.amazon.com/audit-manager/latest/userguide/API_AssessmentFramework.html

        :param assessment_framework_id: - Identifier for the assessmentFrameworkId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3b93ce0c35a4b7d849ded80fba37bceb8d1a24e03080a1daae47e84bbe4e0f4f)
            check_type(argname="argument assessment_framework_id", value=assessment_framework_id, expected_type=type_hints["assessment_framework_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Auditmanager", jsii.invoke(self, "onAssessmentFramework", [assessment_framework_id, account, region, partition]))

    @jsii.member(jsii_name="onControl")
    def on_control(
        self,
        control_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Auditmanager":
        '''(experimental) Adds a resource of type control to the statement.

        https://docs.aws.amazon.com/audit-manager/latest/userguide/API_Control.html

        :param control_id: - Identifier for the controlId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__55ddae23e382dffb72b7fc298dcec1e87ceb0e1b66f8017e441846e658a730e6)
            check_type(argname="argument control_id", value=control_id, expected_type=type_hints["control_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Auditmanager", jsii.invoke(self, "onControl", [control_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateAssessmentReportEvidenceFolder")
    def to_associate_assessment_report_evidence_folder(self) -> "Auditmanager":
        '''(experimental) Grants permission to associate an evidence folder with an assessment report in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_AssociateAssessmentReportEvidenceFolder.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toAssociateAssessmentReportEvidenceFolder", []))

    @jsii.member(jsii_name="toBatchAssociateAssessmentReportEvidence")
    def to_batch_associate_assessment_report_evidence(self) -> "Auditmanager":
        '''(experimental) Grants permission to associate a list of evidence to an assessment report in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_BatchAssociateAssessmentReportEvidence.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toBatchAssociateAssessmentReportEvidence", []))

    @jsii.member(jsii_name="toBatchCreateDelegationByAssessment")
    def to_batch_create_delegation_by_assessment(self) -> "Auditmanager":
        '''(experimental) Grants permission to create delegations for an assessment in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_BatchCreateDelegationByAssessment.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toBatchCreateDelegationByAssessment", []))

    @jsii.member(jsii_name="toBatchDeleteDelegationByAssessment")
    def to_batch_delete_delegation_by_assessment(self) -> "Auditmanager":
        '''(experimental) Grants permission to delete delegations for an assessment in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_BatchDeleteDelegationByAssessment.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toBatchDeleteDelegationByAssessment", []))

    @jsii.member(jsii_name="toBatchDisassociateAssessmentReportEvidence")
    def to_batch_disassociate_assessment_report_evidence(self) -> "Auditmanager":
        '''(experimental) Grants permission to disassociate a list of evidence from an assessment report in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_BatchDisassociateAssessmentReportEvidence.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toBatchDisassociateAssessmentReportEvidence", []))

    @jsii.member(jsii_name="toBatchImportEvidenceToAssessmentControl")
    def to_batch_import_evidence_to_assessment_control(self) -> "Auditmanager":
        '''(experimental) Grants permission to import a list of evidence to an assessment control in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_BatchImportEvidenceToAssessmentControl.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toBatchImportEvidenceToAssessmentControl", []))

    @jsii.member(jsii_name="toCreateAssessment")
    def to_create_assessment(self) -> "Auditmanager":
        '''(experimental) Grants permission to create an assessment to be used with AWS Audit Manager.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_CreateAssessment.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toCreateAssessment", []))

    @jsii.member(jsii_name="toCreateAssessmentFramework")
    def to_create_assessment_framework(self) -> "Auditmanager":
        '''(experimental) Grants permission to create a framework for use in AWS Audit Manager.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_CreateAssessmentFramework.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toCreateAssessmentFramework", []))

    @jsii.member(jsii_name="toCreateAssessmentReport")
    def to_create_assessment_report(self) -> "Auditmanager":
        '''(experimental) Grants permission to create an assessment report in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_CreateAssessmentReport.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toCreateAssessmentReport", []))

    @jsii.member(jsii_name="toCreateControl")
    def to_create_control(self) -> "Auditmanager":
        '''(experimental) Grants permission to create a control to be used in AWS Audit Manager.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_CreateControl.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toCreateControl", []))

    @jsii.member(jsii_name="toDeleteAssessment")
    def to_delete_assessment(self) -> "Auditmanager":
        '''(experimental) Grants permission to delete an assessment in AWS Audit Manager.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_DeleteAssessment.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toDeleteAssessment", []))

    @jsii.member(jsii_name="toDeleteAssessmentFramework")
    def to_delete_assessment_framework(self) -> "Auditmanager":
        '''(experimental) Grants permission to delete an assessment framework in AWS Audit Manager.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_DeleteAssessmentFramework.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toDeleteAssessmentFramework", []))

    @jsii.member(jsii_name="toDeleteAssessmentFrameworkShare")
    def to_delete_assessment_framework_share(self) -> "Auditmanager":
        '''(experimental) Grants permission to delete a share request for a custom framework in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_DeleteAssessmentFrameworkShare.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toDeleteAssessmentFrameworkShare", []))

    @jsii.member(jsii_name="toDeleteAssessmentReport")
    def to_delete_assessment_report(self) -> "Auditmanager":
        '''(experimental) Grants permission to delete an assessment report in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_DeleteAssessmentReport.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toDeleteAssessmentReport", []))

    @jsii.member(jsii_name="toDeleteControl")
    def to_delete_control(self) -> "Auditmanager":
        '''(experimental) Grants permission to delete a control in AWS Audit Manager.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_DeleteControl.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toDeleteControl", []))

    @jsii.member(jsii_name="toDeregisterAccount")
    def to_deregister_account(self) -> "Auditmanager":
        '''(experimental) Grants permission to deregister an account in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ DeregisterAccount.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toDeregisterAccount", []))

    @jsii.member(jsii_name="toDeregisterOrganizationAdminAccount")
    def to_deregister_organization_admin_account(self) -> "Auditmanager":
        '''(experimental) Grants permission to deregister the delegated administrator account for AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_DeregisterOrganizationAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toDeregisterOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toDisassociateAssessmentReportEvidenceFolder")
    def to_disassociate_assessment_report_evidence_folder(self) -> "Auditmanager":
        '''(experimental) Grants permission to disassociate an evidence folder from an assessment report in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_DisassociateAssessmentReportEvidenceFolder.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toDisassociateAssessmentReportEvidenceFolder", []))

    @jsii.member(jsii_name="toGetAccountStatus")
    def to_get_account_status(self) -> "Auditmanager":
        '''(experimental) Grants permission to get the status of an account in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetAccountStatus.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetAccountStatus", []))

    @jsii.member(jsii_name="toGetAssessment")
    def to_get_assessment(self) -> "Auditmanager":
        '''(experimental) Grants permission to get an assessment created in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetAssessment.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetAssessment", []))

    @jsii.member(jsii_name="toGetAssessmentFramework")
    def to_get_assessment_framework(self) -> "Auditmanager":
        '''(experimental) Grants permission to get an assessment framework in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetAssessmentFramework.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetAssessmentFramework", []))

    @jsii.member(jsii_name="toGetAssessmentReportUrl")
    def to_get_assessment_report_url(self) -> "Auditmanager":
        '''(experimental) Grants permission to get the URL for an assessment report in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetAssessmentReportUrl.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetAssessmentReportUrl", []))

    @jsii.member(jsii_name="toGetChangeLogs")
    def to_get_change_logs(self) -> "Auditmanager":
        '''(experimental) Grants permission to get changelogs for an assessment in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetChangeLogs.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetChangeLogs", []))

    @jsii.member(jsii_name="toGetControl")
    def to_get_control(self) -> "Auditmanager":
        '''(experimental) Grants permission to get a control in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetControl.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetControl", []))

    @jsii.member(jsii_name="toGetDelegations")
    def to_get_delegations(self) -> "Auditmanager":
        '''(experimental) Grants permission to get all delegations in AWS Audit Manager.

        Access Level: List

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetDelegations.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetDelegations", []))

    @jsii.member(jsii_name="toGetEvidence")
    def to_get_evidence(self) -> "Auditmanager":
        '''(experimental) Grants permission to get evidence from AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetEvidence.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetEvidence", []))

    @jsii.member(jsii_name="toGetEvidenceByEvidenceFolder")
    def to_get_evidence_by_evidence_folder(self) -> "Auditmanager":
        '''(experimental) Grants permission to get all the evidence from an evidence folder in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetEvidenceByEvidenceFolder.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetEvidenceByEvidenceFolder", []))

    @jsii.member(jsii_name="toGetEvidenceFolder")
    def to_get_evidence_folder(self) -> "Auditmanager":
        '''(experimental) Grants permission to get the evidence folder from AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetEvidenceFolder.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetEvidenceFolder", []))

    @jsii.member(jsii_name="toGetEvidenceFoldersByAssessment")
    def to_get_evidence_folders_by_assessment(self) -> "Auditmanager":
        '''(experimental) Grants permission to get the evidence folders from an assessment in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetEvidenceFoldersByAssessment.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetEvidenceFoldersByAssessment", []))

    @jsii.member(jsii_name="toGetEvidenceFoldersByAssessmentControl")
    def to_get_evidence_folders_by_assessment_control(self) -> "Auditmanager":
        '''(experimental) Grants permission to get the evidence folders from an assessment control in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetEvidenceFoldersByAssessmentControl.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetEvidenceFoldersByAssessmentControl", []))

    @jsii.member(jsii_name="toGetInsights")
    def to_get_insights(self) -> "Auditmanager":
        '''(experimental) Grants permission to get analytics data for all active assessments.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetInsights.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetInsights", []))

    @jsii.member(jsii_name="toGetInsightsByAssessment")
    def to_get_insights_by_assessment(self) -> "Auditmanager":
        '''(experimental) Grants permission to get analytics data for a specific active assessment.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetInsightsByAssessment.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetInsightsByAssessment", []))

    @jsii.member(jsii_name="toGetOrganizationAdminAccount")
    def to_get_organization_admin_account(self) -> "Auditmanager":
        '''(experimental) Grants permission to get the delegated administrator account in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetOrganizationAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toGetServicesInScope")
    def to_get_services_in_scope(self) -> "Auditmanager":
        '''(experimental) Grants permission to get the services in scope for an assessment in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetServicesInScope.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetServicesInScope", []))

    @jsii.member(jsii_name="toGetSettings")
    def to_get_settings(self) -> "Auditmanager":
        '''(experimental) Grants permission to get all settings configured in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_GetSettings.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toGetSettings", []))

    @jsii.member(jsii_name="toListAssessmentControlInsightsByControlDomain")
    def to_list_assessment_control_insights_by_control_domain(self) -> "Auditmanager":
        '''(experimental) Grants permission to list analytics data for controls in a specific control domain and active assessment.

        Access Level: List

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ListAssessmentControlInsightsByControlDomain.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toListAssessmentControlInsightsByControlDomain", []))

    @jsii.member(jsii_name="toListAssessmentFrameworks")
    def to_list_assessment_frameworks(self) -> "Auditmanager":
        '''(experimental) Grants permission to list all assessment frameworks in AWS Audit Manager.

        Access Level: List

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ListAssessmentFrameworks.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toListAssessmentFrameworks", []))

    @jsii.member(jsii_name="toListAssessmentFrameworkShareRequests")
    def to_list_assessment_framework_share_requests(self) -> "Auditmanager":
        '''(experimental) Grants permission to list all sent or received share requests for custom frameworks in AWS Audit Manager.

        Access Level: List

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ListAssessmentFrameworkShareRequests.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toListAssessmentFrameworkShareRequests", []))

    @jsii.member(jsii_name="toListAssessmentReports")
    def to_list_assessment_reports(self) -> "Auditmanager":
        '''(experimental) Grants permission to list all assessment reports in AWS Audit Manager.

        Access Level: List

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ListAssessmentReports.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toListAssessmentReports", []))

    @jsii.member(jsii_name="toListAssessments")
    def to_list_assessments(self) -> "Auditmanager":
        '''(experimental) Grants permission to list all assessments in AWS Audit Manager.

        Access Level: List

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ListAssessments.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toListAssessments", []))

    @jsii.member(jsii_name="toListControlDomainInsights")
    def to_list_control_domain_insights(self) -> "Auditmanager":
        '''(experimental) Grants permission to list analytics data for control domains across all active assessments.

        Access Level: List

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ListControlDomainInsights.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toListControlDomainInsights", []))

    @jsii.member(jsii_name="toListControlDomainInsightsByAssessment")
    def to_list_control_domain_insights_by_assessment(self) -> "Auditmanager":
        '''(experimental) Grants permission to list analytics data for control domains in a specific active assessment.

        Access Level: List

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ListControlDomainInsightsByAssessment.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toListControlDomainInsightsByAssessment", []))

    @jsii.member(jsii_name="toListControlInsightsByControlDomain")
    def to_list_control_insights_by_control_domain(self) -> "Auditmanager":
        '''(experimental) Grants permission to list analytics data for controls in a specific control domain across all active assessments.

        Access Level: List

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ListControlInsightsByControlDomain.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toListControlInsightsByControlDomain", []))

    @jsii.member(jsii_name="toListControls")
    def to_list_controls(self) -> "Auditmanager":
        '''(experimental) Grants permission to list all controls in AWS Audit Manager.

        Access Level: List

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ListControls.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toListControls", []))

    @jsii.member(jsii_name="toListKeywordsForDataSource")
    def to_list_keywords_for_data_source(self) -> "Auditmanager":
        '''(experimental) Grants permission to list all the data source keywords in AWS Audit Manager.

        Access Level: List

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ListKeywordsForDataSource.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toListKeywordsForDataSource", []))

    @jsii.member(jsii_name="toListNotifications")
    def to_list_notifications(self) -> "Auditmanager":
        '''(experimental) Grants permission to list all notifications in AWS Audit Manager.

        Access Level: List

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ListNotifications.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toListNotifications", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Auditmanager":
        '''(experimental) Grants permission to list tags for an AWS Audit Manager resource.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRegisterAccount")
    def to_register_account(self) -> "Auditmanager":
        '''(experimental) Grants permission to register an account in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_RegisterAccount.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toRegisterAccount", []))

    @jsii.member(jsii_name="toRegisterOrganizationAdminAccount")
    def to_register_organization_admin_account(self) -> "Auditmanager":
        '''(experimental) Grants permission to register an account within the organization as the delegated administrator for AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_RegisterOrganizationAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toRegisterOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toStartAssessmentFrameworkShare")
    def to_start_assessment_framework_share(self) -> "Auditmanager":
        '''(experimental) Grants permission to create a share request for a custom framework in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_StartAssessmentFrameworkShare.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toStartAssessmentFrameworkShare", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Auditmanager":
        '''(experimental) Grants permission to tag an AWS Audit Manager resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Auditmanager":
        '''(experimental) Grants permission to untag an AWS Audit Manager resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAssessment")
    def to_update_assessment(self) -> "Auditmanager":
        '''(experimental) Grants permission to update an assessment in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_UpdateAssessment.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toUpdateAssessment", []))

    @jsii.member(jsii_name="toUpdateAssessmentControl")
    def to_update_assessment_control(self) -> "Auditmanager":
        '''(experimental) Grants permission to update an assessment control in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_UpdateAssessmentControl.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toUpdateAssessmentControl", []))

    @jsii.member(jsii_name="toUpdateAssessmentControlSetStatus")
    def to_update_assessment_control_set_status(self) -> "Auditmanager":
        '''(experimental) Grants permission to update the status of an assessment control set in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_UpdateAssessmentControlSetStatus.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toUpdateAssessmentControlSetStatus", []))

    @jsii.member(jsii_name="toUpdateAssessmentFramework")
    def to_update_assessment_framework(self) -> "Auditmanager":
        '''(experimental) Grants permission to update an assessment framework in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_UpdateAssessmentFramework.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toUpdateAssessmentFramework", []))

    @jsii.member(jsii_name="toUpdateAssessmentFrameworkShare")
    def to_update_assessment_framework_share(self) -> "Auditmanager":
        '''(experimental) Grants permission to update a share request for a custom framework in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_UpdateAssessmentFrameworkShare.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toUpdateAssessmentFrameworkShare", []))

    @jsii.member(jsii_name="toUpdateAssessmentStatus")
    def to_update_assessment_status(self) -> "Auditmanager":
        '''(experimental) Grants permission to update the status of an assessment in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_UpdateAssessmentStatus.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toUpdateAssessmentStatus", []))

    @jsii.member(jsii_name="toUpdateControl")
    def to_update_control(self) -> "Auditmanager":
        '''(experimental) Grants permission to update a control in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_UpdateControl.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toUpdateControl", []))

    @jsii.member(jsii_name="toUpdateSettings")
    def to_update_settings(self) -> "Auditmanager":
        '''(experimental) Grants permission to update settings in AWS Audit Manager.

        Access Level: Write

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_UpdateSettings.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toUpdateSettings", []))

    @jsii.member(jsii_name="toValidateAssessmentReportIntegrity")
    def to_validate_assessment_report_integrity(self) -> "Auditmanager":
        '''(experimental) Grants permission to validate the integrity of an assessment report in AWS Audit Manager.

        Access Level: Read

        https://docs.aws.amazon.com/audit-manager/latest/APIReference/API_ValidateAssessmentReportIntegrity.html

        :stability: experimental
        '''
        return typing.cast("Auditmanager", jsii.invoke(self, "toValidateAssessmentReportIntegrity", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__97617f251a3edc56414c776426ea69d196cfd8e3e0f5201e371ac4869d96ad32)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c9cbb5829409d2ffc9141160d2a461e83b7bc43226ed548e90b81b1feeafee57)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Autoscaling(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Autoscaling",
):
    '''(experimental) Statement provider for service `autoscaling <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2autoscaling.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `autoscaling <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2autoscaling.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__58b5cca4c83ffc80b86d397b6dd576e1d4726837c02aa894c505b0bb86f77bff)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifImageId")
    def if_image_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) Filters access based on the AMI ID for the launch configuration.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateLaunchConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c7c26d8cadf257c43c38c2d436422f4d199044377c4262b02fd12f128bf3539d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Autoscaling", jsii.invoke(self, "ifImageId", [value, operator]))

    @jsii.member(jsii_name="ifInstanceType")
    def if_instance_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) Filters access based on the instance type for the launch configuration.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateLaunchConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__57ae7c28319fc9cbb27ef04259a321ab9e263d2eaba2f68e2e24dbef86ffcf1b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Autoscaling", jsii.invoke(self, "ifInstanceType", [value, operator]))

    @jsii.member(jsii_name="ifInstanceTypes")
    def if_instance_types(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) Filters access based on the instance types present as overrides to a launch template for a mixed instances policy.

        Use it to qualify which instance types can be explicitly defined in the policy

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateAutoScalingGroup()
        - .toUpdateAutoScalingGroup()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cb23f6926842b11dd49a4ebf9a24616e08adf76cf68be33e81582c35c609817f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Autoscaling", jsii.invoke(self, "ifInstanceTypes", [value, operator]))

    @jsii.member(jsii_name="ifLaunchConfigurationName")
    def if_launch_configuration_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) Filters access based on the name of a launch configuration.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateAutoScalingGroup()
        - .toUpdateAutoScalingGroup()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e7d2e68f765b33413671fa4683322bad2e2892f03cd29f8c8cff5a83ea7efb41)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Autoscaling", jsii.invoke(self, "ifLaunchConfigurationName", [value, operator]))

    @jsii.member(jsii_name="ifLaunchTemplateVersionSpecified")
    def if_launch_template_version_specified(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Autoscaling":
        '''(experimental) Filters access based on whether users can specify any version of a launch template or only the Latest or Default version.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateAutoScalingGroup()
        - .toUpdateAutoScalingGroup()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f72d700757d8550f3722ddae604248f197c06c158ac1ced61f63dcc5ad32f98c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Autoscaling", jsii.invoke(self, "ifLaunchTemplateVersionSpecified", [value]))

    @jsii.member(jsii_name="ifLoadBalancerNames")
    def if_load_balancer_names(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) Filters access based on the name of the load balancer.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toAttachLoadBalancers()
        - .toCreateAutoScalingGroup()
        - .toDetachLoadBalancers()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b0d5a7fbd117b68dd7b3a6ba8fb12597fb95b962d385a597826f03179fa15765)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Autoscaling", jsii.invoke(self, "ifLoadBalancerNames", [value, operator]))

    @jsii.member(jsii_name="ifMaxSize")
    def if_max_size(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) Filters access based on the maximum scaling size in the request.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateAutoScalingGroup()
        - .toPutScheduledUpdateGroupAction()
        - .toUpdateAutoScalingGroup()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1cd3623c5544f05330fafaaa1457fc976172d239eed29a11298e71b3ecb42c54)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Autoscaling", jsii.invoke(self, "ifMaxSize", [value, operator]))

    @jsii.member(jsii_name="ifMetadataHttpEndpoint")
    def if_metadata_http_endpoint(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) Filters access based on whether the HTTP endpoint is enabled for the instance metadata service.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateLaunchConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__458d5d7a45c9a321ca8945e4e498ac3417cf893cc4e9ec95b821658256e22ccb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Autoscaling", jsii.invoke(self, "ifMetadataHttpEndpoint", [value, operator]))

    @jsii.member(jsii_name="ifMetadataHttpPutResponseHopLimit")
    def if_metadata_http_put_response_hop_limit(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) Filters access based on the allowed number of hops when calling the instance metadata service.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateLaunchConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4abd3af99bd2196f02d0df71ccc665076758975680ec480f8039c64092fa06db)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Autoscaling", jsii.invoke(self, "ifMetadataHttpPutResponseHopLimit", [value, operator]))

    @jsii.member(jsii_name="ifMetadataHttpTokens")
    def if_metadata_http_tokens(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) Filters access based on whether tokens are required when calling the instance metadata service (optional or required).

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateLaunchConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5028f940de5966da584a9756f42f0a94aba2d22828e34bfc444d14a0b2a1db1b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Autoscaling", jsii.invoke(self, "ifMetadataHttpTokens", [value, operator]))

    @jsii.member(jsii_name="ifMinSize")
    def if_min_size(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) Filters access based on the minimum scaling size in the request.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateAutoScalingGroup()
        - .toPutScheduledUpdateGroupAction()
        - .toUpdateAutoScalingGroup()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__356f9f5e76928ff5b070d6ddc8b9257ed57ad55f88a6ecd809a406d0f8ab2c06)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Autoscaling", jsii.invoke(self, "ifMinSize", [value, operator]))

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) Filters access based on the tags associated with the resource.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toAttachInstances()
        - .toAttachLoadBalancerTargetGroups()
        - .toAttachLoadBalancers()
        - .toAttachTrafficSources()
        - .toBatchDeleteScheduledAction()
        - .toBatchPutScheduledUpdateGroupAction()
        - .toCancelInstanceRefresh()
        - .toCompleteLifecycleAction()
        - .toCreateAutoScalingGroup()
        - .toCreateOrUpdateTags()
        - .toDeleteAutoScalingGroup()
        - .toDeleteLifecycleHook()
        - .toDeleteNotificationConfiguration()
        - .toDeletePolicy()
        - .toDeleteScheduledAction()
        - .toDeleteTags()
        - .toDeleteWarmPool()
        - .toDetachInstances()
        - .toDetachLoadBalancerTargetGroups()
        - .toDetachLoadBalancers()
        - .toDetachTrafficSources()
        - .toDisableMetricsCollection()
        - .toEnableMetricsCollection()
        - .toEnterStandby()
        - .toExecutePolicy()
        - .toExitStandby()
        - .toPutLifecycleHook()
        - .toPutNotificationConfiguration()
        - .toPutScalingPolicy()
        - .toPutScheduledUpdateGroupAction()
        - .toPutWarmPool()
        - .toRecordLifecycleActionHeartbeat()
        - .toResumeProcesses()
        - .toRollbackInstanceRefresh()
        - .toSetDesiredCapacity()
        - .toSetInstanceHealth()
        - .toSetInstanceProtection()
        - .toStartInstanceRefresh()
        - .toSuspendProcesses()
        - .toTerminateInstanceInAutoScalingGroup()
        - .toUpdateAutoScalingGroup()

        Applies to resource types:

        - autoScalingGroup

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e8ccf74d4b465a1cda2abf804ab8a4dddc7d7900e12f1c2cfda068e4099bb681)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Autoscaling", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifSpotPrice")
    def if_spot_price(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) Filters access based on the price for Spot Instances for the launch configuration.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateLaunchConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__181fe1dec77e87606f53d99152315e28597ea993f5684d8eca19500d0444e0bd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Autoscaling", jsii.invoke(self, "ifSpotPrice", [value, operator]))

    @jsii.member(jsii_name="ifTargetGroupARNs")
    def if_target_group_ar_ns(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) Filters access based on the ARN of a target group.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toAttachLoadBalancerTargetGroups()
        - .toCreateAutoScalingGroup()
        - .toDetachLoadBalancerTargetGroups()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d59244e138babe9ff1e0662c23aaf5d8925acf240246649428ca74b8235400a4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Autoscaling", jsii.invoke(self, "ifTargetGroupARNs", [value, operator]))

    @jsii.member(jsii_name="ifTrafficSourceIdentifiers")
    def if_traffic_source_identifiers(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) Filters access based on the identifiers of the traffic sources.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toAttachTrafficSources()
        - .toCreateAutoScalingGroup()
        - .toDetachTrafficSources()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b5be7d341f11150dfaf9f3f6e381022f47a1a1474c124f50bae8387a38f5e172)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Autoscaling", jsii.invoke(self, "ifTrafficSourceIdentifiers", [value, operator]))

    @jsii.member(jsii_name="ifVPCZoneIdentifiers")
    def if_vpc_zone_identifiers(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Autoscaling":
        '''(experimental) Filters access based on the identifier of a VPC zone.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-condition-keys

        Applies to actions:

        - .toCreateAutoScalingGroup()
        - .toUpdateAutoScalingGroup()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f3cb966818eeb22f5391fbfa2e497465cc7129fc65afcee358bdfd743742e39e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Autoscaling", jsii.invoke(self, "ifVPCZoneIdentifiers", [value, operator]))

    @jsii.member(jsii_name="onAutoScalingGroup")
    def on_auto_scaling_group(
        self,
        group_id: builtins.str,
        group_friendly_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Autoscaling":
        '''(experimental) Adds a resource of type autoScalingGroup to the statement.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources

        :param group_id: - Identifier for the groupId.
        :param group_friendly_name: - Identifier for the groupFriendlyName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifResourceTag() - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ba6e3c4631a6a51b49ef434e232aba65c9e587f4601c462a1c599904222a3f21)
            check_type(argname="argument group_id", value=group_id, expected_type=type_hints["group_id"])
            check_type(argname="argument group_friendly_name", value=group_friendly_name, expected_type=type_hints["group_friendly_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Autoscaling", jsii.invoke(self, "onAutoScalingGroup", [group_id, group_friendly_name, account, region, partition]))

    @jsii.member(jsii_name="onLaunchConfiguration")
    def on_launch_configuration(
        self,
        id: builtins.str,
        launch_configuration_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Autoscaling":
        '''(experimental) Adds a resource of type launchConfiguration to the statement.

        https://docs.aws.amazon.com/autoscaling/latest/userguide/control-access-using-iam.html#policy-auto-scaling-resources

        :param id: - Identifier for the id.
        :param launch_configuration_name: - Identifier for the launchConfigurationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b647a3c5a897f0aab8ac63fee08cff082b962ceb52e765e226292b91c150f7a7)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument launch_configuration_name", value=launch_configuration_name, expected_type=type_hints["launch_configuration_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Autoscaling", jsii.invoke(self, "onLaunchConfiguration", [id, launch_configuration_name, account, region, partition]))

    @jsii.member(jsii_name="toAttachInstances")
    def to_attach_instances(self) -> "Autoscaling":
        '''(experimental) Grants permission to attach one or more EC2 instances to the specified Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_AttachInstances.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toAttachInstances", []))

    @jsii.member(jsii_name="toAttachLoadBalancers")
    def to_attach_load_balancers(self) -> "Autoscaling":
        '''(experimental) Grants permission to attach one or more load balancers to the specified Auto Scaling group.

        Access Level: Write

        Possible conditions:

        - .ifLoadBalancerNames()

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_AttachLoadBalancers.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toAttachLoadBalancers", []))

    @jsii.member(jsii_name="toAttachLoadBalancerTargetGroups")
    def to_attach_load_balancer_target_groups(self) -> "Autoscaling":
        '''(experimental) Grants permission to attach one or more target groups to the specified Auto Scaling group.

        Access Level: Write

        Possible conditions:

        - .ifTargetGroupARNs()

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_AttachLoadBalancerTargetGroups.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toAttachLoadBalancerTargetGroups", []))

    @jsii.member(jsii_name="toAttachTrafficSources")
    def to_attach_traffic_sources(self) -> "Autoscaling":
        '''(experimental) Grants permission to attach one or more traffic sources to an Auto Scaling group.

        Access Level: Write

        Possible conditions:

        - .ifTrafficSourceIdentifiers()

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_AttachTrafficSources.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toAttachTrafficSources", []))

    @jsii.member(jsii_name="toBatchDeleteScheduledAction")
    def to_batch_delete_scheduled_action(self) -> "Autoscaling":
        '''(experimental) Grants permission to delete the specified scheduled actions.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_BatchDeleteScheduledAction.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toBatchDeleteScheduledAction", []))

    @jsii.member(jsii_name="toBatchPutScheduledUpdateGroupAction")
    def to_batch_put_scheduled_update_group_action(self) -> "Autoscaling":
        '''(experimental) Grants permission to create or update multiple scheduled scaling actions for an Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_BatchPutScheduledUpdateGroupAction.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toBatchPutScheduledUpdateGroupAction", []))

    @jsii.member(jsii_name="toCancelInstanceRefresh")
    def to_cancel_instance_refresh(self) -> "Autoscaling":
        '''(experimental) Grants permission to cancel an instance refresh operation in progress.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_CancelInstanceRefresh.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toCancelInstanceRefresh", []))

    @jsii.member(jsii_name="toCompleteLifecycleAction")
    def to_complete_lifecycle_action(self) -> "Autoscaling":
        '''(experimental) Grants permission to complete the lifecycle action for the specified token or instance with the specified result.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_CompleteLifecycleAction.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toCompleteLifecycleAction", []))

    @jsii.member(jsii_name="toCreateAutoScalingGroup")
    def to_create_auto_scaling_group(self) -> "Autoscaling":
        '''(experimental) Grants permission to create an Auto Scaling group with the specified name and attributes.

        Access Level: Write

        Possible conditions:

        - .ifInstanceTypes()
        - .ifLaunchConfigurationName()
        - .ifLaunchTemplateVersionSpecified()
        - .ifLoadBalancerNames()
        - .ifMaxSize()
        - .ifMinSize()
        - .ifTargetGroupARNs()
        - .ifTrafficSourceIdentifiers()
        - .ifVPCZoneIdentifiers()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - iam:PassRole

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_CreateAutoScalingGroup.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toCreateAutoScalingGroup", []))

    @jsii.member(jsii_name="toCreateLaunchConfiguration")
    def to_create_launch_configuration(self) -> "Autoscaling":
        '''(experimental) Grants permission to create a launch configuration.

        Access Level: Write

        Possible conditions:

        - .ifImageId()
        - .ifInstanceType()
        - .ifSpotPrice()
        - .ifMetadataHttpTokens()
        - .ifMetadataHttpPutResponseHopLimit()
        - .ifMetadataHttpEndpoint()

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_CreateLaunchConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toCreateLaunchConfiguration", []))

    @jsii.member(jsii_name="toCreateOrUpdateTags")
    def to_create_or_update_tags(self) -> "Autoscaling":
        '''(experimental) Grants permission to create or update tags for the specified Auto Scaling group.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_CreateOrUpdateTags.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toCreateOrUpdateTags", []))

    @jsii.member(jsii_name="toDeleteAutoScalingGroup")
    def to_delete_auto_scaling_group(self) -> "Autoscaling":
        '''(experimental) Grants permission to delete the specified Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DeleteAutoScalingGroup.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDeleteAutoScalingGroup", []))

    @jsii.member(jsii_name="toDeleteLaunchConfiguration")
    def to_delete_launch_configuration(self) -> "Autoscaling":
        '''(experimental) Grants permission to delete the specified launch configuration.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DeleteLaunchConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDeleteLaunchConfiguration", []))

    @jsii.member(jsii_name="toDeleteLifecycleHook")
    def to_delete_lifecycle_hook(self) -> "Autoscaling":
        '''(experimental) Grants permission to deletes the specified lifecycle hook.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DeleteLifecycleHook.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDeleteLifecycleHook", []))

    @jsii.member(jsii_name="toDeleteNotificationConfiguration")
    def to_delete_notification_configuration(self) -> "Autoscaling":
        '''(experimental) Grants permission to delete the specified notification.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DeleteNotificationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDeleteNotificationConfiguration", []))

    @jsii.member(jsii_name="toDeletePolicy")
    def to_delete_policy(self) -> "Autoscaling":
        '''(experimental) Grants permission to delete the specified Auto Scaling policy.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DeletePolicy.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDeletePolicy", []))

    @jsii.member(jsii_name="toDeleteScheduledAction")
    def to_delete_scheduled_action(self) -> "Autoscaling":
        '''(experimental) Grants permission to delete the specified scheduled action.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DeleteScheduledAction.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDeleteScheduledAction", []))

    @jsii.member(jsii_name="toDeleteTags")
    def to_delete_tags(self) -> "Autoscaling":
        '''(experimental) Grants permission to delete the specified tags.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DeleteTags.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDeleteTags", []))

    @jsii.member(jsii_name="toDeleteWarmPool")
    def to_delete_warm_pool(self) -> "Autoscaling":
        '''(experimental) Grants permission to delete the warm pool associated with the Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DeleteWarmPool.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDeleteWarmPool", []))

    @jsii.member(jsii_name="toDescribeAccountLimits")
    def to_describe_account_limits(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe the current Auto Scaling resource limits for your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeAccountLimits.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeAccountLimits", []))

    @jsii.member(jsii_name="toDescribeAdjustmentTypes")
    def to_describe_adjustment_types(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe the policy adjustment types for use with PutScalingPolicy.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeAdjustmentTypes.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeAdjustmentTypes", []))

    @jsii.member(jsii_name="toDescribeAutoScalingGroups")
    def to_describe_auto_scaling_groups(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe one or more Auto Scaling groups.

        If a list of names is not provided, the call describes all Auto Scaling groups

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeAutoScalingGroups.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeAutoScalingGroups", []))

    @jsii.member(jsii_name="toDescribeAutoScalingInstances")
    def to_describe_auto_scaling_instances(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe one or more Auto Scaling instances.

        If a list is not provided, the call describes all instances

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeAutoScalingInstances.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeAutoScalingInstances", []))

    @jsii.member(jsii_name="toDescribeAutoScalingNotificationTypes")
    def to_describe_auto_scaling_notification_types(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe the notification types that are supported by Auto Scaling.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeAutoScalingNotificationTypes.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeAutoScalingNotificationTypes", []))

    @jsii.member(jsii_name="toDescribeInstanceRefreshes")
    def to_describe_instance_refreshes(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe one or more instance refreshes for an Auto Scaling group.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeInstanceRefreshes.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeInstanceRefreshes", []))

    @jsii.member(jsii_name="toDescribeLaunchConfigurations")
    def to_describe_launch_configurations(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe one or more launch configurations.

        If you omit the list of names, then the call describes all launch configurations

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeLaunchConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeLaunchConfigurations", []))

    @jsii.member(jsii_name="toDescribeLifecycleHooks")
    def to_describe_lifecycle_hooks(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe the lifecycle hooks for the specified Auto Scaling group.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeLifecycleHooks.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeLifecycleHooks", []))

    @jsii.member(jsii_name="toDescribeLifecycleHookTypes")
    def to_describe_lifecycle_hook_types(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe the available types of lifecycle hooks.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeLifecycleHookTypes.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeLifecycleHookTypes", []))

    @jsii.member(jsii_name="toDescribeLoadBalancers")
    def to_describe_load_balancers(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe the load balancers for the specified Auto Scaling group.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeLoadBalancers.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeLoadBalancers", []))

    @jsii.member(jsii_name="toDescribeLoadBalancerTargetGroups")
    def to_describe_load_balancer_target_groups(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe the target groups for the specified Auto Scaling group.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeLoadBalancerTargetGroups.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeLoadBalancerTargetGroups", []))

    @jsii.member(jsii_name="toDescribeMetricCollectionTypes")
    def to_describe_metric_collection_types(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe the available CloudWatch metrics for Auto Scaling.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeMetricCollectionTypes.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeMetricCollectionTypes", []))

    @jsii.member(jsii_name="toDescribeNotificationConfigurations")
    def to_describe_notification_configurations(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe the notification actions associated with the specified Auto Scaling group.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeNotificationConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeNotificationConfigurations", []))

    @jsii.member(jsii_name="toDescribePolicies")
    def to_describe_policies(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe the policies for the specified Auto Scaling group.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribePolicies.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribePolicies", []))

    @jsii.member(jsii_name="toDescribeScalingActivities")
    def to_describe_scaling_activities(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe one or more scaling activities for the specified Auto Scaling group.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeScalingActivities.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeScalingActivities", []))

    @jsii.member(jsii_name="toDescribeScalingProcessTypes")
    def to_describe_scaling_process_types(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe the scaling process types for use with ResumeProcesses and SuspendProcesses.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeScalingProcessTypes.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeScalingProcessTypes", []))

    @jsii.member(jsii_name="toDescribeScheduledActions")
    def to_describe_scheduled_actions(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe the actions scheduled for your Auto Scaling group that haven't run.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeScheduledActions.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeScheduledActions", []))

    @jsii.member(jsii_name="toDescribeTags")
    def to_describe_tags(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe the specified tags.

        Access Level: Read

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeTags.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeTags", []))

    @jsii.member(jsii_name="toDescribeTerminationPolicyTypes")
    def to_describe_termination_policy_types(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe the termination policies supported by Auto Scaling.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeTerminationPolicyTypes.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeTerminationPolicyTypes", []))

    @jsii.member(jsii_name="toDescribeTrafficSources")
    def to_describe_traffic_sources(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe the target groups for the specified Auto Scaling group.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeTrafficSources.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeTrafficSources", []))

    @jsii.member(jsii_name="toDescribeWarmPool")
    def to_describe_warm_pool(self) -> "Autoscaling":
        '''(experimental) Grants permission to describe the warm pool associated with the Auto Scaling group.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DescribeWarmPool.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDescribeWarmPool", []))

    @jsii.member(jsii_name="toDetachInstances")
    def to_detach_instances(self) -> "Autoscaling":
        '''(experimental) Grants permission to remove one or more instances from the specified Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DetachInstances.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDetachInstances", []))

    @jsii.member(jsii_name="toDetachLoadBalancers")
    def to_detach_load_balancers(self) -> "Autoscaling":
        '''(experimental) Grants permission to remove one or more load balancers from the specified Auto Scaling group.

        Access Level: Write

        Possible conditions:

        - .ifLoadBalancerNames()

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DetachLoadBalancers.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDetachLoadBalancers", []))

    @jsii.member(jsii_name="toDetachLoadBalancerTargetGroups")
    def to_detach_load_balancer_target_groups(self) -> "Autoscaling":
        '''(experimental) Grants permission to detach one or more target groups from the specified Auto Scaling group.

        Access Level: Write

        Possible conditions:

        - .ifTargetGroupARNs()

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DetachLoadBalancerTargetGroups.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDetachLoadBalancerTargetGroups", []))

    @jsii.member(jsii_name="toDetachTrafficSources")
    def to_detach_traffic_sources(self) -> "Autoscaling":
        '''(experimental) Grants permission to detach one or more traffic sources from an Auto Scaling group.

        Access Level: Write

        Possible conditions:

        - .ifTrafficSourceIdentifiers()

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DetachTrafficSources.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDetachTrafficSources", []))

    @jsii.member(jsii_name="toDisableMetricsCollection")
    def to_disable_metrics_collection(self) -> "Autoscaling":
        '''(experimental) Grants permission to disable monitoring of the specified metrics for the specified Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_DisableMetricsCollection.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toDisableMetricsCollection", []))

    @jsii.member(jsii_name="toEnableMetricsCollection")
    def to_enable_metrics_collection(self) -> "Autoscaling":
        '''(experimental) Grants permission to enable monitoring of the specified metrics for the specified Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_EnableMetricsCollection.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toEnableMetricsCollection", []))

    @jsii.member(jsii_name="toEnterStandby")
    def to_enter_standby(self) -> "Autoscaling":
        '''(experimental) Grants permission to move the specified instances into Standby mode.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_EnterStandby.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toEnterStandby", []))

    @jsii.member(jsii_name="toExecutePolicy")
    def to_execute_policy(self) -> "Autoscaling":
        '''(experimental) Grants permission to execute the specified policy.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_ExecutePolicy.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toExecutePolicy", []))

    @jsii.member(jsii_name="toExitStandby")
    def to_exit_standby(self) -> "Autoscaling":
        '''(experimental) Grants permission to move the specified instances out of Standby mode.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_ExitStandby.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toExitStandby", []))

    @jsii.member(jsii_name="toGetPredictiveScalingForecast")
    def to_get_predictive_scaling_forecast(self) -> "Autoscaling":
        '''(experimental) Grants permission to retrieve the forecast data for a predictive scaling policy.

        Access Level: List

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_GetPredictiveScalingForecast.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toGetPredictiveScalingForecast", []))

    @jsii.member(jsii_name="toPutLifecycleHook")
    def to_put_lifecycle_hook(self) -> "Autoscaling":
        '''(experimental) Grants permission to create or update a lifecycle hook for the specified Auto Scaling Group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_PutLifecycleHook.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toPutLifecycleHook", []))

    @jsii.member(jsii_name="toPutNotificationConfiguration")
    def to_put_notification_configuration(self) -> "Autoscaling":
        '''(experimental) Grants permission to configure an Auto Scaling group to send notifications when specified events take place.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_PutNotificationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toPutNotificationConfiguration", []))

    @jsii.member(jsii_name="toPutScalingPolicy")
    def to_put_scaling_policy(self) -> "Autoscaling":
        '''(experimental) Grants permission to create or update a policy for an Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_PutScalingPolicy.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toPutScalingPolicy", []))

    @jsii.member(jsii_name="toPutScheduledUpdateGroupAction")
    def to_put_scheduled_update_group_action(self) -> "Autoscaling":
        '''(experimental) Grants permission to create or update a scheduled scaling action for an Auto Scaling group.

        Access Level: Write

        Possible conditions:

        - .ifMaxSize()
        - .ifMinSize()

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_PutScheduledUpdateGroupAction.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toPutScheduledUpdateGroupAction", []))

    @jsii.member(jsii_name="toPutWarmPool")
    def to_put_warm_pool(self) -> "Autoscaling":
        '''(experimental) Grants permission to create or update the warm pool associated with the specified Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_PutWarmPool.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toPutWarmPool", []))

    @jsii.member(jsii_name="toRecordLifecycleActionHeartbeat")
    def to_record_lifecycle_action_heartbeat(self) -> "Autoscaling":
        '''(experimental) Grants permission to record a heartbeat for the lifecycle action associated with the specified token or instance.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_RecordLifecycleActionHeartbeat.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toRecordLifecycleActionHeartbeat", []))

    @jsii.member(jsii_name="toResumeProcesses")
    def to_resume_processes(self) -> "Autoscaling":
        '''(experimental) Grants permission to resume the specified suspended Auto Scaling processes, or all suspended process, for the specified Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_ResumeProcesses.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toResumeProcesses", []))

    @jsii.member(jsii_name="toRollbackInstanceRefresh")
    def to_rollback_instance_refresh(self) -> "Autoscaling":
        '''(experimental) Grants permission to rollback an instance refresh operation in progress.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_RollbackInstanceRefresh.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toRollbackInstanceRefresh", []))

    @jsii.member(jsii_name="toSetDesiredCapacity")
    def to_set_desired_capacity(self) -> "Autoscaling":
        '''(experimental) Grants permission to set the size of the specified Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_SetDesiredCapacity.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toSetDesiredCapacity", []))

    @jsii.member(jsii_name="toSetInstanceHealth")
    def to_set_instance_health(self) -> "Autoscaling":
        '''(experimental) Grants permission to set the health status of the specified instance.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_SetInstanceHealth.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toSetInstanceHealth", []))

    @jsii.member(jsii_name="toSetInstanceProtection")
    def to_set_instance_protection(self) -> "Autoscaling":
        '''(experimental) Grants permission to update the instance protection settings of the specified instances.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_SetInstanceProtection.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toSetInstanceProtection", []))

    @jsii.member(jsii_name="toStartInstanceRefresh")
    def to_start_instance_refresh(self) -> "Autoscaling":
        '''(experimental) Grants permission to start a new instance refresh operation.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_StartInstanceRefresh.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toStartInstanceRefresh", []))

    @jsii.member(jsii_name="toSuspendProcesses")
    def to_suspend_processes(self) -> "Autoscaling":
        '''(experimental) Grants permission to suspend the specified Auto Scaling processes, or all processes, for the specified Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_SuspendProcesses.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toSuspendProcesses", []))

    @jsii.member(jsii_name="toTerminateInstanceInAutoScalingGroup")
    def to_terminate_instance_in_auto_scaling_group(self) -> "Autoscaling":
        '''(experimental) Grants permission to terminate the specified instance and optionally adjust the desired group size.

        Access Level: Write

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_TerminateInstanceInAutoScalingGroup.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toTerminateInstanceInAutoScalingGroup", []))

    @jsii.member(jsii_name="toUpdateAutoScalingGroup")
    def to_update_auto_scaling_group(self) -> "Autoscaling":
        '''(experimental) Grants permission to update the configuration for the specified Auto Scaling group.

        Access Level: Write

        Possible conditions:

        - .ifInstanceTypes()
        - .ifLaunchConfigurationName()
        - .ifLaunchTemplateVersionSpecified()
        - .ifMaxSize()
        - .ifMinSize()
        - .ifVPCZoneIdentifiers()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AutoScaling/latest/APIReference/API_UpdateAutoScalingGroup.html

        :stability: experimental
        '''
        return typing.cast("Autoscaling", jsii.invoke(self, "toUpdateAutoScalingGroup", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cb2a69f50c115881b2767868c2d77e13acd67bb496645da0f6a5f4a5847bbcab)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4c9a5969626df89a5fee4191d07bc1e953ed632905bd1c5fb9da1b494c9a0bd3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class AutoscalingPlans(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AutoscalingPlans",
):
    '''(experimental) Statement provider for service `autoscaling-plans <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsautoscaling.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `autoscaling-plans <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsautoscaling.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9f20dbc820c26515998e7f65ca5d61e54c6818029084784210ebe83882e24d61)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toCreateScalingPlan")
    def to_create_scaling_plan(self) -> "AutoscalingPlans":
        '''(experimental) Creates a scaling plan.

        Access Level: Write

        https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_CreateScalingPlan.html

        :stability: experimental
        '''
        return typing.cast("AutoscalingPlans", jsii.invoke(self, "toCreateScalingPlan", []))

    @jsii.member(jsii_name="toDeleteScalingPlan")
    def to_delete_scaling_plan(self) -> "AutoscalingPlans":
        '''(experimental) Deletes the specified scaling plan.

        Access Level: Write

        https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_DeleteScalingPlan.html

        :stability: experimental
        '''
        return typing.cast("AutoscalingPlans", jsii.invoke(self, "toDeleteScalingPlan", []))

    @jsii.member(jsii_name="toDescribeScalingPlanResources")
    def to_describe_scaling_plan_resources(self) -> "AutoscalingPlans":
        '''(experimental) Describes the scalable resources in the specified scaling plan.

        Access Level: Read

        https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_DescribeScalingPlanResources.html

        :stability: experimental
        '''
        return typing.cast("AutoscalingPlans", jsii.invoke(self, "toDescribeScalingPlanResources", []))

    @jsii.member(jsii_name="toDescribeScalingPlans")
    def to_describe_scaling_plans(self) -> "AutoscalingPlans":
        '''(experimental) Describes the specified scaling plans or all of your scaling plans.

        Access Level: Read

        https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_DescribeScalingPlans.html

        :stability: experimental
        '''
        return typing.cast("AutoscalingPlans", jsii.invoke(self, "toDescribeScalingPlans", []))

    @jsii.member(jsii_name="toGetScalingPlanResourceForecastData")
    def to_get_scaling_plan_resource_forecast_data(self) -> "AutoscalingPlans":
        '''(experimental) Retrieves the forecast data for a scalable resource.

        Access Level: Read

        https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_GetScalingPlanResourceForecastData.html

        :stability: experimental
        '''
        return typing.cast("AutoscalingPlans", jsii.invoke(self, "toGetScalingPlanResourceForecastData", []))

    @jsii.member(jsii_name="toUpdateScalingPlan")
    def to_update_scaling_plan(self) -> "AutoscalingPlans":
        '''(experimental) Updates a scaling plan.

        Access Level: Write

        https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_UpdateScalingPlan.html

        :stability: experimental
        '''
        return typing.cast("AutoscalingPlans", jsii.invoke(self, "toUpdateScalingPlan", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d803c2da8d7509d6d23586def676c829253c13902dc49dc10148bb631f36495d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__49482f55fa21c7d7a1cd901d2f7cd25ef4e35450d0ae60a8d91bbe32190e9752)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class AwsCloudControlApi(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsCloudControlApi",
):
    '''(experimental) Statement provider for service `aws-cloud-control-api <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudcontrolapi.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-cloud-control-api <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudcontrolapi.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fe4c5a709680a74af58a71089b86f3a170a2b85444ca80b0caab74f4a8802fa8)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toCancelResourceRequest")
    def to_cancel_resource_request(self) -> "AwsCloudControlApi":
        '''(experimental) Grants permission to cancel resource requests in your account.

        Access Level: Write

        https://docs.aws.amazon.com/cloudcontrolapi/latest/APIReference/API_CancelResourceRequest.html

        :stability: experimental
        '''
        return typing.cast("AwsCloudControlApi", jsii.invoke(self, "toCancelResourceRequest", []))

    @jsii.member(jsii_name="toCreateResource")
    def to_create_resource(self) -> "AwsCloudControlApi":
        '''(experimental) Grants permission to create resources in your account.

        Access Level: Write

        https://docs.aws.amazon.com/cloudcontrolapi/latest/APIReference/API_CreateResource.html

        :stability: experimental
        '''
        return typing.cast("AwsCloudControlApi", jsii.invoke(self, "toCreateResource", []))

    @jsii.member(jsii_name="toDeleteResource")
    def to_delete_resource(self) -> "AwsCloudControlApi":
        '''(experimental) Grants permission to delete resources in your account.

        Access Level: Write

        https://docs.aws.amazon.com/cloudcontrolapi/latest/APIReference/API_DeleteResource.html

        :stability: experimental
        '''
        return typing.cast("AwsCloudControlApi", jsii.invoke(self, "toDeleteResource", []))

    @jsii.member(jsii_name="toGetResource")
    def to_get_resource(self) -> "AwsCloudControlApi":
        '''(experimental) Grants permission to get resources in your account.

        Access Level: Read

        https://docs.aws.amazon.com/cloudcontrolapi/latest/APIReference/API_GetResource.html

        :stability: experimental
        '''
        return typing.cast("AwsCloudControlApi", jsii.invoke(self, "toGetResource", []))

    @jsii.member(jsii_name="toGetResourceRequestStatus")
    def to_get_resource_request_status(self) -> "AwsCloudControlApi":
        '''(experimental) Grants permission to get resource requests in your account.

        Access Level: Read

        https://docs.aws.amazon.com/cloudcontrolapi/latest/APIReference/API_GetResourceRequestStatus.html

        :stability: experimental
        '''
        return typing.cast("AwsCloudControlApi", jsii.invoke(self, "toGetResourceRequestStatus", []))

    @jsii.member(jsii_name="toListResourceRequests")
    def to_list_resource_requests(self) -> "AwsCloudControlApi":
        '''(experimental) Grants permission to list resource requests in your account.

        Access Level: Read

        https://docs.aws.amazon.com/cloudcontrolapi/latest/APIReference/API_ListResourceRequests.html

        :stability: experimental
        '''
        return typing.cast("AwsCloudControlApi", jsii.invoke(self, "toListResourceRequests", []))

    @jsii.member(jsii_name="toListResources")
    def to_list_resources(self) -> "AwsCloudControlApi":
        '''(experimental) Grants permission to list resources in your account.

        Access Level: Read

        https://docs.aws.amazon.com/cloudcontrolapi/latest/APIReference/API_ListResources.html

        :stability: experimental
        '''
        return typing.cast("AwsCloudControlApi", jsii.invoke(self, "toListResources", []))

    @jsii.member(jsii_name="toUpdateResource")
    def to_update_resource(self) -> "AwsCloudControlApi":
        '''(experimental) Grants permission to update resources in your account.

        Access Level: Write

        https://docs.aws.amazon.com/cloudcontrolapi/latest/APIReference/API_UpdateResource.html

        :stability: experimental
        '''
        return typing.cast("AwsCloudControlApi", jsii.invoke(self, "toUpdateResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ab0ec6ec99b6056ad819946130576ed34abfc6c528b8a3054e643b0518e39738)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ea4f9068f962d98cb94fce3af384714cfd6b7b1112f07a10235b47b65d0aedb1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class AwsMarketplace(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsMarketplace",
):
    '''(experimental) Statement provider for service `aws-marketplace <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplace.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-marketplace <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplace.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1f4ea36c84a244954705defad03479adf0ec5bc8699bfa43e92010d6e345a2a5)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAgreementType")
    def if_agreement_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "AwsMarketplace":
        '''(experimental) Filters access by the type of the agreement.

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e4c2c7be32731606bc53b6a8a51581ec3377aec6d60dddecc9b666a29d23adac)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("AwsMarketplace", jsii.invoke(self, "ifAgreementType", [value, operator]))

    @jsii.member(jsii_name="ifPartyType")
    def if_party_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "AwsMarketplace":
        '''(experimental) Filters access by the party type of the agreement.

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d3c6e6c0f584c319c793c9093668f9bf34a0fbe7488d5f544fa9f8ba2efb0aed)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("AwsMarketplace", jsii.invoke(self, "ifPartyType", [value, operator]))

    @jsii.member(jsii_name="ifProductId")
    def if_product_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "AwsMarketplace":
        '''(experimental) Filters access by product id for AWS Marketplace RedHat OpenShift products in the RedHat console.

        Note: This condition key only applies to the RedHat console, and using it will not restrict access to products in AWS Marketplace

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3324f6bcb8361073336d171502931ea06e9bc52f148384d78badea6cf031a41a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("AwsMarketplace", jsii.invoke(self, "ifProductId", [value, operator]))

    @jsii.member(jsii_name="toAcceptAgreementApprovalRequest")
    def to_accept_agreement_approval_request(self) -> "AwsMarketplace":
        '''(experimental) Grants permission to users to approve an incoming subscription request (for providers who provide products that require subscription verification).

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toAcceptAgreementApprovalRequest", []))

    @jsii.member(jsii_name="toAcceptAgreementRequest")
    def to_accept_agreement_request(self) -> "AwsMarketplace":
        '''(experimental) Grants permission to users to accept their agreement requests. Note that this action is not applicable to Marketplace purchases.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toAcceptAgreementRequest", []))

    @jsii.member(jsii_name="toCancelAgreement")
    def to_cancel_agreement(self) -> "AwsMarketplace":
        '''(experimental) Grants permission to users to cancel their agreements. Note that this action is not applicable to Marketplace purchases.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toCancelAgreement", []))

    @jsii.member(jsii_name="toCancelAgreementRequest")
    def to_cancel_agreement_request(self) -> "AwsMarketplace":
        '''(experimental) Grants permission to users to cancel pending subscription requests for products that require subscription verification.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toCancelAgreementRequest", []))

    @jsii.member(jsii_name="toCreateAgreementRequest")
    def to_create_agreement_request(self) -> "AwsMarketplace":
        '''(experimental) Grants permission to users to create an agreement request. Note that this action is not applicable to Marketplace purchases.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toCreateAgreementRequest", []))

    @jsii.member(jsii_name="toDescribeAgreement")
    def to_describe_agreement(self) -> "AwsMarketplace":
        '''(experimental) Grants permission to users to describe the metadata about the agreement.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toDescribeAgreement", []))

    @jsii.member(jsii_name="toGetAgreementApprovalRequest")
    def to_get_agreement_approval_request(self) -> "AwsMarketplace":
        '''(experimental) Grants permission to users to view the details of their incoming subscription requests (for providers who provide products that require subscription verification).

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toGetAgreementApprovalRequest", []))

    @jsii.member(jsii_name="toGetAgreementRequest")
    def to_get_agreement_request(self) -> "AwsMarketplace":
        '''(experimental) Grants permission to users to view the details of their subscription requests for data products that require subscription verification.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toGetAgreementRequest", []))

    @jsii.member(jsii_name="toGetAgreementTerms")
    def to_get_agreement_terms(self) -> "AwsMarketplace":
        '''(experimental) Grants permission to users to get a list of terms for an agreement.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toGetAgreementTerms", []))

    @jsii.member(jsii_name="toListAgreementApprovalRequests")
    def to_list_agreement_approval_requests(self) -> "AwsMarketplace":
        '''(experimental) Grants permission to users to list their incoming subscription requests (for providers who provide products that require subscription verification).

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toListAgreementApprovalRequests", []))

    @jsii.member(jsii_name="toListAgreementRequests")
    def to_list_agreement_requests(self) -> "AwsMarketplace":
        '''(experimental) Grants permission to users to list their subscription requests for products that require subscription verification.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toListAgreementRequests", []))

    @jsii.member(jsii_name="toListEntitlementDetails")
    def to_list_entitlement_details(self) -> "AwsMarketplace":
        '''(experimental) Grants permission to users to view details of the entitlements associated with an agreement.

        Note that this action is not applicable to Marketplace purchases

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toListEntitlementDetails", []))

    @jsii.member(jsii_name="toRejectAgreementApprovalRequest")
    def to_reject_agreement_approval_request(self) -> "AwsMarketplace":
        '''(experimental) Grants permission to users to decline an incoming subscription requests (for providers who provide products that require subscription verification).

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toRejectAgreementApprovalRequest", []))

    @jsii.member(jsii_name="toSearchAgreements")
    def to_search_agreements(self) -> "AwsMarketplace":
        '''(experimental) Grants permission to users to search their agreements.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toSearchAgreements", []))

    @jsii.member(jsii_name="toSubscribe")
    def to_subscribe(self) -> "AwsMarketplace":
        '''(experimental) Grants permission to users to subscribe to AWS Marketplace products.

        Includes the ability to send a subscription request for products that require subscription verification. Includes the ability to enable auto-renewal for an existing subscription

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toSubscribe", []))

    @jsii.member(jsii_name="toUnsubscribe")
    def to_unsubscribe(self) -> "AwsMarketplace":
        '''(experimental) Grants permission to users to remove subscriptions to AWS Marketplace products.

        Includes the ability to disable auto-renewal for an existing subscription

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toUnsubscribe", []))

    @jsii.member(jsii_name="toUpdateAgreementApprovalRequest")
    def to_update_agreement_approval_request(self) -> "AwsMarketplace":
        '''(experimental) Grants permission to users to make changes to an incoming subscription request, including the ability to delete the prospective subscriber's information (for providers who provide products that require subscription verification).

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toUpdateAgreementApprovalRequest", []))

    @jsii.member(jsii_name="toViewSubscriptions")
    def to_view_subscriptions(self) -> "AwsMarketplace":
        '''(experimental) Grants permission to users to see their account's subscriptions.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-iam-users-groups-policies.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplace", jsii.invoke(self, "toViewSubscriptions", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f6905198e094bf8dab2dad592a12c9fb134a4229936dbac6ea2fe85a4c16cb7f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__53149af53bac9559e6f529f3c2b273557f81913a4dc92f3399e9d0a3943d8fda)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class AwsMarketplaceCatalog(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsMarketplaceCatalog",
):
    '''(experimental) Statement provider for service `aws-marketplace-catalog <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacecatalog.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-marketplace-catalog <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacecatalog.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9326c1a2ff02fcaa83caf7ec9250e1f0d6a859bd8c9bdb886497388c8ef7b847)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifCatalogChangeType")
    def if_catalog_change_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "AwsMarketplaceCatalog":
        '''(experimental) Filters access by the change type in the StartChangeSet request.

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/api-access-control.html

        Applies to actions:

        - .toStartChangeSet()

        Applies to resource types:

        - Entity
        - ChangeSet

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cdbeb31ff1c56a3985dc024c7eb5bb3c2485497f3c683d16c468ec539f5f7a2d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "ifCatalogChangeType", [value, operator]))

    @jsii.member(jsii_name="onChangeSet")
    def on_change_set(
        self,
        catalog: builtins.str,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AwsMarketplaceCatalog":
        '''(experimental) Adds a resource of type ChangeSet to the statement.

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/API_StartChangeSet.html#API_StartChangeSet_ResponseSyntax

        :param catalog: - Identifier for the catalog.
        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifCatalogChangeType()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f8f0deae60a88146c64e9fff5d4e6ff8eeb48d4dbf3c59764db4b28339f3c535)
            check_type(argname="argument catalog", value=catalog, expected_type=type_hints["catalog"])
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "onChangeSet", [catalog, resource_id, account, region, partition]))

    @jsii.member(jsii_name="onEntity")
    def on_entity(
        self,
        catalog: builtins.str,
        entity_type: builtins.str,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AwsMarketplaceCatalog":
        '''(experimental) Adds a resource of type Entity to the statement.

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/API_DescribeEntity.html#API_DescribeEntity_ResponseSyntax

        :param catalog: - Identifier for the catalog.
        :param entity_type: - Identifier for the entityType.
        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifCatalogChangeType()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__024b37a5337d574aac3101e43d1afce052c7933501e379d67b366621309d3b6f)
            check_type(argname="argument catalog", value=catalog, expected_type=type_hints["catalog"])
            check_type(argname="argument entity_type", value=entity_type, expected_type=type_hints["entity_type"])
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "onEntity", [catalog, entity_type, resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelChangeSet")
    def to_cancel_change_set(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Grants permission to cancel a running change set.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/API_CancelChangeSet.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toCancelChangeSet", []))

    @jsii.member(jsii_name="toCompleteTask")
    def to_complete_task(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Grants permission to complete an existing task and submit the content to the associated change.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toCompleteTask", []))

    @jsii.member(jsii_name="toDescribeChangeSet")
    def to_describe_change_set(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Grants permission to return the details of an existing change set.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/API_DescribeChangeSet.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toDescribeChangeSet", []))

    @jsii.member(jsii_name="toDescribeEntity")
    def to_describe_entity(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Grants permission to return the details of an existing entity.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/API_DescribeEntity.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toDescribeEntity", []))

    @jsii.member(jsii_name="toDescribeTask")
    def to_describe_task(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Grants permission to return the details of an existing task.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toDescribeTask", []))

    @jsii.member(jsii_name="toListChangeSets")
    def to_list_change_sets(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Grants permission to list existing change sets.

        Access Level: List

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/API_ListChangeSets.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toListChangeSets", []))

    @jsii.member(jsii_name="toListEntities")
    def to_list_entities(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Grants permission to list existing entities.

        Access Level: List

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/API_ListEntities.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toListEntities", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Grants permission to list tags on an existing entity or a change set.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTasks")
    def to_list_tasks(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Grants permission to list existing tasks.

        Access Level: List

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toListTasks", []))

    @jsii.member(jsii_name="toStartChangeSet")
    def to_start_change_set(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Grants permission to request a new change set (Note: resource-level permissions for this action and condition context keys for this action are only supported when used with Catalog API and are not supported when used with AWS Marketplace Management Portal).

        Access Level: Write

        Possible conditions:

        - .ifCatalogChangeType()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/API_StartChangeSet.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toStartChangeSet", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Grants permission to tag an existing entity or a change set.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Grants permission to untag an existing entity or a change set.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateTask")
    def to_update_task(self) -> "AwsMarketplaceCatalog":
        '''(experimental) Grants permission to update the contents of an existing task.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceCatalog", jsii.invoke(self, "toUpdateTask", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0ee588f305b960d80011b32e1f0877dbd15972ed69e1567a3d3b31f025798c1d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8f44eabd0f2ca9af66d874ae289e82c250487539d601ce726b888981b6263188)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class AwsMarketplaceDiscovery(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsMarketplaceDiscovery",
):
    '''(experimental) Statement provider for service `aws-marketplace-discovery <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacediscovery.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-marketplace-discovery <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacediscovery.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__05ad8064444b40c5b1c46af55d8d04a84147064b24a65bc3c4f42635f92979ba)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toListPrivateListings")
    def to_list_private_listings(self) -> "AwsMarketplaceDiscovery":
        '''(experimental) Grants permission to users to list their private offers.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-offers-page.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceDiscovery", jsii.invoke(self, "toListPrivateListings", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__376ae21ba351117ecfdb5a25d3649b8e2e267b3e9c778812d8856cfd083062ae)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d072e9f5274e47cbe761f93542e761d113cfcc1fcb0424b62fbdff7769b7b9be)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class AwsMarketplaceEntitlementService(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsMarketplaceEntitlementService",
):
    '''(experimental) Statement provider for service `aws-marketplace-entitlement-service <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplaceentitlementservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-marketplace-entitlement-service <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplaceentitlementservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__936b0f04f737979f2a68abd68ac1b63ed538a417b369f29b42841234eadb517c)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toGetEntitlements")
    def to_get_entitlements(self) -> "AwsMarketplaceEntitlementService":
        '''(experimental) Retrieves entitlement values for a given product. The results can be filtered based on customer identifier or product dimensions.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceEntitlementService", jsii.invoke(self, "toGetEntitlements", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f9e3514cfec7701d6bf0e08d3e81fbf0487212610fece2cd83ee8ecc0a4a76ae)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2ca4794235c7370f3bba8cea341c74ad1de145b7e272c96bc96f9662fd228497)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class AwsMarketplaceImageBuildingService(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsMarketplaceImageBuildingService",
):
    '''(experimental) Statement provider for service `aws-marketplace-image-building-service <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplaceimagebuildingservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-marketplace-image-building-service <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplaceimagebuildingservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__02ff78958fd35a0639b876a7f30b90c2e8337ab494238f19d9230657be24dd60)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toDescribeBuilds")
    def to_describe_builds(self) -> "AwsMarketplaceImageBuildingService":
        '''(experimental) Describes Image Builds identified by a build Id.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/api-reference.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceImageBuildingService", jsii.invoke(self, "toDescribeBuilds", []))

    @jsii.member(jsii_name="toListBuilds")
    def to_list_builds(self) -> "AwsMarketplaceImageBuildingService":
        '''(experimental) Lists Image Builds.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/api-reference.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceImageBuildingService", jsii.invoke(self, "toListBuilds", []))

    @jsii.member(jsii_name="toStartBuild")
    def to_start_build(self) -> "AwsMarketplaceImageBuildingService":
        '''(experimental) Starts an Image Build.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/api-reference.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceImageBuildingService", jsii.invoke(self, "toStartBuild", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3481799d1c139c8f16b11f354e5b6ee8cebbdede6dac1e7290b7a1a2aa2491dc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__db27e288ad62b636a8bba2345091ca83ccc9f812519f762b7ea9aa2f1b6eabd9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class AwsMarketplaceManagement(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsMarketplaceManagement",
):
    '''(experimental) Statement provider for service `aws-marketplace-management <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacemanagementportal.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-marketplace-management <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacemanagementportal.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__376aa37ec0f1f8c331b9cadf6a2d2c866fdacb05fb3f8c97fbc4d9e11830bcf2)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toUploadFiles")
    def to_upload_files(self) -> "AwsMarketplaceManagement":
        '''(experimental) Allows access to the File Upload page inside the AWS Marketplace Management Portal.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/userguide/detailed-management-portal-permissions.html#seller-ammp-permissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceManagement", jsii.invoke(self, "toUploadFiles", []))

    @jsii.member(jsii_name="toViewMarketing")
    def to_view_marketing(self) -> "AwsMarketplaceManagement":
        '''(experimental) Allows access to the Marketing page inside the AWS Marketplace Management Portal.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/userguide/detailed-management-portal-permissions.html#seller-ammp-permissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceManagement", jsii.invoke(self, "toViewMarketing", []))

    @jsii.member(jsii_name="toViewReports")
    def to_view_reports(self) -> "AwsMarketplaceManagement":
        '''(experimental) Allows access to the Reports page inside the AWS Marketplace Management Portal.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/userguide/detailed-management-portal-permissions.html#seller-ammp-permissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceManagement", jsii.invoke(self, "toViewReports", []))

    @jsii.member(jsii_name="toViewSettings")
    def to_view_settings(self) -> "AwsMarketplaceManagement":
        '''(experimental) Allows access to the Settings page inside the AWS Marketplace Management Portal.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/userguide/detailed-management-portal-permissions.html#seller-ammp-permissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceManagement", jsii.invoke(self, "toViewSettings", []))

    @jsii.member(jsii_name="toViewSupport")
    def to_view_support(self) -> "AwsMarketplaceManagement":
        '''(experimental) Allows access to the Customer Support Eligibility page inside the AWS Marketplace Management Portal.

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/userguide/detailed-management-portal-permissions.html#seller-ammp-permissions

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceManagement", jsii.invoke(self, "toViewSupport", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5b188a925912977fc8ce094690155c747616169b7c357e1a90b572a025a816ed)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bb675b4a95a4a3e7a4b4008f739913b3a3d660381778c73c126c3989b0c360e8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class AwsMarketplaceMeteringService(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsMarketplaceMeteringService",
):
    '''(experimental) Statement provider for service `aws-marketplace-metering-service <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacemeteringservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-marketplace-metering-service <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacemeteringservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__507b459bea7a0cfcaad2fe5621fd6d9810d1c4125be32337b48d16690fee23c3)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toBatchMeterUsage")
    def to_batch_meter_usage(self) -> "AwsMarketplaceMeteringService":
        '''(experimental) Grants permission to post metering records for a set of customers for SaaS applications.

        Access Level: Write

        https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/API_BatchMeterUsage.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceMeteringService", jsii.invoke(self, "toBatchMeterUsage", []))

    @jsii.member(jsii_name="toMeterUsage")
    def to_meter_usage(self) -> "AwsMarketplaceMeteringService":
        '''(experimental) Grants permission to emit metering records.

        Access Level: Write

        https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/API_MeterUsage.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceMeteringService", jsii.invoke(self, "toMeterUsage", []))

    @jsii.member(jsii_name="toRegisterUsage")
    def to_register_usage(self) -> "AwsMarketplaceMeteringService":
        '''(experimental) Grants permission to to verify that the customer running your paid software is subscribed to your product on AWS Marketplace, enabling you to guard against unauthorized use.

        Meters software use per ECS task, per hour, with usage prorated to the second

        Access Level: Write

        https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/API_RegisterUsage.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceMeteringService", jsii.invoke(self, "toRegisterUsage", []))

    @jsii.member(jsii_name="toResolveCustomer")
    def to_resolve_customer(self) -> "AwsMarketplaceMeteringService":
        '''(experimental) Grants permission to resolve a registration token to obtain a CustomerIdentifier and product code.

        Access Level: Write

        https://docs.aws.amazon.com/marketplacemetering/latest/APIReference/API_ResolveCustomer.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceMeteringService", jsii.invoke(self, "toResolveCustomer", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f2c6b3866aff09e5628037c83eab6abee1bf01ae94e9518f9231280946ee0b54)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5f61b5eb604b5aad832a8e8ce8686a8244192d415174a1e7aaff93cc65b7ea6c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class AwsMarketplacePrivate(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsMarketplacePrivate",
):
    '''(experimental) Statement provider for service `aws-marketplace-private <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplaceprivatemarketplace.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-marketplace-private <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplaceprivatemarketplace.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ec6cf607765950e3153a59a3e8775b6fbea0bf66dfb3beb25fbc30000a8c9382)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toAssociateProductsWithPrivateMarketplace")
    def to_associate_products_with_private_marketplace(self) -> "AwsMarketplacePrivate":
        '''(experimental) Grants permission to approve a request for a product to be associated with the Private Marketplace.

        This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toAssociateProductsWithPrivateMarketplace", []))

    @jsii.member(jsii_name="toCreatePrivateMarketplaceRequests")
    def to_create_private_marketplace_requests(self) -> "AwsMarketplacePrivate":
        '''(experimental) Grants permission to create a new request for a product or products to be associated with the Private Marketplace.

        This action can be performed by any account in an in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toCreatePrivateMarketplaceRequests", []))

    @jsii.member(jsii_name="toDescribePrivateMarketplaceRequests")
    def to_describe_private_marketplace_requests(self) -> "AwsMarketplacePrivate":
        '''(experimental) Grants permission to describe requests and associated products in the Private Marketplace.

        This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toDescribePrivateMarketplaceRequests", []))

    @jsii.member(jsii_name="toDisassociateProductsFromPrivateMarketplace")
    def to_disassociate_products_from_private_marketplace(
        self,
    ) -> "AwsMarketplacePrivate":
        '''(experimental) Grants permission to decline a request for a product to be associated with the Private Marketplace.

        This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toDisassociateProductsFromPrivateMarketplace", []))

    @jsii.member(jsii_name="toListPrivateMarketplaceRequests")
    def to_list_private_marketplace_requests(self) -> "AwsMarketplacePrivate":
        '''(experimental) Grants permission to get a queryable list for requests and associated products in the Private Marketplace.

        This action can be performed by any account in an AWS Organization, provided the user has permissions to do so, and the Organization's Service Control Policies allow it

        Access Level: List

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/private-marketplace.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplacePrivate", jsii.invoke(self, "toListPrivateMarketplaceRequests", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__97adf50a25cb90af32667067c6eacb2aa751071c2707954ac135640a2b284300)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ed4cd7b6ae4a810da063221797e707f24b0d61fc5e12ce5d20f4d3626693cb7f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class AwsMarketplaceProcurementSystemsIntegration(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsMarketplaceProcurementSystemsIntegration",
):
    '''(experimental) Statement provider for service `aws-marketplace-procurement-systems-integration <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplaceprocurementsystemsintegration.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-marketplace-procurement-systems-integration <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplaceprocurementsystemsintegration.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c8e1f38fc5d720fae3c79171a06a70fea95e585890ea8958726f2f08c91e78dd)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toDescribeProcurementSystemConfiguration")
    def to_describe_procurement_system_configuration(
        self,
    ) -> "AwsMarketplaceProcurementSystemsIntegration":
        '''(experimental) Grants permission to describe the Procurement System integration configuration (e.g. Coupa) for the individual account, or for the entire AWS Organization if one exists. This action can only be performed by the master account if using an AWS Organization.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/procurement-systems-integration.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceProcurementSystemsIntegration", jsii.invoke(self, "toDescribeProcurementSystemConfiguration", []))

    @jsii.member(jsii_name="toPutProcurementSystemConfiguration")
    def to_put_procurement_system_configuration(
        self,
    ) -> "AwsMarketplaceProcurementSystemsIntegration":
        '''(experimental) Grants permission to create or update the Procurement System integration configuration (e.g. Coupa) for the individual account, or for the entire AWS Organization if one exists. This action can only be performed by the master account if using an AWS Organization.

        Access Level: Write

        https://docs.aws.amazon.com/marketplace/latest/buyerguide/procurement-systems-integration.html

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceProcurementSystemsIntegration", jsii.invoke(self, "toPutProcurementSystemConfiguration", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__46ce284aca191bc85f19887eece8610e8e71c16a876f6fe202ae91c7b5c24a63)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b444bb165e4715613c82fa8e21845dd4114f2561c5744fc7cfe04610fee6636c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class AwsMarketplaceSellerReporting(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsMarketplaceSellerReporting",
):
    '''(experimental) Statement provider for service `aws-marketplace-seller-reporting <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacesellerreporting.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-marketplace-seller-reporting <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacesellerreporting.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__db732f1d051f21db2f656101f0dd09b808200e60feecb9b9cde6b78bf18b5373)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onSellerDashboard")
    def on_seller_dashboard(
        self,
        catalog: builtins.str,
        dashboard_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "AwsMarketplaceSellerReporting":
        '''(experimental) Adds a resource of type SellerDashboard to the statement.

        https://docs.aws.amazon.com/marketplace/latest/userguide/dashboards.html#reports-accessing

        :param catalog: - Identifier for the catalog.
        :param dashboard_name: - Identifier for the dashboardName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__62ae6954438803791ebb6b493f06e61272d7d24c2a64a58d41ba0660d92d32bc)
            check_type(argname="argument catalog", value=catalog, expected_type=type_hints["catalog"])
            check_type(argname="argument dashboard_name", value=dashboard_name, expected_type=type_hints["dashboard_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("AwsMarketplaceSellerReporting", jsii.invoke(self, "onSellerDashboard", [catalog, dashboard_name, account, partition]))

    @jsii.member(jsii_name="toGetSellerDashboard")
    def to_get_seller_dashboard(self) -> "AwsMarketplaceSellerReporting":
        '''(experimental) Grants permission to view a seller dashboard.

        Access Level: Read

        https://docs.aws.amazon.com/marketplace/latest/userguide/dashboards.html#reports-accessing

        :stability: experimental
        '''
        return typing.cast("AwsMarketplaceSellerReporting", jsii.invoke(self, "toGetSellerDashboard", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__626690b1fee217feab20e9b11ce18369175b72996be327f3169542d05d5299ef)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ca643dce8f888623d82ca1e61cbd6ecee57854139679554f57545c89452bc30d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class AwsPortal(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.AwsPortal",
):
    '''(experimental) Statement provider for service `aws-portal <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbillingconsole.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `aws-portal <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbillingconsole.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c7eb3f45d9c562c52033924391e15c9971ad6f6fb6018bdb81aef9673fc3aae7)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toModifyAccount")
    def to_modify_account(self) -> "AwsPortal":
        '''(experimental) Allow or deny IAM users permission to modify Account Settings.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("AwsPortal", jsii.invoke(self, "toModifyAccount", []))

    @jsii.member(jsii_name="toModifyBilling")
    def to_modify_billing(self) -> "AwsPortal":
        '''(experimental) Allow or deny IAM users permission to modify billing settings.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("AwsPortal", jsii.invoke(self, "toModifyBilling", []))

    @jsii.member(jsii_name="toModifyPaymentMethods")
    def to_modify_payment_methods(self) -> "AwsPortal":
        '''(experimental) Allow or deny IAM users permission to modify payment methods.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("AwsPortal", jsii.invoke(self, "toModifyPaymentMethods", []))

    @jsii.member(jsii_name="toViewAccount")
    def to_view_account(self) -> "AwsPortal":
        '''(experimental) Allow or deny IAM users permission to view account settings.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("AwsPortal", jsii.invoke(self, "toViewAccount", []))

    @jsii.member(jsii_name="toViewBilling")
    def to_view_billing(self) -> "AwsPortal":
        '''(experimental) Allow or deny IAM users permission to view billing pages in the console.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("AwsPortal", jsii.invoke(self, "toViewBilling", []))

    @jsii.member(jsii_name="toViewPaymentMethods")
    def to_view_payment_methods(self) -> "AwsPortal":
        '''(experimental) Allow or deny IAM users permission to view payment methods.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("AwsPortal", jsii.invoke(self, "toViewPaymentMethods", []))

    @jsii.member(jsii_name="toViewUsage")
    def to_view_usage(self) -> "AwsPortal":
        '''(experimental) Allow or deny IAM users permission to view AWS usage reports.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("AwsPortal", jsii.invoke(self, "toViewUsage", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dab7b0ebd2e20dde2271b4d6725c566b8f221ba3b5a5a5563c90eede15962881)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1e9384a5ad431f37d127a1f924dd0a1c268f298e5dca98eac3f0e9686f008f28)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Awsconnector(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Awsconnector",
):
    '''(experimental) Statement provider for service `awsconnector <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsconnectorservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `awsconnector <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsconnectorservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f58c827c837708b4800174487e9accfedf848020b20e781e6d00af8594567a05)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toGetConnectorHealth")
    def to_get_connector_health(self) -> "Awsconnector":
        '''(experimental) Retrieves all health metrics that were published from the Server Migration Connector.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/userguide/prereqs.html#connector-permissions

        :stability: experimental
        '''
        return typing.cast("Awsconnector", jsii.invoke(self, "toGetConnectorHealth", []))

    @jsii.member(jsii_name="toRegisterConnector")
    def to_register_connector(self) -> "Awsconnector":
        '''(experimental) Registers AWS Connector with AWS Connector Service.

        Access Level: Write

        https://docs.aws.amazon.com/server-migration-service/latest/userguide/prereqs.html#connector-permissions

        :stability: experimental
        '''
        return typing.cast("Awsconnector", jsii.invoke(self, "toRegisterConnector", []))

    @jsii.member(jsii_name="toValidateConnectorId")
    def to_validate_connector_id(self) -> "Awsconnector":
        '''(experimental) Validates Server Migration Connector Id that was registered with AWS Connector Service.

        Access Level: Read

        https://docs.aws.amazon.com/server-migration-service/latest/userguide/prereqs.html#connector-permissions

        :stability: experimental
        '''
        return typing.cast("Awsconnector", jsii.invoke(self, "toValidateConnectorId", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6452b27af18b4b9b48e880e739019574f59b714f77a7b26aaef364257f443fef)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8a75c6c0a64f4a105a0a0236ed4c0a6be47cce40db83e66638f3e764dfe568d0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Backup(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Backup"):
    '''(experimental) Statement provider for service `backup <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbackup.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `backup <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbackup.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8d1f20a13861954bf53e986153a255cf27eeb85f11fc5636366536b2f77bbb72)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifChangeableForDays")
    def if_changeable_for_days(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Backup":
        '''(experimental) Filters access by the value of the ChangeableForDays parameter.

        https://docs.aws.amazon.com/aws-backup/latest/devguide/access-control.html#amazon-backup-keys

        Applies to actions:

        - .toPutBackupVaultLockConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a1833328f065d12df98b5ba4283951b56ef6c6a7ba0d8ce8f163bdaf4e54ee5d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Backup", jsii.invoke(self, "ifChangeableForDays", [value, operator]))

    @jsii.member(jsii_name="ifCopyTargetOrgPaths")
    def if_copy_target_org_paths(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Backup":
        '''(experimental) Filters access by the organization unit.

        https://docs.aws.amazon.com/aws-backup/latest/devguide/access-control.html#amazon-backup-keys

        Applies to actions:

        - .toCopyFromBackupVault()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__94e863f59f3e011d5257915391f2b8bab99c47e642796f0e176e25ad45089404)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Backup", jsii.invoke(self, "ifCopyTargetOrgPaths", [value, operator]))

    @jsii.member(jsii_name="ifCopyTargets")
    def if_copy_targets(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Backup":
        '''(experimental) Filters access by the ARN of an backup vault.

        https://docs.aws.amazon.com/aws-backup/latest/devguide/access-control.html#amazon-backup-keys

        Applies to actions:

        - .toCopyFromBackupVault()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__caaea0f35c479c53cbe89506f5d91af458656f0577841ef4e2b3dd32dab5c438)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Backup", jsii.invoke(self, "ifCopyTargets", [value, operator]))

    @jsii.member(jsii_name="ifFrameworkArns")
    def if_framework_arns(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Backup":
        '''(experimental) Filters access by the Framework ARNs.

        https://docs.aws.amazon.com/aws-backup/latest/devguide/access-control.html#amazon-backup-keys

        Applies to actions:

        - .toCreateReportPlan()
        - .toUpdateReportPlan()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__46a6c772b4317f8aab45931f649212284ae13a0ad2b19deaac2d26f1cf3df4b7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Backup", jsii.invoke(self, "ifFrameworkArns", [value, operator]))

    @jsii.member(jsii_name="onBackupPlan")
    def on_backup_plan(
        self,
        backup_plan_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Backup":
        '''(experimental) Adds a resource of type backupPlan to the statement.

        https://docs.aws.amazon.com/aws-backup/latest/devguide/about-backup-plans.html

        :param backup_plan_id: - Identifier for the backupPlanId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4bba7fe1700c041d4d02be9b02c55a7da51e34b1b367850038f8d60968aa23bc)
            check_type(argname="argument backup_plan_id", value=backup_plan_id, expected_type=type_hints["backup_plan_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Backup", jsii.invoke(self, "onBackupPlan", [backup_plan_id, account, region, partition]))

    @jsii.member(jsii_name="onBackupVault")
    def on_backup_vault(
        self,
        backup_vault_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Backup":
        '''(experimental) Adds a resource of type backupVault to the statement.

        https://docs.aws.amazon.com/aws-backup/latest/devguide/vaults.html

        :param backup_vault_name: - Identifier for the backupVaultName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3a728744324e221189053f52db13d621ad865d7c2a2dcde20f939759f8ef098f)
            check_type(argname="argument backup_vault_name", value=backup_vault_name, expected_type=type_hints["backup_vault_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Backup", jsii.invoke(self, "onBackupVault", [backup_vault_name, account, region, partition]))

    @jsii.member(jsii_name="onFramework")
    def on_framework(
        self,
        framework_name: builtins.str,
        framework_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Backup":
        '''(experimental) Adds a resource of type framework to the statement.

        https://docs.aws.amazon.com/aws-backup/latest/devguide/frameworks.html

        :param framework_name: - Identifier for the frameworkName.
        :param framework_id: - Identifier for the frameworkId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__242cef4f455dfaf795694c213ef571ab4dc0a7e037b470d51c3c81acb5274f53)
            check_type(argname="argument framework_name", value=framework_name, expected_type=type_hints["framework_name"])
            check_type(argname="argument framework_id", value=framework_id, expected_type=type_hints["framework_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Backup", jsii.invoke(self, "onFramework", [framework_name, framework_id, account, region, partition]))

    @jsii.member(jsii_name="onLegalHold")
    def on_legal_hold(
        self,
        legal_hold_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Backup":
        '''(experimental) Adds a resource of type legalHold to the statement.

        https://docs.aws.amazon.com/aws-backup/latest/devguide/legal-holds.html

        :param legal_hold_id: - Identifier for the legalHoldId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__606013e035ffc533ac6f7256665c7719a1219fc1e7f33905bf87d27abf4a6eaa)
            check_type(argname="argument legal_hold_id", value=legal_hold_id, expected_type=type_hints["legal_hold_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Backup", jsii.invoke(self, "onLegalHold", [legal_hold_id, account, region, partition]))

    @jsii.member(jsii_name="onRecoveryPoint")
    def on_recovery_point(
        self,
        recovery_point_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Backup":
        '''(experimental) Adds a resource of type recoveryPoint to the statement.

        https://docs.aws.amazon.com/aws-backup/latest/devguide/recovery-points.html

        :param recovery_point_id: - Identifier for the recoveryPointId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b6f6e54dc769893feea207b29b35509b8167a3308d279f1403366f797c6cca97)
            check_type(argname="argument recovery_point_id", value=recovery_point_id, expected_type=type_hints["recovery_point_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Backup", jsii.invoke(self, "onRecoveryPoint", [recovery_point_id, account, region, partition]))

    @jsii.member(jsii_name="onReportPlan")
    def on_report_plan(
        self,
        report_plan_name: builtins.str,
        report_plan_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Backup":
        '''(experimental) Adds a resource of type reportPlan to the statement.

        https://docs.aws.amazon.com/aws-backup/latest/devguide/report-plans.html

        :param report_plan_name: - Identifier for the reportPlanName.
        :param report_plan_id: - Identifier for the reportPlanId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ecf03e605c94dfc98d695a7c631f7b3665edb743b6e89ea01f94aa82d8f3bca5)
            check_type(argname="argument report_plan_name", value=report_plan_name, expected_type=type_hints["report_plan_name"])
            check_type(argname="argument report_plan_id", value=report_plan_id, expected_type=type_hints["report_plan_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Backup", jsii.invoke(self, "onReportPlan", [report_plan_name, report_plan_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelLegalHold")
    def to_cancel_legal_hold(self) -> "Backup":
        '''(experimental) Grants permission to cancel a legal hold.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_CancelLegalHold.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toCancelLegalHold", []))

    @jsii.member(jsii_name="toCopyFromBackupVault")
    def to_copy_from_backup_vault(self) -> "Backup":
        '''(experimental) Grants permission to copy from a backup vault.

        Access Level: Write

        Possible conditions:

        - .ifCopyTargets()
        - .ifCopyTargetOrgPaths()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_StartCopyJob.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toCopyFromBackupVault", []))

    @jsii.member(jsii_name="toCopyIntoBackupVault")
    def to_copy_into_backup_vault(self) -> "Backup":
        '''(experimental) Grants permission to copy into a backup vault.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_StartCopyJob.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toCopyIntoBackupVault", []))

    @jsii.member(jsii_name="toCreateBackupPlan")
    def to_create_backup_plan(self) -> "Backup":
        '''(experimental) Grants permission to create a new backup plan.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_CreateBackupPlan.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toCreateBackupPlan", []))

    @jsii.member(jsii_name="toCreateBackupSelection")
    def to_create_backup_selection(self) -> "Backup":
        '''(experimental) Grants permission to create a new resource assignment in a backup plan.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_CreateBackupSelection.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toCreateBackupSelection", []))

    @jsii.member(jsii_name="toCreateBackupVault")
    def to_create_backup_vault(self) -> "Backup":
        '''(experimental) Grants permission to create a new backup vault.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_CreateBackupVault.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toCreateBackupVault", []))

    @jsii.member(jsii_name="toCreateFramework")
    def to_create_framework(self) -> "Backup":
        '''(experimental) Grants permission to create a new framework.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_CreateFramework.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toCreateFramework", []))

    @jsii.member(jsii_name="toCreateLegalHold")
    def to_create_legal_hold(self) -> "Backup":
        '''(experimental) Grants permission to create a new legal hold.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_CreateLegalHold.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toCreateLegalHold", []))

    @jsii.member(jsii_name="toCreateReportPlan")
    def to_create_report_plan(self) -> "Backup":
        '''(experimental) Grants permission to create a new report plan.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifFrameworkArns()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_CreateReportPlan.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toCreateReportPlan", []))

    @jsii.member(jsii_name="toDeleteBackupPlan")
    def to_delete_backup_plan(self) -> "Backup":
        '''(experimental) Grants permission to delete a backup plan.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DeleteBackupPlan.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDeleteBackupPlan", []))

    @jsii.member(jsii_name="toDeleteBackupSelection")
    def to_delete_backup_selection(self) -> "Backup":
        '''(experimental) Grants permission to delete a resource assignment from a backup plan.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DeleteBackupSelection.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDeleteBackupSelection", []))

    @jsii.member(jsii_name="toDeleteBackupVault")
    def to_delete_backup_vault(self) -> "Backup":
        '''(experimental) Grants permission to delete a backup vault.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DeleteBackupVault.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDeleteBackupVault", []))

    @jsii.member(jsii_name="toDeleteBackupVaultAccessPolicy")
    def to_delete_backup_vault_access_policy(self) -> "Backup":
        '''(experimental) Grants permission to delete backup vault access policy.

        Access Level: Permissions management

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DeleteBackupVaultAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDeleteBackupVaultAccessPolicy", []))

    @jsii.member(jsii_name="toDeleteBackupVaultLockConfiguration")
    def to_delete_backup_vault_lock_configuration(self) -> "Backup":
        '''(experimental) Grants permission to remove the lock configuration from a backup vault.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DeleteBackupVaultLockConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDeleteBackupVaultLockConfiguration", []))

    @jsii.member(jsii_name="toDeleteBackupVaultNotifications")
    def to_delete_backup_vault_notifications(self) -> "Backup":
        '''(experimental) Grants permission to remove the notifications from a backup vault.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DeleteBackupVaultNotifications.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDeleteBackupVaultNotifications", []))

    @jsii.member(jsii_name="toDeleteFramework")
    def to_delete_framework(self) -> "Backup":
        '''(experimental) Grants permission to delete a framework.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DeleteFramework.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDeleteFramework", []))

    @jsii.member(jsii_name="toDeleteRecoveryPoint")
    def to_delete_recovery_point(self) -> "Backup":
        '''(experimental) Grants permission to delete a recovery point from a backup vault.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DeleteRecoveryPoint.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDeleteRecoveryPoint", []))

    @jsii.member(jsii_name="toDeleteReportPlan")
    def to_delete_report_plan(self) -> "Backup":
        '''(experimental) Grants permission to delete a report plan.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DeleteReportPlan.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDeleteReportPlan", []))

    @jsii.member(jsii_name="toDescribeBackupJob")
    def to_describe_backup_job(self) -> "Backup":
        '''(experimental) Grants permission to describe a backup job.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeBackupJob.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDescribeBackupJob", []))

    @jsii.member(jsii_name="toDescribeBackupVault")
    def to_describe_backup_vault(self) -> "Backup":
        '''(experimental) Grants permission to describe a new backup vault with the specified name.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeBackupVault.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDescribeBackupVault", []))

    @jsii.member(jsii_name="toDescribeCopyJob")
    def to_describe_copy_job(self) -> "Backup":
        '''(experimental) Grants permission to describe a copy job.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeCopyJob.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDescribeCopyJob", []))

    @jsii.member(jsii_name="toDescribeFramework")
    def to_describe_framework(self) -> "Backup":
        '''(experimental) Grants permission to describe a framework with the specified name.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeFramework.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDescribeFramework", []))

    @jsii.member(jsii_name="toDescribeGlobalSettings")
    def to_describe_global_settings(self) -> "Backup":
        '''(experimental) Grants permission to describe global settings.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeGlobalSettings.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDescribeGlobalSettings", []))

    @jsii.member(jsii_name="toDescribeProtectedResource")
    def to_describe_protected_resource(self) -> "Backup":
        '''(experimental) Grants permission to describe a protected resource.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeProtectedResource.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDescribeProtectedResource", []))

    @jsii.member(jsii_name="toDescribeRecoveryPoint")
    def to_describe_recovery_point(self) -> "Backup":
        '''(experimental) Grants permission to describe a recovery point.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeRecoveryPoint.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDescribeRecoveryPoint", []))

    @jsii.member(jsii_name="toDescribeRegionSettings")
    def to_describe_region_settings(self) -> "Backup":
        '''(experimental) Grants permission to describe region settings.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeRegionSettings.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDescribeRegionSettings", []))

    @jsii.member(jsii_name="toDescribeReportJob")
    def to_describe_report_job(self) -> "Backup":
        '''(experimental) Grants permission to describe a report job.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeReportJob.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDescribeReportJob", []))

    @jsii.member(jsii_name="toDescribeReportPlan")
    def to_describe_report_plan(self) -> "Backup":
        '''(experimental) Grants permission to describe a report plan with the specified name.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeReportPlan.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDescribeReportPlan", []))

    @jsii.member(jsii_name="toDescribeRestoreJob")
    def to_describe_restore_job(self) -> "Backup":
        '''(experimental) Grants permission to describe a restore job.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DescribeRestoreJob.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDescribeRestoreJob", []))

    @jsii.member(jsii_name="toDisassociateRecoveryPoint")
    def to_disassociate_recovery_point(self) -> "Backup":
        '''(experimental) Grants permission to disassociate a recovery point from a backup vault.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DisassociateRecoveryPoint.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDisassociateRecoveryPoint", []))

    @jsii.member(jsii_name="toDisassociateRecoveryPointFromParent")
    def to_disassociate_recovery_point_from_parent(self) -> "Backup":
        '''(experimental) Grants permission to disassociate a recovery point from its parent.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DisassociateRecoveryPointFromParent.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toDisassociateRecoveryPointFromParent", []))

    @jsii.member(jsii_name="toExportBackupPlanTemplate")
    def to_export_backup_plan_template(self) -> "Backup":
        '''(experimental) Grants permission to export a backup plan as a JSON.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ExportBackupPlanTemplate.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toExportBackupPlanTemplate", []))

    @jsii.member(jsii_name="toGetBackupPlan")
    def to_get_backup_plan(self) -> "Backup":
        '''(experimental) Grants permission to get a backup plan.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_GetBackupPlan.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toGetBackupPlan", []))

    @jsii.member(jsii_name="toGetBackupPlanFromJSON")
    def to_get_backup_plan_from_json(self) -> "Backup":
        '''(experimental) Grants permission to transform a JSON to a backup plan.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_GetBackupPlanFromJSON.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toGetBackupPlanFromJSON", []))

    @jsii.member(jsii_name="toGetBackupPlanFromTemplate")
    def to_get_backup_plan_from_template(self) -> "Backup":
        '''(experimental) Grants permission to transform a template to a backup plan.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_GetBackupPlanFromTemplate.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toGetBackupPlanFromTemplate", []))

    @jsii.member(jsii_name="toGetBackupSelection")
    def to_get_backup_selection(self) -> "Backup":
        '''(experimental) Grants permission to get a backup plan resource assignment.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_GetBackupSelection.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toGetBackupSelection", []))

    @jsii.member(jsii_name="toGetBackupVaultAccessPolicy")
    def to_get_backup_vault_access_policy(self) -> "Backup":
        '''(experimental) Grants permission to get backup vault access policy.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_GetBackupVaultAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toGetBackupVaultAccessPolicy", []))

    @jsii.member(jsii_name="toGetBackupVaultNotifications")
    def to_get_backup_vault_notifications(self) -> "Backup":
        '''(experimental) Grants permission to get backup vault notifications.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_GetBackupVaultNotifications.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toGetBackupVaultNotifications", []))

    @jsii.member(jsii_name="toGetLegalHold")
    def to_get_legal_hold(self) -> "Backup":
        '''(experimental) Grants permission to get a legal hold.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_GetLegalHold.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toGetLegalHold", []))

    @jsii.member(jsii_name="toGetRecoveryPointRestoreMetadata")
    def to_get_recovery_point_restore_metadata(self) -> "Backup":
        '''(experimental) Grants permission to get recovery point restore metadata.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_GetRecoveryPointRestoreMetadata.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toGetRecoveryPointRestoreMetadata", []))

    @jsii.member(jsii_name="toGetSupportedResourceTypes")
    def to_get_supported_resource_types(self) -> "Backup":
        '''(experimental) Grants permission to get supported resource types.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_GetSupportedResourceTypes.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toGetSupportedResourceTypes", []))

    @jsii.member(jsii_name="toListBackupJobs")
    def to_list_backup_jobs(self) -> "Backup":
        '''(experimental) Grants permission to list backup jobs.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListBackupJobs.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListBackupJobs", []))

    @jsii.member(jsii_name="toListBackupPlans")
    def to_list_backup_plans(self) -> "Backup":
        '''(experimental) Grants permission to list backup plans.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListBackupPlans.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListBackupPlans", []))

    @jsii.member(jsii_name="toListBackupPlanTemplates")
    def to_list_backup_plan_templates(self) -> "Backup":
        '''(experimental) Grants permission to list backup plan templates provided by AWS Backup.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListBackupPlanTemplates.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListBackupPlanTemplates", []))

    @jsii.member(jsii_name="toListBackupPlanVersions")
    def to_list_backup_plan_versions(self) -> "Backup":
        '''(experimental) Grants permission to list backup plan versions.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListBackupPlanVersions.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListBackupPlanVersions", []))

    @jsii.member(jsii_name="toListBackupSelections")
    def to_list_backup_selections(self) -> "Backup":
        '''(experimental) Grants permission to list resource assignments for a specific backup plan.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListBackupSelections.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListBackupSelections", []))

    @jsii.member(jsii_name="toListBackupVaults")
    def to_list_backup_vaults(self) -> "Backup":
        '''(experimental) Grants permission to list backup vaults.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListBackupVaults.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListBackupVaults", []))

    @jsii.member(jsii_name="toListCopyJobs")
    def to_list_copy_jobs(self) -> "Backup":
        '''(experimental) Grants permission to list copy jobs.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListCopyJobs.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListCopyJobs", []))

    @jsii.member(jsii_name="toListFrameworks")
    def to_list_frameworks(self) -> "Backup":
        '''(experimental) Grants permission to list frameworks.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListFrameworks.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListFrameworks", []))

    @jsii.member(jsii_name="toListLegalHolds")
    def to_list_legal_holds(self) -> "Backup":
        '''(experimental) Grants permission to list legal holds.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListLegalHolds.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListLegalHolds", []))

    @jsii.member(jsii_name="toListProtectedResources")
    def to_list_protected_resources(self) -> "Backup":
        '''(experimental) Grants permission to list protected resources by AWS Backup.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListProtectedResources.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListProtectedResources", []))

    @jsii.member(jsii_name="toListRecoveryPointsByBackupVault")
    def to_list_recovery_points_by_backup_vault(self) -> "Backup":
        '''(experimental) Grants permission to list recovery points inside a backup vault.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListRecoveryPointsByBackupVault.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListRecoveryPointsByBackupVault", []))

    @jsii.member(jsii_name="toListRecoveryPointsByLegalHold")
    def to_list_recovery_points_by_legal_hold(self) -> "Backup":
        '''(experimental) Grants permission to list recovery points by legal hold.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListRecoveryPointsByLegalHold.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListRecoveryPointsByLegalHold", []))

    @jsii.member(jsii_name="toListRecoveryPointsByResource")
    def to_list_recovery_points_by_resource(self) -> "Backup":
        '''(experimental) Grants permission to list recovery points for a resource.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListRecoveryPointsByResource.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListRecoveryPointsByResource", []))

    @jsii.member(jsii_name="toListReportJobs")
    def to_list_report_jobs(self) -> "Backup":
        '''(experimental) Grants permission to list report jobs.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListReportJobs.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListReportJobs", []))

    @jsii.member(jsii_name="toListReportPlans")
    def to_list_report_plans(self) -> "Backup":
        '''(experimental) Grants permission to list report plans.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListReportPlans.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListReportPlans", []))

    @jsii.member(jsii_name="toListRestoreJobs")
    def to_list_restore_jobs(self) -> "Backup":
        '''(experimental) Grants permission to lists restore jobs.

        Access Level: List

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListRestoreJobs.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListRestoreJobs", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Backup":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_ListTags.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toPutBackupVaultAccessPolicy")
    def to_put_backup_vault_access_policy(self) -> "Backup":
        '''(experimental) Grants permission to add an access policy to the backup vault.

        Access Level: Permissions management

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_PutBackupVaultAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toPutBackupVaultAccessPolicy", []))

    @jsii.member(jsii_name="toPutBackupVaultLockConfiguration")
    def to_put_backup_vault_lock_configuration(self) -> "Backup":
        '''(experimental) Grants permission to add a lock configuration to the backup vault.

        Access Level: Write

        Possible conditions:

        - .ifChangeableForDays()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_PutBackupVaultLockConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toPutBackupVaultLockConfiguration", []))

    @jsii.member(jsii_name="toPutBackupVaultNotifications")
    def to_put_backup_vault_notifications(self) -> "Backup":
        '''(experimental) Grants permission to add an SNS topic to the backup vault.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_PutBackupVaultNotifications.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toPutBackupVaultNotifications", []))

    @jsii.member(jsii_name="toStartBackupJob")
    def to_start_backup_job(self) -> "Backup":
        '''(experimental) Grants permission to start a new backup job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_StartBackupJob.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toStartBackupJob", []))

    @jsii.member(jsii_name="toStartCopyJob")
    def to_start_copy_job(self) -> "Backup":
        '''(experimental) Grants permission to copy a backup from a source backup vault to a destination backup vault.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_StartCopyJob.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toStartCopyJob", []))

    @jsii.member(jsii_name="toStartReportJob")
    def to_start_report_job(self) -> "Backup":
        '''(experimental) Grants permission to start a new report job.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_StartReportJob.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toStartReportJob", []))

    @jsii.member(jsii_name="toStartRestoreJob")
    def to_start_restore_job(self) -> "Backup":
        '''(experimental) Grants permission to start a new restore job.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_StartRestoreJob.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toStartRestoreJob", []))

    @jsii.member(jsii_name="toStopBackupJob")
    def to_stop_backup_job(self) -> "Backup":
        '''(experimental) Grants permission to stop a backup job.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_StopBackupJob.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toStopBackupJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Backup":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Backup":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateBackupPlan")
    def to_update_backup_plan(self) -> "Backup":
        '''(experimental) Grants permission to update a backup plan.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_UpdateBackupPlan.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toUpdateBackupPlan", []))

    @jsii.member(jsii_name="toUpdateFramework")
    def to_update_framework(self) -> "Backup":
        '''(experimental) Grants permission to update a framework.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_UpdateFramework.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toUpdateFramework", []))

    @jsii.member(jsii_name="toUpdateGlobalSettings")
    def to_update_global_settings(self) -> "Backup":
        '''(experimental) Grants permission to update the current global settings for the AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_UpdateGlobalSettings.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toUpdateGlobalSettings", []))

    @jsii.member(jsii_name="toUpdateRecoveryPointLifecycle")
    def to_update_recovery_point_lifecycle(self) -> "Backup":
        '''(experimental) Grants permission to update the lifecycle of the recovery point.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_UpdateRecoveryPointLifecycle.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toUpdateRecoveryPointLifecycle", []))

    @jsii.member(jsii_name="toUpdateRegionSettings")
    def to_update_region_settings(self) -> "Backup":
        '''(experimental) Grants permission to update the current service opt-in settings for the Region.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_UpdateRegionSettings.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toUpdateRegionSettings", []))

    @jsii.member(jsii_name="toUpdateReportPlan")
    def to_update_report_plan(self) -> "Backup":
        '''(experimental) Grants permission to update a report plan.

        Access Level: Write

        Possible conditions:

        - .ifFrameworkArns()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_UpdateReportPlan.html

        :stability: experimental
        '''
        return typing.cast("Backup", jsii.invoke(self, "toUpdateReportPlan", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d124452734450e9f4cc1971dd9ad6792603b7cc0b55c390e20a09b91d686ad1e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__87d0670eabe1e87448387ee10e4248e8e385caec303410f24d37aa1cd6e95ed4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class BackupGateway(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.BackupGateway",
):
    '''(experimental) Statement provider for service `backup-gateway <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbackupgateway.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `backup-gateway <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbackupgateway.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__44ccd6ee47869e62636a81830ce86552370b10af2bfee0c2167823b9e571505f)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onGateway")
    def on_gateway(
        self,
        gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "BackupGateway":
        '''(experimental) Adds a resource of type gateway to the statement.

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_Gateway.html

        :param gateway_id: - Identifier for the gatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6950ee71a4f5c32212625cc5fc399885cf03402a98634a04491bcfac2161848f)
            check_type(argname="argument gateway_id", value=gateway_id, expected_type=type_hints["gateway_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("BackupGateway", jsii.invoke(self, "onGateway", [gateway_id, account, partition]))

    @jsii.member(jsii_name="onHypervisor")
    def on_hypervisor(
        self,
        hypervisor_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "BackupGateway":
        '''(experimental) Adds a resource of type hypervisor to the statement.

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_Hypervisor.html

        :param hypervisor_id: - Identifier for the hypervisorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c925077c41dbcc1b5789553dd92ced31d764c3aca54c8c28e442d49cc7e6f832)
            check_type(argname="argument hypervisor_id", value=hypervisor_id, expected_type=type_hints["hypervisor_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("BackupGateway", jsii.invoke(self, "onHypervisor", [hypervisor_id, account, partition]))

    @jsii.member(jsii_name="onVirtualmachine")
    def on_virtualmachine(
        self,
        virtualmachine_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "BackupGateway":
        '''(experimental) Adds a resource of type virtualmachine to the statement.

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_VirtualMachine.html

        :param virtualmachine_id: - Identifier for the virtualmachineId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9b83f29bd420b71eb19ecb6fddd83e2b69826d744c74eb6e5af3d00016c4fd88)
            check_type(argname="argument virtualmachine_id", value=virtualmachine_id, expected_type=type_hints["virtualmachine_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("BackupGateway", jsii.invoke(self, "onVirtualmachine", [virtualmachine_id, account, partition]))

    @jsii.member(jsii_name="toAssociateGatewayToServer")
    def to_associate_gateway_to_server(self) -> "BackupGateway":
        '''(experimental) Grants permission to AssociateGatewayToServer.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_AssociateGatewayToServer.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toAssociateGatewayToServer", []))

    @jsii.member(jsii_name="toBackup")
    def to_backup(self) -> "BackupGateway":
        '''(experimental) Grants permission to Backup.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_StartBackupJob.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toBackup", []))

    @jsii.member(jsii_name="toCreateGateway")
    def to_create_gateway(self) -> "BackupGateway":
        '''(experimental) Grants permission to to CreateGateway.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_CreateGateway.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toCreateGateway", []))

    @jsii.member(jsii_name="toDeleteGateway")
    def to_delete_gateway(self) -> "BackupGateway":
        '''(experimental) Grants permission to DeleteGateway.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_DeleteGateway.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toDeleteGateway", []))

    @jsii.member(jsii_name="toDeleteHypervisor")
    def to_delete_hypervisor(self) -> "BackupGateway":
        '''(experimental) Grants permission to DeleteHypervisor.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_DeleteHypervisor.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toDeleteHypervisor", []))

    @jsii.member(jsii_name="toDisassociateGatewayFromServer")
    def to_disassociate_gateway_from_server(self) -> "BackupGateway":
        '''(experimental) Grants permission to DisassociateGatewayFromServer.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_DisassociateGatewayFromServer.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toDisassociateGatewayFromServer", []))

    @jsii.member(jsii_name="toGetBandwidthRateLimitSchedule")
    def to_get_bandwidth_rate_limit_schedule(self) -> "BackupGateway":
        '''(experimental) Grants permission to GetBandwidthRateLimitSchedule.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_GetBandwidthRateLimitSchedule.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toGetBandwidthRateLimitSchedule", []))

    @jsii.member(jsii_name="toGetGateway")
    def to_get_gateway(self) -> "BackupGateway":
        '''(experimental) Grants permission to GetGateway.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_GetGateway.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toGetGateway", []))

    @jsii.member(jsii_name="toGetHypervisor")
    def to_get_hypervisor(self) -> "BackupGateway":
        '''(experimental) Grants permission to GetHypervisor.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_GetHypervisor.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toGetHypervisor", []))

    @jsii.member(jsii_name="toGetHypervisorPropertyMappings")
    def to_get_hypervisor_property_mappings(self) -> "BackupGateway":
        '''(experimental) Grants permission to GetHypervisorPropertyMappings.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_GetHypervisorPropertyMappings.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toGetHypervisorPropertyMappings", []))

    @jsii.member(jsii_name="toGetVirtualMachine")
    def to_get_virtual_machine(self) -> "BackupGateway":
        '''(experimental) Grants permission to GetVirtualMachine.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_GetVirtualMachine.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toGetVirtualMachine", []))

    @jsii.member(jsii_name="toImportHypervisorConfiguration")
    def to_import_hypervisor_configuration(self) -> "BackupGateway":
        '''(experimental) Grants permission to ImportHypervisorConfiguration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_ImportHypervisorConfiguration.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toImportHypervisorConfiguration", []))

    @jsii.member(jsii_name="toListGateways")
    def to_list_gateways(self) -> "BackupGateway":
        '''(experimental) Grants permission to ListGateways.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_ListGateways.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toListGateways", []))

    @jsii.member(jsii_name="toListHypervisors")
    def to_list_hypervisors(self) -> "BackupGateway":
        '''(experimental) Grants permission to ListHypervisors.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_ListHypervisors.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toListHypervisors", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "BackupGateway":
        '''(experimental) Grants permission to ListTagsForResource.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListVirtualMachines")
    def to_list_virtual_machines(self) -> "BackupGateway":
        '''(experimental) Grants permission to ListVirtualMachines.

        Access Level: Read

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_ListVirtualMachines.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toListVirtualMachines", []))

    @jsii.member(jsii_name="toPutBandwidthRateLimitSchedule")
    def to_put_bandwidth_rate_limit_schedule(self) -> "BackupGateway":
        '''(experimental) Grants permission to PutBandwidthRateLimitSchedule.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_PutBandwidthRateLimitSchedule.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toPutBandwidthRateLimitSchedule", []))

    @jsii.member(jsii_name="toPutHypervisorPropertyMappings")
    def to_put_hypervisor_property_mappings(self) -> "BackupGateway":
        '''(experimental) Grants permission to PutHypervisorPropertyMappings.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_PutHypervisorPropertyMappings.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toPutHypervisorPropertyMappings", []))

    @jsii.member(jsii_name="toPutMaintenanceStartTime")
    def to_put_maintenance_start_time(self) -> "BackupGateway":
        '''(experimental) Grants permission to PutMaintenanceStartTime.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_PutMaintenanceStartTime.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toPutMaintenanceStartTime", []))

    @jsii.member(jsii_name="toRestore")
    def to_restore(self) -> "BackupGateway":
        '''(experimental) Grants permission to Restore.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_StartRestoreJob.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toRestore", []))

    @jsii.member(jsii_name="toStartVirtualMachinesMetadataSync")
    def to_start_virtual_machines_metadata_sync(self) -> "BackupGateway":
        '''(experimental) Grants permission to StartVirtualMachinesMetadataSync.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_StartVirtualMachinesMetadataSync.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toStartVirtualMachinesMetadataSync", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "BackupGateway":
        '''(experimental) Grants permission to TagResource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_TagResource.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestHypervisorConfiguration")
    def to_test_hypervisor_configuration(self) -> "BackupGateway":
        '''(experimental) Grants permission to TestHypervisorConfiguration.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_TestHypervisorConfiguration.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toTestHypervisorConfiguration", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "BackupGateway":
        '''(experimental) Grants permission to UntagResource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateGatewayInformation")
    def to_update_gateway_information(self) -> "BackupGateway":
        '''(experimental) Grants permission to UpdateGatewayInformation.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_UpdateGatewayInformation.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toUpdateGatewayInformation", []))

    @jsii.member(jsii_name="toUpdateGatewaySoftwareNow")
    def to_update_gateway_software_now(self) -> "BackupGateway":
        '''(experimental) Grants permission to UpdateGatewaySoftwareNow.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_UpdateGatewaySoftwareNow.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toUpdateGatewaySoftwareNow", []))

    @jsii.member(jsii_name="toUpdateHypervisor")
    def to_update_hypervisor(self) -> "BackupGateway":
        '''(experimental) Grants permission to UpdateHypervisor.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_BGW_UpdateHypervisor.html

        :stability: experimental
        '''
        return typing.cast("BackupGateway", jsii.invoke(self, "toUpdateHypervisor", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__04b48a8c2c44a68899bf91452ca616a45c6692bcd5eab72efc2f26a6436f3755)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__37bbf79aecec4119d28ee501057817facc88ad16a0bdc4635957ae9960ee28c4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class BackupStorage(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.BackupStorage",
):
    '''(experimental) Statement provider for service `backup-storage <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbackupstorage.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `backup-storage <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbackupstorage.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fe09a130f65ea3a7c1921034d3049e7a6a0df3f719b6f28d823cb952fd81a051)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toCommitBackupJob")
    def to_commit_backup_job(self) -> "BackupStorage":
        '''(experimental) Grants permission to commit backup job.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-data-transfer.html

        :stability: experimental
        '''
        return typing.cast("BackupStorage", jsii.invoke(self, "toCommitBackupJob", []))

    @jsii.member(jsii_name="toDeleteObjects")
    def to_delete_objects(self) -> "BackupStorage":
        '''(experimental) Grants permission to delete objects.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-data-transfer.html

        :stability: experimental
        '''
        return typing.cast("BackupStorage", jsii.invoke(self, "toDeleteObjects", []))

    @jsii.member(jsii_name="toDescribeBackupJob")
    def to_describe_backup_job(self) -> "BackupStorage":
        '''(experimental) Grants permission to describe backup job.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-data-transfer.html

        :stability: experimental
        '''
        return typing.cast("BackupStorage", jsii.invoke(self, "toDescribeBackupJob", []))

    @jsii.member(jsii_name="toGetBaseBackup")
    def to_get_base_backup(self) -> "BackupStorage":
        '''(experimental) Grants permission to get base backup.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-data-transfer.html

        :stability: experimental
        '''
        return typing.cast("BackupStorage", jsii.invoke(self, "toGetBaseBackup", []))

    @jsii.member(jsii_name="toGetChunk")
    def to_get_chunk(self) -> "BackupStorage":
        '''(experimental) Grants permission to get data from a recovery point for a restore job.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-data-transfer.html

        :stability: experimental
        '''
        return typing.cast("BackupStorage", jsii.invoke(self, "toGetChunk", []))

    @jsii.member(jsii_name="toGetIncrementalBaseBackup")
    def to_get_incremental_base_backup(self) -> "BackupStorage":
        '''(experimental) Grants permission to get incremental base backup.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-data-transfer.html

        :stability: experimental
        '''
        return typing.cast("BackupStorage", jsii.invoke(self, "toGetIncrementalBaseBackup", []))

    @jsii.member(jsii_name="toGetObjectMetadata")
    def to_get_object_metadata(self) -> "BackupStorage":
        '''(experimental) Grants permission to get metadata from a recovery point for a restore job.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-data-transfer.html

        :stability: experimental
        '''
        return typing.cast("BackupStorage", jsii.invoke(self, "toGetObjectMetadata", []))

    @jsii.member(jsii_name="toListChunks")
    def to_list_chunks(self) -> "BackupStorage":
        '''(experimental) Grants permission to list data from a recovery point for a restore job.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-data-transfer.html

        :stability: experimental
        '''
        return typing.cast("BackupStorage", jsii.invoke(self, "toListChunks", []))

    @jsii.member(jsii_name="toListObjects")
    def to_list_objects(self) -> "BackupStorage":
        '''(experimental) Grants permission to list data from a recovery point for a restore job.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-data-transfer.html

        :stability: experimental
        '''
        return typing.cast("BackupStorage", jsii.invoke(self, "toListObjects", []))

    @jsii.member(jsii_name="toMountCapsule")
    def to_mount_capsule(self) -> "BackupStorage":
        '''(experimental) Associates a KMS key to a backup vault.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/API_CreateBackupVault.html

        :stability: experimental
        '''
        return typing.cast("BackupStorage", jsii.invoke(self, "toMountCapsule", []))

    @jsii.member(jsii_name="toNotifyObjectComplete")
    def to_notify_object_complete(self) -> "BackupStorage":
        '''(experimental) Grants permission to mark an uploaded data as completed for a backup job.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-data-transfer.html

        :stability: experimental
        '''
        return typing.cast("BackupStorage", jsii.invoke(self, "toNotifyObjectComplete", []))

    @jsii.member(jsii_name="toPutChunk")
    def to_put_chunk(self) -> "BackupStorage":
        '''(experimental) Grants permission to upload data to an AWS Backup-managed recovery point for a backup job.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-data-transfer.html

        :stability: experimental
        '''
        return typing.cast("BackupStorage", jsii.invoke(self, "toPutChunk", []))

    @jsii.member(jsii_name="toPutObject")
    def to_put_object(self) -> "BackupStorage":
        '''(experimental) Grants permission to put object.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-data-transfer.html

        :stability: experimental
        '''
        return typing.cast("BackupStorage", jsii.invoke(self, "toPutObject", []))

    @jsii.member(jsii_name="toStartObject")
    def to_start_object(self) -> "BackupStorage":
        '''(experimental) Grants permission to upload data to an AWS Backup-managed recovery point for a backup job.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-data-transfer.html

        :stability: experimental
        '''
        return typing.cast("BackupStorage", jsii.invoke(self, "toStartObject", []))

    @jsii.member(jsii_name="toUpdateObjectComplete")
    def to_update_object_complete(self) -> "BackupStorage":
        '''(experimental) Grants permission to update object complete.

        Access Level: Write

        https://docs.aws.amazon.com/aws-backup/latest/devguide/backup-data-transfer.html

        :stability: experimental
        '''
        return typing.cast("BackupStorage", jsii.invoke(self, "toUpdateObjectComplete", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5ea131868eda6bd1e10b5c34a10254ea5a7c73c5572e704c31d5b6c6bd0fa8a9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c14cfc92503d02f081e19aac071f3ffe0626931f6a0c0325b457443bd5b9c3af)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Batch(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Batch"):
    '''(experimental) Statement provider for service `batch <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `batch <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__729ebeace8c71482c60d51d582c66609e34aac4b48af87312b1506f81e733781)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAWSLogsCreateGroup")
    def if_aws_logs_create_group(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Batch":
        '''(experimental) Filters access by the specified logging driver to determine whether awslogs group will be created for the logs.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6e775683859f316f87d2102d1bffe56a7f3e4635770078c0a2176d0bb49a421a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Batch", jsii.invoke(self, "ifAWSLogsCreateGroup", [value]))

    @jsii.member(jsii_name="ifAWSLogsGroup")
    def if_aws_logs_group(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Batch":
        '''(experimental) Filters access by the awslogs group where the logs are located.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c7b5e9719bd8bc150f504d38073ecb07f5dcfb1d22c610452e92436918175c4c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Batch", jsii.invoke(self, "ifAWSLogsGroup", [value, operator]))

    @jsii.member(jsii_name="ifAWSLogsRegion")
    def if_aws_logs_region(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Batch":
        '''(experimental) Filters access by the region where the logs are sent to.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5c5fc492427fb6a8ef0d402ebd910874abc5a1c8199c529d0a800792062179de)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Batch", jsii.invoke(self, "ifAWSLogsRegion", [value, operator]))

    @jsii.member(jsii_name="ifAWSLogsStreamPrefix")
    def if_aws_logs_stream_prefix(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Batch":
        '''(experimental) Filters access by the awslogs log stream prefix.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3d5c9caeef5afd80227a031b29529adba9910f54566cbfcd6c71366f8766c4f2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Batch", jsii.invoke(self, "ifAWSLogsStreamPrefix", [value, operator]))

    @jsii.member(jsii_name="ifEKSImage")
    def if_eks_image(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Batch":
        '''(experimental) Filters access by the image used to start a container for an Amazon EKS job.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()
        - .toSubmitJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a95387d28b30830433d145b1f749aa4d97a348ca79e5384632c43e47c15f1a54)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Batch", jsii.invoke(self, "ifEKSImage", [value, operator]))

    @jsii.member(jsii_name="ifEKSPrivileged")
    def if_eks_privileged(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Batch":
        '''(experimental) Filters access by the specified privileged parameter value that determines whether the container is given elevated privileges on the host container instance (similar to the root user) for an Amazon EKS job.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__310a56081149883a5b9b74dbd16622a4c464f7cee3b6251414859c6e3e435356)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Batch", jsii.invoke(self, "ifEKSPrivileged", [value]))

    @jsii.member(jsii_name="ifEKSRunAsGroup")
    def if_eks_run_as_group(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Batch":
        '''(experimental) Filters access by the specified group numeric ID (gid) used to start a container in an Amazon EKS job.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b4d0208d9084d7cf658bb01c7afe46e7d6ae1265d6f8bb08dd4d5d41e1cc490a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Batch", jsii.invoke(self, "ifEKSRunAsGroup", [value, operator]))

    @jsii.member(jsii_name="ifEKSRunAsUser")
    def if_eks_run_as_user(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Batch":
        '''(experimental) Filters access by the specified user numeric ID (uid) used to start a a container in an Amazon EKS job.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6821ffcbe22f58eb4440a8d9bf76fd931dbf226aff004c795016a2305a1a348e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Batch", jsii.invoke(self, "ifEKSRunAsUser", [value, operator]))

    @jsii.member(jsii_name="ifEKSServiceAccountName")
    def if_eks_service_account_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Batch":
        '''(experimental) Filters access by the name of the service account used to run the pod for an Amazon EKS job.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__422517ce44b51e351ac50489b50ee2c2a74fdb10c68667522054ec49186ead49)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Batch", jsii.invoke(self, "ifEKSServiceAccountName", [value, operator]))

    @jsii.member(jsii_name="ifImage")
    def if_image(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Batch":
        '''(experimental) Filters access by the image used to start a container.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6ae3ea96ddd7f8991512960f1aaf89707058952d8fdb660fd4297e5865189b2d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Batch", jsii.invoke(self, "ifImage", [value, operator]))

    @jsii.member(jsii_name="ifLogDriver")
    def if_log_driver(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Batch":
        '''(experimental) Filters access by the log driver used for the container.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8f29324403c0dda932375e7febc07bb88c33fa6e42ee57cc92f07d52bf9f5c3d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Batch", jsii.invoke(self, "ifLogDriver", [value, operator]))

    @jsii.member(jsii_name="ifPrivileged")
    def if_privileged(self, value: typing.Optional[builtins.bool] = None) -> "Batch":
        '''(experimental) Filters access by the specified privileged parameter value that determines whether the container is given elevated privileges on the host container instance (similar to the root user).

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eaadac3d4a38b0a7071c14c5c19921a8ab7ceaec828fe5ef63560a9ff431cb89)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Batch", jsii.invoke(self, "ifPrivileged", [value]))

    @jsii.member(jsii_name="ifShareIdentifier")
    def if_share_identifier(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Batch":
        '''(experimental) Filters access by the shareIdentifier used inside submit job.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toSubmitJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__93c24adb0925e5266eaa810f45eb98a8f995d74636c7c30bd58efbc0577b52a3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Batch", jsii.invoke(self, "ifShareIdentifier", [value, operator]))

    @jsii.member(jsii_name="ifUser")
    def if_user(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Batch":
        '''(experimental) Filters access by user name or numeric uid used inside the container.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbatch.html#awsbatch-policy-keys

        Applies to actions:

        - .toRegisterJobDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__63a42f74e8d4ea8c3c6c805b978f10a19594080263ec3c5574c4f75d5a577004)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Batch", jsii.invoke(self, "ifUser", [value, operator]))

    @jsii.member(jsii_name="onComputeEnvironment")
    def on_compute_environment(
        self,
        compute_environment_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Batch":
        '''(experimental) Adds a resource of type compute-environment to the statement.

        https://docs.aws.amazon.com/batch/latest/userguide/compute_environments.html

        :param compute_environment_name: - Identifier for the computeEnvironmentName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__276681df06807e87e204492dae639ff24dc3b813d0150ac540797a88e568d92f)
            check_type(argname="argument compute_environment_name", value=compute_environment_name, expected_type=type_hints["compute_environment_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Batch", jsii.invoke(self, "onComputeEnvironment", [compute_environment_name, account, region, partition]))

    @jsii.member(jsii_name="onJob")
    def on_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Batch":
        '''(experimental) Adds a resource of type job to the statement.

        https://docs.aws.amazon.com/batch/latest/userguide/jobs.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c7b8712fed4156c7f2f204b81d7c22ccf09cd41fcff81a1ae312ea9be5ff2316)
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Batch", jsii.invoke(self, "onJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onJobDefinition")
    def on_job_definition(
        self,
        job_definition_name: builtins.str,
        revision: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Batch":
        '''(experimental) Adds a resource of type job-definition to the statement.

        https://docs.aws.amazon.com/batch/latest/userguide/job_definitions.html

        :param job_definition_name: - Identifier for the jobDefinitionName.
        :param revision: - Identifier for the revision.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6d66b6c43e3e65ee46dc5b9450d56cfa5806cebd94067d04d173681bcfdaf9a5)
            check_type(argname="argument job_definition_name", value=job_definition_name, expected_type=type_hints["job_definition_name"])
            check_type(argname="argument revision", value=revision, expected_type=type_hints["revision"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Batch", jsii.invoke(self, "onJobDefinition", [job_definition_name, revision, account, region, partition]))

    @jsii.member(jsii_name="onJobQueue")
    def on_job_queue(
        self,
        job_queue_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Batch":
        '''(experimental) Adds a resource of type job-queue to the statement.

        https://docs.aws.amazon.com/batch/latest/userguide/job_queues.html

        :param job_queue_name: - Identifier for the jobQueueName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c8e4899cb043e1e623aaf5b6372a3ca9473d85e98dfd5a7d597bcb8164497826)
            check_type(argname="argument job_queue_name", value=job_queue_name, expected_type=type_hints["job_queue_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Batch", jsii.invoke(self, "onJobQueue", [job_queue_name, account, region, partition]))

    @jsii.member(jsii_name="onSchedulingPolicy")
    def on_scheduling_policy(
        self,
        scheduling_policy_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Batch":
        '''(experimental) Adds a resource of type scheduling-policy to the statement.

        https://docs.aws.amazon.com/batch/latest/userguide/scheduling-policies.html

        :param scheduling_policy_name: - Identifier for the schedulingPolicyName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5f900e41c76c4ba1bcebeba9beb4a123e5d8d6dbdf402e54b7f4c2ef932ba880)
            check_type(argname="argument scheduling_policy_name", value=scheduling_policy_name, expected_type=type_hints["scheduling_policy_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Batch", jsii.invoke(self, "onSchedulingPolicy", [scheduling_policy_name, account, region, partition]))

    @jsii.member(jsii_name="toCancelJob")
    def to_cancel_job(self) -> "Batch":
        '''(experimental) Grants permission to cancel a job in an AWS Batch job queue in your account.

        Access Level: Write

        https://docs.aws.amazon.com/batch/latest/APIReference/API_CancelJob.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toCancelJob", []))

    @jsii.member(jsii_name="toCreateComputeEnvironment")
    def to_create_compute_environment(self) -> "Batch":
        '''(experimental) Grants permission to create an AWS Batch compute environment in your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/batch/latest/APIReference/API_CreateComputeEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toCreateComputeEnvironment", []))

    @jsii.member(jsii_name="toCreateJobQueue")
    def to_create_job_queue(self) -> "Batch":
        '''(experimental) Grants permission to create an AWS Batch job queue in your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/batch/latest/APIReference/API_CreateJobQueue.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toCreateJobQueue", []))

    @jsii.member(jsii_name="toCreateSchedulingPolicy")
    def to_create_scheduling_policy(self) -> "Batch":
        '''(experimental) Grants permission to create an AWS Batch scheduling policy in your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/batch/latest/APIReference/API_CreateSchedulingPolicy.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toCreateSchedulingPolicy", []))

    @jsii.member(jsii_name="toDeleteComputeEnvironment")
    def to_delete_compute_environment(self) -> "Batch":
        '''(experimental) Grants permission to delete an AWS Batch compute environment in your account.

        Access Level: Write

        https://docs.aws.amazon.com/batch/latest/APIReference/API_DeleteComputeEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toDeleteComputeEnvironment", []))

    @jsii.member(jsii_name="toDeleteJobQueue")
    def to_delete_job_queue(self) -> "Batch":
        '''(experimental) Grants permission to delete an AWS Batch job queue in your account.

        Access Level: Write

        https://docs.aws.amazon.com/batch/latest/APIReference/API_DeleteJobQueue.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toDeleteJobQueue", []))

    @jsii.member(jsii_name="toDeleteSchedulingPolicy")
    def to_delete_scheduling_policy(self) -> "Batch":
        '''(experimental) Grants permission to delete an AWS Batch scheduling policy in your account.

        Access Level: Write

        https://docs.aws.amazon.com/batch/latest/APIReference/API_DeleteSchedulingPolicy.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toDeleteSchedulingPolicy", []))

    @jsii.member(jsii_name="toDeregisterJobDefinition")
    def to_deregister_job_definition(self) -> "Batch":
        '''(experimental) Grants permission to deregister an AWS Batch job definition in your account.

        Access Level: Write

        https://docs.aws.amazon.com/batch/latest/APIReference/API_DeregisterJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toDeregisterJobDefinition", []))

    @jsii.member(jsii_name="toDescribeComputeEnvironments")
    def to_describe_compute_environments(self) -> "Batch":
        '''(experimental) Grants permission to describe one or more AWS Batch compute environments in your account.

        Access Level: Read

        https://docs.aws.amazon.com/batch/latest/APIReference/API_DescribeComputeEnvironments.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toDescribeComputeEnvironments", []))

    @jsii.member(jsii_name="toDescribeJobDefinitions")
    def to_describe_job_definitions(self) -> "Batch":
        '''(experimental) Grants permission to describe one or more AWS Batch job definitions in your account.

        Access Level: Read

        https://docs.aws.amazon.com/batch/latest/APIReference/API_DescribeJobDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toDescribeJobDefinitions", []))

    @jsii.member(jsii_name="toDescribeJobQueues")
    def to_describe_job_queues(self) -> "Batch":
        '''(experimental) Grants permission to describe one or more AWS Batch job queues in your account.

        Access Level: Read

        https://docs.aws.amazon.com/batch/latest/APIReference/API_DescribeJobQueues.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toDescribeJobQueues", []))

    @jsii.member(jsii_name="toDescribeJobs")
    def to_describe_jobs(self) -> "Batch":
        '''(experimental) Grants permission to describe a list of AWS Batch jobs in your account.

        Access Level: Read

        https://docs.aws.amazon.com/batch/latest/APIReference/API_DescribeJobs.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toDescribeJobs", []))

    @jsii.member(jsii_name="toDescribeSchedulingPolicies")
    def to_describe_scheduling_policies(self) -> "Batch":
        '''(experimental) Grants permission to describe one or more AWS Batch scheduling policies in your account.

        Access Level: Read

        https://docs.aws.amazon.com/batch/latest/APIReference/API_DescribeSchedulingPolicies.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toDescribeSchedulingPolicies", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Batch":
        '''(experimental) Grants permission to list jobs for a specified AWS Batch job queue in your account.

        Access Level: List

        https://docs.aws.amazon.com/batch/latest/APIReference/API_ListJobs.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListSchedulingPolicies")
    def to_list_scheduling_policies(self) -> "Batch":
        '''(experimental) Grants permission to list AWS Batch scheduling policies in your account.

        Access Level: Read

        https://docs.aws.amazon.com/batch/latest/APIReference/API_ListSchedulingPolicies.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toListSchedulingPolicies", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Batch":
        '''(experimental) Grants permission to list tags for an AWS Batch resource in your account.

        Access Level: Read

        https://docs.aws.amazon.com/batch/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRegisterJobDefinition")
    def to_register_job_definition(self) -> "Batch":
        '''(experimental) Grants permission to register an AWS Batch job definition in your account.

        Access Level: Write

        Possible conditions:

        - .ifUser()
        - .ifPrivileged()
        - .ifImage()
        - .ifLogDriver()
        - .ifAWSLogsGroup()
        - .ifAWSLogsRegion()
        - .ifAWSLogsStreamPrefix()
        - .ifAWSLogsCreateGroup()
        - .ifEKSServiceAccountName()
        - .ifEKSImage()
        - .ifEKSRunAsUser()
        - .ifEKSRunAsGroup()
        - .ifEKSPrivileged()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/batch/latest/APIReference/API_RegisterJobDefinition.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toRegisterJobDefinition", []))

    @jsii.member(jsii_name="toSubmitJob")
    def to_submit_job(self) -> "Batch":
        '''(experimental) Grants permission to submit an AWS Batch job from a job definition in your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifShareIdentifier()
        - .ifEKSImage()

        https://docs.aws.amazon.com/batch/latest/APIReference/API_SubmitJob.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toSubmitJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Batch":
        '''(experimental) Grants permission to tag an AWS Batch resource in your account.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/batch/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTerminateJob")
    def to_terminate_job(self) -> "Batch":
        '''(experimental) Grants permission to terminate a job in an AWS Batch job queue in your account.

        Access Level: Write

        https://docs.aws.amazon.com/batch/latest/APIReference/API_TerminateJob.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toTerminateJob", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Batch":
        '''(experimental) Grants permission to untag an AWS Batch resource in your account.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/batch/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateComputeEnvironment")
    def to_update_compute_environment(self) -> "Batch":
        '''(experimental) Grants permission to update an AWS Batch compute environment in your account.

        Access Level: Write

        https://docs.aws.amazon.com/batch/latest/APIReference/API_UpdateComputeEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toUpdateComputeEnvironment", []))

    @jsii.member(jsii_name="toUpdateJobQueue")
    def to_update_job_queue(self) -> "Batch":
        '''(experimental) Grants permission to update an AWS Batch job queue in your account.

        Access Level: Write

        https://docs.aws.amazon.com/batch/latest/APIReference/API_UpdateJobQueue.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toUpdateJobQueue", []))

    @jsii.member(jsii_name="toUpdateSchedulingPolicy")
    def to_update_scheduling_policy(self) -> "Batch":
        '''(experimental) Grants permission to update an AWS Batch scheduling policy in your account.

        Access Level: Write

        https://docs.aws.amazon.com/batch/latest/APIReference/API_UpdateSchedulingPolicy.html

        :stability: experimental
        '''
        return typing.cast("Batch", jsii.invoke(self, "toUpdateSchedulingPolicy", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e3c80868df4f2abb50fe3e825697fbb936ab49d02d2a1e4077825e3bb63a458b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__415a4fa0103919a766a5a9d5a5f218630e1159ee716a8a14cc2a29a306385508)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Billing(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Billing"):
    '''(experimental) Statement provider for service `billing <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbilling_.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `billing <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbilling_.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bf1f2860c3021cfbee23baeeccd868aefa58e97b43d08038d4b45cca0736eedb)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toGetBillingData")
    def to_get_billing_data(self) -> "Billing":
        '''(experimental) Grants permission to perform queries on billing information.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Billing", jsii.invoke(self, "toGetBillingData", []))

    @jsii.member(jsii_name="toGetBillingDetails")
    def to_get_billing_details(self) -> "Billing":
        '''(experimental) Grants permission to view detailed line item billing information.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Billing", jsii.invoke(self, "toGetBillingDetails", []))

    @jsii.member(jsii_name="toGetBillingNotifications")
    def to_get_billing_notifications(self) -> "Billing":
        '''(experimental) Grants permission to view notifications sent by AWS related to your accounts billing information.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Billing", jsii.invoke(self, "toGetBillingNotifications", []))

    @jsii.member(jsii_name="toGetBillingPreferences")
    def to_get_billing_preferences(self) -> "Billing":
        '''(experimental) Grants permission to view billing preferences such as reserved instance, savings plans and credits sharing.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Billing", jsii.invoke(self, "toGetBillingPreferences", []))

    @jsii.member(jsii_name="toGetContractInformation")
    def to_get_contract_information(self) -> "Billing":
        '''(experimental) Grants permission to view the account's contract information including the contract number, end-user organization names, PO numbers and if the account is used to service public-sector customers.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Billing", jsii.invoke(self, "toGetContractInformation", []))

    @jsii.member(jsii_name="toGetCredits")
    def to_get_credits(self) -> "Billing":
        '''(experimental) Grants permission to view credits that have been redeemed.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Billing", jsii.invoke(self, "toGetCredits", []))

    @jsii.member(jsii_name="toGetIAMAccessPreference")
    def to_get_iam_access_preference(self) -> "Billing":
        '''(experimental) Grants permission to retrieve the state of the Allow IAM Access billing preference.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Billing", jsii.invoke(self, "toGetIAMAccessPreference", []))

    @jsii.member(jsii_name="toGetSellerOfRecord")
    def to_get_seller_of_record(self) -> "Billing":
        '''(experimental) Grants permission to retrieve the account's default Seller of Record.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Billing", jsii.invoke(self, "toGetSellerOfRecord", []))

    @jsii.member(jsii_name="toListBillingViews")
    def to_list_billing_views(self) -> "Billing":
        '''(experimental) Grants permission to get billing information for your proforma billing groups.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Billing", jsii.invoke(self, "toListBillingViews", []))

    @jsii.member(jsii_name="toPutContractInformation")
    def to_put_contract_information(self) -> "Billing":
        '''(experimental) Grants permission to set the account's contract information end-user organization names and if the account is used to service public-sector customers.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Billing", jsii.invoke(self, "toPutContractInformation", []))

    @jsii.member(jsii_name="toRedeemCredits")
    def to_redeem_credits(self) -> "Billing":
        '''(experimental) Grants permission to redeem an AWS credit.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Billing", jsii.invoke(self, "toRedeemCredits", []))

    @jsii.member(jsii_name="toUpdateBillingPreferences")
    def to_update_billing_preferences(self) -> "Billing":
        '''(experimental) Grants permission to update billing preferences such as reserved instance, savings plans and credits sharing.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Billing", jsii.invoke(self, "toUpdateBillingPreferences", []))

    @jsii.member(jsii_name="toUpdateIAMAccessPreference")
    def to_update_iam_access_preference(self) -> "Billing":
        '''(experimental) Grants permission to update the Allow IAM Access billing preference.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Billing", jsii.invoke(self, "toUpdateIAMAccessPreference", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3968e3405ed250c3a3dd40eb2bd47f53c14666a65368768cd7389a1e8154984d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e55cb3d2736d3c92c224c2e44981e3a74f927037ac6f141e1461184191c80489)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Billingconductor(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Billingconductor",
):
    '''(experimental) Statement provider for service `billingconductor <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbillingconductor.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `billingconductor <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbillingconductor.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bcc803ea171a9c92287ea94e5d096fa6dafe4f267462f5e7a8903e1fdcb6f148)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onBillinggroup")
    def on_billinggroup(
        self,
        billing_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Billingconductor":
        '''(experimental) Adds a resource of type billinggroup to the statement.

        https://docs.aws.amazon.com/billingconductor/latest/userguide/understanding-abc.html

        :param billing_group_id: - Identifier for the billingGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f6a0dd171308d968ca95d07b99a4a3e145a703eeac922ddd9cef5f7f3ccedaee)
            check_type(argname="argument billing_group_id", value=billing_group_id, expected_type=type_hints["billing_group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Billingconductor", jsii.invoke(self, "onBillinggroup", [billing_group_id, account, partition]))

    @jsii.member(jsii_name="onCustomlineitem")
    def on_customlineitem(
        self,
        custom_line_item_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Billingconductor":
        '''(experimental) Adds a resource of type customlineitem to the statement.

        https://docs.aws.amazon.com/billingconductor/latest/userguide/understanding-abc.html

        :param custom_line_item_id: - Identifier for the customLineItemId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7d02cf443ac429d6c286e43db4518e3e85aac055803d71404abe160e5eeffd8b)
            check_type(argname="argument custom_line_item_id", value=custom_line_item_id, expected_type=type_hints["custom_line_item_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Billingconductor", jsii.invoke(self, "onCustomlineitem", [custom_line_item_id, account, partition]))

    @jsii.member(jsii_name="onPricingplan")
    def on_pricingplan(
        self,
        pricing_plan_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Billingconductor":
        '''(experimental) Adds a resource of type pricingplan to the statement.

        https://docs.aws.amazon.com/billingconductor/latest/userguide/understanding-abc.html

        :param pricing_plan_id: - Identifier for the pricingPlanId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6634f08c1371fb86eb59114566140a9bf945d65f8d9c661066a00905213aec3d)
            check_type(argname="argument pricing_plan_id", value=pricing_plan_id, expected_type=type_hints["pricing_plan_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Billingconductor", jsii.invoke(self, "onPricingplan", [pricing_plan_id, account, partition]))

    @jsii.member(jsii_name="onPricingrule")
    def on_pricingrule(
        self,
        pricing_rule_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Billingconductor":
        '''(experimental) Adds a resource of type pricingrule to the statement.

        https://docs.aws.amazon.com/billingconductor/latest/userguide/understanding-abc.html

        :param pricing_rule_id: - Identifier for the pricingRuleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__253802e1fbbb5f48493a1fa751c556aa4dcf3eeb0839c28599a2911fe9538e58)
            check_type(argname="argument pricing_rule_id", value=pricing_rule_id, expected_type=type_hints["pricing_rule_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Billingconductor", jsii.invoke(self, "onPricingrule", [pricing_rule_id, account, partition]))

    @jsii.member(jsii_name="toAssociateAccounts")
    def to_associate_accounts(self) -> "Billingconductor":
        '''(experimental) Grants permission to associate between one and 30 accounts to a billing group.

        Access Level: Write

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_AssociateAccounts.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toAssociateAccounts", []))

    @jsii.member(jsii_name="toAssociatePricingRules")
    def to_associate_pricing_rules(self) -> "Billingconductor":
        '''(experimental) Grants permission to associate pricing rules.

        Access Level: Write

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_AssociatePricingRules.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toAssociatePricingRules", []))

    @jsii.member(jsii_name="toBatchAssociateResourcesToCustomLineItem")
    def to_batch_associate_resources_to_custom_line_item(self) -> "Billingconductor":
        '''(experimental) Grants permission to batch associate resources to a percentage custom line item.

        Access Level: Write

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_BatchAssociateResourcesToCustomLineItem.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toBatchAssociateResourcesToCustomLineItem", []))

    @jsii.member(jsii_name="toBatchDisassociateResourcesFromCustomLineItem")
    def to_batch_disassociate_resources_from_custom_line_item(
        self,
    ) -> "Billingconductor":
        '''(experimental) Grants permission to batch disassociate resources from a percentage custom line item.

        Access Level: Write

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_BatchDisassociateResourcesFromCustomLineItem.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toBatchDisassociateResourcesFromCustomLineItem", []))

    @jsii.member(jsii_name="toCreateBillingGroup")
    def to_create_billing_group(self) -> "Billingconductor":
        '''(experimental) Grants permission to create a billing group.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_CreateBillingGroup.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toCreateBillingGroup", []))

    @jsii.member(jsii_name="toCreateCustomLineItem")
    def to_create_custom_line_item(self) -> "Billingconductor":
        '''(experimental) Grants permission to create a custom line item.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_CreateCustomLineItem.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toCreateCustomLineItem", []))

    @jsii.member(jsii_name="toCreatePricingPlan")
    def to_create_pricing_plan(self) -> "Billingconductor":
        '''(experimental) Grants permission to create a pricing plan.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_CreatePricingPlan.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toCreatePricingPlan", []))

    @jsii.member(jsii_name="toCreatePricingRule")
    def to_create_pricing_rule(self) -> "Billingconductor":
        '''(experimental) Grants permission to create a pricing rule.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_CreatePricingRule.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toCreatePricingRule", []))

    @jsii.member(jsii_name="toDeleteBillingGroup")
    def to_delete_billing_group(self) -> "Billingconductor":
        '''(experimental) Grants permission to delete a billing group.

        Access Level: Write

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_DeleteBillingGroup.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toDeleteBillingGroup", []))

    @jsii.member(jsii_name="toDeleteCustomLineItem")
    def to_delete_custom_line_item(self) -> "Billingconductor":
        '''(experimental) Grants permission to delete a custom line item.

        Access Level: Write

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_DeleteCustomLineItem.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toDeleteCustomLineItem", []))

    @jsii.member(jsii_name="toDeletePricingPlan")
    def to_delete_pricing_plan(self) -> "Billingconductor":
        '''(experimental) Grants permission to delete a pricing plan.

        Access Level: Write

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_DeletePricingPlan.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toDeletePricingPlan", []))

    @jsii.member(jsii_name="toDeletePricingRule")
    def to_delete_pricing_rule(self) -> "Billingconductor":
        '''(experimental) Grants permission to delete a pricing rule.

        Access Level: Write

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_DeletePricingRule.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toDeletePricingRule", []))

    @jsii.member(jsii_name="toDisassociateAccounts")
    def to_disassociate_accounts(self) -> "Billingconductor":
        '''(experimental) Grants permission to detach between one and 30 accounts from a billing group.

        Access Level: Write

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_DisassociateAccounts.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toDisassociateAccounts", []))

    @jsii.member(jsii_name="toDisassociatePricingRules")
    def to_disassociate_pricing_rules(self) -> "Billingconductor":
        '''(experimental) Grants permission to disassociate pricing rules.

        Access Level: Write

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_DisassociatePricingRules.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toDisassociatePricingRules", []))

    @jsii.member(jsii_name="toListAccountAssociations")
    def to_list_account_associations(self) -> "Billingconductor":
        '''(experimental) Grants permission to list the linked accounts of the payer account for the given billing period while also providing the billing group the linked accounts belong to.

        Access Level: List

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_ListAccountAssociations.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toListAccountAssociations", []))

    @jsii.member(jsii_name="toListBillingGroupCostReports")
    def to_list_billing_group_cost_reports(self) -> "Billingconductor":
        '''(experimental) Grants permission to view the billing group cost report.

        Access Level: Read

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_ListBillingGroupCostReports.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toListBillingGroupCostReports", []))

    @jsii.member(jsii_name="toListBillingGroups")
    def to_list_billing_groups(self) -> "Billingconductor":
        '''(experimental) Grants permission to view the details of billing groups.

        Access Level: Read

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_ListBillingGroups.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toListBillingGroups", []))

    @jsii.member(jsii_name="toListCustomLineItems")
    def to_list_custom_line_items(self) -> "Billingconductor":
        '''(experimental) Grants permission to view custom line item details.

        Access Level: Read

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_ListCustomLineItems.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toListCustomLineItems", []))

    @jsii.member(jsii_name="toListCustomLineItemVersions")
    def to_list_custom_line_item_versions(self) -> "Billingconductor":
        '''(experimental) Grants permission to view custom line item versions.

        Access Level: Read

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_ListCustomLineItemVersions.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toListCustomLineItemVersions", []))

    @jsii.member(jsii_name="toListPricingPlans")
    def to_list_pricing_plans(self) -> "Billingconductor":
        '''(experimental) Grants permission to view the pricing plans details.

        Access Level: Read

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_ListPricingPlans.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toListPricingPlans", []))

    @jsii.member(jsii_name="toListPricingPlansAssociatedWithPricingRule")
    def to_list_pricing_plans_associated_with_pricing_rule(self) -> "Billingconductor":
        '''(experimental) Grants permission to list pricing plans associated with a pricing rule.

        Access Level: List

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_ListPricingPlansAssociatedWithPricingRule.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toListPricingPlansAssociatedWithPricingRule", []))

    @jsii.member(jsii_name="toListPricingRules")
    def to_list_pricing_rules(self) -> "Billingconductor":
        '''(experimental) Grants permission to view pricing rules details.

        Access Level: Read

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_ListPricingRules.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toListPricingRules", []))

    @jsii.member(jsii_name="toListPricingRulesAssociatedToPricingPlan")
    def to_list_pricing_rules_associated_to_pricing_plan(self) -> "Billingconductor":
        '''(experimental) Grants permission to list pricing rules associated to a pricing plan.

        Access Level: List

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_ListPricingRulesAssociatedToPricingPlan.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toListPricingRulesAssociatedToPricingPlan", []))

    @jsii.member(jsii_name="toListResourcesAssociatedToCustomLineItem")
    def to_list_resources_associated_to_custom_line_item(self) -> "Billingconductor":
        '''(experimental) Grants permission to list resources associated to a percentage custom line item.

        Access Level: List

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_ListResourcesAssociatedToCustomLineItem.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toListResourcesAssociatedToCustomLineItem", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Billingconductor":
        '''(experimental) Grants permission to list tags of a resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Billingconductor":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Billingconductor":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateBillingGroup")
    def to_update_billing_group(self) -> "Billingconductor":
        '''(experimental) Grants permission to update a billing group.

        Access Level: Write

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_UpdateBillingGroup.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toUpdateBillingGroup", []))

    @jsii.member(jsii_name="toUpdateCustomLineItem")
    def to_update_custom_line_item(self) -> "Billingconductor":
        '''(experimental) Grants permission to update a custom line item.

        Access Level: Write

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_UpdateCustomLineItem.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toUpdateCustomLineItem", []))

    @jsii.member(jsii_name="toUpdatePricingPlan")
    def to_update_pricing_plan(self) -> "Billingconductor":
        '''(experimental) Grants permission to update a pricing plan.

        Access Level: Write

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_UpdatePricingPlan.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toUpdatePricingPlan", []))

    @jsii.member(jsii_name="toUpdatePricingRule")
    def to_update_pricing_rule(self) -> "Billingconductor":
        '''(experimental) Grants permission to update a pricing rule.

        Access Level: Write

        https://docs.aws.amazon.com/billingconductor/latest/APIReference/API_UpdatePricingRule.html

        :stability: experimental
        '''
        return typing.cast("Billingconductor", jsii.invoke(self, "toUpdatePricingRule", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b9f1890080f3384631ff0e42252dd76998ff7f128ff5f00d8bacdd80a2b8fabb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3e9bd030bf4442ec56cb51f92d2bf23c8ade3a62cb20d6c830e78794e6d44f66)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Braket(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Braket"):
    '''(experimental) Statement provider for service `braket <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbraket.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `braket <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbraket.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d5eb712bac5abbaf9ed2ad9e0a3864bb46b6d97d0e1dd3656ecd7fc05a54d75b)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onJob")
    def on_job(
        self,
        job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Braket":
        '''(experimental) Adds a resource of type job to the statement.

        https://docs.aws.amazon.com/braket/latest/developerguide/braket-manage-access.html#resources

        :param job_name: - Identifier for the jobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4e229b5c29d02648d9cc29e99d709bb4c9a6581354e965dd61ea24bf739299ea)
            check_type(argname="argument job_name", value=job_name, expected_type=type_hints["job_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Braket", jsii.invoke(self, "onJob", [job_name, account, region, partition]))

    @jsii.member(jsii_name="onQuantumTask")
    def on_quantum_task(
        self,
        random_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Braket":
        '''(experimental) Adds a resource of type quantum-task to the statement.

        https://docs.aws.amazon.com/braket/latest/developerguide/braket-manage-access.html#resources

        :param random_id: - Identifier for the randomId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d685654c2596dfea885623c7e868e429558b224e80dbe4d02c8e195a7eb84e7b)
            check_type(argname="argument random_id", value=random_id, expected_type=type_hints["random_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Braket", jsii.invoke(self, "onQuantumTask", [random_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelJob")
    def to_cancel_job(self) -> "Braket":
        '''(experimental) Grants permission to cancel a job.

        Access Level: Write

        https://docs.aws.amazon.com/braket/latest/APIReference/API_CancelJob.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toCancelJob", []))

    @jsii.member(jsii_name="toCancelQuantumTask")
    def to_cancel_quantum_task(self) -> "Braket":
        '''(experimental) Grants permission to cancel a quantum task.

        Access Level: Write

        https://docs.aws.amazon.com/braket/latest/APIReference/API_CancelQuantumTask.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toCancelQuantumTask", []))

    @jsii.member(jsii_name="toCreateJob")
    def to_create_job(self) -> "Braket":
        '''(experimental) Grants permission to create a job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/braket/latest/APIReference/API_CreateJob.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toCreateJob", []))

    @jsii.member(jsii_name="toCreateQuantumTask")
    def to_create_quantum_task(self) -> "Braket":
        '''(experimental) Grants permission to create a quantum task.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/braket/latest/APIReference/API_CreateQuantumTask.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toCreateQuantumTask", []))

    @jsii.member(jsii_name="toGetDevice")
    def to_get_device(self) -> "Braket":
        '''(experimental) Grants permission to retrieve information about the devices available in Amazon Braket.

        Access Level: Read

        https://docs.aws.amazon.com/braket/latest/APIReference/API_GetDevice.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toGetDevice", []))

    @jsii.member(jsii_name="toGetJob")
    def to_get_job(self) -> "Braket":
        '''(experimental) Grants permission to retrieve jobs.

        Access Level: Read

        https://docs.aws.amazon.com/braket/latest/APIReference/API_Job.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toGetJob", []))

    @jsii.member(jsii_name="toGetQuantumTask")
    def to_get_quantum_task(self) -> "Braket":
        '''(experimental) Grants permission to retrieve quantum tasks.

        Access Level: Read

        https://docs.aws.amazon.com/braket/latest/APIReference/API_GetQuantumTask.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toGetQuantumTask", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Braket":
        '''(experimental) Grants permission to listing the tags that have been applied to the quantum task resource or the job.

        Access Level: Read

        https://docs.aws.amazon.com/braket/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toSearchDevices")
    def to_search_devices(self) -> "Braket":
        '''(experimental) Grants permission to search for devices available in Amazon Braket.

        Access Level: Read

        https://docs.aws.amazon.com/braket/latest/APIReference/API_SearchDevices.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toSearchDevices", []))

    @jsii.member(jsii_name="toSearchJobs")
    def to_search_jobs(self) -> "Braket":
        '''(experimental) Grants permission to search for jobs.

        Access Level: Read

        https://docs.aws.amazon.com/braket/latest/APIReference/API_SearchJob.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toSearchJobs", []))

    @jsii.member(jsii_name="toSearchQuantumTasks")
    def to_search_quantum_tasks(self) -> "Braket":
        '''(experimental) Grants permission to search for quantum tasks.

        Access Level: Read

        https://docs.aws.amazon.com/braket/latest/APIReference/API_SearchQuantumTasks.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toSearchQuantumTasks", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Braket":
        '''(experimental) Grants permission to add one or more tags to a quantum task.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/braket/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Braket":
        '''(experimental) Grants permission to remove one or more tags from a quantum task resource or a job.

        A tag consists of a key-value pair

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/braket/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Braket", jsii.invoke(self, "toUntagResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e132c814b4c4ec3ed4253e0df0ef04c12b612b96dd413cc2d1b3fb3d1180fc13)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__848c06e5178bc83b2f5fdf5c6c970223c557149189f32f91e3ae3beb7a99607f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Budgets(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Budgets"):
    '''(experimental) Statement provider for service `budgets <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbudgetservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `budgets <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbudgetservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cd54aa98789322c960512dd3a0ad9d5b1659b27a0e50e139603bab53bc17a593)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onBudget")
    def on_budget(
        self,
        budget_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Budgets":
        '''(experimental) Adds a resource of type budget to the statement.

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/budgets-managing-costs.html

        :param budget_name: - Identifier for the budgetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ce629a22c30d17b6f90b4ce4cabdab9dea22b36a2f68e5e934a4a13e3c47503a)
            check_type(argname="argument budget_name", value=budget_name, expected_type=type_hints["budget_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Budgets", jsii.invoke(self, "onBudget", [budget_name, account, partition]))

    @jsii.member(jsii_name="onBudgetAction")
    def on_budget_action(
        self,
        budget_name: builtins.str,
        action_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Budgets":
        '''(experimental) Adds a resource of type budgetAction to the statement.

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/budgets-managing-costs.html

        :param budget_name: - Identifier for the budgetName.
        :param action_id: - Identifier for the actionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__338a69663ae6166b439973d206e7fd08d95711d0d4969baef48ab99d202a92b5)
            check_type(argname="argument budget_name", value=budget_name, expected_type=type_hints["budget_name"])
            check_type(argname="argument action_id", value=action_id, expected_type=type_hints["action_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Budgets", jsii.invoke(self, "onBudgetAction", [budget_name, action_id, account, partition]))

    @jsii.member(jsii_name="toCreateBudgetAction")
    def to_create_budget_action(self) -> "Budgets":
        '''(experimental) Grants permission to create and define a response that you can configure to execute once your budget has exceeded a specific budget threshold.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "toCreateBudgetAction", []))

    @jsii.member(jsii_name="toDeleteBudgetAction")
    def to_delete_budget_action(self) -> "Budgets":
        '''(experimental) Grants permission to delete an action that is associated with a specific budget.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "toDeleteBudgetAction", []))

    @jsii.member(jsii_name="toDescribeBudgetAction")
    def to_describe_budget_action(self) -> "Budgets":
        '''(experimental) Grants permission to retrieve the details of a specific budget action associated with a budget.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "toDescribeBudgetAction", []))

    @jsii.member(jsii_name="toDescribeBudgetActionHistories")
    def to_describe_budget_action_histories(self) -> "Budgets":
        '''(experimental) Grants permission to retrieve a historical view of the budget actions statuses associated with a particular budget action.

        These status include statues such as 'Standby', 'Pending' and 'Executed'

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "toDescribeBudgetActionHistories", []))

    @jsii.member(jsii_name="toDescribeBudgetActionsForAccount")
    def to_describe_budget_actions_for_account(self) -> "Budgets":
        '''(experimental) Grants permission to retrieve the details of all of the budget actions associated with your account.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "toDescribeBudgetActionsForAccount", []))

    @jsii.member(jsii_name="toDescribeBudgetActionsForBudget")
    def to_describe_budget_actions_for_budget(self) -> "Budgets":
        '''(experimental) Grants permission to retrieve the details of all of the budget actions associated with a budget.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "toDescribeBudgetActionsForBudget", []))

    @jsii.member(jsii_name="toExecuteBudgetAction")
    def to_execute_budget_action(self) -> "Budgets":
        '''(experimental) Grants permission to initiate a pending budget action as well as reverse a previously executed budget action.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "toExecuteBudgetAction", []))

    @jsii.member(jsii_name="toModifyBudget")
    def to_modify_budget(self) -> "Budgets":
        '''(experimental) Grants permission to modify budgets and budget details.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "toModifyBudget", []))

    @jsii.member(jsii_name="toUpdateBudgetAction")
    def to_update_budget_action(self) -> "Budgets":
        '''(experimental) Grants permission to update the details of a specific budget action associated with a budget.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "toUpdateBudgetAction", []))

    @jsii.member(jsii_name="toViewBudget")
    def to_view_budget(self) -> "Budgets":
        '''(experimental) Grants permission to view budgets and budget details.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Budgets", jsii.invoke(self, "toViewBudget", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d810814bc7799ee1250d056924b19481567ac8f8b6b606e2b808a0c97a6d9549)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5b4624ebf188484f0f337d0353bd1dbbd66fafb10354ed992df2b9c0d213c4d9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Bugbust(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Bugbust"):
    '''(experimental) Statement provider for service `bugbust <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbugbust.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `bugbust <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsbugbust.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d1fea4d3511d7d6e2f8664f5700c0cd4c3cd96445713aa82d401cd0678c0d6c9)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onEvent")
    def on_event(
        self,
        event_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Bugbust":
        '''(experimental) Adds a resource of type Event to the statement.

        https://docs.aws.amazon.com/codeguru/latest/bugbust-ug/event-managing.html

        :param event_id: - Identifier for the eventId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__94aa0a57ebeea02911925f901881267a1410a050c94496fbfbb433c6b951135b)
            check_type(argname="argument event_id", value=event_id, expected_type=type_hints["event_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Bugbust", jsii.invoke(self, "onEvent", [event_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateEvent")
    def to_create_event(self) -> "Bugbust":
        '''(experimental) Grants permission to create a BugBust event.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/codeguru/latest/bugbust-ug/auth-and-access-control-permissions-reference.html

        :stability: experimental
        '''
        return typing.cast("Bugbust", jsii.invoke(self, "toCreateEvent", []))

    @jsii.member(jsii_name="toEvaluateProfilingGroups")
    def to_evaluate_profiling_groups(self) -> "Bugbust":
        '''(experimental) Grants permission to evaluate checked-in profiling groups.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/codeguru/latest/bugbust-ug/auth-and-access-control-permissions-reference.html

        :stability: experimental
        '''
        return typing.cast("Bugbust", jsii.invoke(self, "toEvaluateProfilingGroups", []))

    @jsii.member(jsii_name="toGetEvent")
    def to_get_event(self) -> "Bugbust":
        '''(experimental) Grants permission to view customer details about an event.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/codeguru/latest/bugbust-ug/auth-and-access-control-permissions-reference.html

        :stability: experimental
        '''
        return typing.cast("Bugbust", jsii.invoke(self, "toGetEvent", []))

    @jsii.member(jsii_name="toGetJoinEventStatus")
    def to_get_join_event_status(self) -> "Bugbust":
        '''(experimental) Grants permission to view the status of a BugBust player's attempt to join a BugBust event.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/codeguru/latest/bugbust-ug/auth-and-access-control-permissions-reference.html

        :stability: experimental
        '''
        return typing.cast("Bugbust", jsii.invoke(self, "toGetJoinEventStatus", []))

    @jsii.member(jsii_name="toJoinEvent")
    def to_join_event(self) -> "Bugbust":
        '''(experimental) Grants permission to join an event.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/codeguru/latest/bugbust-ug/auth-and-access-control-permissions-reference.html

        :stability: experimental
        '''
        return typing.cast("Bugbust", jsii.invoke(self, "toJoinEvent", []))

    @jsii.member(jsii_name="toListBugs")
    def to_list_bugs(self) -> "Bugbust":
        '''(experimental) Grants permission to view the bugs that were imported into an event for players to work on.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - codeguru-reviewer:DescribeCodeReview
        - codeguru-reviewer:ListRecommendations

        https://docs.aws.amazon.com/codeguru/latest/bugbust-ug/auth-and-access-control-permissions-reference.html

        :stability: experimental
        '''
        return typing.cast("Bugbust", jsii.invoke(self, "toListBugs", []))

    @jsii.member(jsii_name="toListEventParticipants")
    def to_list_event_participants(self) -> "Bugbust":
        '''(experimental) Grants permission to view the participants of an event.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/codeguru/latest/bugbust-ug/auth-and-access-control-permissions-reference.html

        :stability: experimental
        '''
        return typing.cast("Bugbust", jsii.invoke(self, "toListEventParticipants", []))

    @jsii.member(jsii_name="toListEvents")
    def to_list_events(self) -> "Bugbust":
        '''(experimental) Grants permission to List BugBust events.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/codeguru/latest/bugbust-ug/auth-and-access-control-permissions-reference.html

        :stability: experimental
        '''
        return typing.cast("Bugbust", jsii.invoke(self, "toListEvents", []))

    @jsii.member(jsii_name="toListEventScores")
    def to_list_event_scores(self) -> "Bugbust":
        '''(experimental) Grants permission to view the scores of an event's players.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/codeguru/latest/bugbust-ug/auth-and-access-control-permissions-reference.html

        :stability: experimental
        '''
        return typing.cast("Bugbust", jsii.invoke(self, "toListEventScores", []))

    @jsii.member(jsii_name="toListProfilingGroups")
    def to_list_profiling_groups(self) -> "Bugbust":
        '''(experimental) Grants permission to view the profiling groups that were imported into an event for players to work on.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/codeguru/latest/bugbust-ug/auth-and-access-control-permissions-reference.html

        :stability: experimental
        '''
        return typing.cast("Bugbust", jsii.invoke(self, "toListProfilingGroups", []))

    @jsii.member(jsii_name="toListPullRequests")
    def to_list_pull_requests(self) -> "Bugbust":
        '''(experimental) Grants permission to view the pull requests used by players to submit fixes to their claimed bugs in an event.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/codeguru/latest/bugbust-ug/auth-and-access-control-permissions-reference.html

        :stability: experimental
        '''
        return typing.cast("Bugbust", jsii.invoke(self, "toListPullRequests", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Bugbust":
        '''(experimental) Grants permission to lists tag for a Bugbust resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/codeguru/latest/bugbust-ug/auth-and-access-control-permissions-reference.html

        :stability: experimental
        '''
        return typing.cast("Bugbust", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Bugbust":
        '''(experimental) Grants permission to tag a Bugbust resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/codeguru/latest/bugbust-ug/auth-and-access-control-permissions-reference.html

        :stability: experimental
        '''
        return typing.cast("Bugbust", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Bugbust":
        '''(experimental) Grants permission to untag a Bugbust resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/codeguru/latest/bugbust-ug/auth-and-access-control-permissions-reference.html

        :stability: experimental
        '''
        return typing.cast("Bugbust", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateEvent")
    def to_update_event(self) -> "Bugbust":
        '''(experimental) Grants permission to update a BugBust event.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - codeguru-profiler:DescribeProfilingGroup
        - codeguru-profiler:ListProfilingGroups
        - codeguru-reviewer:DescribeCodeReview
        - codeguru-reviewer:ListCodeReviews
        - codeguru-reviewer:ListRecommendations
        - codeguru-reviewer:TagResource
        - codeguru-reviewer:UnTagResource

        https://docs.aws.amazon.com/codeguru/latest/bugbust-ug/auth-and-access-control-permissions-reference.html

        :stability: experimental
        '''
        return typing.cast("Bugbust", jsii.invoke(self, "toUpdateEvent", []))

    @jsii.member(jsii_name="toUpdateWorkItem")
    def to_update_work_item(self) -> "Bugbust":
        '''(experimental) Grants permission to update a work item as claimed or unclaimed (bug or profiling group).

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - codeguru-reviewer:ListRecommendations

        https://docs.aws.amazon.com/codeguru/latest/bugbust-ug/auth-and-access-control-permissions-reference.html

        :stability: experimental
        '''
        return typing.cast("Bugbust", jsii.invoke(self, "toUpdateWorkItem", []))

    @jsii.member(jsii_name="toUpdateWorkItemAdmin")
    def to_update_work_item_admin(self) -> "Bugbust":
        '''(experimental) Grants permission to update an event's work item (bug or profiling group).

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - codeguru-reviewer:ListRecommendations

        https://docs.aws.amazon.com/codeguru/latest/bugbust-ug/auth-and-access-control-permissions-reference.html

        :stability: experimental
        '''
        return typing.cast("Bugbust", jsii.invoke(self, "toUpdateWorkItemAdmin", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4c5df6f4162d14757d52ddcca8641d1616d659a2ba678f860da6be576f4efa6f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__38bd2a7c80d99f87fa724bdd162d943eb079ff71e330a82eff6fc316fd104cd3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Cases(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Cases"):
    '''(experimental) Statement provider for service `cases <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonconnectcases.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cases <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonconnectcases.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1dec88351c6f39e7d75edb15cf8ea8585b856b86b58e591a84e20ca9323c84e0)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onCase")
    def on_case(
        self,
        domain_id: builtins.str,
        case_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cases":
        '''(experimental) Adds a resource of type Case to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/cases.html

        :param domain_id: - Identifier for the domainId.
        :param case_id: - Identifier for the caseId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6ca0e92273f6096cc8a46ecd636daca1add04c2f690fefa898b8860743181aa6)
            check_type(argname="argument domain_id", value=domain_id, expected_type=type_hints["domain_id"])
            check_type(argname="argument case_id", value=case_id, expected_type=type_hints["case_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cases", jsii.invoke(self, "onCase", [domain_id, case_id, account, region, partition]))

    @jsii.member(jsii_name="onDomain")
    def on_domain(
        self,
        domain_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cases":
        '''(experimental) Adds a resource of type Domain to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/cases.html

        :param domain_id: - Identifier for the domainId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dbb8b77c7105a38bd8751501f9482224e3cbff02864199e73d86d66eac9b448d)
            check_type(argname="argument domain_id", value=domain_id, expected_type=type_hints["domain_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cases", jsii.invoke(self, "onDomain", [domain_id, account, region, partition]))

    @jsii.member(jsii_name="onField")
    def on_field(
        self,
        domain_id: builtins.str,
        field_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cases":
        '''(experimental) Adds a resource of type Field to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/case-fields.html

        :param domain_id: - Identifier for the domainId.
        :param field_id: - Identifier for the fieldId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a1c07b384e0af6e1e87284b250621393fad30540dd086d327139e0d8420d830b)
            check_type(argname="argument domain_id", value=domain_id, expected_type=type_hints["domain_id"])
            check_type(argname="argument field_id", value=field_id, expected_type=type_hints["field_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cases", jsii.invoke(self, "onField", [domain_id, field_id, account, region, partition]))

    @jsii.member(jsii_name="onLayout")
    def on_layout(
        self,
        domain_id: builtins.str,
        layout_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cases":
        '''(experimental) Adds a resource of type Layout to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/case-layouts.html

        :param domain_id: - Identifier for the domainId.
        :param layout_id: - Identifier for the layoutId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cfd6b787e63aa5af9dcf403cb81bf6ce1d98c4cf4380e0d742ce8963ca436356)
            check_type(argname="argument domain_id", value=domain_id, expected_type=type_hints["domain_id"])
            check_type(argname="argument layout_id", value=layout_id, expected_type=type_hints["layout_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cases", jsii.invoke(self, "onLayout", [domain_id, layout_id, account, region, partition]))

    @jsii.member(jsii_name="onRelatedItem")
    def on_related_item(
        self,
        domain_id: builtins.str,
        case_id: builtins.str,
        related_item_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cases":
        '''(experimental) Adds a resource of type RelatedItem to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/associatecontactandcase.html

        :param domain_id: - Identifier for the domainId.
        :param case_id: - Identifier for the caseId.
        :param related_item_id: - Identifier for the relatedItemId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6f15ac642a23dda316adc2206523caee5fb600204a77f309dab44eb9941fb953)
            check_type(argname="argument domain_id", value=domain_id, expected_type=type_hints["domain_id"])
            check_type(argname="argument case_id", value=case_id, expected_type=type_hints["case_id"])
            check_type(argname="argument related_item_id", value=related_item_id, expected_type=type_hints["related_item_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cases", jsii.invoke(self, "onRelatedItem", [domain_id, case_id, related_item_id, account, region, partition]))

    @jsii.member(jsii_name="onTemplate")
    def on_template(
        self,
        domain_id: builtins.str,
        template_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cases":
        '''(experimental) Adds a resource of type Template to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/case-templates.html

        :param domain_id: - Identifier for the domainId.
        :param template_id: - Identifier for the templateId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f7c2532d61ea713614033c71bcba3327af51f41eb2f44a28e5ec7d90a68ae7eb)
            check_type(argname="argument domain_id", value=domain_id, expected_type=type_hints["domain_id"])
            check_type(argname="argument template_id", value=template_id, expected_type=type_hints["template_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cases", jsii.invoke(self, "onTemplate", [domain_id, template_id, account, region, partition]))

    @jsii.member(jsii_name="toBatchGetField")
    def to_batch_get_field(self) -> "Cases":
        '''(experimental) Grants permission to retrieve information about the fields in the case domain.

        Access Level: Read

        https://docs.aws.amazon.com/cases/latest/APIReference/API_BatchGetField.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toBatchGetField", []))

    @jsii.member(jsii_name="toBatchPutFieldOptions")
    def to_batch_put_field_options(self) -> "Cases":
        '''(experimental) Grants permission to update the field options in the case domain.

        Access Level: Write

        https://docs.aws.amazon.com/cases/latest/APIReference/API_BatchPutFieldOptions.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toBatchPutFieldOptions", []))

    @jsii.member(jsii_name="toCreateCase")
    def to_create_case(self) -> "Cases":
        '''(experimental) Grants permission to create a case in the case domain.

        Access Level: Write

        https://docs.aws.amazon.com/cases/latest/APIReference/API_CreateCase.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toCreateCase", []))

    @jsii.member(jsii_name="toCreateDomain")
    def to_create_domain(self) -> "Cases":
        '''(experimental) Grants permission to create a new case domain.

        Access Level: Write

        https://docs.aws.amazon.com/cases/latest/APIReference/API_CreateDomain.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toCreateDomain", []))

    @jsii.member(jsii_name="toCreateField")
    def to_create_field(self) -> "Cases":
        '''(experimental) Grants permission to create a field in the case domain.

        Access Level: Write

        https://docs.aws.amazon.com/cases/latest/APIReference/API_CreateField.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toCreateField", []))

    @jsii.member(jsii_name="toCreateLayout")
    def to_create_layout(self) -> "Cases":
        '''(experimental) Grants permission to create a layout in the case domain.

        Access Level: Write

        https://docs.aws.amazon.com/cases/latest/APIReference/API_CreateLayout.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toCreateLayout", []))

    @jsii.member(jsii_name="toCreateRelatedItem")
    def to_create_related_item(self) -> "Cases":
        '''(experimental) Grants permission to create a related item associated to a case in the case domain.

        Access Level: Write

        https://docs.aws.amazon.com/cases/latest/APIReference/API_CreateRelatedItem.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toCreateRelatedItem", []))

    @jsii.member(jsii_name="toCreateTemplate")
    def to_create_template(self) -> "Cases":
        '''(experimental) Grants permission to create a template in the case domain.

        Access Level: Write

        https://docs.aws.amazon.com/cases/latest/APIReference/API_CreateTemplate.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toCreateTemplate", []))

    @jsii.member(jsii_name="toDeleteDomain")
    def to_delete_domain(self) -> "Cases":
        '''(experimental) Grants permission to delete the domain.

        Access Level: Write

        https://docs.aws.amazon.com/cases/latest/APIReference/API_DeleteDomain.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toDeleteDomain", []))

    @jsii.member(jsii_name="toGetCase")
    def to_get_case(self) -> "Cases":
        '''(experimental) Grants permission to retrieve information about a case in the case domain.

        Access Level: Read

        https://docs.aws.amazon.com/cases/latest/APIReference/API_GetCase.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toGetCase", []))

    @jsii.member(jsii_name="toGetCaseEventConfiguration")
    def to_get_case_event_configuration(self) -> "Cases":
        '''(experimental) Grants permission to retrieve information about the case event configuraton in the case domain.

        Access Level: Read

        https://docs.aws.amazon.com/cases/latest/APIReference/API_GetCaseEventConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toGetCaseEventConfiguration", []))

    @jsii.member(jsii_name="toGetDomain")
    def to_get_domain(self) -> "Cases":
        '''(experimental) Grants permission to retrieve information about the case domain.

        Access Level: Read

        https://docs.aws.amazon.com/cases/latest/APIReference/API_GetDomain.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toGetDomain", []))

    @jsii.member(jsii_name="toGetLayout")
    def to_get_layout(self) -> "Cases":
        '''(experimental) Grants permission to retrieve information about the layout in the case domain.

        Access Level: Read

        https://docs.aws.amazon.com/cases/latest/APIReference/API_GetLayout.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toGetLayout", []))

    @jsii.member(jsii_name="toGetTemplate")
    def to_get_template(self) -> "Cases":
        '''(experimental) Grants permission to retrieve information about the template in the case domain.

        Access Level: Read

        https://docs.aws.amazon.com/cases/latest/APIReference/API_GetTemplate.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toGetTemplate", []))

    @jsii.member(jsii_name="toListCasesForContact")
    def to_list_cases_for_contact(self) -> "Cases":
        '''(experimental) Grants permission to list cases for a specific contact in the case domain.

        Access Level: List

        https://docs.aws.amazon.com/cases/latest/APIReference/API_ListCasesForContact.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toListCasesForContact", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Cases":
        '''(experimental) Grants permission to list all domains in the aws account.

        Access Level: List

        https://docs.aws.amazon.com/cases/latest/APIReference/API_ListDomains.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toListFieldOptions")
    def to_list_field_options(self) -> "Cases":
        '''(experimental) Grants permission to list field options for a single select field in the case domain.

        Access Level: List

        https://docs.aws.amazon.com/cases/latest/APIReference/API_ListFieldOptions.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toListFieldOptions", []))

    @jsii.member(jsii_name="toListFields")
    def to_list_fields(self) -> "Cases":
        '''(experimental) Grants permission to list fields in the case domain.

        Access Level: List

        https://docs.aws.amazon.com/cases/latest/APIReference/API_ListFields.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toListFields", []))

    @jsii.member(jsii_name="toListLayouts")
    def to_list_layouts(self) -> "Cases":
        '''(experimental) Grants permission to list layouts in the case domain.

        Access Level: List

        https://docs.aws.amazon.com/cases/latest/APIReference/API_ListLayouts.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toListLayouts", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Cases":
        '''(experimental) Grants permission to list the tags for the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/cases/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTemplates")
    def to_list_templates(self) -> "Cases":
        '''(experimental) Grants permission to list templates in the case domain.

        Access Level: List

        https://docs.aws.amazon.com/cases/latest/APIReference/API_ListTemplates.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toListTemplates", []))

    @jsii.member(jsii_name="toPutCaseEventConfiguration")
    def to_put_case_event_configuration(self) -> "Cases":
        '''(experimental) Grants permission to insert or update the case event configuration in the case domain.

        Access Level: Write

        https://docs.aws.amazon.com/cases/latest/APIReference/API_PutCaseEventConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toPutCaseEventConfiguration", []))

    @jsii.member(jsii_name="toSearchCases")
    def to_search_cases(self) -> "Cases":
        '''(experimental) Grants permission to search for cases in the case domain.

        Access Level: Read

        https://docs.aws.amazon.com/cases/latest/APIReference/API_SearchCases.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toSearchCases", []))

    @jsii.member(jsii_name="toSearchRelatedItems")
    def to_search_related_items(self) -> "Cases":
        '''(experimental) Grants permission to search for related items associated to the case in the case domain.

        Access Level: Read

        https://docs.aws.amazon.com/cases/latest/APIReference/API_SearchRelatedItems.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toSearchRelatedItems", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Cases":
        '''(experimental) Grants permission to add the specified tags to the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cases/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Cases":
        '''(experimental) Grants permission to remove the specified tags from the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cases/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateCase")
    def to_update_case(self) -> "Cases":
        '''(experimental) Grants permission to update the field values on the case in the case domain.

        Access Level: Write

        https://docs.aws.amazon.com/cases/latest/APIReference/API_UpdateCase.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toUpdateCase", []))

    @jsii.member(jsii_name="toUpdateField")
    def to_update_field(self) -> "Cases":
        '''(experimental) Grants permission to update the field in the case domain.

        Access Level: Write

        https://docs.aws.amazon.com/cases/latest/APIReference/API_UpdateField.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toUpdateField", []))

    @jsii.member(jsii_name="toUpdateLayout")
    def to_update_layout(self) -> "Cases":
        '''(experimental) Grants permission to update the layout in the case domain.

        Access Level: Write

        https://docs.aws.amazon.com/cases/latest/APIReference/API_UpdateLayout.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toUpdateLayout", []))

    @jsii.member(jsii_name="toUpdateTemplate")
    def to_update_template(self) -> "Cases":
        '''(experimental) Grants permission to update the template in the case domain.

        Access Level: Write

        https://docs.aws.amazon.com/cases/latest/APIReference/API_UpdateTemplate.html

        :stability: experimental
        '''
        return typing.cast("Cases", jsii.invoke(self, "toUpdateTemplate", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__951561acd0e1526b6e1b82f418ef8eaefae6f04b8d3a36e684659954dd5e0ef0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e82d91701c2065887e65d1d0924fee90cb786f29d6ed950523a3a510fcc5f34e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Cassandra(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Cassandra",
):
    '''(experimental) Statement provider for service `cassandra <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkeyspacesforapachecassandra.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cassandra <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkeyspacesforapachecassandra.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b2a1e393d34ec13f42797f9f047b937150e275a325ebaef2c25f0e720ed9f8b1)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onKeyspace")
    def on_keyspace(
        self,
        keyspace_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cassandra":
        '''(experimental) Adds a resource of type keyspace to the statement.

        https://docs.aws.amazon.com/keyspaces/latest/devguide/what-is.html

        :param keyspace_name: - Identifier for the keyspaceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ff3ada33465244ea7e74cd8f263ede277b14db0f9d8d4c161de59c3e66ee8801)
            check_type(argname="argument keyspace_name", value=keyspace_name, expected_type=type_hints["keyspace_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cassandra", jsii.invoke(self, "onKeyspace", [keyspace_name, account, region, partition]))

    @jsii.member(jsii_name="onTable")
    def on_table(
        self,
        keyspace_name: builtins.str,
        table_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cassandra":
        '''(experimental) Adds a resource of type table to the statement.

        https://docs.aws.amazon.com/keyspaces/latest/devguide/what-is.html

        :param keyspace_name: - Identifier for the keyspaceName.
        :param table_name: - Identifier for the tableName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__43d00bb8299a917ee5b580decb488c75a3cdfd3e8d356cba048296a785fdc16d)
            check_type(argname="argument keyspace_name", value=keyspace_name, expected_type=type_hints["keyspace_name"])
            check_type(argname="argument table_name", value=table_name, expected_type=type_hints["table_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cassandra", jsii.invoke(self, "onTable", [keyspace_name, table_name, account, region, partition]))

    @jsii.member(jsii_name="toAlter")
    def to_alter(self) -> "Cassandra":
        '''(experimental) Grants permission to alter a keyspace or table.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/keyspaces/latest/devguide/

        :stability: experimental
        '''
        return typing.cast("Cassandra", jsii.invoke(self, "toAlter", []))

    @jsii.member(jsii_name="toCreate")
    def to_create(self) -> "Cassandra":
        '''(experimental) Grants permission to create a keyspace or table.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/keyspaces/latest/devguide/

        :stability: experimental
        '''
        return typing.cast("Cassandra", jsii.invoke(self, "toCreate", []))

    @jsii.member(jsii_name="toDrop")
    def to_drop(self) -> "Cassandra":
        '''(experimental) Grants permission to drop a keyspace or table.

        Access Level: Write

        https://docs.aws.amazon.com/keyspaces/latest/devguide/

        :stability: experimental
        '''
        return typing.cast("Cassandra", jsii.invoke(self, "toDrop", []))

    @jsii.member(jsii_name="toModify")
    def to_modify(self) -> "Cassandra":
        '''(experimental) Grants permission to INSERT, UPDATE or DELETE data in a table.

        Access Level: Write

        https://docs.aws.amazon.com/keyspaces/latest/devguide/

        :stability: experimental
        '''
        return typing.cast("Cassandra", jsii.invoke(self, "toModify", []))

    @jsii.member(jsii_name="toRestore")
    def to_restore(self) -> "Cassandra":
        '''(experimental) Grants permission to restore table from a backup.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/keyspaces/latest/devguide/

        :stability: experimental
        '''
        return typing.cast("Cassandra", jsii.invoke(self, "toRestore", []))

    @jsii.member(jsii_name="toSelect")
    def to_select(self) -> "Cassandra":
        '''(experimental) Grants permission to SELECT data from a table.

        Access Level: Read

        https://docs.aws.amazon.com/keyspaces/latest/devguide/

        :stability: experimental
        '''
        return typing.cast("Cassandra", jsii.invoke(self, "toSelect", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Cassandra":
        '''(experimental) Grants permission to tag a keyspace or table.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/keyspaces/latest/devguide/

        :stability: experimental
        '''
        return typing.cast("Cassandra", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Cassandra":
        '''(experimental) Grants permission to untag a keyspace or table.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/keyspaces/latest/devguide/

        :stability: experimental
        '''
        return typing.cast("Cassandra", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdatePartitioner")
    def to_update_partitioner(self) -> "Cassandra":
        '''(experimental) Grants permission to UPDATE the partitioner in a system table.

        Access Level: Write

        https://docs.aws.amazon.com/keyspaces/latest/devguide/

        :stability: experimental
        '''
        return typing.cast("Cassandra", jsii.invoke(self, "toUpdatePartitioner", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bd1d256ae5d407c53be4efe480af78bb80ae8ad28ed3d80e3538763d32f4c6ff)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__890246c174b009420e2a4774a99b7424411bfee7f1397b6ebc1dad2c83364355)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Ce(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ce"):
    '''(experimental) Statement provider for service `ce <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscostexplorerservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ce <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscostexplorerservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__70fac6d9ddf176b163c6f9ef26aab520ae9beb4494c7f3475ef104f59c40843e)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAnomalymonitor")
    def on_anomalymonitor(
        self,
        identifier: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ce":
        '''(experimental) Adds a resource of type anomalymonitor to the statement.

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_AnomalyMonitor.html

        :param identifier: - Identifier for the identifier.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3be9c25066d96659971bd2ada25fbfc16c8debda536c1aa46d427fb272f73742)
            check_type(argname="argument identifier", value=identifier, expected_type=type_hints["identifier"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ce", jsii.invoke(self, "onAnomalymonitor", [identifier, account, partition]))

    @jsii.member(jsii_name="onAnomalysubscription")
    def on_anomalysubscription(
        self,
        identifier: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ce":
        '''(experimental) Adds a resource of type anomalysubscription to the statement.

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_AnomalySubscription.html

        :param identifier: - Identifier for the identifier.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bda03acf12b9dedd0daa30b7f88cfdcdd47445047bfae12bcf2a06034e9f3c3e)
            check_type(argname="argument identifier", value=identifier, expected_type=type_hints["identifier"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ce", jsii.invoke(self, "onAnomalysubscription", [identifier, account, partition]))

    @jsii.member(jsii_name="onCostcategory")
    def on_costcategory(
        self,
        identifier: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ce":
        '''(experimental) Adds a resource of type costcategory to the statement.

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_CostCategory.html

        :param identifier: - Identifier for the identifier.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d519d425b9054f3e1fe85859fff48b3136d6e92ac9e5cc5732e96dbd4a11091c)
            check_type(argname="argument identifier", value=identifier, expected_type=type_hints["identifier"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ce", jsii.invoke(self, "onCostcategory", [identifier, account, partition]))

    @jsii.member(jsii_name="toCreateAnomalyMonitor")
    def to_create_anomaly_monitor(self) -> "Ce":
        '''(experimental) Grants permission to create a new Anomaly Monitor.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_CreateAnomalyMonitor.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toCreateAnomalyMonitor", []))

    @jsii.member(jsii_name="toCreateAnomalySubscription")
    def to_create_anomaly_subscription(self) -> "Ce":
        '''(experimental) Grants permission to create a new Anomaly Subscription.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_CreateAnomalySubscription.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toCreateAnomalySubscription", []))

    @jsii.member(jsii_name="toCreateCostCategoryDefinition")
    def to_create_cost_category_definition(self) -> "Ce":
        '''(experimental) Grants permission to create a new Cost Category with the requested name and rules.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_CreateCostCategoryDefinition.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toCreateCostCategoryDefinition", []))

    @jsii.member(jsii_name="toCreateNotificationSubscription")
    def to_create_notification_subscription(self) -> "Ce":
        '''(experimental) Grants permission to create Reservation expiration alerts.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toCreateNotificationSubscription", []))

    @jsii.member(jsii_name="toCreateReport")
    def to_create_report(self) -> "Ce":
        '''(experimental) Grants permission to create Cost Explorer Reports.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toCreateReport", []))

    @jsii.member(jsii_name="toDeleteAnomalyMonitor")
    def to_delete_anomaly_monitor(self) -> "Ce":
        '''(experimental) Grants permission to delete an Anomaly Monitor.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_DeleteAnomalyMonitor.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toDeleteAnomalyMonitor", []))

    @jsii.member(jsii_name="toDeleteAnomalySubscription")
    def to_delete_anomaly_subscription(self) -> "Ce":
        '''(experimental) Grants permission to delete an Anomaly Subscription.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_DeleteAnomalySubscription.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toDeleteAnomalySubscription", []))

    @jsii.member(jsii_name="toDeleteCostCategoryDefinition")
    def to_delete_cost_category_definition(self) -> "Ce":
        '''(experimental) Grants permission to delete a Cost Category.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_DeleteCostCategoryDefinition.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toDeleteCostCategoryDefinition", []))

    @jsii.member(jsii_name="toDeleteNotificationSubscription")
    def to_delete_notification_subscription(self) -> "Ce":
        '''(experimental) Grants permission to delete Reservation expiration alerts.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toDeleteNotificationSubscription", []))

    @jsii.member(jsii_name="toDeleteReport")
    def to_delete_report(self) -> "Ce":
        '''(experimental) Grants permission to delete Cost Explorer Reports.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toDeleteReport", []))

    @jsii.member(jsii_name="toDescribeCostCategoryDefinition")
    def to_describe_cost_category_definition(self) -> "Ce":
        '''(experimental) Grants permission to retrieve descriptions such as the name, ARN, rules, definition, and effective dates of a Cost Category.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_DescribeCostCategoryDefinition.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toDescribeCostCategoryDefinition", []))

    @jsii.member(jsii_name="toDescribeNotificationSubscription")
    def to_describe_notification_subscription(self) -> "Ce":
        '''(experimental) Grants permission to view Reservation expiration alerts.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toDescribeNotificationSubscription", []))

    @jsii.member(jsii_name="toDescribeReport")
    def to_describe_report(self) -> "Ce":
        '''(experimental) Grants permission to view Cost Explorer Reports page.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toDescribeReport", []))

    @jsii.member(jsii_name="toGetAnomalies")
    def to_get_anomalies(self) -> "Ce":
        '''(experimental) Grants permission to retrieve anomalies.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetAnomalies.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetAnomalies", []))

    @jsii.member(jsii_name="toGetAnomalyMonitors")
    def to_get_anomaly_monitors(self) -> "Ce":
        '''(experimental) Grants permission to query Anomaly Monitors.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetAnomalyMonitors.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetAnomalyMonitors", []))

    @jsii.member(jsii_name="toGetAnomalySubscriptions")
    def to_get_anomaly_subscriptions(self) -> "Ce":
        '''(experimental) Grants permission to query Anomaly Subscriptions.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetAnomalySubscriptions.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetAnomalySubscriptions", []))

    @jsii.member(jsii_name="toGetConsoleActionSetEnforced")
    def to_get_console_action_set_enforced(self) -> "Ce":
        '''(experimental) Grants permission to view whether existing or fine-grained IAM actions are being used to control authorization to Billing, Cost Management, and Account consoles.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetConsoleActionSetEnforced", []))

    @jsii.member(jsii_name="toGetCostAndUsage")
    def to_get_cost_and_usage(self) -> "Ce":
        '''(experimental) Grants permission to retrieve the cost and usage metrics for your account.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetCostAndUsage.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetCostAndUsage", []))

    @jsii.member(jsii_name="toGetCostAndUsageWithResources")
    def to_get_cost_and_usage_with_resources(self) -> "Ce":
        '''(experimental) Grants permission to retrieve the cost and usage metrics with resources for your account.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetCostAndUsageWithResources.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetCostAndUsageWithResources", []))

    @jsii.member(jsii_name="toGetCostCategories")
    def to_get_cost_categories(self) -> "Ce":
        '''(experimental) Grants permission to query Cost Catagory names and values for a specified time period.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetCostCategories.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetCostCategories", []))

    @jsii.member(jsii_name="toGetCostForecast")
    def to_get_cost_forecast(self) -> "Ce":
        '''(experimental) Grants permission to retrieve a cost forecast for a forecast time period.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetCostForecast.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetCostForecast", []))

    @jsii.member(jsii_name="toGetDimensionValues")
    def to_get_dimension_values(self) -> "Ce":
        '''(experimental) Grants permission to retrieve all available filter values for a filter for a period of time.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetDimensionValues.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetDimensionValues", []))

    @jsii.member(jsii_name="toGetPreferences")
    def to_get_preferences(self) -> "Ce":
        '''(experimental) Grants permission to view Cost Explorer Preferences page.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetPreferences", []))

    @jsii.member(jsii_name="toGetReservationCoverage")
    def to_get_reservation_coverage(self) -> "Ce":
        '''(experimental) Grants permission to retrieve the reservation coverage for your account.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetReservationCoverage.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetReservationCoverage", []))

    @jsii.member(jsii_name="toGetReservationPurchaseRecommendation")
    def to_get_reservation_purchase_recommendation(self) -> "Ce":
        '''(experimental) Grants permission to retrieve the reservation recommendations for your account.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetReservationPurchaseRecommendation.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetReservationPurchaseRecommendation", []))

    @jsii.member(jsii_name="toGetReservationUtilization")
    def to_get_reservation_utilization(self) -> "Ce":
        '''(experimental) Grants permission to retrieve the reservation utilization for your account.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetReservationUtilization.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetReservationUtilization", []))

    @jsii.member(jsii_name="toGetRightsizingRecommendation")
    def to_get_rightsizing_recommendation(self) -> "Ce":
        '''(experimental) Grants permission to retrieve the rightsizing recommendations for your account.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetRightsizingRecommendation.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetRightsizingRecommendation", []))

    @jsii.member(jsii_name="toGetSavingsPlansCoverage")
    def to_get_savings_plans_coverage(self) -> "Ce":
        '''(experimental) Grants permission to retrieve the Savings Plans coverage for your account.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetSavingsPlansCoverage.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetSavingsPlansCoverage", []))

    @jsii.member(jsii_name="toGetSavingsPlansPurchaseRecommendation")
    def to_get_savings_plans_purchase_recommendation(self) -> "Ce":
        '''(experimental) Grants permission to retrieve the Savings Plans recommendations for your account.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetSavingsPlansPurchaseRecommendation.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetSavingsPlansPurchaseRecommendation", []))

    @jsii.member(jsii_name="toGetSavingsPlansUtilization")
    def to_get_savings_plans_utilization(self) -> "Ce":
        '''(experimental) Grants permission to retrieve the Savings Plans utilization for your account.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetSavingsPlansUtilization.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetSavingsPlansUtilization", []))

    @jsii.member(jsii_name="toGetSavingsPlansUtilizationDetails")
    def to_get_savings_plans_utilization_details(self) -> "Ce":
        '''(experimental) Grants permission to retrieve the Savings Plans utilization details for your account.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetSavingsPlansUtilizationDetails.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetSavingsPlansUtilizationDetails", []))

    @jsii.member(jsii_name="toGetTags")
    def to_get_tags(self) -> "Ce":
        '''(experimental) Grants permission to query tags for a specified time period.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetTags.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetTags", []))

    @jsii.member(jsii_name="toGetUsageForecast")
    def to_get_usage_forecast(self) -> "Ce":
        '''(experimental) Grants permission to retrieve a usage forecast for a forecast time period.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetUsageForecast.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toGetUsageForecast", []))

    @jsii.member(jsii_name="toListCostAllocationTags")
    def to_list_cost_allocation_tags(self) -> "Ce":
        '''(experimental) Grants permission to list Cost Allocation Tags.

        Access Level: List

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_ListCostAllocationTags.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toListCostAllocationTags", []))

    @jsii.member(jsii_name="toListCostCategoryDefinitions")
    def to_list_cost_category_definitions(self) -> "Ce":
        '''(experimental) Grants permission to retrieve names, ARN, and effective dates for all Cost Categories.

        Access Level: List

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_ListCostCategoryDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toListCostCategoryDefinitions", []))

    @jsii.member(jsii_name="toListSavingsPlansPurchaseRecommendationGeneration")
    def to_list_savings_plans_purchase_recommendation_generation(self) -> "Ce":
        '''(experimental) Grants permission to retrieve a list of your historical recommendation generations.

        Access Level: List

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_ListSavingsPlansPurchaseRecommendationGeneration.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toListSavingsPlansPurchaseRecommendationGeneration", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Ce":
        '''(experimental) Grants permission to list tags for a Cost Explorer resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toProvideAnomalyFeedback")
    def to_provide_anomaly_feedback(self) -> "Ce":
        '''(experimental) Grants permission to provide feedback on detected anomalies.

        Access Level: Write

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_ProvideAnomalyFeedback.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toProvideAnomalyFeedback", []))

    @jsii.member(jsii_name="toStartSavingsPlansPurchaseRecommendationGeneration")
    def to_start_savings_plans_purchase_recommendation_generation(self) -> "Ce":
        '''(experimental) Grants permission to request a Savings Plans recommendation generation.

        Access Level: Write

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_StartSavingsPlansPurchaseRecommendationGeneration.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toStartSavingsPlansPurchaseRecommendationGeneration", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Ce":
        '''(experimental) Grants permission to tag a Cost Explorer resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Ce":
        '''(experimental) Grants permission to remove tags from a Cost Explorer resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAnomalyMonitor")
    def to_update_anomaly_monitor(self) -> "Ce":
        '''(experimental) Grants permission to update an existing Anomaly Monitor.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_UpdateAnomalyMonitor.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toUpdateAnomalyMonitor", []))

    @jsii.member(jsii_name="toUpdateAnomalySubscription")
    def to_update_anomaly_subscription(self) -> "Ce":
        '''(experimental) Grants permission to update an existing Anomaly Subscription.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_UpdateAnomalySubscription.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toUpdateAnomalySubscription", []))

    @jsii.member(jsii_name="toUpdateConsoleActionSetEnforced")
    def to_update_console_action_set_enforced(self) -> "Ce":
        '''(experimental) Grants permission to change whether existing or fine-grained IAM actions will be used to control authorization to Billing, Cost Management, and Account consoles.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toUpdateConsoleActionSetEnforced", []))

    @jsii.member(jsii_name="toUpdateCostAllocationTagsStatus")
    def to_update_cost_allocation_tags_status(self) -> "Ce":
        '''(experimental) Grants permission to update existing Cost Allocation Tags status.

        Access Level: Write

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_UpdateCostAllocationTagsStatus.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toUpdateCostAllocationTagsStatus", []))

    @jsii.member(jsii_name="toUpdateCostCategoryDefinition")
    def to_update_cost_category_definition(self) -> "Ce":
        '''(experimental) Grants permission to update an existing Cost Category.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_UpdateCostCategoryDefinition.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toUpdateCostCategoryDefinition", []))

    @jsii.member(jsii_name="toUpdateNotificationSubscription")
    def to_update_notification_subscription(self) -> "Ce":
        '''(experimental) Grants permission to update Reservation expiration alerts.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toUpdateNotificationSubscription", []))

    @jsii.member(jsii_name="toUpdatePreferences")
    def to_update_preferences(self) -> "Ce":
        '''(experimental) Grants permission to edit Cost Explorer Preferences page.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toUpdatePreferences", []))

    @jsii.member(jsii_name="toUpdateReport")
    def to_update_report(self) -> "Ce":
        '''(experimental) Grants permission to update Cost Explorer Reports.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Ce", jsii.invoke(self, "toUpdateReport", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__befdb89f1b706253f56d0a0899e54afc108a8fa31796f3a3fe855ed4341cae67)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__298b00de780fbb4fafd010b8e75cb0ece12b6b719ef1be102fe2e269d9a1ed11)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Chatbot(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Chatbot"):
    '''(experimental) Statement provider for service `chatbot <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awschatbot.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `chatbot <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awschatbot.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2d1d474c6dfd57227c082d9b39aeec26ca4972568a7a14470e36608479724600)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onChatbotConfiguration")
    def on_chatbot_configuration(
        self,
        configuration_type: builtins.str,
        chatbot_configuration_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Chatbot":
        '''(experimental) Adds a resource of type ChatbotConfiguration to the statement.

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :param configuration_type: - Identifier for the configurationType.
        :param chatbot_configuration_name: - Identifier for the chatbotConfigurationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__54b60e31fa91167b8294ea4ce72f708c53dc053f5da5a17ad77c874f3f3e78b5)
            check_type(argname="argument configuration_type", value=configuration_type, expected_type=type_hints["configuration_type"])
            check_type(argname="argument chatbot_configuration_name", value=chatbot_configuration_name, expected_type=type_hints["chatbot_configuration_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Chatbot", jsii.invoke(self, "onChatbotConfiguration", [configuration_type, chatbot_configuration_name, account, partition]))

    @jsii.member(jsii_name="toCreateChimeWebhookConfiguration")
    def to_create_chime_webhook_configuration(self) -> "Chatbot":
        '''(experimental) Grants permission to create an AWS Chatbot Chime Webhook Configuration.

        Access Level: Write

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toCreateChimeWebhookConfiguration", []))

    @jsii.member(jsii_name="toCreateMicrosoftTeamsChannelConfiguration")
    def to_create_microsoft_teams_channel_configuration(self) -> "Chatbot":
        '''(experimental) Grants permission to create an AWS Chatbot Microsoft Teams Channel Configuration.

        Access Level: Write

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toCreateMicrosoftTeamsChannelConfiguration", []))

    @jsii.member(jsii_name="toCreateSlackChannelConfiguration")
    def to_create_slack_channel_configuration(self) -> "Chatbot":
        '''(experimental) Grants permission to create an AWS Chatbot Slack Channel Configuration.

        Access Level: Write

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toCreateSlackChannelConfiguration", []))

    @jsii.member(jsii_name="toDeleteChimeWebhookConfiguration")
    def to_delete_chime_webhook_configuration(self) -> "Chatbot":
        '''(experimental) Grants permission to delete an AWS Chatbot Chime Webhook Configuration.

        Access Level: Write

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toDeleteChimeWebhookConfiguration", []))

    @jsii.member(jsii_name="toDeleteMicrosoftTeamsChannelConfiguration")
    def to_delete_microsoft_teams_channel_configuration(self) -> "Chatbot":
        '''(experimental) Grants permission to delete an AWS Chatbot Microsoft Teams Channel Configuration.

        Access Level: Write

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toDeleteMicrosoftTeamsChannelConfiguration", []))

    @jsii.member(jsii_name="toDeleteMicrosoftTeamsConfiguredTeam")
    def to_delete_microsoft_teams_configured_team(self) -> "Chatbot":
        '''(experimental) Grants permission to delete the Microsoft Teams configured with AWS Chatbot in an AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toDeleteMicrosoftTeamsConfiguredTeam", []))

    @jsii.member(jsii_name="toDeleteMicrosoftTeamsUserIdentity")
    def to_delete_microsoft_teams_user_identity(self) -> "Chatbot":
        '''(experimental) Grants permission to delete an AWS Chatbot Microsoft Teams User Identity.

        Access Level: Write

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toDeleteMicrosoftTeamsUserIdentity", []))

    @jsii.member(jsii_name="toDeleteSlackChannelConfiguration")
    def to_delete_slack_channel_configuration(self) -> "Chatbot":
        '''(experimental) Grants permission to delete an AWS Chatbot Slack Channel Configuration.

        Access Level: Write

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toDeleteSlackChannelConfiguration", []))

    @jsii.member(jsii_name="toDeleteSlackUserIdentity")
    def to_delete_slack_user_identity(self) -> "Chatbot":
        '''(experimental) Grants permission to delete an AWS Chatbot Slack User Identity.

        Access Level: Write

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toDeleteSlackUserIdentity", []))

    @jsii.member(jsii_name="toDeleteSlackWorkspaceAuthorization")
    def to_delete_slack_workspace_authorization(self) -> "Chatbot":
        '''(experimental) Grants permission to delete the Slack workspace authorization with AWS Chatbot, associated with an AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toDeleteSlackWorkspaceAuthorization", []))

    @jsii.member(jsii_name="toDescribeChimeWebhookConfigurations")
    def to_describe_chime_webhook_configurations(self) -> "Chatbot":
        '''(experimental) Grants permission to list all AWS Chatbot Chime Webhook Configurations in an AWS Account.

        Access Level: Read

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toDescribeChimeWebhookConfigurations", []))

    @jsii.member(jsii_name="toDescribeSlackChannelConfigurations")
    def to_describe_slack_channel_configurations(self) -> "Chatbot":
        '''(experimental) Grants permission to list all AWS Chatbot Slack Channel Configurations in an AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toDescribeSlackChannelConfigurations", []))

    @jsii.member(jsii_name="toDescribeSlackChannels")
    def to_describe_slack_channels(self) -> "Chatbot":
        '''(experimental) Grants permission to list all public Slack channels in the Slack workspace connected to the AWS Account onboarded with AWS Chatbot service.

        Access Level: Read

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toDescribeSlackChannels", []))

    @jsii.member(jsii_name="toDescribeSlackUserIdentities")
    def to_describe_slack_user_identities(self) -> "Chatbot":
        '''(experimental) Grants permission to describe AWS Chatbot Slack User Identities.

        Access Level: Read

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toDescribeSlackUserIdentities", []))

    @jsii.member(jsii_name="toDescribeSlackWorkspaces")
    def to_describe_slack_workspaces(self) -> "Chatbot":
        '''(experimental) Grants permission to list all authorized Slack workspaces connected to the AWS Account onboarded with AWS Chatbot service.

        Access Level: Read

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toDescribeSlackWorkspaces", []))

    @jsii.member(jsii_name="toGetAccountPreferences")
    def to_get_account_preferences(self) -> "Chatbot":
        '''(experimental) Grants permission to retrieve AWS Chatbot account preferences.

        Access Level: Read

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toGetAccountPreferences", []))

    @jsii.member(jsii_name="toGetMicrosoftTeamsChannelConfiguration")
    def to_get_microsoft_teams_channel_configuration(self) -> "Chatbot":
        '''(experimental) Grants permission to get a single AWS Chatbot Microsoft Teams Channel Configurations in an AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toGetMicrosoftTeamsChannelConfiguration", []))

    @jsii.member(jsii_name="toGetMicrosoftTeamsOauthParameters")
    def to_get_microsoft_teams_oauth_parameters(self) -> "Chatbot":
        '''(experimental) Grants permission to generate OAuth parameters to request Microsoft Teams OAuth code to be used by the AWS Chatbot service.

        Access Level: Read

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toGetMicrosoftTeamsOauthParameters", []))

    @jsii.member(jsii_name="toGetSlackOauthParameters")
    def to_get_slack_oauth_parameters(self) -> "Chatbot":
        '''(experimental) Grants permission to generate OAuth parameters to request Slack OAuth code to be used by the AWS Chatbot service.

        Access Level: Read

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toGetSlackOauthParameters", []))

    @jsii.member(jsii_name="toListMicrosoftTeamsChannelConfigurations")
    def to_list_microsoft_teams_channel_configurations(self) -> "Chatbot":
        '''(experimental) Grants permission to list all AWS Chatbot Microsoft Teams Channel Configurations in an AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toListMicrosoftTeamsChannelConfigurations", []))

    @jsii.member(jsii_name="toListMicrosoftTeamsConfiguredTeams")
    def to_list_microsoft_teams_configured_teams(self) -> "Chatbot":
        '''(experimental) Grants permission to list all Microsoft Teams connected to the AWS Account onboarded with AWS Chatbot service.

        Access Level: Read

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toListMicrosoftTeamsConfiguredTeams", []))

    @jsii.member(jsii_name="toListMicrosoftTeamsUserIdentities")
    def to_list_microsoft_teams_user_identities(self) -> "Chatbot":
        '''(experimental) Grants permission to describe AWS Chatbot Microsoft Teams User Identities.

        Access Level: Read

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toListMicrosoftTeamsUserIdentities", []))

    @jsii.member(jsii_name="toRedeemMicrosoftTeamsOauthCode")
    def to_redeem_microsoft_teams_oauth_code(self) -> "Chatbot":
        '''(experimental) Grants permission to redeem previously generated parameters with Microsoft APIs, to acquire OAuth tokens to be used by the AWS Chatbot service.

        Access Level: Write

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toRedeemMicrosoftTeamsOauthCode", []))

    @jsii.member(jsii_name="toRedeemSlackOauthCode")
    def to_redeem_slack_oauth_code(self) -> "Chatbot":
        '''(experimental) Grants permission to redeem previously generated parameters with Slack API, to acquire OAuth tokens to be used by the AWS Chatbot service.

        Access Level: Write

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toRedeemSlackOauthCode", []))

    @jsii.member(jsii_name="toUpdateAccountPreferences")
    def to_update_account_preferences(self) -> "Chatbot":
        '''(experimental) Grants permission to update AWS Chatbot account preferences.

        Access Level: Write

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toUpdateAccountPreferences", []))

    @jsii.member(jsii_name="toUpdateChimeWebhookConfiguration")
    def to_update_chime_webhook_configuration(self) -> "Chatbot":
        '''(experimental) Grants permission to update an AWS Chatbot Chime Webhook Configuration.

        Access Level: Write

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toUpdateChimeWebhookConfiguration", []))

    @jsii.member(jsii_name="toUpdateMicrosoftTeamsChannelConfiguration")
    def to_update_microsoft_teams_channel_configuration(self) -> "Chatbot":
        '''(experimental) Grants permission to update an AWS Chatbot Microsoft Teams Channel Configuration.

        Access Level: Write

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toUpdateMicrosoftTeamsChannelConfiguration", []))

    @jsii.member(jsii_name="toUpdateSlackChannelConfiguration")
    def to_update_slack_channel_configuration(self) -> "Chatbot":
        '''(experimental) Grants permission to update an AWS Chatbot Slack Channel Configuration.

        Access Level: Write

        https://docs.aws.amazon.com/chatbot/latest/adminguide/what-is.html

        :stability: experimental
        '''
        return typing.cast("Chatbot", jsii.invoke(self, "toUpdateSlackChannelConfiguration", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__920bbb1ac122b275c34237b7dabe1ec24e945fe4faa9b390b9b93962bab53532)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3db1ecef7ca8741cf49bb24027a9db3b701dda862677bd897f9b03d368c5ac0e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Chime(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Chime"):
    '''(experimental) Statement provider for service `chime <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonchime.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `chime <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonchime.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4f8bd3f1e78faf7e018224590708a6fe60bfc9b055f3903465d3f3a0f3403bc4)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAppInstance")
    def on_app_instance(
        self,
        app_instance_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Chime":
        '''(experimental) Adds a resource of type app-instance to the statement.

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_AppInstance.html

        :param app_instance_id: - Identifier for the appInstanceId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d9e9c251da376dc99e13b8d21da71b14086dacc7da687324557c02fe0cf18e88)
            check_type(argname="argument app_instance_id", value=app_instance_id, expected_type=type_hints["app_instance_id"])
            check_type(argname="argument account_id", value=account_id, expected_type=type_hints["account_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Chime", jsii.invoke(self, "onAppInstance", [app_instance_id, account_id, region, partition]))

    @jsii.member(jsii_name="onAppInstanceBot")
    def on_app_instance_bot(
        self,
        app_instance_id: builtins.str,
        app_instance_bot_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Chime":
        '''(experimental) Adds a resource of type app-instance-bot to the statement.

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_AppInstanceBot.html

        :param app_instance_id: - Identifier for the appInstanceId.
        :param app_instance_bot_id: - Identifier for the appInstanceBotId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dc16f904b4818019d052a0b4a765448b3c48e804d997b7cdd83c1633ba202f64)
            check_type(argname="argument app_instance_id", value=app_instance_id, expected_type=type_hints["app_instance_id"])
            check_type(argname="argument app_instance_bot_id", value=app_instance_bot_id, expected_type=type_hints["app_instance_bot_id"])
            check_type(argname="argument account_id", value=account_id, expected_type=type_hints["account_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Chime", jsii.invoke(self, "onAppInstanceBot", [app_instance_id, app_instance_bot_id, account_id, region, partition]))

    @jsii.member(jsii_name="onAppInstanceUser")
    def on_app_instance_user(
        self,
        app_instance_id: builtins.str,
        app_instance_user_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Chime":
        '''(experimental) Adds a resource of type app-instance-user to the statement.

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_AppInstanceUser.html

        :param app_instance_id: - Identifier for the appInstanceId.
        :param app_instance_user_id: - Identifier for the appInstanceUserId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8d411e4394ba43e2a1b4f295a4aecc11d2326feeca4baa7ba76876e6a58a97a0)
            check_type(argname="argument app_instance_id", value=app_instance_id, expected_type=type_hints["app_instance_id"])
            check_type(argname="argument app_instance_user_id", value=app_instance_user_id, expected_type=type_hints["app_instance_user_id"])
            check_type(argname="argument account_id", value=account_id, expected_type=type_hints["account_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Chime", jsii.invoke(self, "onAppInstanceUser", [app_instance_id, app_instance_user_id, account_id, region, partition]))

    @jsii.member(jsii_name="onChannel")
    def on_channel(
        self,
        app_instance_id: builtins.str,
        channel_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Chime":
        '''(experimental) Adds a resource of type channel to the statement.

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_Channel.html

        :param app_instance_id: - Identifier for the appInstanceId.
        :param channel_id: - Identifier for the channelId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b6cf6a51d8e2a2c69d901c01e50d85f944092633a647241236e0215cc8267005)
            check_type(argname="argument app_instance_id", value=app_instance_id, expected_type=type_hints["app_instance_id"])
            check_type(argname="argument channel_id", value=channel_id, expected_type=type_hints["channel_id"])
            check_type(argname="argument account_id", value=account_id, expected_type=type_hints["account_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Chime", jsii.invoke(self, "onChannel", [app_instance_id, channel_id, account_id, region, partition]))

    @jsii.member(jsii_name="onChannelFlow")
    def on_channel_flow(
        self,
        app_instance_id: builtins.str,
        channel_flow_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Chime":
        '''(experimental) Adds a resource of type channel-flow to the statement.

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_ChannelFlow.html

        :param app_instance_id: - Identifier for the appInstanceId.
        :param channel_flow_id: - Identifier for the channelFlowId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__647594b6501520ba2f88addeee34765e95774e50a9d8fff1a74aaede68bbda39)
            check_type(argname="argument app_instance_id", value=app_instance_id, expected_type=type_hints["app_instance_id"])
            check_type(argname="argument channel_flow_id", value=channel_flow_id, expected_type=type_hints["channel_flow_id"])
            check_type(argname="argument account_id", value=account_id, expected_type=type_hints["account_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Chime", jsii.invoke(self, "onChannelFlow", [app_instance_id, channel_flow_id, account_id, region, partition]))

    @jsii.member(jsii_name="onMediaInsightsPipelineConfiguration")
    def on_media_insights_pipeline_configuration(
        self,
        configuration_name: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Chime":
        '''(experimental) Adds a resource of type media-insights-pipeline-configuration to the statement.

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_media-pipelines-chime_MediaInsightsPipelineConfiguration.html

        :param configuration_name: - Identifier for the configurationName.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fd37b708e7cec369fc7605b079726f4ae65c844da9acb3ca069391f688b50114)
            check_type(argname="argument configuration_name", value=configuration_name, expected_type=type_hints["configuration_name"])
            check_type(argname="argument account_id", value=account_id, expected_type=type_hints["account_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Chime", jsii.invoke(self, "onMediaInsightsPipelineConfiguration", [configuration_name, account_id, region, partition]))

    @jsii.member(jsii_name="onMediaPipeline")
    def on_media_pipeline(
        self,
        media_pipeline_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Chime":
        '''(experimental) Adds a resource of type media-pipeline to the statement.

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_media-pipelines-chime_MediaPipeline.html

        :param media_pipeline_id: - Identifier for the mediaPipelineId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9cac840270fc19e7d8fd62bd20c7b7f36d0d665feb222898c0e92546cf2e857c)
            check_type(argname="argument media_pipeline_id", value=media_pipeline_id, expected_type=type_hints["media_pipeline_id"])
            check_type(argname="argument account_id", value=account_id, expected_type=type_hints["account_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Chime", jsii.invoke(self, "onMediaPipeline", [media_pipeline_id, account_id, region, partition]))

    @jsii.member(jsii_name="onMeeting")
    def on_meeting(
        self,
        meeting_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Chime":
        '''(experimental) Adds a resource of type meeting to the statement.

        https://docs.aws.amazon.com/chime/latest/APIReference/API_Meeting.html

        :param meeting_id: - Identifier for the meetingId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__407cea03ec7371b2a3aec3aa45518afabccd6959ab22fd085013b51635af62c0)
            check_type(argname="argument meeting_id", value=meeting_id, expected_type=type_hints["meeting_id"])
            check_type(argname="argument account_id", value=account_id, expected_type=type_hints["account_id"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Chime", jsii.invoke(self, "onMeeting", [meeting_id, account_id, partition]))

    @jsii.member(jsii_name="onVoiceProfile")
    def on_voice_profile(
        self,
        voice_profile_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Chime":
        '''(experimental) Adds a resource of type voice-profile to the statement.

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_voice-chime_CreateVoiceProfile.html

        :param voice_profile_id: - Identifier for the voiceProfileId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d775ea9e66e542293393e1f9f087899e3ebb22156091a5cc745325bf1d6ec036)
            check_type(argname="argument voice_profile_id", value=voice_profile_id, expected_type=type_hints["voice_profile_id"])
            check_type(argname="argument account_id", value=account_id, expected_type=type_hints["account_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Chime", jsii.invoke(self, "onVoiceProfile", [voice_profile_id, account_id, region, partition]))

    @jsii.member(jsii_name="onVoiceProfileDomain")
    def on_voice_profile_domain(
        self,
        voice_profile_domain_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Chime":
        '''(experimental) Adds a resource of type voice-profile-domain to the statement.

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_voice-chime_CreateVoiceProfileDomain.html

        :param voice_profile_domain_id: - Identifier for the voiceProfileDomainId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a9a25a23735e612378ef0117ce5a8fe41d7055d5b5accde2d6a01cfe6ad92f90)
            check_type(argname="argument voice_profile_domain_id", value=voice_profile_domain_id, expected_type=type_hints["voice_profile_domain_id"])
            check_type(argname="argument account_id", value=account_id, expected_type=type_hints["account_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Chime", jsii.invoke(self, "onVoiceProfileDomain", [voice_profile_domain_id, account_id, region, partition]))

    @jsii.member(jsii_name="toAcceptDelegate")
    def to_accept_delegate(self) -> "Chime":
        '''(experimental) Grants permission to accept the delegate invitation to share management of an Amazon Chime account with another AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toAcceptDelegate", []))

    @jsii.member(jsii_name="toActivateUsers")
    def to_activate_users(self) -> "Chime":
        '''(experimental) Grants permission to activate users in an Amazon Chime Enterprise account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/manage-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toActivateUsers", []))

    @jsii.member(jsii_name="toAddDomain")
    def to_add_domain(self) -> "Chime":
        '''(experimental) Grants permission to add a domain to your Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/claim-domain.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toAddDomain", []))

    @jsii.member(jsii_name="toAddOrUpdateGroups")
    def to_add_or_update_groups(self) -> "Chime":
        '''(experimental) Grants permission to add new or update existing Active Directory or Okta user groups associated with your Amazon Chime Enterprise account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/manage-chime-account.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toAddOrUpdateGroups", []))

    @jsii.member(jsii_name="toAssociateChannelFlow")
    def to_associate_channel_flow(self) -> "Chime":
        '''(experimental) Grants permission to associate a flow with a channel.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_AssociateChannelFlow.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toAssociateChannelFlow", []))

    @jsii.member(jsii_name="toAssociatePhoneNumbersWithVoiceConnector")
    def to_associate_phone_numbers_with_voice_connector(self) -> "Chime":
        '''(experimental) Grants permission to associate multiple phone numbers with an Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_AssociatePhoneNumbersWithVoiceConnector.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toAssociatePhoneNumbersWithVoiceConnector", []))

    @jsii.member(jsii_name="toAssociatePhoneNumbersWithVoiceConnectorGroup")
    def to_associate_phone_numbers_with_voice_connector_group(self) -> "Chime":
        '''(experimental) Grants permission to associate multiple phone numbers with an Amazon Chime Voice Connector Group.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_AssociatePhoneNumbersWithVoiceConnectorGroup.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toAssociatePhoneNumbersWithVoiceConnectorGroup", []))

    @jsii.member(jsii_name="toAssociatePhoneNumberWithUser")
    def to_associate_phone_number_with_user(self) -> "Chime":
        '''(experimental) Grants permission to associate a phone number with an Amazon Chime user.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_AssociatePhoneNumberWithUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toAssociatePhoneNumberWithUser", []))

    @jsii.member(jsii_name="toAssociateSigninDelegateGroupsWithAccount")
    def to_associate_signin_delegate_groups_with_account(self) -> "Chime":
        '''(experimental) Grants permission to associate the specified sign-in delegate groups with the specified Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_AssociateSigninDelegateGroupsWithAccount.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toAssociateSigninDelegateGroupsWithAccount", []))

    @jsii.member(jsii_name="toAuthorizeDirectory")
    def to_authorize_directory(self) -> "Chime":
        '''(experimental) Grants permission to authorize an Active Directory for your Amazon Chime Enterprise account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toAuthorizeDirectory", []))

    @jsii.member(jsii_name="toBatchCreateAttendee")
    def to_batch_create_attendee(self) -> "Chime":
        '''(experimental) Grants permission to create new attendees for an active Amazon Chime SDK meeting.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_BatchCreateAttendee.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toBatchCreateAttendee", []))

    @jsii.member(jsii_name="toBatchCreateChannelMembership")
    def to_batch_create_channel_membership(self) -> "Chime":
        '''(experimental) Grants permission to add multiple users and bots to a channel.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_BatchCreateChannelMembership.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toBatchCreateChannelMembership", []))

    @jsii.member(jsii_name="toBatchCreateRoomMembership")
    def to_batch_create_room_membership(self) -> "Chime":
        '''(experimental) Grants permission to batch add room members.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_BatchCreateRoomMembership.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toBatchCreateRoomMembership", []))

    @jsii.member(jsii_name="toBatchDeletePhoneNumber")
    def to_batch_delete_phone_number(self) -> "Chime":
        '''(experimental) Grants permission to move up to 50 phone numbers to the deletion queue.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_BatchDeletePhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toBatchDeletePhoneNumber", []))

    @jsii.member(jsii_name="toBatchSuspendUser")
    def to_batch_suspend_user(self) -> "Chime":
        '''(experimental) Grants permission to suspend up to 50 users from a Team or EnterpriseLWA Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_BatchSuspendUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toBatchSuspendUser", []))

    @jsii.member(jsii_name="toBatchUnsuspendUser")
    def to_batch_unsuspend_user(self) -> "Chime":
        '''(experimental) Grants permission to remove the suspension from up to 50 previously suspended users for the specified Amazon Chime EnterpriseLWA account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_BatchUnsuspendUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toBatchUnsuspendUser", []))

    @jsii.member(jsii_name="toBatchUpdateAttendeeCapabilitiesExcept")
    def to_batch_update_attendee_capabilities_except(self) -> "Chime":
        '''(experimental) Grants permission to update AttendeeCapabilities except the capabilities listed in an ExcludedAttendeeIds table.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_meeting-chime_BatchUpdateAttendeeCapabilitiesExcept.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toBatchUpdateAttendeeCapabilitiesExcept", []))

    @jsii.member(jsii_name="toBatchUpdatePhoneNumber")
    def to_batch_update_phone_number(self) -> "Chime":
        '''(experimental) Grants permission to update phone number details within the UpdatePhoneNumberRequestItem object for up to 50 phone numbers.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_BatchUpdatePhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toBatchUpdatePhoneNumber", []))

    @jsii.member(jsii_name="toBatchUpdateUser")
    def to_batch_update_user(self) -> "Chime":
        '''(experimental) Grants permission to update user details within the UpdateUserRequestItem object for up to 20 users for the specified Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_BatchUpdateUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toBatchUpdateUser", []))

    @jsii.member(jsii_name="toChannelFlowCallback")
    def to_channel_flow_callback(self) -> "Chime":
        '''(experimental) Grants permission to callback for a message on a channel.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_ChannelFlowCallback.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toChannelFlowCallback", []))

    @jsii.member(jsii_name="toConnect")
    def to_connect(self) -> "Chime":
        '''(experimental) Grants permission to establish a web socket connection for app instance user to the messaging session endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_Connect.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toConnect", []))

    @jsii.member(jsii_name="toConnectDirectory")
    def to_connect_directory(self) -> "Chime":
        '''(experimental) Grants permission to connect an Active Directory to your Amazon Chime Enterprise account.

        Access Level: Write

        Dependent actions:

        - ds:ConnectDirectory

        https://docs.aws.amazon.com/chime/latest/ag/active_directory.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toConnectDirectory", []))

    @jsii.member(jsii_name="toCreateAccount")
    def to_create_account(self) -> "Chime":
        '''(experimental) Grants permission to create an Amazon Chime account under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateAccount.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateAccount", []))

    @jsii.member(jsii_name="toCreateApiKey")
    def to_create_api_key(self) -> "Chime":
        '''(experimental) Grants permission to create a new SCIM access key for your Amazon Chime account and Okta configuration.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/okta_sso.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateApiKey", []))

    @jsii.member(jsii_name="toCreateAppInstance")
    def to_create_app_instance(self) -> "Chime":
        '''(experimental) Grants permission to create an app instance under the AWS account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_CreateAppInstance.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateAppInstance", []))

    @jsii.member(jsii_name="toCreateAppInstanceAdmin")
    def to_create_app_instance_admin(self) -> "Chime":
        '''(experimental) Grants permission to promote a user or bot to an AppInstanceAdmin.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_CreateAppInstanceAdmin.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateAppInstanceAdmin", []))

    @jsii.member(jsii_name="toCreateAppInstanceBot")
    def to_create_app_instance_bot(self) -> "Chime":
        '''(experimental) Grants permission to create a bot under an Amazon Chime AppInstance.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_CreateAppInstanceBot.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateAppInstanceBot", []))

    @jsii.member(jsii_name="toCreateAppInstanceUser")
    def to_create_app_instance_user(self) -> "Chime":
        '''(experimental) Grants permission to create a user under an Amazon Chime AppInstance.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_CreateAppInstanceUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateAppInstanceUser", []))

    @jsii.member(jsii_name="toCreateAttendee")
    def to_create_attendee(self) -> "Chime":
        '''(experimental) Grants permission to create a new attendee for an active Amazon Chime SDK meeting.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateAttendee.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateAttendee", []))

    @jsii.member(jsii_name="toCreateBot")
    def to_create_bot(self) -> "Chime":
        '''(experimental) Grants permission to create a bot for an Amazon Chime Enterprise account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateBot.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateBot", []))

    @jsii.member(jsii_name="toCreateCDRBucket")
    def to_create_cdr_bucket(self) -> "Chime":
        '''(experimental) Grants permission to create a new Call Detail Record S3 bucket.

        Access Level: Write

        Dependent actions:

        - s3:CreateBucket
        - s3:ListAllMyBuckets

        https://docs.aws.amazon.com/chime/latest/ag/manage-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateCDRBucket", []))

    @jsii.member(jsii_name="toCreateChannel")
    def to_create_channel(self) -> "Chime":
        '''(experimental) Grants permission to create a channel for an app instance under the AWS account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_CreateChannel.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateChannel", []))

    @jsii.member(jsii_name="toCreateChannelBan")
    def to_create_channel_ban(self) -> "Chime":
        '''(experimental) Grants permission to ban a user or bot from a channel.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_CreateChannelBan.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateChannelBan", []))

    @jsii.member(jsii_name="toCreateChannelFlow")
    def to_create_channel_flow(self) -> "Chime":
        '''(experimental) Grants permission to create a channel flow for an app instance under the AWS account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_CreateChannelFlow.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateChannelFlow", []))

    @jsii.member(jsii_name="toCreateChannelMembership")
    def to_create_channel_membership(self) -> "Chime":
        '''(experimental) Grants permission to add a user or bot to a channel.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_CreateChannelMembership.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateChannelMembership", []))

    @jsii.member(jsii_name="toCreateChannelModerator")
    def to_create_channel_moderator(self) -> "Chime":
        '''(experimental) Grants permission to create a channel moderator.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_CreateChannelModerator.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateChannelModerator", []))

    @jsii.member(jsii_name="toCreateMediaCapturePipeline")
    def to_create_media_capture_pipeline(self) -> "Chime":
        '''(experimental) Grants permission to create a media capture pipeline.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - s3:GetBucketPolicy

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_media-pipelines-chime_CreateMediaCapturePipeline.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateMediaCapturePipeline", []))

    @jsii.member(jsii_name="toCreateMediaConcatenationPipeline")
    def to_create_media_concatenation_pipeline(self) -> "Chime":
        '''(experimental) Grants permission to create a media concatenation pipeline.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - s3:GetBucketPolicy

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_media-pipelines-chime_CreateMediaConcatenationPipeline.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateMediaConcatenationPipeline", []))

    @jsii.member(jsii_name="toCreateMediaInsightsPipeline")
    def to_create_media_insights_pipeline(self) -> "Chime":
        '''(experimental) Grants permission to create a media insights pipeline.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - chime:TagResource
        - kinesisvideo:DescribeStream

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_media-pipelines-chime_CreateMediaInsightsPipeline.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateMediaInsightsPipeline", []))

    @jsii.member(jsii_name="toCreateMediaInsightsPipelineConfiguration")
    def to_create_media_insights_pipeline_configuration(self) -> "Chime":
        '''(experimental) Grants permission to create a media insights pipeline configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - chime:TagResource
        - iam:PassRole
        - kinesis:DescribeStream
        - s3:ListBucket

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_media-pipelines-chime_CreateMediaInsightsPipelineConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateMediaInsightsPipelineConfiguration", []))

    @jsii.member(jsii_name="toCreateMediaLiveConnectorPipeline")
    def to_create_media_live_connector_pipeline(self) -> "Chime":
        '''(experimental) Grants permission to create a media live connector pipeline.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_media-pipelines-chime_CreateMediaLiveConnectorPipeline.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateMediaLiveConnectorPipeline", []))

    @jsii.member(jsii_name="toCreateMeeting")
    def to_create_meeting(self) -> "Chime":
        '''(experimental) Grants permission to create a new Amazon Chime SDK meeting in the specified media Region, with no initial attendees.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateMeeting.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateMeeting", []))

    @jsii.member(jsii_name="toCreateMeetingDialOut")
    def to_create_meeting_dial_out(self) -> "Chime":
        '''(experimental) Grants permission to call a phone number to join the specified Amazon Chime SDK meeting.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateMeetingDialOut.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateMeetingDialOut", []))

    @jsii.member(jsii_name="toCreateMeetingWithAttendees")
    def to_create_meeting_with_attendees(self) -> "Chime":
        '''(experimental) Grants permission to create a new Amazon Chime SDK meeting in the specified media Region, with a set of attendees.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateMeetingWithAttendees.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateMeetingWithAttendees", []))

    @jsii.member(jsii_name="toCreatePhoneNumberOrder")
    def to_create_phone_number_order(self) -> "Chime":
        '''(experimental) Grants permission to create a phone number order with the Carriers.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreatePhoneNumberOrder.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreatePhoneNumberOrder", []))

    @jsii.member(jsii_name="toCreateProxySession")
    def to_create_proxy_session(self) -> "Chime":
        '''(experimental) Grants permission to create a proxy session for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateProxySession.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateProxySession", []))

    @jsii.member(jsii_name="toCreateRoom")
    def to_create_room(self) -> "Chime":
        '''(experimental) Grants permission to create a room.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateRoom.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateRoom", []))

    @jsii.member(jsii_name="toCreateRoomMembership")
    def to_create_room_membership(self) -> "Chime":
        '''(experimental) Grants permission to add a room member.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateRoomMembership.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateRoomMembership", []))

    @jsii.member(jsii_name="toCreateSipMediaApplication")
    def to_create_sip_media_application(self) -> "Chime":
        '''(experimental) Grants permission to create an Amazon Chime SIP media application under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateSipMediaApplication.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateSipMediaApplication", []))

    @jsii.member(jsii_name="toCreateSipMediaApplicationCall")
    def to_create_sip_media_application_call(self) -> "Chime":
        '''(experimental) Grants permission to create outbound call for Amazon Chime SIP media application under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateSipMediaApplicationCall.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateSipMediaApplicationCall", []))

    @jsii.member(jsii_name="toCreateSipRule")
    def to_create_sip_rule(self) -> "Chime":
        '''(experimental) Grants permission to create an Amazon Chime SIP rule under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateSipRule.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateSipRule", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Chime":
        '''(experimental) Grants permission to create a user under the specified Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toCreateVoiceConnector")
    def to_create_voice_connector(self) -> "Chime":
        '''(experimental) Grants permission to create a Amazon Chime Voice Connector under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateVoiceConnector.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateVoiceConnector", []))

    @jsii.member(jsii_name="toCreateVoiceConnectorGroup")
    def to_create_voice_connector_group(self) -> "Chime":
        '''(experimental) Grants permission to create a Amazon Chime Voice Connector Group under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_CreateVoiceConnectorGroup.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateVoiceConnectorGroup", []))

    @jsii.member(jsii_name="toCreateVoiceProfile")
    def to_create_voice_profile(self) -> "Chime":
        '''(experimental) Grants permission to create a voice profile.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_voice-chime_CreateVoiceProfile.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateVoiceProfile", []))

    @jsii.member(jsii_name="toCreateVoiceProfileDomain")
    def to_create_voice_profile_domain(self) -> "Chime":
        '''(experimental) Grants permission to create a voice profile domain.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - chime:TagResource
        - kms:CreateGrant
        - kms:DescribeKey

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_voice-chime_CreateVoiceProfileDomain.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toCreateVoiceProfileDomain", []))

    @jsii.member(jsii_name="toDeleteAccount")
    def to_delete_account(self) -> "Chime":
        '''(experimental) Grants permission to delete the specified Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteAccount.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteAccount", []))

    @jsii.member(jsii_name="toDeleteAccountOpenIdConfig")
    def to_delete_account_open_id_config(self) -> "Chime":
        '''(experimental) Grants permission to delete the OpenIdConfig attributes from your Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/okta_sso.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteAccountOpenIdConfig", []))

    @jsii.member(jsii_name="toDeleteApiKey")
    def to_delete_api_key(self) -> "Chime":
        '''(experimental) Grants permission to delete the specified SCIM access key associated with your Amazon Chime account and Okta configuration.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/okta_sso.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteApiKey", []))

    @jsii.member(jsii_name="toDeleteAppInstance")
    def to_delete_app_instance(self) -> "Chime":
        '''(experimental) Grants permission to delete an AppInstance.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_DeleteAppInstance.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteAppInstance", []))

    @jsii.member(jsii_name="toDeleteAppInstanceAdmin")
    def to_delete_app_instance_admin(self) -> "Chime":
        '''(experimental) Grants permission to demote an AppInstanceAdmin to a user or bot.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_DeleteAppInstanceAdmin.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteAppInstanceAdmin", []))

    @jsii.member(jsii_name="toDeleteAppInstanceBot")
    def to_delete_app_instance_bot(self) -> "Chime":
        '''(experimental) Grants permission to delete an AppInstanceBot.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_DeleteAppInstanceBot.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteAppInstanceBot", []))

    @jsii.member(jsii_name="toDeleteAppInstanceStreamingConfigurations")
    def to_delete_app_instance_streaming_configurations(self) -> "Chime":
        '''(experimental) Grants permission to disable data streaming for the app instance.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_DeleteAppInstanceStreamingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteAppInstanceStreamingConfigurations", []))

    @jsii.member(jsii_name="toDeleteAppInstanceUser")
    def to_delete_app_instance_user(self) -> "Chime":
        '''(experimental) Grants permission to delete an AppInstanceUser.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_DeleteAppInstanceUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteAppInstanceUser", []))

    @jsii.member(jsii_name="toDeleteAttendee")
    def to_delete_attendee(self) -> "Chime":
        '''(experimental) Grants permission to delete the specified attendee from an Amazon Chime SDK meeting.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteAttendee.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteAttendee", []))

    @jsii.member(jsii_name="toDeleteCDRBucket")
    def to_delete_cdr_bucket(self) -> "Chime":
        '''(experimental) Grants permission to delete a Call Detail Record S3 bucket from your Amazon Chime account.

        Access Level: Write

        Dependent actions:

        - s3:DeleteBucket

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteCDRBucket", []))

    @jsii.member(jsii_name="toDeleteChannel")
    def to_delete_channel(self) -> "Chime":
        '''(experimental) Grants permission to delete a channel.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_DeleteChannel.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteChannel", []))

    @jsii.member(jsii_name="toDeleteChannelBan")
    def to_delete_channel_ban(self) -> "Chime":
        '''(experimental) Grants permission to remove a user or bot from a channel's ban list.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_DeleteChannelBan.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteChannelBan", []))

    @jsii.member(jsii_name="toDeleteChannelFlow")
    def to_delete_channel_flow(self) -> "Chime":
        '''(experimental) Grants permission to delete a channel flow.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_DeleteChannelFlow.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteChannelFlow", []))

    @jsii.member(jsii_name="toDeleteChannelMembership")
    def to_delete_channel_membership(self) -> "Chime":
        '''(experimental) Grants permission to remove a member from a channel.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_DeleteChannelMembership.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteChannelMembership", []))

    @jsii.member(jsii_name="toDeleteChannelMessage")
    def to_delete_channel_message(self) -> "Chime":
        '''(experimental) Grants permission to delete a channel message.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_DeleteChannelMessage.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteChannelMessage", []))

    @jsii.member(jsii_name="toDeleteChannelModerator")
    def to_delete_channel_moderator(self) -> "Chime":
        '''(experimental) Grants permission to delete a channel moderator.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_DeleteChannelModerator.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteChannelModerator", []))

    @jsii.member(jsii_name="toDeleteDelegate")
    def to_delete_delegate(self) -> "Chime":
        '''(experimental) Grants permission to delete delegated AWS account management from your Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteDelegate", []))

    @jsii.member(jsii_name="toDeleteDomain")
    def to_delete_domain(self) -> "Chime":
        '''(experimental) Grants permission to delete a domain from your Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/claim-domain.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteDomain", []))

    @jsii.member(jsii_name="toDeleteEventsConfiguration")
    def to_delete_events_configuration(self) -> "Chime":
        '''(experimental) Grants permission to delete an events configuration for a bot to receive outgoing events.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteEventsConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteEventsConfiguration", []))

    @jsii.member(jsii_name="toDeleteGroups")
    def to_delete_groups(self) -> "Chime":
        '''(experimental) Grants permission to delete Active Directory or Okta user groups from your Amazon Chime Enterprise account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteGroups", []))

    @jsii.member(jsii_name="toDeleteMediaCapturePipeline")
    def to_delete_media_capture_pipeline(self) -> "Chime":
        '''(experimental) Grants permission to delete a media capture pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_media-pipelines-chime_DeleteMediaCapturePipeline.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteMediaCapturePipeline", []))

    @jsii.member(jsii_name="toDeleteMediaInsightsPipelineConfiguration")
    def to_delete_media_insights_pipeline_configuration(self) -> "Chime":
        '''(experimental) Grants permission to delete a media insights pipeline configuration.

        Access Level: Write

        Dependent actions:

        - chime:ListVoiceConnectors

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_media-pipelines-chime_DeleteMediaInsightsPipelineConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteMediaInsightsPipelineConfiguration", []))

    @jsii.member(jsii_name="toDeleteMediaPipeline")
    def to_delete_media_pipeline(self) -> "Chime":
        '''(experimental) Grants permission to delete a media pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_media-pipelines-chime_DeleteMediaPipeline.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteMediaPipeline", []))

    @jsii.member(jsii_name="toDeleteMeeting")
    def to_delete_meeting(self) -> "Chime":
        '''(experimental) Grants permission to delete the specified Amazon Chime SDK meeting.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteMeeting.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteMeeting", []))

    @jsii.member(jsii_name="toDeleteMessagingStreamingConfigurations")
    def to_delete_messaging_streaming_configurations(self) -> "Chime":
        '''(experimental) Grants permission to delete the data streaming configurations of an AppInstance.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_DeleteMessagingStreamingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteMessagingStreamingConfigurations", []))

    @jsii.member(jsii_name="toDeletePhoneNumber")
    def to_delete_phone_number(self) -> "Chime":
        '''(experimental) Grants permission to move a phone number to the deletion queue.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeletePhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeletePhoneNumber", []))

    @jsii.member(jsii_name="toDeleteProxySession")
    def to_delete_proxy_session(self) -> "Chime":
        '''(experimental) Grants permission to delete a proxy session for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteProxySession.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteProxySession", []))

    @jsii.member(jsii_name="toDeleteRoom")
    def to_delete_room(self) -> "Chime":
        '''(experimental) Grants permission to delete a room.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteRoom.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteRoom", []))

    @jsii.member(jsii_name="toDeleteRoomMembership")
    def to_delete_room_membership(self) -> "Chime":
        '''(experimental) Grants permission to remove a room member.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteRoomMembership.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteRoomMembership", []))

    @jsii.member(jsii_name="toDeleteSipMediaApplication")
    def to_delete_sip_media_application(self) -> "Chime":
        '''(experimental) Grants permission to delete Amazon Chime SIP media application under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteSipMediaApplication.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteSipMediaApplication", []))

    @jsii.member(jsii_name="toDeleteSipRule")
    def to_delete_sip_rule(self) -> "Chime":
        '''(experimental) Grants permission to delete Amazon Chime SIP rule under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteSipRule.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteSipRule", []))

    @jsii.member(jsii_name="toDeleteVoiceConnector")
    def to_delete_voice_connector(self) -> "Chime":
        '''(experimental) Grants permission to delete the specified Amazon Chime Voice Connector.

        Access Level: Write

        Dependent actions:

        - logs:CreateLogDelivery
        - logs:DeleteLogDelivery
        - logs:GetLogDelivery
        - logs:ListLogDeliveries

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteVoiceConnector.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteVoiceConnector", []))

    @jsii.member(jsii_name="toDeleteVoiceConnectorEmergencyCallingConfiguration")
    def to_delete_voice_connector_emergency_calling_configuration(self) -> "Chime":
        '''(experimental) Grants permission to delete emergency calling configuration for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteVoiceConnectorEmergencyCallingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteVoiceConnectorEmergencyCallingConfiguration", []))

    @jsii.member(jsii_name="toDeleteVoiceConnectorGroup")
    def to_delete_voice_connector_group(self) -> "Chime":
        '''(experimental) Grants permission to delete the specified Amazon Chime Voice Connector Group.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteVoiceConnectorGroup.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteVoiceConnectorGroup", []))

    @jsii.member(jsii_name="toDeleteVoiceConnectorOrigination")
    def to_delete_voice_connector_origination(self) -> "Chime":
        '''(experimental) Grants permission to delete the origination settings for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteVoiceConnectorOrigination.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteVoiceConnectorOrigination", []))

    @jsii.member(jsii_name="toDeleteVoiceConnectorProxy")
    def to_delete_voice_connector_proxy(self) -> "Chime":
        '''(experimental) Grants permission to delete proxy configuration for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteVoiceConnectorProxy.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteVoiceConnectorProxy", []))

    @jsii.member(jsii_name="toDeleteVoiceConnectorStreamingConfiguration")
    def to_delete_voice_connector_streaming_configuration(self) -> "Chime":
        '''(experimental) Grants permission to delete streaming configuration for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteVoiceConnectorStreamingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteVoiceConnectorStreamingConfiguration", []))

    @jsii.member(jsii_name="toDeleteVoiceConnectorTermination")
    def to_delete_voice_connector_termination(self) -> "Chime":
        '''(experimental) Grants permission to delete the termination settings for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteVoiceConnectorTermination.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteVoiceConnectorTermination", []))

    @jsii.member(jsii_name="toDeleteVoiceConnectorTerminationCredentials")
    def to_delete_voice_connector_termination_credentials(self) -> "Chime":
        '''(experimental) Grants permission to delete SIP termination credentials for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DeleteVoiceConnectorTerminationCredentials.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteVoiceConnectorTerminationCredentials", []))

    @jsii.member(jsii_name="toDeleteVoiceProfile")
    def to_delete_voice_profile(self) -> "Chime":
        '''(experimental) Grants permission to delete a voice profile.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_voice-chime_DeleteVoiceProfile.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteVoiceProfile", []))

    @jsii.member(jsii_name="toDeleteVoiceProfileDomain")
    def to_delete_voice_profile_domain(self) -> "Chime":
        '''(experimental) Grants permission to delete a voice profile domain.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_voice-chime_DeleteVoiceProfileDomain.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeleteVoiceProfileDomain", []))

    @jsii.member(jsii_name="toDeregisterAppInstanceUserEndpoint")
    def to_deregister_app_instance_user_endpoint(self) -> "Chime":
        '''(experimental) Grants permission to deregister an endpoint for an app instance user.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_DeregisterAppInstanceUserEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDeregisterAppInstanceUserEndpoint", []))

    @jsii.member(jsii_name="toDescribeAppInstance")
    def to_describe_app_instance(self) -> "Chime":
        '''(experimental) Grants permission to get the full details of an AppInstance.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_DescribeAppInstance.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeAppInstance", []))

    @jsii.member(jsii_name="toDescribeAppInstanceAdmin")
    def to_describe_app_instance_admin(self) -> "Chime":
        '''(experimental) Grants permission to get the full details of an AppInstanceAdmin.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_DescribeAppInstanceAdmin.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeAppInstanceAdmin", []))

    @jsii.member(jsii_name="toDescribeAppInstanceBot")
    def to_describe_app_instance_bot(self) -> "Chime":
        '''(experimental) Grants permission to get the full details of an AppInstanceBot.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_DescribeAppInstanceBot.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeAppInstanceBot", []))

    @jsii.member(jsii_name="toDescribeAppInstanceUser")
    def to_describe_app_instance_user(self) -> "Chime":
        '''(experimental) Grants permission to get the full details of an AppInstanceUser.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_DescribeAppInstanceUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeAppInstanceUser", []))

    @jsii.member(jsii_name="toDescribeAppInstanceUserEndpoint")
    def to_describe_app_instance_user_endpoint(self) -> "Chime":
        '''(experimental) Grants permission to describe an endpoint registered for an app instance user.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_DescribeAppInstanceUserEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeAppInstanceUserEndpoint", []))

    @jsii.member(jsii_name="toDescribeChannel")
    def to_describe_channel(self) -> "Chime":
        '''(experimental) Grants permission to get the full details of a channel.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_DescribeChannel.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeChannel", []))

    @jsii.member(jsii_name="toDescribeChannelBan")
    def to_describe_channel_ban(self) -> "Chime":
        '''(experimental) Grants permission to get the full details of a channel ban.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_DescribeChannelBan.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeChannelBan", []))

    @jsii.member(jsii_name="toDescribeChannelFlow")
    def to_describe_channel_flow(self) -> "Chime":
        '''(experimental) Grants permission to get the full details of a channel flow.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_DescribeChannelFlow.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeChannelFlow", []))

    @jsii.member(jsii_name="toDescribeChannelMembership")
    def to_describe_channel_membership(self) -> "Chime":
        '''(experimental) Grants permission to get the full details of a channel membership.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_DescribeChannelMembership.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeChannelMembership", []))

    @jsii.member(jsii_name="toDescribeChannelMembershipForAppInstanceUser")
    def to_describe_channel_membership_for_app_instance_user(self) -> "Chime":
        '''(experimental) Grants permission to get the details of a channel based on the membership of the specified user or bot.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_DescribeChannelMembershipForAppInstanceUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeChannelMembershipForAppInstanceUser", []))

    @jsii.member(jsii_name="toDescribeChannelModeratedByAppInstanceUser")
    def to_describe_channel_moderated_by_app_instance_user(self) -> "Chime":
        '''(experimental) Grants permission to get the full details of a channel moderated by the specified user or bot.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_DescribeChannelModeratedByAppInstanceUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeChannelModeratedByAppInstanceUser", []))

    @jsii.member(jsii_name="toDescribeChannelModerator")
    def to_describe_channel_moderator(self) -> "Chime":
        '''(experimental) Grants permission to get the full details of a single ChannelModerator.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_DescribeChannelModerator.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDescribeChannelModerator", []))

    @jsii.member(jsii_name="toDisassociateChannelFlow")
    def to_disassociate_channel_flow(self) -> "Chime":
        '''(experimental) Grants permission to disassociate a flow from a channel.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_DisassociateChannelFlow.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDisassociateChannelFlow", []))

    @jsii.member(jsii_name="toDisassociatePhoneNumberFromUser")
    def to_disassociate_phone_number_from_user(self) -> "Chime":
        '''(experimental) Grants permission to disassociate the primary provisioned number from the specified Amazon Chime user.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DisassociatePhoneNumberFromUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDisassociatePhoneNumberFromUser", []))

    @jsii.member(jsii_name="toDisassociatePhoneNumbersFromVoiceConnector")
    def to_disassociate_phone_numbers_from_voice_connector(self) -> "Chime":
        '''(experimental) Grants permission to disassociate multiple phone numbers from the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DisassociatePhoneNumbersFromVoiceConnector.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDisassociatePhoneNumbersFromVoiceConnector", []))

    @jsii.member(jsii_name="toDisassociatePhoneNumbersFromVoiceConnectorGroup")
    def to_disassociate_phone_numbers_from_voice_connector_group(self) -> "Chime":
        '''(experimental) Grants permission to disassociate multiple phone numbers from the specified Amazon Chime Voice Connector Group.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DisassociatePhoneNumbersFromVoiceConnectorGroup.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDisassociatePhoneNumbersFromVoiceConnectorGroup", []))

    @jsii.member(jsii_name="toDisassociateSigninDelegateGroupsFromAccount")
    def to_disassociate_signin_delegate_groups_from_account(self) -> "Chime":
        '''(experimental) Grants permission to disassociate the specified sign-in delegate groups from the specified Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_DisassociateSigninDelegateGroupsFromAccount.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDisassociateSigninDelegateGroupsFromAccount", []))

    @jsii.member(jsii_name="toDisconnectDirectory")
    def to_disconnect_directory(self) -> "Chime":
        '''(experimental) Grants permission to disconnect the Active Directory from your Amazon Chime Enterprise account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toDisconnectDirectory", []))

    @jsii.member(jsii_name="toGetAccount")
    def to_get_account(self) -> "Chime":
        '''(experimental) Grants permission to get details for the specified Amazon Chime account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetAccount.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetAccount", []))

    @jsii.member(jsii_name="toGetAccountResource")
    def to_get_account_resource(self) -> "Chime":
        '''(experimental) Grants permission to get details for the account resource associated with your Amazon Chime account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetAccountResource", []))

    @jsii.member(jsii_name="toGetAccountSettings")
    def to_get_account_settings(self) -> "Chime":
        '''(experimental) Grants permission to get account settings for the specified Amazon Chime account ID.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetAccountSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetAccountSettings", []))

    @jsii.member(jsii_name="toGetAccountWithOpenIdConfig")
    def to_get_account_with_open_id_config(self) -> "Chime":
        '''(experimental) Grants permission to get the account details and OpenIdConfig attributes for your Amazon Chime account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/ag/okta_sso.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetAccountWithOpenIdConfig", []))

    @jsii.member(jsii_name="toGetAppInstanceRetentionSettings")
    def to_get_app_instance_retention_settings(self) -> "Chime":
        '''(experimental) Grants permission to get retention settings for an app instance.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_GetAppInstanceRetentionSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetAppInstanceRetentionSettings", []))

    @jsii.member(jsii_name="toGetAppInstanceStreamingConfigurations")
    def to_get_app_instance_streaming_configurations(self) -> "Chime":
        '''(experimental) Grants permission to get the streaming configurations for an app instance.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_GetAppInstanceStreamingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetAppInstanceStreamingConfigurations", []))

    @jsii.member(jsii_name="toGetAttendee")
    def to_get_attendee(self) -> "Chime":
        '''(experimental) Grants permission to get attendee details for a specified meeting ID and attendee ID.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetAttendee.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetAttendee", []))

    @jsii.member(jsii_name="toGetBot")
    def to_get_bot(self) -> "Chime":
        '''(experimental) Grants permission to retrieve details for the specified bot.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetBot.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetBot", []))

    @jsii.member(jsii_name="toGetCDRBucket")
    def to_get_cdr_bucket(self) -> "Chime":
        '''(experimental) Grants permission to get details of a Call Detail Record S3 bucket associated with your Amazon Chime account.

        Access Level: Read

        Dependent actions:

        - s3:GetBucketAcl
        - s3:GetBucketLocation
        - s3:GetBucketLogging
        - s3:GetBucketVersioning
        - s3:GetBucketWebsite

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetCDRBucket", []))

    @jsii.member(jsii_name="toGetChannelMembershipPreferences")
    def to_get_channel_membership_preferences(self) -> "Chime":
        '''(experimental) Grants permission to get the preferences for a channel membership.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_GetChannelMembershipPreferences.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetChannelMembershipPreferences", []))

    @jsii.member(jsii_name="toGetChannelMessage")
    def to_get_channel_message(self) -> "Chime":
        '''(experimental) Grants permission to get the full details of a channel message.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_GetChannelMessage.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetChannelMessage", []))

    @jsii.member(jsii_name="toGetChannelMessageStatus")
    def to_get_channel_message_status(self) -> "Chime":
        '''(experimental) Grants permission to get the status of a channel message.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_GetChannelMessageStatus.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetChannelMessageStatus", []))

    @jsii.member(jsii_name="toGetDomain")
    def to_get_domain(self) -> "Chime":
        '''(experimental) Grants permission to get domain details for a domain associated with your Amazon Chime account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/ag/claim-domain.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetDomain", []))

    @jsii.member(jsii_name="toGetEventsConfiguration")
    def to_get_events_configuration(self) -> "Chime":
        '''(experimental) Grants permission to retrieve details for an events configuration for a bot to receive outgoing events.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetEventsConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetEventsConfiguration", []))

    @jsii.member(jsii_name="toGetGlobalSettings")
    def to_get_global_settings(self) -> "Chime":
        '''(experimental) Grants permission to get global settings related to Amazon Chime for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetGlobalSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetGlobalSettings", []))

    @jsii.member(jsii_name="toGetMediaCapturePipeline")
    def to_get_media_capture_pipeline(self) -> "Chime":
        '''(experimental) Grants permission to get an existing media capture pipeline.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_media-pipelines-chime_GetMediaCapturePipeline.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetMediaCapturePipeline", []))

    @jsii.member(jsii_name="toGetMediaInsightsPipelineConfiguration")
    def to_get_media_insights_pipeline_configuration(self) -> "Chime":
        '''(experimental) Grants permission to get a media insights pipeline configuration.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_media-pipelines-chime_GetMediaInsightsPipelineConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetMediaInsightsPipelineConfiguration", []))

    @jsii.member(jsii_name="toGetMediaPipeline")
    def to_get_media_pipeline(self) -> "Chime":
        '''(experimental) Grants permission to get an existing media pipeline.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_media-pipelines-chime_GetMediaPipeline.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetMediaPipeline", []))

    @jsii.member(jsii_name="toGetMeeting")
    def to_get_meeting(self) -> "Chime":
        '''(experimental) Grants permission to get the meeting record for a specified meeting ID.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetMeeting.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetMeeting", []))

    @jsii.member(jsii_name="toGetMeetingDetail")
    def to_get_meeting_detail(self) -> "Chime":
        '''(experimental) Grants permission to get attendee, connection, and other details for a meeting.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetMeetingDetail", []))

    @jsii.member(jsii_name="toGetMessagingSessionEndpoint")
    def to_get_messaging_session_endpoint(self) -> "Chime":
        '''(experimental) Grants permission to get the endpoint for the messaging session.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_GetMessagingSessionEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetMessagingSessionEndpoint", []))

    @jsii.member(jsii_name="toGetMessagingStreamingConfigurations")
    def to_get_messaging_streaming_configurations(self) -> "Chime":
        '''(experimental) Grants permission to get the data streaming configurations of an AppInstance.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_GetMessagingStreamingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetMessagingStreamingConfigurations", []))

    @jsii.member(jsii_name="toGetPhoneNumber")
    def to_get_phone_number(self) -> "Chime":
        '''(experimental) Grants permission to get details for the specified phone number.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetPhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetPhoneNumber", []))

    @jsii.member(jsii_name="toGetPhoneNumberOrder")
    def to_get_phone_number_order(self) -> "Chime":
        '''(experimental) Grants permission to get details for the specified phone number order.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetPhoneNumberOrder.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetPhoneNumberOrder", []))

    @jsii.member(jsii_name="toGetPhoneNumberSettings")
    def to_get_phone_number_settings(self) -> "Chime":
        '''(experimental) Grants permission to get phone number settings related to Amazon Chime for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetPhoneNumberSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetPhoneNumberSettings", []))

    @jsii.member(jsii_name="toGetProxySession")
    def to_get_proxy_session(self) -> "Chime":
        '''(experimental) Grants permission to get details of the specified proxy session for the specified Amazon Chime Voice Connector.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetProxySession.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetProxySession", []))

    @jsii.member(jsii_name="toGetRetentionSettings")
    def to_get_retention_settings(self) -> "Chime":
        '''(experimental) Grants permission to retrieve the retention settings for the specified Amazon Chime account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetRetentionSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetRetentionSettings", []))

    @jsii.member(jsii_name="toGetRoom")
    def to_get_room(self) -> "Chime":
        '''(experimental) Grants permission to retrieve a room.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetRoom.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetRoom", []))

    @jsii.member(jsii_name="toGetSipMediaApplication")
    def to_get_sip_media_application(self) -> "Chime":
        '''(experimental) Grants permission to get details of Amazon Chime SIP media application under the administrator's AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetSipMediaApplication.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetSipMediaApplication", []))

    @jsii.member(jsii_name="toGetSipMediaApplicationAlexaSkillConfiguration")
    def to_get_sip_media_application_alexa_skill_configuration(self) -> "Chime":
        '''(experimental) Grants permission to get Alexa Skill configuration settings for Amazon Chime SIP media application under the administrator's AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_voice-chime_GetSipMediaApplicationAlexaSkillConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetSipMediaApplicationAlexaSkillConfiguration", []))

    @jsii.member(jsii_name="toGetSipMediaApplicationLoggingConfiguration")
    def to_get_sip_media_application_logging_configuration(self) -> "Chime":
        '''(experimental) Grants permission to get logging configuration settings for Amazon Chime SIP media application under the administrator's AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetSipMediaApplicationLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetSipMediaApplicationLoggingConfiguration", []))

    @jsii.member(jsii_name="toGetSipRule")
    def to_get_sip_rule(self) -> "Chime":
        '''(experimental) Grants permission to get details of Amazon Chime SIP rule under the administrator's AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetSipRule.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetSipRule", []))

    @jsii.member(jsii_name="toGetSpeakerSearchTask")
    def to_get_speaker_search_task(self) -> "Chime":
        '''(experimental) Grants permission to get a speaker search task.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_voice-chime_GetSpeakerSearchTask.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetSpeakerSearchTask", []))

    @jsii.member(jsii_name="toGetTelephonyLimits")
    def to_get_telephony_limits(self) -> "Chime":
        '''(experimental) Grants permission to get telephony limits for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/ag/phone-numbers.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetTelephonyLimits", []))

    @jsii.member(jsii_name="toGetUser")
    def to_get_user(self) -> "Chime":
        '''(experimental) Grants permission to get details for the specified user ID.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetUser", []))

    @jsii.member(jsii_name="toGetUserActivityReportData")
    def to_get_user_activity_report_data(self) -> "Chime":
        '''(experimental) Grants permission to get a summary of user activity on the user details page.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/ag/user-details.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetUserActivityReportData", []))

    @jsii.member(jsii_name="toGetUserByEmail")
    def to_get_user_by_email(self) -> "Chime":
        '''(experimental) Grants permission to get user details for an Amazon Chime user based on the email address in an Amazon Chime Enterprise or Team account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/ag/user-details.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetUserByEmail", []))

    @jsii.member(jsii_name="toGetUserSettings")
    def to_get_user_settings(self) -> "Chime":
        '''(experimental) Grants permission to get user settings related to the specified Amazon Chime user.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetUserSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetUserSettings", []))

    @jsii.member(jsii_name="toGetVoiceConnector")
    def to_get_voice_connector(self) -> "Chime":
        '''(experimental) Grants permission to get details for the specified Amazon Chime Voice Connector.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetVoiceConnector.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceConnector", []))

    @jsii.member(jsii_name="toGetVoiceConnectorEmergencyCallingConfiguration")
    def to_get_voice_connector_emergency_calling_configuration(self) -> "Chime":
        '''(experimental) Grants permission to get details of the emergency calling configuration for the specified Amazon Chime Voice Connector.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetVoiceConnectorEmergencyCallingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceConnectorEmergencyCallingConfiguration", []))

    @jsii.member(jsii_name="toGetVoiceConnectorGroup")
    def to_get_voice_connector_group(self) -> "Chime":
        '''(experimental) Grants permission to get details for the specified Amazon Chime Voice Connector Group.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetVoiceConnectorGroup.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceConnectorGroup", []))

    @jsii.member(jsii_name="toGetVoiceConnectorLoggingConfiguration")
    def to_get_voice_connector_logging_configuration(self) -> "Chime":
        '''(experimental) Grants permission to get details of the logging configuration for the specified Amazon Chime Voice Connector.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetVoiceConnectorLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceConnectorLoggingConfiguration", []))

    @jsii.member(jsii_name="toGetVoiceConnectorOrigination")
    def to_get_voice_connector_origination(self) -> "Chime":
        '''(experimental) Grants permission to get details of the origination settings for the specified Amazon Chime Voice Connector.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetVoiceConnectorOrigination.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceConnectorOrigination", []))

    @jsii.member(jsii_name="toGetVoiceConnectorProxy")
    def to_get_voice_connector_proxy(self) -> "Chime":
        '''(experimental) Grants permission to get details of the proxy configuration for the specified Amazon Chime Voice Connector.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetVoiceConnectorProxy.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceConnectorProxy", []))

    @jsii.member(jsii_name="toGetVoiceConnectorStreamingConfiguration")
    def to_get_voice_connector_streaming_configuration(self) -> "Chime":
        '''(experimental) Grants permission to get details of the streaming configuration for the specified Amazon Chime Voice Connector.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetVoiceConnectorStreamingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceConnectorStreamingConfiguration", []))

    @jsii.member(jsii_name="toGetVoiceConnectorTermination")
    def to_get_voice_connector_termination(self) -> "Chime":
        '''(experimental) Grants permission to get details of the termination settings for the specified Amazon Chime Voice Connector.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetVoiceConnectorTermination.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceConnectorTermination", []))

    @jsii.member(jsii_name="toGetVoiceConnectorTerminationHealth")
    def to_get_voice_connector_termination_health(self) -> "Chime":
        '''(experimental) Grants permission to get details of the termination health for the specified Amazon Chime Voice Connector.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_GetVoiceConnectorTerminationHealth.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceConnectorTerminationHealth", []))

    @jsii.member(jsii_name="toGetVoiceProfile")
    def to_get_voice_profile(self) -> "Chime":
        '''(experimental) Grants permission to get a voice profile.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_voice-chime_GetVoiceProfile.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceProfile", []))

    @jsii.member(jsii_name="toGetVoiceProfileDomain")
    def to_get_voice_profile_domain(self) -> "Chime":
        '''(experimental) Grants permission to get a voice profile domain.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_voice-chime_GetVoiceProfileDomain.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceProfileDomain", []))

    @jsii.member(jsii_name="toGetVoiceToneAnalysisTask")
    def to_get_voice_tone_analysis_task(self) -> "Chime":
        '''(experimental) Grants permission to get a voice tone analysis task.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_voice-chime_GetVoiceToneAnalysisTask.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toGetVoiceToneAnalysisTask", []))

    @jsii.member(jsii_name="toInviteDelegate")
    def to_invite_delegate(self) -> "Chime":
        '''(experimental) Grants permission to send an invitation to accept a request for AWS account delegation for an Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toInviteDelegate", []))

    @jsii.member(jsii_name="toInviteUsers")
    def to_invite_users(self) -> "Chime":
        '''(experimental) Grants permission to invite as many as 50 users to the specified Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_InviteUsers.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toInviteUsers", []))

    @jsii.member(jsii_name="toInviteUsersFromProvider")
    def to_invite_users_from_provider(self) -> "Chime":
        '''(experimental) Grants permission to invite users from a third party provider to your Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toInviteUsersFromProvider", []))

    @jsii.member(jsii_name="toListAccounts")
    def to_list_accounts(self) -> "Chime":
        '''(experimental) Grants permission to list the Amazon Chime accounts under the administrator's AWS account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListAccounts.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListAccounts", []))

    @jsii.member(jsii_name="toListAccountUsageReportData")
    def to_list_account_usage_report_data(self) -> "Chime":
        '''(experimental) Grants permission to list Amazon Chime account usage reporting data.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/ag/view-reports.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListAccountUsageReportData", []))

    @jsii.member(jsii_name="toListApiKeys")
    def to_list_api_keys(self) -> "Chime":
        '''(experimental) Grants permission to list the SCIM access keys defined for your Amazon Chime account and Okta configuration.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/ag/okta_sso.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListApiKeys", []))

    @jsii.member(jsii_name="toListAppInstanceAdmins")
    def to_list_app_instance_admins(self) -> "Chime":
        '''(experimental) Grants permission to list administrators in the app instance.

        Access Level: List

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_ListAppInstanceAdmins.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListAppInstanceAdmins", []))

    @jsii.member(jsii_name="toListAppInstanceBots")
    def to_list_app_instance_bots(self) -> "Chime":
        '''(experimental) Grants permission to list all AppInstanceBots created under a single app instance.

        Access Level: List

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_ListAppInstanceBots.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListAppInstanceBots", []))

    @jsii.member(jsii_name="toListAppInstances")
    def to_list_app_instances(self) -> "Chime":
        '''(experimental) Grants permission to list all Amazon Chime app instances created under a single AWS account.

        Access Level: List

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_ListAppInstances.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListAppInstances", []))

    @jsii.member(jsii_name="toListAppInstanceUserEndpoints")
    def to_list_app_instance_user_endpoints(self) -> "Chime":
        '''(experimental) Grants permission to list the endpoints registered for an app instance user.

        Access Level: List

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_ListAppInstanceUserEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListAppInstanceUserEndpoints", []))

    @jsii.member(jsii_name="toListAppInstanceUsers")
    def to_list_app_instance_users(self) -> "Chime":
        '''(experimental) Grants permission to list all AppInstanceUsers created under a single app instance.

        Access Level: List

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_ListAppInstanceUsers.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListAppInstanceUsers", []))

    @jsii.member(jsii_name="toListAttendees")
    def to_list_attendees(self) -> "Chime":
        '''(experimental) Grants permission to list up to 100 attendees for a specified Amazon Chime SDK meeting.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListAttendees.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListAttendees", []))

    @jsii.member(jsii_name="toListAttendeeTags")
    def to_list_attendee_tags(self) -> "Chime":
        '''(experimental) Grants permission to list the tags applied to an Amazon Chime SDK attendee resource.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListAttendeeTags.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListAttendeeTags", []))

    @jsii.member(jsii_name="toListAvailableVoiceConnectorRegions")
    def to_list_available_voice_connector_regions(self) -> "Chime":
        '''(experimental) Grants permission to list the available AWS Regions in which you can create an Amazon Chime SDK Voice Connector.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListAvailableVoiceConnectorRegions", []))

    @jsii.member(jsii_name="toListBots")
    def to_list_bots(self) -> "Chime":
        '''(experimental) Grants permission to list the bots associated with the administrator's Amazon Chime Enterprise account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListBots.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListBots", []))

    @jsii.member(jsii_name="toListCallingRegions")
    def to_list_calling_regions(self) -> "Chime":
        '''(experimental) Grants permission to list the calling regions available for the administrator's AWS account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/ag/phone-numbers.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListCallingRegions", []))

    @jsii.member(jsii_name="toListCDRBucket")
    def to_list_cdr_bucket(self) -> "Chime":
        '''(experimental) Grants permission to list Call Detail Record S3 buckets.

        Access Level: List

        Dependent actions:

        - s3:ListAllMyBuckets
        - s3:ListBucket

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListCDRBucket", []))

    @jsii.member(jsii_name="toListChannelBans")
    def to_list_channel_bans(self) -> "Chime":
        '''(experimental) Grants permission to list all the users and bots banned from a particular channel.

        Access Level: List

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_ListChannelBans.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListChannelBans", []))

    @jsii.member(jsii_name="toListChannelFlows")
    def to_list_channel_flows(self) -> "Chime":
        '''(experimental) Grants permission to list all the Channel Flows created under a single Chime AppInstance.

        Access Level: List

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_ListChannelFlows.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListChannelFlows", []))

    @jsii.member(jsii_name="toListChannelMemberships")
    def to_list_channel_memberships(self) -> "Chime":
        '''(experimental) Grants permission to list all channel memberships in a channel.

        Access Level: List

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_ListChannelMemberships.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListChannelMemberships", []))

    @jsii.member(jsii_name="toListChannelMembershipsForAppInstanceUser")
    def to_list_channel_memberships_for_app_instance_user(self) -> "Chime":
        '''(experimental) Grants permission to list all channels that a particular user or bot is a part of.

        Access Level: List

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_ListChannelMembershipsForAppInstanceUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListChannelMembershipsForAppInstanceUser", []))

    @jsii.member(jsii_name="toListChannelMessages")
    def to_list_channel_messages(self) -> "Chime":
        '''(experimental) Grants permission to list all the messages in a channel.

        Access Level: Read

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_ListChannelMessages.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListChannelMessages", []))

    @jsii.member(jsii_name="toListChannelModerators")
    def to_list_channel_moderators(self) -> "Chime":
        '''(experimental) Grants permission to list all the moderators for a channel.

        Access Level: List

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_ListChannelModerators.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListChannelModerators", []))

    @jsii.member(jsii_name="toListChannels")
    def to_list_channels(self) -> "Chime":
        '''(experimental) Grants permission to list all the Channels created under a single Chime AppInstance.

        Access Level: List

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_ListChannels.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListChannels", []))

    @jsii.member(jsii_name="toListChannelsAssociatedWithChannelFlow")
    def to_list_channels_associated_with_channel_flow(self) -> "Chime":
        '''(experimental) Grants permission to list all the Channels associated with a single Chime Channel Flow.

        Access Level: List

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_ListChannelsAssociatedWithChannelFlow.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListChannelsAssociatedWithChannelFlow", []))

    @jsii.member(jsii_name="toListChannelsModeratedByAppInstanceUser")
    def to_list_channels_moderated_by_app_instance_user(self) -> "Chime":
        '''(experimental) Grants permission to list all channels moderated by a user or bot.

        Access Level: List

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_ListChannelsModeratedByAppInstanceUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListChannelsModeratedByAppInstanceUser", []))

    @jsii.member(jsii_name="toListDelegates")
    def to_list_delegates(self) -> "Chime":
        '''(experimental) Grants permission to list account delegate information associated with your Amazon Chime account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListDelegates", []))

    @jsii.member(jsii_name="toListDirectories")
    def to_list_directories(self) -> "Chime":
        '''(experimental) Grants permission to list active Active Directories hosted in the Directory Service of your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListDirectories", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Chime":
        '''(experimental) Grants permission to list domains associated with your Amazon Chime account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/ag/claim-domain.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toListGroups")
    def to_list_groups(self) -> "Chime":
        '''(experimental) Grants permission to list Active Directory or Okta user groups associated with your Amazon Chime Enterprise account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListGroups", []))

    @jsii.member(jsii_name="toListMediaCapturePipelines")
    def to_list_media_capture_pipelines(self) -> "Chime":
        '''(experimental) Grants permission to list media capture pipelines.

        Access Level: List

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_media-pipelines-chime_ListMediaCapturePipelines.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListMediaCapturePipelines", []))

    @jsii.member(jsii_name="toListMediaInsightsPipelineConfigurations")
    def to_list_media_insights_pipeline_configurations(self) -> "Chime":
        '''(experimental) Grants permission to list all media insights pipeline configurations.

        Access Level: List

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_media-pipelines-chime_ListMediaInsightsPipelineConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListMediaInsightsPipelineConfigurations", []))

    @jsii.member(jsii_name="toListMediaPipelines")
    def to_list_media_pipelines(self) -> "Chime":
        '''(experimental) Grants permission to list media pipelines.

        Access Level: List

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_media-pipelines-chime_ListMediaPipelines.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListMediaPipelines", []))

    @jsii.member(jsii_name="toListMeetingEvents")
    def to_list_meeting_events(self) -> "Chime":
        '''(experimental) Grants permission to list all events that occurred for a specified meeting.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/ag/view-reports.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListMeetingEvents", []))

    @jsii.member(jsii_name="toListMeetings")
    def to_list_meetings(self) -> "Chime":
        '''(experimental) Grants permission to list up to 100 active Amazon Chime SDK meetings.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListMeetings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListMeetings", []))

    @jsii.member(jsii_name="toListMeetingsReportData")
    def to_list_meetings_report_data(self) -> "Chime":
        '''(experimental) Grants permission to list meetings ended during the specified date range.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/ag/view-reports.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListMeetingsReportData", []))

    @jsii.member(jsii_name="toListMeetingTags")
    def to_list_meeting_tags(self) -> "Chime":
        '''(experimental) Grants permission to list the tags applied to an Amazon Chime SDK meeting resource.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListMeetingTags.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListMeetingTags", []))

    @jsii.member(jsii_name="toListPhoneNumberOrders")
    def to_list_phone_number_orders(self) -> "Chime":
        '''(experimental) Grants permission to list the phone number orders under the administrator's AWS account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListPhoneNumberOrders.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListPhoneNumberOrders", []))

    @jsii.member(jsii_name="toListPhoneNumbers")
    def to_list_phone_numbers(self) -> "Chime":
        '''(experimental) Grants permission to list the phone numbers under the administrator's AWS account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListPhoneNumbers.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListPhoneNumbers", []))

    @jsii.member(jsii_name="toListProxySessions")
    def to_list_proxy_sessions(self) -> "Chime":
        '''(experimental) Grants permission to list proxy sessions for the specified Amazon Chime Voice Connector.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListProxySessions.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListProxySessions", []))

    @jsii.member(jsii_name="toListRoomMemberships")
    def to_list_room_memberships(self) -> "Chime":
        '''(experimental) Grants permission to list all room members.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListRoomMemberships.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListRoomMemberships", []))

    @jsii.member(jsii_name="toListRooms")
    def to_list_rooms(self) -> "Chime":
        '''(experimental) Grants permission to list rooms.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListRooms.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListRooms", []))

    @jsii.member(jsii_name="toListSipMediaApplications")
    def to_list_sip_media_applications(self) -> "Chime":
        '''(experimental) Grants permission to list all Amazon Chime SIP media applications under the administrator's AWS account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListSipMediaApplications.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListSipMediaApplications", []))

    @jsii.member(jsii_name="toListSipRules")
    def to_list_sip_rules(self) -> "Chime":
        '''(experimental) Grants permission to list all Amazon Chime SIP rules under the administrator's AWS account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListSipRules.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListSipRules", []))

    @jsii.member(jsii_name="toListSubChannels")
    def to_list_sub_channels(self) -> "Chime":
        '''(experimental) Grants permission to list all the SubChannels under a single Channel.

        Access Level: List

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_ListSubChannels.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListSubChannels", []))

    @jsii.member(jsii_name="toListSupportedPhoneNumberCountries")
    def to_list_supported_phone_number_countries(self) -> "Chime":
        '''(experimental) Grants permission to list the phone number countries supported by the AWS account.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListSupportedPhoneNumberCountries", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Chime":
        '''(experimental) Grants permission to list the tags applied to an Amazon Chime resource.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListUsers")
    def to_list_users(self) -> "Chime":
        '''(experimental) Grants permission to list the users that belong to the specified Amazon Chime account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListUsers.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListUsers", []))

    @jsii.member(jsii_name="toListVoiceConnectorGroups")
    def to_list_voice_connector_groups(self) -> "Chime":
        '''(experimental) Grants permission to list the Amazon Chime Voice Connector Groups under the administrator's AWS account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListVoiceConnectorGroups.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListVoiceConnectorGroups", []))

    @jsii.member(jsii_name="toListVoiceConnectors")
    def to_list_voice_connectors(self) -> "Chime":
        '''(experimental) Grants permission to list the Amazon Chime Voice Connectors under the administrator's AWS account.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListVoiceConnectors.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListVoiceConnectors", []))

    @jsii.member(jsii_name="toListVoiceConnectorTerminationCredentials")
    def to_list_voice_connector_termination_credentials(self) -> "Chime":
        '''(experimental) Grants permission to list the SIP termination credentials for the specified Amazon Chime Voice Connector.

        Access Level: List

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ListVoiceConnectorTerminationCredentials.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListVoiceConnectorTerminationCredentials", []))

    @jsii.member(jsii_name="toListVoiceProfileDomains")
    def to_list_voice_profile_domains(self) -> "Chime":
        '''(experimental) Grants permission to list voice profile domains.

        Access Level: List

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_voice-chime_ListVoiceProfileDomains.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListVoiceProfileDomains", []))

    @jsii.member(jsii_name="toListVoiceProfiles")
    def to_list_voice_profiles(self) -> "Chime":
        '''(experimental) Grants permission to list voice profiles.

        Access Level: List

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_voice-chime_ListVoiceProfiles.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toListVoiceProfiles", []))

    @jsii.member(jsii_name="toLogoutUser")
    def to_logout_user(self) -> "Chime":
        '''(experimental) Grants permission to log out the specified user from all of the devices they are currently logged into.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_LogoutUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toLogoutUser", []))

    @jsii.member(jsii_name="toPutAppInstanceRetentionSettings")
    def to_put_app_instance_retention_settings(self) -> "Chime":
        '''(experimental) Grants permission to enable data retention for the app instance.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_PutAppInstanceRetentionSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutAppInstanceRetentionSettings", []))

    @jsii.member(jsii_name="toPutAppInstanceStreamingConfigurations")
    def to_put_app_instance_streaming_configurations(self) -> "Chime":
        '''(experimental) Grants permission to configure data streaming for the app instance.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_PutAppInstanceStreamingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutAppInstanceStreamingConfigurations", []))

    @jsii.member(jsii_name="toPutAppInstanceUserExpirationSettings")
    def to_put_app_instance_user_expiration_settings(self) -> "Chime":
        '''(experimental) Grants permission to put expiration settings for an AppInstanceUser.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_PutAppInstanceUserExpirationSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutAppInstanceUserExpirationSettings", []))

    @jsii.member(jsii_name="toPutChannelExpirationSettings")
    def to_put_channel_expiration_settings(self) -> "Chime":
        '''(experimental) Grants permission to put expiration settings for a channel.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_PutChannelExpirationSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutChannelExpirationSettings", []))

    @jsii.member(jsii_name="toPutChannelMembershipPreferences")
    def to_put_channel_membership_preferences(self) -> "Chime":
        '''(experimental) Grants permission to put the preferences for a channel membership.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_PutChannelMembershipPreferences.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutChannelMembershipPreferences", []))

    @jsii.member(jsii_name="toPutEventsConfiguration")
    def to_put_events_configuration(self) -> "Chime":
        '''(experimental) Grants permission to update details for an events configuration for a bot to receive outgoing events.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutEventsConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutEventsConfiguration", []))

    @jsii.member(jsii_name="toPutMessagingStreamingConfigurations")
    def to_put_messaging_streaming_configurations(self) -> "Chime":
        '''(experimental) Grants permission to put the data streaming configurations of an AppInstance.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_PutMessagingStreamingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutMessagingStreamingConfigurations", []))

    @jsii.member(jsii_name="toPutRetentionSettings")
    def to_put_retention_settings(self) -> "Chime":
        '''(experimental) Grants permission to create or update retention settings for the specified Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutRetentionSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutRetentionSettings", []))

    @jsii.member(jsii_name="toPutSipMediaApplicationAlexaSkillConfiguration")
    def to_put_sip_media_application_alexa_skill_configuration(self) -> "Chime":
        '''(experimental) Grants permission to update Alexa Skill configuration settings for Amazon Chime SIP media application under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_voice-chime_PutSipMediaApplicationAlexaSkillConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutSipMediaApplicationAlexaSkillConfiguration", []))

    @jsii.member(jsii_name="toPutSipMediaApplicationLoggingConfiguration")
    def to_put_sip_media_application_logging_configuration(self) -> "Chime":
        '''(experimental) Grants permission to update logging configuration settings for Amazon Chime SIP media application under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutSipMediaApplicationLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutSipMediaApplicationLoggingConfiguration", []))

    @jsii.member(jsii_name="toPutVoiceConnectorEmergencyCallingConfiguration")
    def to_put_voice_connector_emergency_calling_configuration(self) -> "Chime":
        '''(experimental) Grants permission to add emergency calling configuration for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutVoiceConnectorEmergencyCallingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutVoiceConnectorEmergencyCallingConfiguration", []))

    @jsii.member(jsii_name="toPutVoiceConnectorLoggingConfiguration")
    def to_put_voice_connector_logging_configuration(self) -> "Chime":
        '''(experimental) Grants permission to add logging configuration for the specified Amazon Chime Voice Connector.

        Access Level: Write

        Dependent actions:

        - logs:CreateLogDelivery
        - logs:CreateLogGroup
        - logs:DeleteLogDelivery
        - logs:DescribeLogGroups
        - logs:GetLogDelivery
        - logs:ListLogDeliveries

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutVoiceConnectorLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutVoiceConnectorLoggingConfiguration", []))

    @jsii.member(jsii_name="toPutVoiceConnectorOrigination")
    def to_put_voice_connector_origination(self) -> "Chime":
        '''(experimental) Grants permission to update the origination settings for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutVoiceConnectorOrigination.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutVoiceConnectorOrigination", []))

    @jsii.member(jsii_name="toPutVoiceConnectorProxy")
    def to_put_voice_connector_proxy(self) -> "Chime":
        '''(experimental) Grants permission to add proxy configuration for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutVoiceConnectorProxy.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutVoiceConnectorProxy", []))

    @jsii.member(jsii_name="toPutVoiceConnectorStreamingConfiguration")
    def to_put_voice_connector_streaming_configuration(self) -> "Chime":
        '''(experimental) Grants permission to add streaming configuration for the specified Amazon Chime Voice Connector.

        Access Level: Write

        Dependent actions:

        - chime:GetMediaInsightsPipelineConfiguration

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutVoiceConnectorStreamingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutVoiceConnectorStreamingConfiguration", []))

    @jsii.member(jsii_name="toPutVoiceConnectorTermination")
    def to_put_voice_connector_termination(self) -> "Chime":
        '''(experimental) Grants permission to update the termination settings for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutVoiceConnectorTermination.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutVoiceConnectorTermination", []))

    @jsii.member(jsii_name="toPutVoiceConnectorTerminationCredentials")
    def to_put_voice_connector_termination_credentials(self) -> "Chime":
        '''(experimental) Grants permission to add SIP termination credentials for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_PutVoiceConnectorTerminationCredentials.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toPutVoiceConnectorTerminationCredentials", []))

    @jsii.member(jsii_name="toRedactChannelMessage")
    def to_redact_channel_message(self) -> "Chime":
        '''(experimental) Grants permission to redact message content.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_RedactChannelMessage.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toRedactChannelMessage", []))

    @jsii.member(jsii_name="toRedactConversationMessage")
    def to_redact_conversation_message(self) -> "Chime":
        '''(experimental) Grants permission to redact the specified Chime conversation Message.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_RedactConversationMessage.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toRedactConversationMessage", []))

    @jsii.member(jsii_name="toRedactRoomMessage")
    def to_redact_room_message(self) -> "Chime":
        '''(experimental) Grants permission to redacts the specified Chime room Message.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_RedactRoomMessage.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toRedactRoomMessage", []))

    @jsii.member(jsii_name="toRegenerateSecurityToken")
    def to_regenerate_security_token(self) -> "Chime":
        '''(experimental) Grants permission to regenerate the security token for the specified bot.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_RegenerateSecurityToken.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toRegenerateSecurityToken", []))

    @jsii.member(jsii_name="toRegisterAppInstanceUserEndpoint")
    def to_register_app_instance_user_endpoint(self) -> "Chime":
        '''(experimental) Grants permission to register an endpoint for an app instance user.

        Access Level: Write

        Dependent actions:

        - mobiletargeting:GetApp

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_RegisterAppInstanceUserEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toRegisterAppInstanceUserEndpoint", []))

    @jsii.member(jsii_name="toRenameAccount")
    def to_rename_account(self) -> "Chime":
        '''(experimental) Grants permission to modify the account name for your Amazon Chime Enterprise or Team account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/rename-account.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toRenameAccount", []))

    @jsii.member(jsii_name="toRenewDelegate")
    def to_renew_delegate(self) -> "Chime":
        '''(experimental) Grants permission to renew the delegation request associated with an Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toRenewDelegate", []))

    @jsii.member(jsii_name="toResetAccountResource")
    def to_reset_account_resource(self) -> "Chime":
        '''(experimental) Grants permission to reset the account resource in your Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toResetAccountResource", []))

    @jsii.member(jsii_name="toResetPersonalPIN")
    def to_reset_personal_pin(self) -> "Chime":
        '''(experimental) Grants permission to reset the personal meeting PIN for the specified user on an Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ResetPersonalPIN.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toResetPersonalPIN", []))

    @jsii.member(jsii_name="toRestorePhoneNumber")
    def to_restore_phone_number(self) -> "Chime":
        '''(experimental) Grants permission to restore the specified phone number from the deltion queue back to the phone number inventory.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_RestorePhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toRestorePhoneNumber", []))

    @jsii.member(jsii_name="toRetrieveDataExports")
    def to_retrieve_data_exports(self) -> "Chime":
        '''(experimental) Grants permission to download the file containing links to all user attachments returned as part of the "Request attachments" action.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/ag/request-attachments.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toRetrieveDataExports", []))

    @jsii.member(jsii_name="toSearchAvailablePhoneNumbers")
    def to_search_available_phone_numbers(self) -> "Chime":
        '''(experimental) Grants permission to search phone numbers that can be ordered from the carrier.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/APIReference/API_SearchAvailablePhoneNumbers.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toSearchAvailablePhoneNumbers", []))

    @jsii.member(jsii_name="toSearchChannels")
    def to_search_channels(self) -> "Chime":
        '''(experimental) Grants permission to search channels that an AppInstanceUser belongs to, or search channels across the AppInstance for an AppInstaceAdmin.

        Access Level: List

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_SearchChannels.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toSearchChannels", []))

    @jsii.member(jsii_name="toSendChannelMessage")
    def to_send_channel_message(self) -> "Chime":
        '''(experimental) Grants permission to send a message to a particular channel that the member is a part of.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_SendChannelMessage.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toSendChannelMessage", []))

    @jsii.member(jsii_name="toStartDataExport")
    def to_start_data_export(self) -> "Chime":
        '''(experimental) Grants permission to submit the "Request attachments" request.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/request-attachments.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toStartDataExport", []))

    @jsii.member(jsii_name="toStartMeetingTranscription")
    def to_start_meeting_transcription(self) -> "Chime":
        '''(experimental) Grants permission to start transcription for a meeting.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_StartMeetingTranscription.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toStartMeetingTranscription", []))

    @jsii.member(jsii_name="toStartSpeakerSearchTask")
    def to_start_speaker_search_task(self) -> "Chime":
        '''(experimental) Grants permission to start a speaker search task.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_voice-chime_StartSpeakerSearchTask.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toStartSpeakerSearchTask", []))

    @jsii.member(jsii_name="toStartVoiceToneAnalysisTask")
    def to_start_voice_tone_analysis_task(self) -> "Chime":
        '''(experimental) Grants permission to start a voice tone analysis task.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_voice-chime_StartVoiceToneAnalysisTask.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toStartVoiceToneAnalysisTask", []))

    @jsii.member(jsii_name="toStopMeetingTranscription")
    def to_stop_meeting_transcription(self) -> "Chime":
        '''(experimental) Grants permission to stop transcription for a meeting.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_StopMeetingTranscription.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toStopMeetingTranscription", []))

    @jsii.member(jsii_name="toStopSpeakerSearchTask")
    def to_stop_speaker_search_task(self) -> "Chime":
        '''(experimental) Grants permission to stop a speaker search task.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_voice-chime_StopSpeakerSearchTask.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toStopSpeakerSearchTask", []))

    @jsii.member(jsii_name="toStopVoiceToneAnalysisTask")
    def to_stop_voice_tone_analysis_task(self) -> "Chime":
        '''(experimental) Grants permission to stop a voice tone analysis task.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_voice-chime_StopVoiceToneAnalysisTask.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toStopVoiceToneAnalysisTask", []))

    @jsii.member(jsii_name="toSubmitSupportRequest")
    def to_submit_support_request(self) -> "Chime":
        '''(experimental) Grants permission to submit a customer service support request.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/chime-getting-admin-support.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toSubmitSupportRequest", []))

    @jsii.member(jsii_name="toSuspendUsers")
    def to_suspend_users(self) -> "Chime":
        '''(experimental) Grants permission to suspend users from an Amazon Chime Enterprise account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/manage-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toSuspendUsers", []))

    @jsii.member(jsii_name="toTagAttendee")
    def to_tag_attendee(self) -> "Chime":
        '''(experimental) Grants permission to apply the specified tags to the specified Amazon Chime SDK attendee.

        Access Level: Tagging

        https://docs.aws.amazon.com/chime/latest/APIReference/API_TagAttendee.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toTagAttendee", []))

    @jsii.member(jsii_name="toTagMeeting")
    def to_tag_meeting(self) -> "Chime":
        '''(experimental) Grants permission to apply the specified tags to the specified Amazon Chime SDK meeting.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/chime/latest/APIReference/API_TagMeeting.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toTagMeeting", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Chime":
        '''(experimental) Grants permission to apply the specified tags to the specified Amazon Chime resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/chime/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUnauthorizeDirectory")
    def to_unauthorize_directory(self) -> "Chime":
        '''(experimental) Grants permission to unauthorize an Active Directory from your Amazon Chime Enterprise account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUnauthorizeDirectory", []))

    @jsii.member(jsii_name="toUntagAttendee")
    def to_untag_attendee(self) -> "Chime":
        '''(experimental) Grants permission to untag the specified tags from the specified Amazon Chime SDK attendee.

        Access Level: Tagging

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UntagAttendee.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUntagAttendee", []))

    @jsii.member(jsii_name="toUntagMeeting")
    def to_untag_meeting(self) -> "Chime":
        '''(experimental) Grants permission to untag the specified tags from the specified Amazon Chime SDK meeting.

        Access Level: Tagging

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UntagMeeting.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUntagMeeting", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Chime":
        '''(experimental) Grants permission to untag the specified tags from the specified Amazon Chime resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAccount")
    def to_update_account(self) -> "Chime":
        '''(experimental) Grants permission to update account details for the specified Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateAccount.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateAccount", []))

    @jsii.member(jsii_name="toUpdateAccountOpenIdConfig")
    def to_update_account_open_id_config(self) -> "Chime":
        '''(experimental) Grants permission to update the OpenIdConfig attributes for your Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/okta_sso.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateAccountOpenIdConfig", []))

    @jsii.member(jsii_name="toUpdateAccountResource")
    def to_update_account_resource(self) -> "Chime":
        '''(experimental) Grants permission to update the account resource in your Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateAccountResource", []))

    @jsii.member(jsii_name="toUpdateAccountSettings")
    def to_update_account_settings(self) -> "Chime":
        '''(experimental) Grants permission to update the settings for the specified Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateAccountSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateAccountSettings", []))

    @jsii.member(jsii_name="toUpdateAppInstance")
    def to_update_app_instance(self) -> "Chime":
        '''(experimental) Grants permission to update AppInstance metadata.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_UpdateAppInstance.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateAppInstance", []))

    @jsii.member(jsii_name="toUpdateAppInstanceBot")
    def to_update_app_instance_bot(self) -> "Chime":
        '''(experimental) Grants permission to update the details for an AppInstanceBot.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_UpdateAppInstanceBot.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateAppInstanceBot", []))

    @jsii.member(jsii_name="toUpdateAppInstanceUser")
    def to_update_app_instance_user(self) -> "Chime":
        '''(experimental) Grants permission to update the details for an AppInstanceUser.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_UpdateAppInstanceUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateAppInstanceUser", []))

    @jsii.member(jsii_name="toUpdateAppInstanceUserEndpoint")
    def to_update_app_instance_user_endpoint(self) -> "Chime":
        '''(experimental) Grants permission to update an endpoint registered for an app instance user.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_identity-chime_UpdateAppInstanceUserEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateAppInstanceUserEndpoint", []))

    @jsii.member(jsii_name="toUpdateAttendeeCapabilities")
    def to_update_attendee_capabilities(self) -> "Chime":
        '''(experimental) Grants permission to the capabilties that you want to update.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_meeting-chime_UpdateAttendeeCapabilities.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateAttendeeCapabilities", []))

    @jsii.member(jsii_name="toUpdateBot")
    def to_update_bot(self) -> "Chime":
        '''(experimental) Grants permission to update the status of the specified bot.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateBot.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateBot", []))

    @jsii.member(jsii_name="toUpdateCDRSettings")
    def to_update_cdr_settings(self) -> "Chime":
        '''(experimental) Grants permission to update your Call Detail Record S3 bucket.

        Access Level: Write

        Dependent actions:

        - s3:CreateBucket
        - s3:DeleteBucket
        - s3:ListAllMyBuckets

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateCDRSettings", []))

    @jsii.member(jsii_name="toUpdateChannel")
    def to_update_channel(self) -> "Chime":
        '''(experimental) Grants permission to update a channel's attributes.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_UpdateChannel.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateChannel", []))

    @jsii.member(jsii_name="toUpdateChannelFlow")
    def to_update_channel_flow(self) -> "Chime":
        '''(experimental) Grants permission to update a channel flow.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_UpdateChannelFlow.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateChannelFlow", []))

    @jsii.member(jsii_name="toUpdateChannelMessage")
    def to_update_channel_message(self) -> "Chime":
        '''(experimental) Grants permission to update the content of a message.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_UpdateChannelMessage.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateChannelMessage", []))

    @jsii.member(jsii_name="toUpdateChannelReadMarker")
    def to_update_channel_read_marker(self) -> "Chime":
        '''(experimental) Grants permission to set the timestamp to the point when a user last read messages in a channel.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_messaging-chime_UpdateChannelReadMarker.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateChannelReadMarker", []))

    @jsii.member(jsii_name="toUpdateGlobalSettings")
    def to_update_global_settings(self) -> "Chime":
        '''(experimental) Grants permission to update the global settings related to Amazon Chime for the AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateGlobalSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateGlobalSettings", []))

    @jsii.member(jsii_name="toUpdateMediaInsightsPipelineConfiguration")
    def to_update_media_insights_pipeline_configuration(self) -> "Chime":
        '''(experimental) Grants permission to update the status of a media insights pipeline configuration.

        Access Level: Write

        Dependent actions:

        - chime:ListVoiceConnectors
        - iam:PassRole
        - kinesis:DescribeStream
        - s3:ListBucket

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_media-pipelines-chime_UpdateMediaInsightsPipelineConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateMediaInsightsPipelineConfiguration", []))

    @jsii.member(jsii_name="toUpdateMediaInsightsPipelineStatus")
    def to_update_media_insights_pipeline_status(self) -> "Chime":
        '''(experimental) Grants permission to update the status of a media insights pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_media-pipelines-chime_UpdateMediaInsightsPipelineStatus.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateMediaInsightsPipelineStatus", []))

    @jsii.member(jsii_name="toUpdatePhoneNumber")
    def to_update_phone_number(self) -> "Chime":
        '''(experimental) Grants permission to update phone number details for the specified phone number.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdatePhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdatePhoneNumber", []))

    @jsii.member(jsii_name="toUpdatePhoneNumberSettings")
    def to_update_phone_number_settings(self) -> "Chime":
        '''(experimental) Grants permission to update phone number settings related to Amazon Chime for the AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdatePhoneNumberSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdatePhoneNumberSettings", []))

    @jsii.member(jsii_name="toUpdateProxySession")
    def to_update_proxy_session(self) -> "Chime":
        '''(experimental) Grants permission to update a proxy session for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateProxySession.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateProxySession", []))

    @jsii.member(jsii_name="toUpdateRoom")
    def to_update_room(self) -> "Chime":
        '''(experimental) Grants permission to update a room.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateRoom.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateRoom", []))

    @jsii.member(jsii_name="toUpdateRoomMembership")
    def to_update_room_membership(self) -> "Chime":
        '''(experimental) Grants permission to update room membership role.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateRoomMembership.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateRoomMembership", []))

    @jsii.member(jsii_name="toUpdateSipMediaApplication")
    def to_update_sip_media_application(self) -> "Chime":
        '''(experimental) Grants permission to update properties of Amazon Chime SIP media application under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateSipMediaApplication.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateSipMediaApplication", []))

    @jsii.member(jsii_name="toUpdateSipMediaApplicationCall")
    def to_update_sip_media_application_call(self) -> "Chime":
        '''(experimental) Grants permission to update an Amazon Chime SIP media application call under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateSipMediaApplicationCall.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateSipMediaApplicationCall", []))

    @jsii.member(jsii_name="toUpdateSipRule")
    def to_update_sip_rule(self) -> "Chime":
        '''(experimental) Grants permission to update properties of Amazon Chime SIP rule under the administrator's AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateSipRule.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateSipRule", []))

    @jsii.member(jsii_name="toUpdateSupportedLicenses")
    def to_update_supported_licenses(self) -> "Chime":
        '''(experimental) Grants permission to update the supported license tiers available for users in your Amazon Chime account.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/manage-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateSupportedLicenses", []))

    @jsii.member(jsii_name="toUpdateUser")
    def to_update_user(self) -> "Chime":
        '''(experimental) Grants permission to update user details for a specified user ID.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateUser.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateUser", []))

    @jsii.member(jsii_name="toUpdateUserLicenses")
    def to_update_user_licenses(self) -> "Chime":
        '''(experimental) Grants permission to update the licenses for your Amazon Chime users.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/ag/manage-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateUserLicenses", []))

    @jsii.member(jsii_name="toUpdateUserSettings")
    def to_update_user_settings(self) -> "Chime":
        '''(experimental) Grants permission to update user settings related to the specified Amazon Chime user.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateUserSettings.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateUserSettings", []))

    @jsii.member(jsii_name="toUpdateVoiceConnector")
    def to_update_voice_connector(self) -> "Chime":
        '''(experimental) Grants permission to update Amazon Chime Voice Connector details for the specified Amazon Chime Voice Connector.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateVoiceConnector.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateVoiceConnector", []))

    @jsii.member(jsii_name="toUpdateVoiceConnectorGroup")
    def to_update_voice_connector_group(self) -> "Chime":
        '''(experimental) Grants permission to update Amazon Chime Voice Connector Group details for the specified Amazon Chime Voice Connector Group.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_UpdateVoiceConnectorGroup.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateVoiceConnectorGroup", []))

    @jsii.member(jsii_name="toUpdateVoiceProfile")
    def to_update_voice_profile(self) -> "Chime":
        '''(experimental) Grants permission to update a voice profile.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_voice-chime_UpdateVoiceProfile.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateVoiceProfile", []))

    @jsii.member(jsii_name="toUpdateVoiceProfileDomain")
    def to_update_voice_profile_domain(self) -> "Chime":
        '''(experimental) Grants permission to update a voice profile domain.

        Access Level: Write

        https://docs.aws.amazon.com/chime-sdk/latest/APIReference/API_voice-chime_UpdateVoiceProfileDomain.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toUpdateVoiceProfileDomain", []))

    @jsii.member(jsii_name="toValidateAccountResource")
    def to_validate_account_resource(self) -> "Chime":
        '''(experimental) Grants permission to validate the account resource in your Amazon Chime account.

        Access Level: Read

        https://docs.aws.amazon.com/chime/latest/ag/control-access.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toValidateAccountResource", []))

    @jsii.member(jsii_name="toValidateE911Address")
    def to_validate_e911_address(self) -> "Chime":
        '''(experimental) Grants permission to validate an address to be used for 911 calls made with Amazon Chime Voice Connectors.

        Access Level: Write

        https://docs.aws.amazon.com/chime/latest/APIReference/API_ValidateE911Address.html

        :stability: experimental
        '''
        return typing.cast("Chime", jsii.invoke(self, "toValidateE911Address", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4b4c3392bb4b58e19c30dcb31b952b8c2817871dbfaa8e9c1da8cebe87d28388)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2002394112378a611877a5edf31bad30463f5b16f69c2388b1ce5b592de409b4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Cleanrooms(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Cleanrooms",
):
    '''(experimental) Statement provider for service `cleanrooms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscleanrooms.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cleanrooms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscleanrooms.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a3f50c07bca9ae9a764bde58a930620fb12d7084f49dd629653433f1027ce0ef)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onCollaboration")
    def on_collaboration(
        self,
        collaboration_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cleanrooms":
        '''(experimental) Adds a resource of type Collaboration to the statement.

        https://docs.aws.amazon.com/clean-rooms/latest/userguide/security-iam.html

        :param collaboration_id: - Identifier for the collaborationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bc40cad9432e509aabbc219c94c9c598a9b89a460dea32d6d6ee07f621ef4dad)
            check_type(argname="argument collaboration_id", value=collaboration_id, expected_type=type_hints["collaboration_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cleanrooms", jsii.invoke(self, "onCollaboration", [collaboration_id, account, region, partition]))

    @jsii.member(jsii_name="onConfiguredTable")
    def on_configured_table(
        self,
        configured_table_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cleanrooms":
        '''(experimental) Adds a resource of type ConfiguredTable to the statement.

        https://docs.aws.amazon.com/clean-rooms/latest/userguide/security-iam.html

        :param configured_table_id: - Identifier for the configuredTableId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0a04065e76e705af5936a1bd32cc49e8c4121503514003e041c871a07d511f38)
            check_type(argname="argument configured_table_id", value=configured_table_id, expected_type=type_hints["configured_table_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cleanrooms", jsii.invoke(self, "onConfiguredTable", [configured_table_id, account, region, partition]))

    @jsii.member(jsii_name="onConfiguredTableAssociation")
    def on_configured_table_association(
        self,
        membership_id: builtins.str,
        configured_table_association_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cleanrooms":
        '''(experimental) Adds a resource of type ConfiguredTableAssociation to the statement.

        https://docs.aws.amazon.com/clean-rooms/latest/userguide/security-iam.html

        :param membership_id: - Identifier for the membershipId.
        :param configured_table_association_id: - Identifier for the configuredTableAssociationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__01e555af0e1980d1e38fd3c9b82b206d6a39fad829a96f3a29819b561817f95e)
            check_type(argname="argument membership_id", value=membership_id, expected_type=type_hints["membership_id"])
            check_type(argname="argument configured_table_association_id", value=configured_table_association_id, expected_type=type_hints["configured_table_association_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cleanrooms", jsii.invoke(self, "onConfiguredTableAssociation", [membership_id, configured_table_association_id, account, region, partition]))

    @jsii.member(jsii_name="onMembership")
    def on_membership(
        self,
        membership_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cleanrooms":
        '''(experimental) Adds a resource of type Membership to the statement.

        https://docs.aws.amazon.com/clean-rooms/latest/userguide/security-iam.html

        :param membership_id: - Identifier for the membershipId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8629a5454e6b9e7fb81abc3c602b985abb505c9fa65b85f43e430178d3d6ef8b)
            check_type(argname="argument membership_id", value=membership_id, expected_type=type_hints["membership_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cleanrooms", jsii.invoke(self, "onMembership", [membership_id, account, region, partition]))

    @jsii.member(jsii_name="toBatchGetSchema")
    def to_batch_get_schema(self) -> "Cleanrooms":
        '''(experimental) Grants permission to view details for schemas.

        Access Level: Read

        Dependent actions:

        - cleanrooms:GetSchema

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_BatchGetSchema.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toBatchGetSchema", []))

    @jsii.member(jsii_name="toCreateCollaboration")
    def to_create_collaboration(self) -> "Cleanrooms":
        '''(experimental) Grants permission to create a new collaboration, a shared data collaboration environment.

        Access Level: Write

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_CreateCollaboration.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toCreateCollaboration", []))

    @jsii.member(jsii_name="toCreateConfiguredTable")
    def to_create_configured_table(self) -> "Cleanrooms":
        '''(experimental) Grants permission to create a new configured table.

        Access Level: Write

        Dependent actions:

        - glue:BatchGetPartition
        - glue:GetDatabase
        - glue:GetDatabases
        - glue:GetPartition
        - glue:GetPartitions
        - glue:GetSchemaVersion
        - glue:GetTable
        - glue:GetTables

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_CreateConfiguredTable.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toCreateConfiguredTable", []))

    @jsii.member(jsii_name="toCreateConfiguredTableAnalysisRule")
    def to_create_configured_table_analysis_rule(self) -> "Cleanrooms":
        '''(experimental) Grants permission to create a analysis rule for a configured table.

        Access Level: Write

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_CreateConfiguredTableAnalysisRule.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toCreateConfiguredTableAnalysisRule", []))

    @jsii.member(jsii_name="toCreateConfiguredTableAssociation")
    def to_create_configured_table_association(self) -> "Cleanrooms":
        '''(experimental) Grants permission to link a configured table with a collaboration by creating a new association.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_CreateConfiguredTableAssociation.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toCreateConfiguredTableAssociation", []))

    @jsii.member(jsii_name="toCreateMembership")
    def to_create_membership(self) -> "Cleanrooms":
        '''(experimental) Grants permission to join collaborations by creating a membership.

        Access Level: Write

        Dependent actions:

        - logs:CreateLogDelivery
        - logs:CreateLogGroup
        - logs:DeleteLogDelivery
        - logs:DescribeLogGroups
        - logs:DescribeResourcePolicies
        - logs:GetLogDelivery
        - logs:ListLogDeliveries
        - logs:PutResourcePolicy
        - logs:UpdateLogDelivery

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_CreateMembership.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toCreateMembership", []))

    @jsii.member(jsii_name="toDeleteCollaboration")
    def to_delete_collaboration(self) -> "Cleanrooms":
        '''(experimental) Grants permission to delete an existing collaboration.

        Access Level: Write

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_DeleteCollaboration.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toDeleteCollaboration", []))

    @jsii.member(jsii_name="toDeleteConfiguredTable")
    def to_delete_configured_table(self) -> "Cleanrooms":
        '''(experimental) Grants permission to delete a configured table.

        Access Level: Write

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_DeleteConfiguredTable.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toDeleteConfiguredTable", []))

    @jsii.member(jsii_name="toDeleteConfiguredTableAnalysisRule")
    def to_delete_configured_table_analysis_rule(self) -> "Cleanrooms":
        '''(experimental) Grants permission to delete an existing analysis rule.

        Access Level: Write

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_DeleteConfiguredTableAnalysisRule.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toDeleteConfiguredTableAnalysisRule", []))

    @jsii.member(jsii_name="toDeleteConfiguredTableAssociation")
    def to_delete_configured_table_association(self) -> "Cleanrooms":
        '''(experimental) Grants permission to remove a configured table association from a collaboration.

        Access Level: Write

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_DeleteConfiguredTableAssociation.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toDeleteConfiguredTableAssociation", []))

    @jsii.member(jsii_name="toDeleteMember")
    def to_delete_member(self) -> "Cleanrooms":
        '''(experimental) Grants permission to delete members from a collaboration.

        Access Level: Write

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_DeleteMember.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toDeleteMember", []))

    @jsii.member(jsii_name="toDeleteMembership")
    def to_delete_membership(self) -> "Cleanrooms":
        '''(experimental) Grants permission to leave collaborations by deleting a membership.

        Access Level: Write

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_DeleteMembership.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toDeleteMembership", []))

    @jsii.member(jsii_name="toGetCollaboration")
    def to_get_collaboration(self) -> "Cleanrooms":
        '''(experimental) Grants permission to view details for a collaboration.

        Access Level: Read

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_GetCollaboration.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toGetCollaboration", []))

    @jsii.member(jsii_name="toGetConfiguredTable")
    def to_get_configured_table(self) -> "Cleanrooms":
        '''(experimental) Grants permission to view details for a configured table.

        Access Level: Read

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_GetConfiguredTable.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toGetConfiguredTable", []))

    @jsii.member(jsii_name="toGetConfiguredTableAnalysisRule")
    def to_get_configured_table_analysis_rule(self) -> "Cleanrooms":
        '''(experimental) Grants permission to view analysis rules for a configured table.

        Access Level: Read

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_GetConfiguredTableAnalysisRule.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toGetConfiguredTableAnalysisRule", []))

    @jsii.member(jsii_name="toGetConfiguredTableAssociation")
    def to_get_configured_table_association(self) -> "Cleanrooms":
        '''(experimental) Grants permission to view details for a configured table association.

        Access Level: Read

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_GetConfiguredTableAssociation.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toGetConfiguredTableAssociation", []))

    @jsii.member(jsii_name="toGetMembership")
    def to_get_membership(self) -> "Cleanrooms":
        '''(experimental) Grants permission to view details about a membership.

        Access Level: Read

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_GetMembership.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toGetMembership", []))

    @jsii.member(jsii_name="toGetProtectedQuery")
    def to_get_protected_query(self) -> "Cleanrooms":
        '''(experimental) Grants permission to view a protected query.

        Access Level: Read

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_GetProtectedQuery.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toGetProtectedQuery", []))

    @jsii.member(jsii_name="toGetSchema")
    def to_get_schema(self) -> "Cleanrooms":
        '''(experimental) Grants permission to view details for a schema.

        Access Level: Read

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_GetSchema.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toGetSchema", []))

    @jsii.member(jsii_name="toGetSchemaAnalysisRule")
    def to_get_schema_analysis_rule(self) -> "Cleanrooms":
        '''(experimental) Grants permission to view analysis rules associated with a schema.

        Access Level: Read

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_GetSchemaAnalysisRule.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toGetSchemaAnalysisRule", []))

    @jsii.member(jsii_name="toListCollaborations")
    def to_list_collaborations(self) -> "Cleanrooms":
        '''(experimental) Grants permission to list available collaborations.

        Access Level: List

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_ListCollaborations.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toListCollaborations", []))

    @jsii.member(jsii_name="toListConfiguredTableAssociations")
    def to_list_configured_table_associations(self) -> "Cleanrooms":
        '''(experimental) Grants permission to list available configured table associations for a membership.

        Access Level: List

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_ListConfiguredTableAssociations.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toListConfiguredTableAssociations", []))

    @jsii.member(jsii_name="toListConfiguredTables")
    def to_list_configured_tables(self) -> "Cleanrooms":
        '''(experimental) Grants permission to list available configured tables.

        Access Level: List

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_ListConfiguredTables.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toListConfiguredTables", []))

    @jsii.member(jsii_name="toListMembers")
    def to_list_members(self) -> "Cleanrooms":
        '''(experimental) Grants permission to list the members of a collaboration.

        Access Level: List

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_ListMembers.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toListMembers", []))

    @jsii.member(jsii_name="toListMemberships")
    def to_list_memberships(self) -> "Cleanrooms":
        '''(experimental) Grants permission to list available memberships.

        Access Level: List

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_ListMemberships.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toListMemberships", []))

    @jsii.member(jsii_name="toListProtectedQueries")
    def to_list_protected_queries(self) -> "Cleanrooms":
        '''(experimental) Grants permission to list protected queries.

        Access Level: List

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_ListProtectedQueries.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toListProtectedQueries", []))

    @jsii.member(jsii_name="toListSchemas")
    def to_list_schemas(self) -> "Cleanrooms":
        '''(experimental) Grants permission to view available schemas for a collaboration.

        Access Level: List

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_ListSchemas.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toListSchemas", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Cleanrooms":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: List

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartProtectedQuery")
    def to_start_protected_query(self) -> "Cleanrooms":
        '''(experimental) Grants permission to start protected queries.

        Access Level: Write

        Dependent actions:

        - cleanrooms:GetSchema
        - s3:GetBucketLocation
        - s3:ListBucket
        - s3:PutObject

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_StartProtectedQuery.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toStartProtectedQuery", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Cleanrooms":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Cleanrooms":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateCollaboration")
    def to_update_collaboration(self) -> "Cleanrooms":
        '''(experimental) Grants permission to update details of the collaboration.

        Access Level: Write

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_UpdateCollaboration.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toUpdateCollaboration", []))

    @jsii.member(jsii_name="toUpdateConfiguredTable")
    def to_update_configured_table(self) -> "Cleanrooms":
        '''(experimental) Grants permission to update an existing configured table.

        Access Level: Write

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_UpdateConfiguredTable.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toUpdateConfiguredTable", []))

    @jsii.member(jsii_name="toUpdateConfiguredTableAnalysisRule")
    def to_update_configured_table_analysis_rule(self) -> "Cleanrooms":
        '''(experimental) Grants permission to update analysis rules for a configured table.

        Access Level: Write

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_UpdateConfiguredTableAnalysisRule.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toUpdateConfiguredTableAnalysisRule", []))

    @jsii.member(jsii_name="toUpdateConfiguredTableAssociation")
    def to_update_configured_table_association(self) -> "Cleanrooms":
        '''(experimental) Grants permission to update a configured table association.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_UpdateConfiguredTableAssociation.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toUpdateConfiguredTableAssociation", []))

    @jsii.member(jsii_name="toUpdateMembership")
    def to_update_membership(self) -> "Cleanrooms":
        '''(experimental) Grants permission to update details of a membership.

        Access Level: Write

        Dependent actions:

        - logs:CreateLogDelivery
        - logs:CreateLogGroup
        - logs:DeleteLogDelivery
        - logs:DescribeLogGroups
        - logs:DescribeResourcePolicies
        - logs:GetLogDelivery
        - logs:ListLogDeliveries
        - logs:PutResourcePolicy
        - logs:UpdateLogDelivery

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_UpdateMembership.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toUpdateMembership", []))

    @jsii.member(jsii_name="toUpdateProtectedQuery")
    def to_update_protected_query(self) -> "Cleanrooms":
        '''(experimental) Grants permission to update protected queries.

        Access Level: Write

        https://docs.aws.amazon.com/clean-rooms/latest/apireference/API_UpdateProtectedQuery.html

        :stability: experimental
        '''
        return typing.cast("Cleanrooms", jsii.invoke(self, "toUpdateProtectedQuery", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dbdcd4914dc48f244c92c709db889fa32a07838a5304e60d932dc034046b3b2e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6a8d1259a28bff11e4e85d1cd1df897db799a69835d8a1d50501cbae104f58e6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Cloud9(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Cloud9"):
    '''(experimental) Statement provider for service `cloud9 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloud9.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cloud9 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloud9.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__339744f47c675293e0c17266ae5392bba4d44700878a1d505b1575c5e9192280)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifEnvironmentId")
    def if_environment_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloud9":
        '''(experimental) Filters access by the AWS Cloud9 environment ID.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awscloud9.html##awscloud9-cloud9_EnvironmentId

        Applies to actions:

        - .toCreateEnvironmentMembership()
        - .toDescribeEnvironmentMemberships()
        - .toUpdateEnvironmentMembership()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__05fb138899d207c63afed40fecc9203afecae9da4ccd802805f1a8d1335f94ec)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Cloud9", jsii.invoke(self, "ifEnvironmentId", [value, operator]))

    @jsii.member(jsii_name="ifEnvironmentName")
    def if_environment_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloud9":
        '''(experimental) Filters access by the AWS Cloud9 environment name.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awscloud9.html##awscloud9-cloud9_EnvironmentName

        Applies to actions:

        - .toCreateEnvironmentEC2()
        - .toCreateEnvironmentSSH()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bc8ab2d6240167ae0937c87efd297583d4245f35829095d1bcdbd3d7e9e5ad27)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Cloud9", jsii.invoke(self, "ifEnvironmentName", [value, operator]))

    @jsii.member(jsii_name="ifInstanceType")
    def if_instance_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloud9":
        '''(experimental) Filters access by the instance type of the AWS Cloud9 environment's Amazon EC2 instance.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awscloud9.html##awscloud9-cloud9_InstanceType

        Applies to actions:

        - .toCreateEnvironmentEC2()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6e62c3ed460edf02944bec057e523f525d81a789159030a13f3d38c75ed815af)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Cloud9", jsii.invoke(self, "ifInstanceType", [value, operator]))

    @jsii.member(jsii_name="ifOwnerArn")
    def if_owner_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloud9":
        '''(experimental) Filters access by the owner ARN specified.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awscloud9.html##awscloud9-cloud9_OwnerArn

        Applies to actions:

        - .toCreateEnvironmentEC2()
        - .toCreateEnvironmentSSH()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8ff07b4013b1bcda516d669eec5c65f46a57720b3d78cb1aa431aadc64cb2a1b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Cloud9", jsii.invoke(self, "ifOwnerArn", [value, operator]))

    @jsii.member(jsii_name="ifPermissions")
    def if_permissions(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloud9":
        '''(experimental) Filters access by the type of AWS Cloud9 permissions.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awscloud9.html##awscloud9-cloud9_Permissions

        Applies to actions:

        - .toCreateEnvironmentMembership()
        - .toUpdateEnvironmentMembership()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__61189a43fa5c2a9d60f3f94df129b0d2977651c435485ea3f38a52aeed966451)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Cloud9", jsii.invoke(self, "ifPermissions", [value, operator]))

    @jsii.member(jsii_name="ifSubnetId")
    def if_subnet_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloud9":
        '''(experimental) Filters access by the subnet ID that the AWS Cloud9 environment will be created in.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awscloud9.html##awscloud9-cloud9_SubnetId

        Applies to actions:

        - .toCreateEnvironmentEC2()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0b821643eff4500a26d2640670dd058e6a2c6b9b7f0b9e7ab18f2236570049b2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Cloud9", jsii.invoke(self, "ifSubnetId", [value, operator]))

    @jsii.member(jsii_name="ifUserArn")
    def if_user_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloud9":
        '''(experimental) Filters access by the user ARN specified.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awscloud9.html##awscloud9-cloud9_UserArn

        Applies to actions:

        - .toCreateEnvironmentEC2()
        - .toCreateEnvironmentMembership()
        - .toDescribeEnvironmentMemberships()
        - .toGetUserPublicKey()
        - .toUpdateEnvironmentMembership()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d8aac11d9c34245f2d12173e7e906bab70b36d51e2434253c290c5b94ddbe3de)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Cloud9", jsii.invoke(self, "ifUserArn", [value, operator]))

    @jsii.member(jsii_name="onEnvironment")
    def on_environment(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloud9":
        '''(experimental) Adds a resource of type environment to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awscloud9.html##awscloud9-environment

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5eb71ace7f84bfca8fbc39d943daa510a54b1e24f717ab695791fbb81ec3c03b)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloud9", jsii.invoke(self, "onEnvironment", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toActivateEC2Remote")
    def to_activate_ec2_remote(self) -> "Cloud9":
        '''(experimental) Grants permission to start the Amazon EC2 instance that your AWS Cloud9 IDE connects to.

        Access Level: Write

        https://docs.aws.amazon.com/cloud9/latest/user-guide/security-iam.html#auth-and-access-control-ref-matrix

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toActivateEC2Remote", []))

    @jsii.member(jsii_name="toCreateEnvironmentEC2")
    def to_create_environment_ec2(self) -> "Cloud9":
        '''(experimental) Grants permission to create an AWS Cloud9 development environment, launches an Amazon Elastic Compute Cloud (Amazon EC2) instance, and then hosts the environment on the instance.

        Access Level: Write

        Possible conditions:

        - .ifEnvironmentName()
        - .ifInstanceType()
        - .ifSubnetId()
        - .ifUserArn()
        - .ifOwnerArn()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:DescribeSubnets
        - ec2:DescribeVpcs
        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_CreateEnvironmentEC2.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toCreateEnvironmentEC2", []))

    @jsii.member(jsii_name="toCreateEnvironmentMembership")
    def to_create_environment_membership(self) -> "Cloud9":
        '''(experimental) Grants permission to add an environment member to an AWS Cloud9 development environment.

        Access Level: Write

        Possible conditions:

        - .ifUserArn()
        - .ifEnvironmentId()
        - .ifPermissions()

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_CreateEnvironmentMembership.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toCreateEnvironmentMembership", []))

    @jsii.member(jsii_name="toCreateEnvironmentSSH")
    def to_create_environment_ssh(self) -> "Cloud9":
        '''(experimental) Grants permission to create an AWS Cloud9 SSH development environment.

        Access Level: Write

        Possible conditions:

        - .ifEnvironmentName()
        - .ifOwnerArn()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloud9/latest/user-guide/security-iam.html#auth-and-access-control-ref-matrix

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toCreateEnvironmentSSH", []))

    @jsii.member(jsii_name="toCreateEnvironmentToken")
    def to_create_environment_token(self) -> "Cloud9":
        '''(experimental) Grants permission to create an authentication token that allows a connection between the AWS Cloud9 IDE and the user's environment.

        Access Level: Read

        https://docs.aws.amazon.com/cloud9/latest/user-guide/security-iam.html#auth-and-access-control-ref-matrix

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toCreateEnvironmentToken", []))

    @jsii.member(jsii_name="toDeleteEnvironment")
    def to_delete_environment(self) -> "Cloud9":
        '''(experimental) Grants permission to delete an AWS Cloud9 development environment.

        If the environment is hosted on an Amazon Elastic Compute Cloud (Amazon EC2) instance, also terminates the instance

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_DeleteEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toDeleteEnvironment", []))

    @jsii.member(jsii_name="toDeleteEnvironmentMembership")
    def to_delete_environment_membership(self) -> "Cloud9":
        '''(experimental) Grants permission to delete an environment member from an AWS Cloud9 development environment.

        Access Level: Write

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_DeleteEnvironmentMembership.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toDeleteEnvironmentMembership", []))

    @jsii.member(jsii_name="toDescribeEC2Remote")
    def to_describe_ec2_remote(self) -> "Cloud9":
        '''(experimental) Grants permission to get details about the connection to the EC2 development environment, including host, user, and port.

        Access Level: Read

        https://docs.aws.amazon.com/cloud9/latest/user-guide/security-iam.html#auth-and-access-control-ref-matrix

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toDescribeEC2Remote", []))

    @jsii.member(jsii_name="toDescribeEnvironmentMemberships")
    def to_describe_environment_memberships(self) -> "Cloud9":
        '''(experimental) Grants permission to get information about environment members for an AWS Cloud9 development environment.

        Access Level: Read

        Possible conditions:

        - .ifUserArn()
        - .ifEnvironmentId()

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_DescribeEnvironmentMemberships.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toDescribeEnvironmentMemberships", []))

    @jsii.member(jsii_name="toDescribeEnvironments")
    def to_describe_environments(self) -> "Cloud9":
        '''(experimental) Grants permission to get information about AWS Cloud9 development environments.

        Access Level: Read

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_DescribeEnvironments.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toDescribeEnvironments", []))

    @jsii.member(jsii_name="toDescribeEnvironmentStatus")
    def to_describe_environment_status(self) -> "Cloud9":
        '''(experimental) Grants permission to get status information for an AWS Cloud9 development environment.

        Access Level: Read

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_DescribeEnvironmentStatus.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toDescribeEnvironmentStatus", []))

    @jsii.member(jsii_name="toDescribeSSHRemote")
    def to_describe_ssh_remote(self) -> "Cloud9":
        '''(experimental) Grants permission to get details about the connection to the SSH development environment, including host, user, and port.

        Access Level: Read

        https://docs.aws.amazon.com/cloud9/latest/user-guide/security-iam.html#auth-and-access-control-ref-matrix

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toDescribeSSHRemote", []))

    @jsii.member(jsii_name="toGetEnvironmentConfig")
    def to_get_environment_config(self) -> "Cloud9":
        '''(experimental) Grants permission to get configuration information that's used to initialize the AWS Cloud9 IDE.

        Access Level: Read

        https://docs.aws.amazon.com/cloud9/latest/user-guide/security-iam.html#auth-and-access-control-ref-matrix

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toGetEnvironmentConfig", []))

    @jsii.member(jsii_name="toGetEnvironmentSettings")
    def to_get_environment_settings(self) -> "Cloud9":
        '''(experimental) Grants permission to get the AWS Cloud9 IDE settings for a specified development environment.

        Access Level: Read

        https://docs.aws.amazon.com/cloud9/latest/user-guide/security-iam.html#auth-and-access-control-ref-matrix

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toGetEnvironmentSettings", []))

    @jsii.member(jsii_name="toGetMembershipSettings")
    def to_get_membership_settings(self) -> "Cloud9":
        '''(experimental) Grants permission to get the AWS Cloud9 IDE settings for a specified environment member.

        Access Level: Read

        https://docs.aws.amazon.com/cloud9/latest/user-guide/security-iam.html#auth-and-access-control-ref-matrix

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toGetMembershipSettings", []))

    @jsii.member(jsii_name="toGetUserPublicKey")
    def to_get_user_public_key(self) -> "Cloud9":
        '''(experimental) Grants permission to get the user's public SSH key, which is used by AWS Cloud9 to connect to SSH development environments.

        Access Level: Read

        Possible conditions:

        - .ifUserArn()

        https://docs.aws.amazon.com/cloud9/latest/user-guide/security-iam.html#auth-and-access-control-ref-matrix

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toGetUserPublicKey", []))

    @jsii.member(jsii_name="toGetUserSettings")
    def to_get_user_settings(self) -> "Cloud9":
        '''(experimental) Grants permission to get the AWS Cloud9 IDE settings for a specified user.

        Access Level: Read

        https://docs.aws.amazon.com/cloud9/latest/user-guide/security-iam.html#auth-and-access-control-ref-matrix

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toGetUserSettings", []))

    @jsii.member(jsii_name="toListEnvironments")
    def to_list_environments(self) -> "Cloud9":
        '''(experimental) Grants permission to get a list of AWS Cloud9 development environment identifiers.

        Access Level: Read

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_ListEnvironments.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toListEnvironments", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Cloud9":
        '''(experimental) Grants permission to list tags for a cloud9 environment.

        Access Level: Read

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toModifyTemporaryCredentialsOnEnvironmentEC2")
    def to_modify_temporary_credentials_on_environment_ec2(self) -> "Cloud9":
        '''(experimental) Grants permission to set AWS managed temporary credentials on the Amazon EC2 instance that's used by the AWS Cloud9 integrated development environment (IDE).

        Access Level: Write

        https://docs.aws.amazon.com/cloud9/latest/user-guide/security-iam.html#auth-and-access-control-ref-matrix

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toModifyTemporaryCredentialsOnEnvironmentEC2", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Cloud9":
        '''(experimental) Grants permission to add tags to a cloud9 environment.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Cloud9":
        '''(experimental) Grants permission to remove tags from a cloud9 environment.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateEnvironment")
    def to_update_environment(self) -> "Cloud9":
        '''(experimental) Grants permission to change the settings of an existing AWS Cloud9 development environment.

        Access Level: Write

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_UpdateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toUpdateEnvironment", []))

    @jsii.member(jsii_name="toUpdateEnvironmentMembership")
    def to_update_environment_membership(self) -> "Cloud9":
        '''(experimental) Grants permission to change the settings of an existing environment member for an AWS Cloud9 development environment.

        Access Level: Write

        Possible conditions:

        - .ifUserArn()
        - .ifEnvironmentId()
        - .ifPermissions()

        https://docs.aws.amazon.com/cloud9/latest/APIReference/API_UpdateEnvironmentMembership.html

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toUpdateEnvironmentMembership", []))

    @jsii.member(jsii_name="toUpdateEnvironmentSettings")
    def to_update_environment_settings(self) -> "Cloud9":
        '''(experimental) Grants permission to update the AWS Cloud9 IDE settings for a specified development environment.

        Access Level: Write

        https://docs.aws.amazon.com/cloud9/latest/user-guide/security-iam.html#auth-and-access-control-ref-matrix

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toUpdateEnvironmentSettings", []))

    @jsii.member(jsii_name="toUpdateMembershipSettings")
    def to_update_membership_settings(self) -> "Cloud9":
        '''(experimental) Grants permission to update the AWS Cloud9 IDE settings for a specified environment member.

        Access Level: Write

        https://docs.aws.amazon.com/cloud9/latest/user-guide/security-iam.html#auth-and-access-control-ref-matrix

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toUpdateMembershipSettings", []))

    @jsii.member(jsii_name="toUpdateSSHRemote")
    def to_update_ssh_remote(self) -> "Cloud9":
        '''(experimental) Grants permission to update details about the connection to the SSH development environment, including host, user, and port.

        Access Level: Write

        https://docs.aws.amazon.com/cloud9/latest/user-guide/security-iam.html#auth-and-access-control-ref-matrix

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toUpdateSSHRemote", []))

    @jsii.member(jsii_name="toUpdateUserSettings")
    def to_update_user_settings(self) -> "Cloud9":
        '''(experimental) Grants permission to update IDE-specific settings of an AWS Cloud9 user.

        Access Level: Write

        https://docs.aws.amazon.com/cloud9/latest/user-guide/security-iam.html#auth-and-access-control-ref-matrix

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toUpdateUserSettings", []))

    @jsii.member(jsii_name="toValidateEnvironmentName")
    def to_validate_environment_name(self) -> "Cloud9":
        '''(experimental) Grants permission to validate the environment name during the process of creating an AWS Cloud9 development environment.

        Access Level: Read

        https://docs.aws.amazon.com/cloud9/latest/user-guide/security-iam.html#auth-and-access-control-ref-matrix

        :stability: experimental
        '''
        return typing.cast("Cloud9", jsii.invoke(self, "toValidateEnvironmentName", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__15edc460d78d0b11a94fa211b2f44275583884a0342c58728cf0e942b61e1b3b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__294bc921bb77482ac3526d3cff74adf7b09f57afa8e1a097aa822504bf251627)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Clouddirectory(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Clouddirectory",
):
    '''(experimental) Statement provider for service `clouddirectory <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonclouddirectory.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `clouddirectory <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonclouddirectory.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bbe5c34de249aa71ea745fa7fc61c4ad997a074d7c34f2b243b9db29e9c08b74)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAppliedSchema")
    def on_applied_schema(
        self,
        directory_id: builtins.str,
        schema_name: builtins.str,
        version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Clouddirectory":
        '''(experimental) Adds a resource of type appliedSchema to the statement.

        https://docs.aws.amazon.com/directoryservice/latest/admin-guide/cd_key_concepts.html#whatisdirectory

        :param directory_id: - Identifier for the directoryId.
        :param schema_name: - Identifier for the schemaName.
        :param version: - Identifier for the version.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__902b92e402d96b75eb9e697feee51c0f5399ee99457fde19062c69fa7d22af8c)
            check_type(argname="argument directory_id", value=directory_id, expected_type=type_hints["directory_id"])
            check_type(argname="argument schema_name", value=schema_name, expected_type=type_hints["schema_name"])
            check_type(argname="argument version", value=version, expected_type=type_hints["version"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Clouddirectory", jsii.invoke(self, "onAppliedSchema", [directory_id, schema_name, version, account, region, partition]))

    @jsii.member(jsii_name="onDevelopmentSchema")
    def on_development_schema(
        self,
        schema_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Clouddirectory":
        '''(experimental) Adds a resource of type developmentSchema to the statement.

        https://docs.aws.amazon.com/directoryservice/latest/admin-guide/cd_key_concepts.html#whatisdirectory

        :param schema_name: - Identifier for the schemaName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8415f0ebe00ea65806c9e087fc6aff5248867b14992b711f176042ee6676c547)
            check_type(argname="argument schema_name", value=schema_name, expected_type=type_hints["schema_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Clouddirectory", jsii.invoke(self, "onDevelopmentSchema", [schema_name, account, region, partition]))

    @jsii.member(jsii_name="onDirectory")
    def on_directory(
        self,
        directory_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Clouddirectory":
        '''(experimental) Adds a resource of type directory to the statement.

        https://docs.aws.amazon.com/directoryservice/latest/admin-guide/cd_key_concepts.html#whatisdirectory

        :param directory_id: - Identifier for the directoryId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a0cdcd85f79a20b790a9af2f471ec4dcd453c3b70702ff074b417089d416d012)
            check_type(argname="argument directory_id", value=directory_id, expected_type=type_hints["directory_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Clouddirectory", jsii.invoke(self, "onDirectory", [directory_id, account, region, partition]))

    @jsii.member(jsii_name="onPublishedSchema")
    def on_published_schema(
        self,
        schema_name: builtins.str,
        version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Clouddirectory":
        '''(experimental) Adds a resource of type publishedSchema to the statement.

        https://docs.aws.amazon.com/directoryservice/latest/admin-guide/cd_key_concepts.html#whatisdirectory

        :param schema_name: - Identifier for the schemaName.
        :param version: - Identifier for the version.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7b048125e8e1e81f55cb4a063468630c6fe9757b8fc5783fe5e33362e22777a5)
            check_type(argname="argument schema_name", value=schema_name, expected_type=type_hints["schema_name"])
            check_type(argname="argument version", value=version, expected_type=type_hints["version"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Clouddirectory", jsii.invoke(self, "onPublishedSchema", [schema_name, version, account, region, partition]))

    @jsii.member(jsii_name="toAddFacetToObject")
    def to_add_facet_to_object(self) -> "Clouddirectory":
        '''(experimental) Grants permission to add a new Facet to an object.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_AddFacetToObject.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toAddFacetToObject", []))

    @jsii.member(jsii_name="toApplySchema")
    def to_apply_schema(self) -> "Clouddirectory":
        '''(experimental) Grants permission to copy input published schema into Directory with same name and version as that of published schema.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ApplySchema.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toApplySchema", []))

    @jsii.member(jsii_name="toAttachObject")
    def to_attach_object(self) -> "Clouddirectory":
        '''(experimental) Grants permission to attach an existing object to another existing object.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_AttachObject.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toAttachObject", []))

    @jsii.member(jsii_name="toAttachPolicy")
    def to_attach_policy(self) -> "Clouddirectory":
        '''(experimental) Grants permission to attach a policy object to any other object.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_AttachPolicy.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toAttachPolicy", []))

    @jsii.member(jsii_name="toAttachToIndex")
    def to_attach_to_index(self) -> "Clouddirectory":
        '''(experimental) Grants permission to attach the specified object to the specified index.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_AttachToIndex.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toAttachToIndex", []))

    @jsii.member(jsii_name="toAttachTypedLink")
    def to_attach_typed_link(self) -> "Clouddirectory":
        '''(experimental) Grants permission to attach a typed link b/w a source & target object reference.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_AttachTypedLink.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toAttachTypedLink", []))

    @jsii.member(jsii_name="toBatchRead")
    def to_batch_read(self) -> "Clouddirectory":
        '''(experimental) Grants permission to perform all the read operations in a batch.

        Each individual operation inside BatchRead needs to be granted permissions explicitly

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_BatchRead.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toBatchRead", []))

    @jsii.member(jsii_name="toBatchWrite")
    def to_batch_write(self) -> "Clouddirectory":
        '''(experimental) Grants permission to perform all the write operations in a batch.

        Each individual operation inside BatchWrite needs to be granted permissions explicitly

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_BatchWrite.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toBatchWrite", []))

    @jsii.member(jsii_name="toCreateDirectory")
    def to_create_directory(self) -> "Clouddirectory":
        '''(experimental) Grants permission to create a Directory by copying the published schema into the directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_CreateDirectory.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toCreateDirectory", []))

    @jsii.member(jsii_name="toCreateFacet")
    def to_create_facet(self) -> "Clouddirectory":
        '''(experimental) Grants permission to create a new Facet in a schema.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_CreateFacet.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toCreateFacet", []))

    @jsii.member(jsii_name="toCreateIndex")
    def to_create_index(self) -> "Clouddirectory":
        '''(experimental) Grants permission to create an index object.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_CreateIndex.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toCreateIndex", []))

    @jsii.member(jsii_name="toCreateObject")
    def to_create_object(self) -> "Clouddirectory":
        '''(experimental) Grants permission to create an object in a Directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_CreateObject.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toCreateObject", []))

    @jsii.member(jsii_name="toCreateSchema")
    def to_create_schema(self) -> "Clouddirectory":
        '''(experimental) Grants permission to create a new schema in a development state.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_CreateSchema.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toCreateSchema", []))

    @jsii.member(jsii_name="toCreateTypedLinkFacet")
    def to_create_typed_link_facet(self) -> "Clouddirectory":
        '''(experimental) Grants permission to create a new Typed Link facet in a schema.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_CreateTypedLinkFacet.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toCreateTypedLinkFacet", []))

    @jsii.member(jsii_name="toDeleteDirectory")
    def to_delete_directory(self) -> "Clouddirectory":
        '''(experimental) Grants permission to delete a directory. Only disabled directories can be deleted.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_DeleteDirectory.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toDeleteDirectory", []))

    @jsii.member(jsii_name="toDeleteFacet")
    def to_delete_facet(self) -> "Clouddirectory":
        '''(experimental) Grants permission to delete a given Facet. All attributes and Rules associated with the facet will be deleted.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_DeleteFacet.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toDeleteFacet", []))

    @jsii.member(jsii_name="toDeleteObject")
    def to_delete_object(self) -> "Clouddirectory":
        '''(experimental) Grants permission to delete an object and its associated attributes.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_DeleteObject.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toDeleteObject", []))

    @jsii.member(jsii_name="toDeleteSchema")
    def to_delete_schema(self) -> "Clouddirectory":
        '''(experimental) Grants permission to delete a given schema.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_DeleteSchema.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toDeleteSchema", []))

    @jsii.member(jsii_name="toDeleteTypedLinkFacet")
    def to_delete_typed_link_facet(self) -> "Clouddirectory":
        '''(experimental) Grants permission to delete a given TypedLink Facet. All attributes and Rules associated with the facet will be deleted.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_DeleteTypedLinkFacet.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toDeleteTypedLinkFacet", []))

    @jsii.member(jsii_name="toDetachFromIndex")
    def to_detach_from_index(self) -> "Clouddirectory":
        '''(experimental) Grants permission to detach the specified object from the specified index.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_DetachFromIndex.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toDetachFromIndex", []))

    @jsii.member(jsii_name="toDetachObject")
    def to_detach_object(self) -> "Clouddirectory":
        '''(experimental) Grants permission to detach a given object from the parent object.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_DetachObject.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toDetachObject", []))

    @jsii.member(jsii_name="toDetachPolicy")
    def to_detach_policy(self) -> "Clouddirectory":
        '''(experimental) Grants permission to detach a policy from an object.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_DetachPolicy.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toDetachPolicy", []))

    @jsii.member(jsii_name="toDetachTypedLink")
    def to_detach_typed_link(self) -> "Clouddirectory":
        '''(experimental) Grants permission to detach a given typed link b/w given source and target object reference.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_DetachTypedLink.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toDetachTypedLink", []))

    @jsii.member(jsii_name="toDisableDirectory")
    def to_disable_directory(self) -> "Clouddirectory":
        '''(experimental) Grants permission to disable the specified directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_DisableDirectory.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toDisableDirectory", []))

    @jsii.member(jsii_name="toEnableDirectory")
    def to_enable_directory(self) -> "Clouddirectory":
        '''(experimental) Grants permission to enable the specified directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_EnableDirectory.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toEnableDirectory", []))

    @jsii.member(jsii_name="toGetAppliedSchemaVersion")
    def to_get_applied_schema_version(self) -> "Clouddirectory":
        '''(experimental) Grants permission to return current applied schema version ARN, including the minor version in use.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_GetAppliedSchemaVersion.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toGetAppliedSchemaVersion", []))

    @jsii.member(jsii_name="toGetDirectory")
    def to_get_directory(self) -> "Clouddirectory":
        '''(experimental) Grants permission to retrieve metadata about a directory.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_GetDirectory.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toGetDirectory", []))

    @jsii.member(jsii_name="toGetFacet")
    def to_get_facet(self) -> "Clouddirectory":
        '''(experimental) Grants permission to get details of the Facet, such as Facet Name, Attributes, Rules, or ObjectType.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_GetFacet.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toGetFacet", []))

    @jsii.member(jsii_name="toGetLinkAttributes")
    def to_get_link_attributes(self) -> "Clouddirectory":
        '''(experimental) Grants permission to retrieve attributes that are associated with a typed link.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_GetLinkAttributes.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toGetLinkAttributes", []))

    @jsii.member(jsii_name="toGetObjectAttributes")
    def to_get_object_attributes(self) -> "Clouddirectory":
        '''(experimental) Grants permission to retrieve attributes within a facet that are associated with an object.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_GetObjectAttributes.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toGetObjectAttributes", []))

    @jsii.member(jsii_name="toGetObjectInformation")
    def to_get_object_information(self) -> "Clouddirectory":
        '''(experimental) Grants permission to retrieve metadata about an object.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_GetObjectInformation.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toGetObjectInformation", []))

    @jsii.member(jsii_name="toGetSchemaAsJson")
    def to_get_schema_as_json(self) -> "Clouddirectory":
        '''(experimental) Grants permission to retrieve a JSON representation of the schema.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_GetSchemaAsJson.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toGetSchemaAsJson", []))

    @jsii.member(jsii_name="toGetTypedLinkFacetInformation")
    def to_get_typed_link_facet_information(self) -> "Clouddirectory":
        '''(experimental) Grants permission to return identity attributes order information associated with a given typed link facet.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_GetTypedLinkFacetInformation.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toGetTypedLinkFacetInformation", []))

    @jsii.member(jsii_name="toListAppliedSchemaArns")
    def to_list_applied_schema_arns(self) -> "Clouddirectory":
        '''(experimental) Grants permission to list schemas applied to a directory.

        Access Level: List

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListAppliedSchemaArns.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListAppliedSchemaArns", []))

    @jsii.member(jsii_name="toListAttachedIndices")
    def to_list_attached_indices(self) -> "Clouddirectory":
        '''(experimental) Grants permission to list indices attached to an object.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListAttachedIndices.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListAttachedIndices", []))

    @jsii.member(jsii_name="toListDevelopmentSchemaArns")
    def to_list_development_schema_arns(self) -> "Clouddirectory":
        '''(experimental) Grants permission to retrieve the ARNs of schemas in the development state.

        Access Level: List

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListDevelopmentSchemaArns.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListDevelopmentSchemaArns", []))

    @jsii.member(jsii_name="toListDirectories")
    def to_list_directories(self) -> "Clouddirectory":
        '''(experimental) Grants permission to list directories created within an account.

        Access Level: List

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListDirectories.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListDirectories", []))

    @jsii.member(jsii_name="toListFacetAttributes")
    def to_list_facet_attributes(self) -> "Clouddirectory":
        '''(experimental) Grants permission to retrieve attributes attached to the facet.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListFacetAttributes.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListFacetAttributes", []))

    @jsii.member(jsii_name="toListFacetNames")
    def to_list_facet_names(self) -> "Clouddirectory":
        '''(experimental) Grants permission to retrieve the names of facets that exist in a schema.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListFacetNames.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListFacetNames", []))

    @jsii.member(jsii_name="toListIncomingTypedLinks")
    def to_list_incoming_typed_links(self) -> "Clouddirectory":
        '''(experimental) Grants permission to return a paginated list of all incoming TypedLinks for a given object.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListIncomingTypedLinks.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListIncomingTypedLinks", []))

    @jsii.member(jsii_name="toListIndex")
    def to_list_index(self) -> "Clouddirectory":
        '''(experimental) Grants permission to list objects attached to the specified index.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListIndex.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListIndex", []))

    @jsii.member(jsii_name="toListManagedSchemaArns")
    def to_list_managed_schema_arns(self) -> "Clouddirectory":
        '''(experimental) Grants permission to list the major version families of each managed schema.

        If a major version ARN is provided as SchemaArn, the minor version revisions in that family are listed instead

        Access Level: List

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListManagedSchemaArns.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListManagedSchemaArns", []))

    @jsii.member(jsii_name="toListObjectAttributes")
    def to_list_object_attributes(self) -> "Clouddirectory":
        '''(experimental) Grants permission to list all attributes associated with an object.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListObjectAttributes.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListObjectAttributes", []))

    @jsii.member(jsii_name="toListObjectChildren")
    def to_list_object_children(self) -> "Clouddirectory":
        '''(experimental) Grants permission to return a paginated list of child objects associated with a given object.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListObjectChildren.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListObjectChildren", []))

    @jsii.member(jsii_name="toListObjectParentPaths")
    def to_list_object_parent_paths(self) -> "Clouddirectory":
        '''(experimental) Grants permission to retrieve all available parent paths for any object type such as node, leaf node, policy node, and index node objects.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListObjectParentPaths.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListObjectParentPaths", []))

    @jsii.member(jsii_name="toListObjectParents")
    def to_list_object_parents(self) -> "Clouddirectory":
        '''(experimental) Grants permission to list parent objects associated with a given object in pagination fashion.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListObjectParents.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListObjectParents", []))

    @jsii.member(jsii_name="toListObjectPolicies")
    def to_list_object_policies(self) -> "Clouddirectory":
        '''(experimental) Grants permission to return policies attached to an object in pagination fashion.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListObjectPolicies.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListObjectPolicies", []))

    @jsii.member(jsii_name="toListOutgoingTypedLinks")
    def to_list_outgoing_typed_links(self) -> "Clouddirectory":
        '''(experimental) Grants permission to return a paginated list of all outgoing TypedLinks for a given object.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListOutgoingTypedLinks.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListOutgoingTypedLinks", []))

    @jsii.member(jsii_name="toListPolicyAttachments")
    def to_list_policy_attachments(self) -> "Clouddirectory":
        '''(experimental) Grants permission to return all of the ObjectIdentifiers to which a given policy is attached.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListPolicyAttachments.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListPolicyAttachments", []))

    @jsii.member(jsii_name="toListPublishedSchemaArns")
    def to_list_published_schema_arns(self) -> "Clouddirectory":
        '''(experimental) Grants permission to retrieve published schema ARNs.

        Access Level: List

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListPublishedSchemaArns.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListPublishedSchemaArns", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Clouddirectory":
        '''(experimental) Grants permission to return tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTypedLinkFacetAttributes")
    def to_list_typed_link_facet_attributes(self) -> "Clouddirectory":
        '''(experimental) Grants permission to return a paginated list of attributes associated with typed link facet.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListTypedLinkFacetAttributes.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListTypedLinkFacetAttributes", []))

    @jsii.member(jsii_name="toListTypedLinkFacetNames")
    def to_list_typed_link_facet_names(self) -> "Clouddirectory":
        '''(experimental) Grants permission to return a paginated list of typed link facet names that exist in a schema.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_ListTypedLinkFacetNames.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toListTypedLinkFacetNames", []))

    @jsii.member(jsii_name="toLookupPolicy")
    def to_lookup_policy(self) -> "Clouddirectory":
        '''(experimental) Grants permission to list all policies from the root of the Directory to the object specified.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_LookupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toLookupPolicy", []))

    @jsii.member(jsii_name="toPublishSchema")
    def to_publish_schema(self) -> "Clouddirectory":
        '''(experimental) Grants permission to publish a development schema with a version.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_PublishSchema.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toPublishSchema", []))

    @jsii.member(jsii_name="toPutSchemaFromJson")
    def to_put_schema_from_json(self) -> "Clouddirectory":
        '''(experimental) Grants permission to update a schema using JSON upload. Only available for development schemas.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_PutSchemaFromJson.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toPutSchemaFromJson", []))

    @jsii.member(jsii_name="toRemoveFacetFromObject")
    def to_remove_facet_from_object(self) -> "Clouddirectory":
        '''(experimental) Grants permission to remove the specified facet from the specified object.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_RemoveFacetFromObject.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toRemoveFacetFromObject", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Clouddirectory":
        '''(experimental) Grants permission to add tags to a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Clouddirectory":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateFacet")
    def to_update_facet(self) -> "Clouddirectory":
        '''(experimental) Grants permission to add/update/delete existing Attributes, Rules, or ObjectType of a Facet.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_UpdateFacet.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toUpdateFacet", []))

    @jsii.member(jsii_name="toUpdateLinkAttributes")
    def to_update_link_attributes(self) -> "Clouddirectory":
        '''(experimental) Grants permission to update a given typed link’s attributes.

        Attributes to be updated must not contribute to the typed link’s identity, as defined by its IdentityAttributeOrder

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_UpdateLinkAttributes.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toUpdateLinkAttributes", []))

    @jsii.member(jsii_name="toUpdateObjectAttributes")
    def to_update_object_attributes(self) -> "Clouddirectory":
        '''(experimental) Grants permission to update a given object's attributes.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_UpdateObjectAttributes.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toUpdateObjectAttributes", []))

    @jsii.member(jsii_name="toUpdateSchema")
    def to_update_schema(self) -> "Clouddirectory":
        '''(experimental) Grants permission to update the schema name with a new name.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_UpdateSchema.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toUpdateSchema", []))

    @jsii.member(jsii_name="toUpdateTypedLinkFacet")
    def to_update_typed_link_facet(self) -> "Clouddirectory":
        '''(experimental) Grants permission to add/update/delete existing Attributes, Rules, identity attribute order of a TypedLink Facet.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_UpdateTypedLinkFacet.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toUpdateTypedLinkFacet", []))

    @jsii.member(jsii_name="toUpgradeAppliedSchema")
    def to_upgrade_applied_schema(self) -> "Clouddirectory":
        '''(experimental) Grants permission to upgrade a single directory in-place using the PublishedSchemaArn with schema updates found in MinorVersion.

        Backwards-compatible minor version upgrades are instantaneously available for readers on all objects in the directory

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_UpgradeAppliedSchema.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toUpgradeAppliedSchema", []))

    @jsii.member(jsii_name="toUpgradePublishedSchema")
    def to_upgrade_published_schema(self) -> "Clouddirectory":
        '''(experimental) Grants permission to upgrade a published schema under a new minor version revision using the current contents of DevelopmentSchemaArn.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/APIReference/API_UpgradePublishedSchema.html

        :stability: experimental
        '''
        return typing.cast("Clouddirectory", jsii.invoke(self, "toUpgradePublishedSchema", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__91e53331d5a8607dce71e26a16e42f662de19fe99fd39e3ee8ff831bbbb12e21)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__307cabc78418ae987bd6ebdc4ccc5a254fe2f9a10421d2b6696c1ced7e8a4f45)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Cloudformation(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Cloudformation",
):
    '''(experimental) Statement provider for service `cloudformation <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudformation.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cloudformation <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudformation.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__921f6454e598e7e2eae142afe80f1dbef15f5719f66655bfdf27f24a0864f6ae)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifChangeSetName")
    def if_change_set_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloudformation":
        '''(experimental) Filters access by an AWS CloudFormation change set name.

        Use to control which change sets IAM users can execute or delete

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-template-conditions

        Applies to actions:

        - .toCreateChangeSet()
        - .toDeleteChangeSet()
        - .toDescribeChangeSet()
        - .toDescribeChangeSetHooks()
        - .toExecuteChangeSet()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__55a3345d40efd2382583c102e2b75c1834daa3a297d48e2cb4262a2e1009a677)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Cloudformation", jsii.invoke(self, "ifChangeSetName", [value, operator]))

    @jsii.member(jsii_name="ifImportResourceTypes")
    def if_import_resource_types(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloudformation":
        '''(experimental) Filters access by the template resource types, such as AWS::EC2::Instance.

        Use to control which resource types IAM users can work with when they want to import a resource into a stack

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-template-conditions

        Applies to actions:

        - .toCreateChangeSet()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bcb12380db3ea952ca3f44f97688e1cdf4eabe03928e03879980d631d048d50a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Cloudformation", jsii.invoke(self, "ifImportResourceTypes", [value, operator]))

    @jsii.member(jsii_name="ifResourceTypes")
    def if_resource_types(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloudformation":
        '''(experimental) Filters access by the template resource types, such as AWS::EC2::Instance.

        Use to control which resource types IAM users can work with when they create or update a stack

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-template-conditions

        Applies to actions:

        - .toCreateChangeSet()
        - .toCreateStack()
        - .toUpdateStack()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d0db01570e18ae854adb80ee9fb6b4929679df7f1798b7071abd6a11f63be2a9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Cloudformation", jsii.invoke(self, "ifResourceTypes", [value, operator]))

    @jsii.member(jsii_name="ifRoleArn")
    def if_role_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloudformation":
        '''(experimental) Filters access by the ARN of an IAM service role.

        Use to control which service role IAM users can use to work with stacks or change sets

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-template-conditions

        Applies to actions:

        - .toContinueUpdateRollback()
        - .toCreateChangeSet()
        - .toCreateStack()
        - .toCreateStackSet()
        - .toDeleteStack()
        - .toRollbackStack()
        - .toUpdateStack()
        - .toUpdateStackSet()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dfce19158769c20d0ae878c5295efe014769864f928bea8b25aa4952d0036ffc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Cloudformation", jsii.invoke(self, "ifRoleArn", [value, operator]))

    @jsii.member(jsii_name="ifStackPolicyUrl")
    def if_stack_policy_url(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloudformation":
        '''(experimental) Filters access by an Amazon S3 stack policy URL.

        Use to control which stack policies IAM users can associate with a stack during a create or update stack action

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-template-conditions

        Applies to actions:

        - .toCreateChangeSet()
        - .toCreateStack()
        - .toSetStackPolicy()
        - .toUpdateStack()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5650670ea6d8052d4e8a79c0a2e5c5dff2ab2d8843c172b5e34c46761a8f00da)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Cloudformation", jsii.invoke(self, "ifStackPolicyUrl", [value, operator]))

    @jsii.member(jsii_name="ifTargetRegion")
    def if_target_region(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloudformation":
        '''(experimental) Filters access by stack set target region.

        Use to control which regions IAM users can use when they create or update stack sets

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-template-conditions

        Applies to actions:

        - .toCreateStackInstances()
        - .toDeleteStackInstances()
        - .toUpdateStackInstances()
        - .toUpdateStackSet()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__aa280d9ccc463d292ca06d2053a341bced9f1c37dfe7f91702cdc1909e245178)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Cloudformation", jsii.invoke(self, "ifTargetRegion", [value, operator]))

    @jsii.member(jsii_name="ifTemplateUrl")
    def if_template_url(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloudformation":
        '''(experimental) Filters access by an Amazon S3 template URL.

        Use to control which templates IAM users can use when they create or update stacks

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html#using-iam-template-conditions

        Applies to actions:

        - .toCreateChangeSet()
        - .toCreateStack()
        - .toCreateStackSet()
        - .toUpdateStack()
        - .toUpdateStackSet()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__27404c94178949e8f100f72d300e434b024abad9a8b0de2cac5290da77c9d080)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Cloudformation", jsii.invoke(self, "ifTemplateUrl", [value, operator]))

    @jsii.member(jsii_name="onChangeset")
    def on_changeset(
        self,
        change_set_name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudformation":
        '''(experimental) Adds a resource of type changeset to the statement.

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-whatis-concepts.html#w2ab1b5c15c11

        :param change_set_name: - Identifier for the changeSetName.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a4ff710b2676fd87f6d10fb128a8a8067909eb7b9d92742afc9f66020fba9adb)
            check_type(argname="argument change_set_name", value=change_set_name, expected_type=type_hints["change_set_name"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudformation", jsii.invoke(self, "onChangeset", [change_set_name, id, account, region, partition]))

    @jsii.member(jsii_name="onStack")
    def on_stack(
        self,
        stack_name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudformation":
        '''(experimental) Adds a resource of type stack to the statement.

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-whatis-concepts.html#w2ab1b5c15b9

        :param stack_name: - Identifier for the stackName.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__85a94d20fc811390841192341621046a3655d8ff8f0c11624d33fb491b9d612f)
            check_type(argname="argument stack_name", value=stack_name, expected_type=type_hints["stack_name"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudformation", jsii.invoke(self, "onStack", [stack_name, id, account, region, partition]))

    @jsii.member(jsii_name="onStackset")
    def on_stackset(
        self,
        stack_set_name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudformation":
        '''(experimental) Adds a resource of type stackset to the statement.

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-concepts.html#stacksets-concepts-stackset

        :param stack_set_name: - Identifier for the stackSetName.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ad4f6658ccc02558502eacd749e4b007e357677b87ab0ac2d4d2cdea1919e94c)
            check_type(argname="argument stack_set_name", value=stack_set_name, expected_type=type_hints["stack_set_name"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudformation", jsii.invoke(self, "onStackset", [stack_set_name, id, account, region, partition]))

    @jsii.member(jsii_name="onStacksetTarget")
    def on_stackset_target(
        self,
        stack_set_target: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudformation":
        '''(experimental) Adds a resource of type stackset-target to the statement.

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html

        :param stack_set_target: - Identifier for the stackSetTarget.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4063d250212439bbb150e7d6833bc4c9d4c17089b940bfbc490f0678cc5ea717)
            check_type(argname="argument stack_set_target", value=stack_set_target, expected_type=type_hints["stack_set_target"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudformation", jsii.invoke(self, "onStacksetTarget", [stack_set_target, account, region, partition]))

    @jsii.member(jsii_name="onType")
    def on_type(
        self,
        type: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudformation":
        '''(experimental) Adds a resource of type type to the statement.

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html

        :param type: - Identifier for the type.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a62d71a7ed7e71b1b27de542176da9b3a72064a53a22cf1659ab3f26b4f9ab99)
            check_type(argname="argument type", value=type, expected_type=type_hints["type"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudformation", jsii.invoke(self, "onType", [type, account, region, partition]))

    @jsii.member(jsii_name="toActivateType")
    def to_activate_type(self) -> "Cloudformation":
        '''(experimental) Grants permission to activate a public third-party extension, making it available for use in stack templates.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ActivateType.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toActivateType", []))

    @jsii.member(jsii_name="toBatchDescribeTypeConfigurations")
    def to_batch_describe_type_configurations(self) -> "Cloudformation":
        '''(experimental) Grants permission to return configuration data for the specified CloudFormation extensions.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_BatchDescribeTypeConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toBatchDescribeTypeConfigurations", []))

    @jsii.member(jsii_name="toCancelUpdateStack")
    def to_cancel_update_stack(self) -> "Cloudformation":
        '''(experimental) Grants permission to cancel an update on the specified stack.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CancelUpdateStack.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toCancelUpdateStack", []))

    @jsii.member(jsii_name="toContinueUpdateRollback")
    def to_continue_update_rollback(self) -> "Cloudformation":
        '''(experimental) Grants permission to continue rolling back a stack that is in the UPDATE_ROLLBACK_FAILED state to the UPDATE_ROLLBACK_COMPLETE state.

        Access Level: Write

        Possible conditions:

        - .ifRoleArn()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ContinueUpdateRollback.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toContinueUpdateRollback", []))

    @jsii.member(jsii_name="toCreateChangeSet")
    def to_create_change_set(self) -> "Cloudformation":
        '''(experimental) Grants permission to create a list of changes for a stack.

        Access Level: Write

        Possible conditions:

        - .ifChangeSetName()
        - .ifResourceTypes()
        - .ifImportResourceTypes()
        - .ifRoleArn()
        - .ifStackPolicyUrl()
        - .ifTemplateUrl()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateChangeSet.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toCreateChangeSet", []))

    @jsii.member(jsii_name="toCreateStack")
    def to_create_stack(self) -> "Cloudformation":
        '''(experimental) Grants permission to create a stack as specified in the template.

        Access Level: Write

        Possible conditions:

        - .ifResourceTypes()
        - .ifRoleArn()
        - .ifStackPolicyUrl()
        - .ifTemplateUrl()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateStack.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toCreateStack", []))

    @jsii.member(jsii_name="toCreateStackInstances")
    def to_create_stack_instances(self) -> "Cloudformation":
        '''(experimental) Grants permission to create stack instances for the specified accounts, within the specified regions.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifTargetRegion()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateStackInstances.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toCreateStackInstances", []))

    @jsii.member(jsii_name="toCreateStackSet")
    def to_create_stack_set(self) -> "Cloudformation":
        '''(experimental) Grants permission to create a stackset as specified in the template.

        Access Level: Write

        Possible conditions:

        - .ifRoleArn()
        - .ifTemplateUrl()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateStackSet.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toCreateStackSet", []))

    @jsii.member(jsii_name="toCreateUploadBucket")
    def to_create_upload_bucket(self) -> "Cloudformation":
        '''(experimental) Grants permission to upload templates to Amazon S3 buckets.

        Used only by the AWS CloudFormation console and is not documented in the API reference

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toCreateUploadBucket", []))

    @jsii.member(jsii_name="toDeactivateType")
    def to_deactivate_type(self) -> "Cloudformation":
        '''(experimental) Grants permission to deactivate a public extension that was previously activated in this account and region.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DeactivateType.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDeactivateType", []))

    @jsii.member(jsii_name="toDeleteChangeSet")
    def to_delete_change_set(self) -> "Cloudformation":
        '''(experimental) Grants permission to delete the specified change set.

        Deleting change sets ensures that no one executes the wrong change set

        Access Level: Write

        Possible conditions:

        - .ifChangeSetName()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DeleteChangeSet.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDeleteChangeSet", []))

    @jsii.member(jsii_name="toDeleteStack")
    def to_delete_stack(self) -> "Cloudformation":
        '''(experimental) Grants permission to delete a specified stack.

        Access Level: Write

        Possible conditions:

        - .ifRoleArn()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DeleteStack.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDeleteStack", []))

    @jsii.member(jsii_name="toDeleteStackInstances")
    def to_delete_stack_instances(self) -> "Cloudformation":
        '''(experimental) Grants permission to delete stack instances for the specified accounts, in the specified regions.

        Access Level: Write

        Possible conditions:

        - .ifTargetRegion()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DeleteStackInstances.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDeleteStackInstances", []))

    @jsii.member(jsii_name="toDeleteStackSet")
    def to_delete_stack_set(self) -> "Cloudformation":
        '''(experimental) Grants permission to delete a specified stackset.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DeleteStackSet.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDeleteStackSet", []))

    @jsii.member(jsii_name="toDeregisterType")
    def to_deregister_type(self) -> "Cloudformation":
        '''(experimental) Grants permission to deregister an existing CloudFormation type or type version.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DeregisterType.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDeregisterType", []))

    @jsii.member(jsii_name="toDescribeAccountLimits")
    def to_describe_account_limits(self) -> "Cloudformation":
        '''(experimental) Grants permission to retrieve your account's AWS CloudFormation limits.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeAccountLimits.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeAccountLimits", []))

    @jsii.member(jsii_name="toDescribeChangeSet")
    def to_describe_change_set(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the description for the specified change set.

        Access Level: Read

        Possible conditions:

        - .ifChangeSetName()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeChangeSet.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeChangeSet", []))

    @jsii.member(jsii_name="toDescribeChangeSetHooks")
    def to_describe_change_set_hooks(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the Hook invocation information for the specified change set.

        Access Level: Read

        Possible conditions:

        - .ifChangeSetName()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeChangeSetHooks.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeChangeSetHooks", []))

    @jsii.member(jsii_name="toDescribePublisher")
    def to_describe_publisher(self) -> "Cloudformation":
        '''(experimental) Grants permission to return information about a CloudFormation extension publisher.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribePublisher.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribePublisher", []))

    @jsii.member(jsii_name="toDescribeStackDriftDetectionStatus")
    def to_describe_stack_drift_detection_status(self) -> "Cloudformation":
        '''(experimental) Grants permission to return information about a stack drift detection operation.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackDriftDetectionStatus.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeStackDriftDetectionStatus", []))

    @jsii.member(jsii_name="toDescribeStackEvents")
    def to_describe_stack_events(self) -> "Cloudformation":
        '''(experimental) Grants permission to return all stack related events for a specified stack.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackEvents.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeStackEvents", []))

    @jsii.member(jsii_name="toDescribeStackInstance")
    def to_describe_stack_instance(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the stack instance that's associated with the specified stack set, AWS account, and region.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackInstance.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeStackInstance", []))

    @jsii.member(jsii_name="toDescribeStackResource")
    def to_describe_stack_resource(self) -> "Cloudformation":
        '''(experimental) Grants permission to return a description of the specified resource in the specified stack.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeStackResource", []))

    @jsii.member(jsii_name="toDescribeStackResourceDrifts")
    def to_describe_stack_resource_drifts(self) -> "Cloudformation":
        '''(experimental) Grants permission to return drift information for the resources that have been checked for drift in the specified stack.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackResourceDrifts.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeStackResourceDrifts", []))

    @jsii.member(jsii_name="toDescribeStackResources")
    def to_describe_stack_resources(self) -> "Cloudformation":
        '''(experimental) Grants permission to return AWS resource descriptions for running and deleted stacks.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackResources.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeStackResources", []))

    @jsii.member(jsii_name="toDescribeStacks")
    def to_describe_stacks(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the description for the specified stack.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStacks.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeStacks", []))

    @jsii.member(jsii_name="toDescribeStackSet")
    def to_describe_stack_set(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the description of the specified stack set.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackSet.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeStackSet", []))

    @jsii.member(jsii_name="toDescribeStackSetOperation")
    def to_describe_stack_set_operation(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the description of the specified stack set operation.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackSetOperation.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeStackSetOperation", []))

    @jsii.member(jsii_name="toDescribeType")
    def to_describe_type(self) -> "Cloudformation":
        '''(experimental) Grants permission to return information about the CloudFormation type requested.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeType.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeType", []))

    @jsii.member(jsii_name="toDescribeTypeRegistration")
    def to_describe_type_registration(self) -> "Cloudformation":
        '''(experimental) Grants permission to return information about the registration process for a CloudFormation type.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeTypeRegistration.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDescribeTypeRegistration", []))

    @jsii.member(jsii_name="toDetectStackDrift")
    def to_detect_stack_drift(self) -> "Cloudformation":
        '''(experimental) Grants permission to detects whether a stack's actual configuration differs, or has drifted, from it's expected configuration, as defined in the stack template and any values specified as template parameters.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DetectStackDrift.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDetectStackDrift", []))

    @jsii.member(jsii_name="toDetectStackResourceDrift")
    def to_detect_stack_resource_drift(self) -> "Cloudformation":
        '''(experimental) Grants permission to return information about whether a resource's actual configuration differs, or has drifted, from it's expected configuration, as defined in the stack template and any values specified as template parameters.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DetectStackResourceDrift.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDetectStackResourceDrift", []))

    @jsii.member(jsii_name="toDetectStackSetDrift")
    def to_detect_stack_set_drift(self) -> "Cloudformation":
        '''(experimental) Grants permission to enable users to detect drift on a stack set and the stack instances that belong to that stack set.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DetectStackSetDrift.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toDetectStackSetDrift", []))

    @jsii.member(jsii_name="toEstimateTemplateCost")
    def to_estimate_template_cost(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the estimated monthly cost of a template.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_EstimateTemplateCost.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toEstimateTemplateCost", []))

    @jsii.member(jsii_name="toExecuteChangeSet")
    def to_execute_change_set(self) -> "Cloudformation":
        '''(experimental) Grants permission to update a stack using the input information that was provided when the specified change set was created.

        Access Level: Write

        Possible conditions:

        - .ifChangeSetName()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ExecuteChangeSet.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toExecuteChangeSet", []))

    @jsii.member(jsii_name="toGetStackPolicy")
    def to_get_stack_policy(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the stack policy for a specified stack.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_GetStackPolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toGetStackPolicy", []))

    @jsii.member(jsii_name="toGetTemplate")
    def to_get_template(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the template body for a specified stack.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_GetTemplate.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toGetTemplate", []))

    @jsii.member(jsii_name="toGetTemplateSummary")
    def to_get_template_summary(self) -> "Cloudformation":
        '''(experimental) Grants permission to return information about a new or existing template.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_GetTemplateSummary.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toGetTemplateSummary", []))

    @jsii.member(jsii_name="toImportStacksToStackSet")
    def to_import_stacks_to_stack_set(self) -> "Cloudformation":
        '''(experimental) Grants permission to enable users to import existing stacks to a new or existing stackset.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ImportStacksToStackSet.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toImportStacksToStackSet", []))

    @jsii.member(jsii_name="toListChangeSets")
    def to_list_change_sets(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the ID and status of each active change set for a stack.

        For example, AWS CloudFormation lists change sets that are in the CREATE_IN_PROGRESS or CREATE_PENDING state

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListChangeSets.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListChangeSets", []))

    @jsii.member(jsii_name="toListExports")
    def to_list_exports(self) -> "Cloudformation":
        '''(experimental) Grants permission to list all exported output values in the account and region in which you call this action.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListExports.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListExports", []))

    @jsii.member(jsii_name="toListImports")
    def to_list_imports(self) -> "Cloudformation":
        '''(experimental) Grants permission to list all stacks that are importing an exported output value.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListImports.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListImports", []))

    @jsii.member(jsii_name="toListStackInstances")
    def to_list_stack_instances(self) -> "Cloudformation":
        '''(experimental) Grants permission to return summary information about stack instances that are associated with the specified stack set.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListStackSets.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListStackInstances", []))

    @jsii.member(jsii_name="toListStackResources")
    def to_list_stack_resources(self) -> "Cloudformation":
        '''(experimental) Grants permission to return descriptions of all resources of the specified stack.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListStackResources.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListStackResources", []))

    @jsii.member(jsii_name="toListStacks")
    def to_list_stacks(self) -> "Cloudformation":
        '''(experimental) Grants permission to return the summary information for stacks whose status matches the specified StackStatusFilter.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListStacks.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListStacks", []))

    @jsii.member(jsii_name="toListStackSetOperationResults")
    def to_list_stack_set_operation_results(self) -> "Cloudformation":
        '''(experimental) Grants permission to return summary information about the results of a stack set operation.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListStackSetOperationResults.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListStackSetOperationResults", []))

    @jsii.member(jsii_name="toListStackSetOperations")
    def to_list_stack_set_operations(self) -> "Cloudformation":
        '''(experimental) Grants permission to return summary information about operations performed on a stack set.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListStackSetOperations.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListStackSetOperations", []))

    @jsii.member(jsii_name="toListStackSets")
    def to_list_stack_sets(self) -> "Cloudformation":
        '''(experimental) Grants permission to return summary information about stack sets that are associated with the user.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListStackSets.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListStackSets", []))

    @jsii.member(jsii_name="toListTypeRegistrations")
    def to_list_type_registrations(self) -> "Cloudformation":
        '''(experimental) Grants permission to list CloudFormation type registration attempts.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListTypeRegistrations.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListTypeRegistrations", []))

    @jsii.member(jsii_name="toListTypes")
    def to_list_types(self) -> "Cloudformation":
        '''(experimental) Grants permission to list available CloudFormation types.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListTypes.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListTypes", []))

    @jsii.member(jsii_name="toListTypeVersions")
    def to_list_type_versions(self) -> "Cloudformation":
        '''(experimental) Grants permission to list versions of a particular CloudFormation type.

        Access Level: List

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListTypeVersions.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toListTypeVersions", []))

    @jsii.member(jsii_name="toPublishType")
    def to_publish_type(self) -> "Cloudformation":
        '''(experimental) Grants permission to publish the specified extension to the CloudFormation registry as a public extension in this region.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_PublishType.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toPublishType", []))

    @jsii.member(jsii_name="toRecordHandlerProgress")
    def to_record_handler_progress(self) -> "Cloudformation":
        '''(experimental) Grants permission to record the handler progress.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_RecordHandlerProgress.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toRecordHandlerProgress", []))

    @jsii.member(jsii_name="toRegisterPublisher")
    def to_register_publisher(self) -> "Cloudformation":
        '''(experimental) Grants permission to register account as a publisher of public extensions in the CloudFormation registry.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_RegisterPublisher.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toRegisterPublisher", []))

    @jsii.member(jsii_name="toRegisterType")
    def to_register_type(self) -> "Cloudformation":
        '''(experimental) Grants permission to register a new CloudFormation type.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_RegisterType.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toRegisterType", []))

    @jsii.member(jsii_name="toRollbackStack")
    def to_rollback_stack(self) -> "Cloudformation":
        '''(experimental) Grants permission to rollback the stack to the last stable state.

        Access Level: Write

        Possible conditions:

        - .ifRoleArn()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_RollbackStack.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toRollbackStack", []))

    @jsii.member(jsii_name="toSetStackPolicy")
    def to_set_stack_policy(self) -> "Cloudformation":
        '''(experimental) Grants permission to set a stack policy for a specified stack.

        Access Level: Permissions management

        Possible conditions:

        - .ifStackPolicyUrl()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_SetStackPolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toSetStackPolicy", []))

    @jsii.member(jsii_name="toSetTypeConfiguration")
    def to_set_type_configuration(self) -> "Cloudformation":
        '''(experimental) Grants permission to set the configuration data for a registered CloudFormation extension, in the given account and region.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_SetTypeConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toSetTypeConfiguration", []))

    @jsii.member(jsii_name="toSetTypeDefaultVersion")
    def to_set_type_default_version(self) -> "Cloudformation":
        '''(experimental) Grants permission to set which version of a CloudFormation type applies to CloudFormation operations.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_SetTypeDefaultVersion.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toSetTypeDefaultVersion", []))

    @jsii.member(jsii_name="toSignalResource")
    def to_signal_resource(self) -> "Cloudformation":
        '''(experimental) Grants permission to send a signal to the specified resource with a success or failure status.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_SignalResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toSignalResource", []))

    @jsii.member(jsii_name="toStopStackSetOperation")
    def to_stop_stack_set_operation(self) -> "Cloudformation":
        '''(experimental) Grants permission to stop an in-progress operation on a stack set and its associated stack instances.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_StopStackSetOperation.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toStopStackSetOperation", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Cloudformation":
        '''(experimental) Grants permission to tag cloudformation resources.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestType")
    def to_test_type(self) -> "Cloudformation":
        '''(experimental) Grants permission to test a registered extension to make sure it meets all necessary requirements for being published in the CloudFormation registry.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_TestType.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toTestType", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Cloudformation":
        '''(experimental) Grants permission to untag cloudformation resources.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateStack")
    def to_update_stack(self) -> "Cloudformation":
        '''(experimental) Grants permission to update a stack as specified in the template.

        Access Level: Write

        Possible conditions:

        - .ifResourceTypes()
        - .ifRoleArn()
        - .ifStackPolicyUrl()
        - .ifTemplateUrl()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_UpdateStack.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toUpdateStack", []))

    @jsii.member(jsii_name="toUpdateStackInstances")
    def to_update_stack_instances(self) -> "Cloudformation":
        '''(experimental) Grants permission to update the parameter values for stack instances for the specified accounts, within the specified regions.

        Access Level: Write

        Possible conditions:

        - .ifTargetRegion()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_UpdateStackInstances.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toUpdateStackInstances", []))

    @jsii.member(jsii_name="toUpdateStackSet")
    def to_update_stack_set(self) -> "Cloudformation":
        '''(experimental) Grants permission to update a stackset as specified in the template.

        Access Level: Write

        Possible conditions:

        - .ifRoleArn()
        - .ifTemplateUrl()
        - .ifTargetRegion()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_UpdateStackSet.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toUpdateStackSet", []))

    @jsii.member(jsii_name="toUpdateTerminationProtection")
    def to_update_termination_protection(self) -> "Cloudformation":
        '''(experimental) Grants permission to update termination protection for the specified stack.

        Access Level: Write

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_UpdateTerminationProtection.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toUpdateTerminationProtection", []))

    @jsii.member(jsii_name="toValidateTemplate")
    def to_validate_template(self) -> "Cloudformation":
        '''(experimental) Grants permission to validate a specified template.

        Access Level: Read

        https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ValidateTemplate.html

        :stability: experimental
        '''
        return typing.cast("Cloudformation", jsii.invoke(self, "toValidateTemplate", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2bfc4e539cdb89284b732b548fdcc40510997e1ad433cd2809fe67e296369cbb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7a6eac315f9fd895fe73b4b5bad99453f686877c831719c4afd90783a424c8a5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Cloudfront(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Cloudfront",
):
    '''(experimental) Statement provider for service `cloudfront <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudfront.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cloudfront <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudfront.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__284c20a3ff5b8c63e99af030c65f7af19486bd32c4e2036e4f2cda837d7b427a)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onCachePolicy")
    def on_cache_policy(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudfront":
        '''(experimental) Adds a resource of type cache-policy to the statement.

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/working-with-policies.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9db6d4cc792ddb7adce535bebe82bae67b62f64d1790b40879a8a34007c0a680)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudfront", jsii.invoke(self, "onCachePolicy", [id, account, partition]))

    @jsii.member(jsii_name="onContinuousDeploymentPolicy")
    def on_continuous_deployment_policy(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudfront":
        '''(experimental) Adds a resource of type continuous-deployment-policy to the statement.

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/working-with-policies.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8cc07955dc8c66e5d42e37e70c0c7eeccd9e9fba2f141b7aac32bc9664fe48e2)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudfront", jsii.invoke(self, "onContinuousDeploymentPolicy", [id, account, partition]))

    @jsii.member(jsii_name="onDistribution")
    def on_distribution(
        self,
        distribution_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudfront":
        '''(experimental) Adds a resource of type distribution to the statement.

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html

        :param distribution_id: - Identifier for the distributionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__032baf43dd267b86d9f9d0df81a9ac2d60e29bbe72821fd880ebcd6c8e4c5912)
            check_type(argname="argument distribution_id", value=distribution_id, expected_type=type_hints["distribution_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudfront", jsii.invoke(self, "onDistribution", [distribution_id, account, partition]))

    @jsii.member(jsii_name="onFieldLevelEncryptionConfig")
    def on_field_level_encryption_config(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudfront":
        '''(experimental) Adds a resource of type field-level-encryption-config to the statement.

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fe695ad991af0cc392869d518c18074d8561181a2d86e231005b6010102441e3)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudfront", jsii.invoke(self, "onFieldLevelEncryptionConfig", [id, account, partition]))

    @jsii.member(jsii_name="onFieldLevelEncryptionProfile")
    def on_field_level_encryption_profile(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudfront":
        '''(experimental) Adds a resource of type field-level-encryption-profile to the statement.

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/field-level-encryption.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__882c48b1de790e253c0751fb332b18aabdf7c36a2e7d3a36a024accc4ad0bbc0)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudfront", jsii.invoke(self, "onFieldLevelEncryptionProfile", [id, account, partition]))

    @jsii.member(jsii_name="onFunction")
    def on_function(
        self,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudfront":
        '''(experimental) Adds a resource of type function to the statement.

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-functions.html

        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b58bc8f890347bdd151d02ffd9cc03d3c0c1273b03f97b48c9d9bf4e38237f34)
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudfront", jsii.invoke(self, "onFunction", [name, account, partition]))

    @jsii.member(jsii_name="onOriginAccessControl")
    def on_origin_access_control(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudfront":
        '''(experimental) Adds a resource of type origin-access-control to the statement.

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/working-with-policies.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__10da0d616757e8c67387bb73ab04a0d909c553eb16372633e23bc48bd9513b4f)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudfront", jsii.invoke(self, "onOriginAccessControl", [id, account, partition]))

    @jsii.member(jsii_name="onOriginAccessIdentity")
    def on_origin_access_identity(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudfront":
        '''(experimental) Adds a resource of type origin-access-identity to the statement.

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html#private-content-restricting-access-to-s3-overview

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cc58ee31d8c91527ea7c0564c0f83e24c1338ad3aff452e06563f18cb746c72a)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudfront", jsii.invoke(self, "onOriginAccessIdentity", [id, account, partition]))

    @jsii.member(jsii_name="onOriginRequestPolicy")
    def on_origin_request_policy(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudfront":
        '''(experimental) Adds a resource of type origin-request-policy to the statement.

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/working-with-policies.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__04a34233d9b80d3f8395ce325c9140dfccbd6c109ee248e9cd3ec10dae059379)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudfront", jsii.invoke(self, "onOriginRequestPolicy", [id, account, partition]))

    @jsii.member(jsii_name="onRealtimeLogConfig")
    def on_realtime_log_config(
        self,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudfront":
        '''(experimental) Adds a resource of type realtime-log-config to the statement.

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/real-time-logs.html

        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5a09f38031a6e31db6004f63641e36c119cbacda04feecadcd81473ac0a12e66)
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudfront", jsii.invoke(self, "onRealtimeLogConfig", [name, account, partition]))

    @jsii.member(jsii_name="onResponseHeadersPolicy")
    def on_response_headers_policy(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudfront":
        '''(experimental) Adds a resource of type response-headers-policy to the statement.

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/working-with-policies.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__42c392ab2e5d1740fc3544f272afdc1e169f915bd9dae8dee27d0cb2fdafd631)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudfront", jsii.invoke(self, "onResponseHeadersPolicy", [id, account, partition]))

    @jsii.member(jsii_name="onStreamingDistribution")
    def on_streaming_distribution(
        self,
        distribution_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudfront":
        '''(experimental) Adds a resource of type streaming-distribution to the statement.

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html

        :param distribution_id: - Identifier for the distributionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9ee1ffc63f929156764ef520269d50280ec8509b3f5e6a4ce5690ec8b944f14a)
            check_type(argname="argument distribution_id", value=distribution_id, expected_type=type_hints["distribution_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudfront", jsii.invoke(self, "onStreamingDistribution", [distribution_id, account, partition]))

    @jsii.member(jsii_name="toAssociateAlias")
    def to_associate_alias(self) -> "Cloudfront":
        '''(experimental) Grants permission to associate an alias to a CloudFront distribution.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_AssociateAlias.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toAssociateAlias", []))

    @jsii.member(jsii_name="toCopyDistribution")
    def to_copy_distribution(self) -> "Cloudfront":
        '''(experimental) Grants permission to copy an existing distribution and create a new web distribution.

        Access Level: Write

        Dependent actions:

        - cloudfront:CreateDistribution
        - cloudfront:GetDistribution

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CopyDistribution.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCopyDistribution", []))

    @jsii.member(jsii_name="toCreateCachePolicy")
    def to_create_cache_policy(self) -> "Cloudfront":
        '''(experimental) Grants permission to add a new cache policy to CloudFront.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateCachePolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateCachePolicy", []))

    @jsii.member(jsii_name="toCreateCloudFrontOriginAccessIdentity")
    def to_create_cloud_front_origin_access_identity(self) -> "Cloudfront":
        '''(experimental) Grants permission to create a new CloudFront origin access identity.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateCloudFrontOriginAccessIdentity.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateCloudFrontOriginAccessIdentity", []))

    @jsii.member(jsii_name="toCreateContinuousDeploymentPolicy")
    def to_create_continuous_deployment_policy(self) -> "Cloudfront":
        '''(experimental) Grants permission to add a new continuous-deployment policy to CloudFront.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateContinuousDeploymentPolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateContinuousDeploymentPolicy", []))

    @jsii.member(jsii_name="toCreateDistribution")
    def to_create_distribution(self) -> "Cloudfront":
        '''(experimental) Grants permission to create a new web distribution.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateDistribution.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateDistribution", []))

    @jsii.member(jsii_name="toCreateFieldLevelEncryptionConfig")
    def to_create_field_level_encryption_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to create a new field-level encryption configuration.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateFieldLevelEncryptionConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateFieldLevelEncryptionConfig", []))

    @jsii.member(jsii_name="toCreateFieldLevelEncryptionProfile")
    def to_create_field_level_encryption_profile(self) -> "Cloudfront":
        '''(experimental) Grants permission to create a field-level encryption profile.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateFieldLevelEncryptionProfile.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateFieldLevelEncryptionProfile", []))

    @jsii.member(jsii_name="toCreateFunction")
    def to_create_function(self) -> "Cloudfront":
        '''(experimental) Grants permission to create a CloudFront function.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateFunction.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateFunction", []))

    @jsii.member(jsii_name="toCreateInvalidation")
    def to_create_invalidation(self) -> "Cloudfront":
        '''(experimental) Grants permission to create a new invalidation batch request.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateInvalidation.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateInvalidation", []))

    @jsii.member(jsii_name="toCreateKeyGroup")
    def to_create_key_group(self) -> "Cloudfront":
        '''(experimental) Grants permission to add a new key group to CloudFront.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateKeyGroup.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateKeyGroup", []))

    @jsii.member(jsii_name="toCreateMonitoringSubscription")
    def to_create_monitoring_subscription(self) -> "Cloudfront":
        '''(experimental) Grants permission to enable additional CloudWatch metrics for the specified CloudFront distribution. The additional metrics incur an additional cost.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateMonitoringSubscription.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateMonitoringSubscription", []))

    @jsii.member(jsii_name="toCreateOriginAccessControl")
    def to_create_origin_access_control(self) -> "Cloudfront":
        '''(experimental) Grants permission to create a new origin access control.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateOriginAccessControl.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateOriginAccessControl", []))

    @jsii.member(jsii_name="toCreateOriginRequestPolicy")
    def to_create_origin_request_policy(self) -> "Cloudfront":
        '''(experimental) Grants permission to add a new origin request policy to CloudFront.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateOriginRequestPolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateOriginRequestPolicy", []))

    @jsii.member(jsii_name="toCreatePublicKey")
    def to_create_public_key(self) -> "Cloudfront":
        '''(experimental) Grants permission to add a new public key to CloudFront.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreatePublicKey.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreatePublicKey", []))

    @jsii.member(jsii_name="toCreateRealtimeLogConfig")
    def to_create_realtime_log_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to create a real-time log configuration.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateRealtimeLogConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateRealtimeLogConfig", []))

    @jsii.member(jsii_name="toCreateResponseHeadersPolicy")
    def to_create_response_headers_policy(self) -> "Cloudfront":
        '''(experimental) Grants permission to add a new response headers policy to CloudFront.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateResponseHeadersPolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateResponseHeadersPolicy", []))

    @jsii.member(jsii_name="toCreateSavingsPlan")
    def to_create_savings_plan(self) -> "Cloudfront":
        '''(experimental) Grants permission to create a new savings plan.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cf-api-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateSavingsPlan", []))

    @jsii.member(jsii_name="toCreateStreamingDistribution")
    def to_create_streaming_distribution(self) -> "Cloudfront":
        '''(experimental) Grants permission to create a new RTMP distribution.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateStreamingDistribution.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateStreamingDistribution", []))

    @jsii.member(jsii_name="toCreateStreamingDistributionWithTags")
    def to_create_streaming_distribution_with_tags(self) -> "Cloudfront":
        '''(experimental) Grants permission to create a new RTMP distribution with tags.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_CreateStreamingDistributionWithTags.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toCreateStreamingDistributionWithTags", []))

    @jsii.member(jsii_name="toDeleteCachePolicy")
    def to_delete_cache_policy(self) -> "Cloudfront":
        '''(experimental) Grants permission to delete a cache policy.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteCachePolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteCachePolicy", []))

    @jsii.member(jsii_name="toDeleteCloudFrontOriginAccessIdentity")
    def to_delete_cloud_front_origin_access_identity(self) -> "Cloudfront":
        '''(experimental) Grants permission to delete a CloudFront origin access identity.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteCloudFrontOriginAccessIdentity.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteCloudFrontOriginAccessIdentity", []))

    @jsii.member(jsii_name="toDeleteContinuousDeploymentPolicy")
    def to_delete_continuous_deployment_policy(self) -> "Cloudfront":
        '''(experimental) Grants permission to delete a continuous-deployment policy.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteContinuousDeploymentPolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteContinuousDeploymentPolicy", []))

    @jsii.member(jsii_name="toDeleteDistribution")
    def to_delete_distribution(self) -> "Cloudfront":
        '''(experimental) Grants permission to delete a web distribution.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteDistribution.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteDistribution", []))

    @jsii.member(jsii_name="toDeleteFieldLevelEncryptionConfig")
    def to_delete_field_level_encryption_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to delete a field-level encryption configuration.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteFieldLevelEncryptionConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteFieldLevelEncryptionConfig", []))

    @jsii.member(jsii_name="toDeleteFieldLevelEncryptionProfile")
    def to_delete_field_level_encryption_profile(self) -> "Cloudfront":
        '''(experimental) Grants permission to delete a field-level encryption profile.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteFieldLevelEncryptionProfile.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteFieldLevelEncryptionProfile", []))

    @jsii.member(jsii_name="toDeleteFunction")
    def to_delete_function(self) -> "Cloudfront":
        '''(experimental) Grants permission to delete a CloudFront function.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteFunction.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteFunction", []))

    @jsii.member(jsii_name="toDeleteKeyGroup")
    def to_delete_key_group(self) -> "Cloudfront":
        '''(experimental) Grants permission to delete a key group.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteKeyGroup.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteKeyGroup", []))

    @jsii.member(jsii_name="toDeleteMonitoringSubscription")
    def to_delete_monitoring_subscription(self) -> "Cloudfront":
        '''(experimental) Grants permission to disable additional CloudWatch metrics for the specified CloudFront distribution.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteMonitoringSubscription.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteMonitoringSubscription", []))

    @jsii.member(jsii_name="toDeleteOriginAccessControl")
    def to_delete_origin_access_control(self) -> "Cloudfront":
        '''(experimental) Grants permission to delete an origin access control.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteOriginAccessControl.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteOriginAccessControl", []))

    @jsii.member(jsii_name="toDeleteOriginRequestPolicy")
    def to_delete_origin_request_policy(self) -> "Cloudfront":
        '''(experimental) Grants permission to delete an origin request policy.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteOriginRequestPolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteOriginRequestPolicy", []))

    @jsii.member(jsii_name="toDeletePublicKey")
    def to_delete_public_key(self) -> "Cloudfront":
        '''(experimental) Grants permission to delete a public key from CloudFront.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeletePublicKey.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeletePublicKey", []))

    @jsii.member(jsii_name="toDeleteRealtimeLogConfig")
    def to_delete_realtime_log_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to delete a real-time log configuration.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteRealtimeLogConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteRealtimeLogConfig", []))

    @jsii.member(jsii_name="toDeleteResponseHeadersPolicy")
    def to_delete_response_headers_policy(self) -> "Cloudfront":
        '''(experimental) Grants permission to delete a response headers policy.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteResponseHeadersPolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteResponseHeadersPolicy", []))

    @jsii.member(jsii_name="toDeleteStreamingDistribution")
    def to_delete_streaming_distribution(self) -> "Cloudfront":
        '''(experimental) Grants permission to delete an RTMP distribution.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DeleteStreamingDistribution.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDeleteStreamingDistribution", []))

    @jsii.member(jsii_name="toDescribeFunction")
    def to_describe_function(self) -> "Cloudfront":
        '''(experimental) Grants permission to get a CloudFront function summary.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DescribeFunction.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toDescribeFunction", []))

    @jsii.member(jsii_name="toGetCachePolicy")
    def to_get_cache_policy(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the cache policy.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetCachePolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetCachePolicy", []))

    @jsii.member(jsii_name="toGetCachePolicyConfig")
    def to_get_cache_policy_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the cache policy configuration.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetCachePolicyConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetCachePolicyConfig", []))

    @jsii.member(jsii_name="toGetCloudFrontOriginAccessIdentity")
    def to_get_cloud_front_origin_access_identity(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the information about a CloudFront origin access identity.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetCloudFrontOriginAccessIdentity.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetCloudFrontOriginAccessIdentity", []))

    @jsii.member(jsii_name="toGetCloudFrontOriginAccessIdentityConfig")
    def to_get_cloud_front_origin_access_identity_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the configuration information about a Cloudfront origin access identity.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetCloudFrontOriginAccessIdentityConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetCloudFrontOriginAccessIdentityConfig", []))

    @jsii.member(jsii_name="toGetContinuousDeploymentPolicy")
    def to_get_continuous_deployment_policy(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the continuous-deployment policy.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetContinuousDeploymentPolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetContinuousDeploymentPolicy", []))

    @jsii.member(jsii_name="toGetContinuousDeploymentPolicyConfig")
    def to_get_continuous_deployment_policy_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the continuous-deployment policy configuration.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetContinuousDeploymentPolicyConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetContinuousDeploymentPolicyConfig", []))

    @jsii.member(jsii_name="toGetDistribution")
    def to_get_distribution(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the information about a web distribution.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetDistribution.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetDistribution", []))

    @jsii.member(jsii_name="toGetDistributionConfig")
    def to_get_distribution_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the configuration information about a distribution.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetDistributionConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetDistributionConfig", []))

    @jsii.member(jsii_name="toGetFieldLevelEncryption")
    def to_get_field_level_encryption(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the field-level encryption configuration information.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetFieldLevelEncryption.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetFieldLevelEncryption", []))

    @jsii.member(jsii_name="toGetFieldLevelEncryptionConfig")
    def to_get_field_level_encryption_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the field-level encryption configuration information.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetFieldLevelEncryptionConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetFieldLevelEncryptionConfig", []))

    @jsii.member(jsii_name="toGetFieldLevelEncryptionProfile")
    def to_get_field_level_encryption_profile(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the field-level encryption configuration information.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetFieldLevelEncryptionProfile.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetFieldLevelEncryptionProfile", []))

    @jsii.member(jsii_name="toGetFieldLevelEncryptionProfileConfig")
    def to_get_field_level_encryption_profile_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the field-level encryption profile configuration information.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetFieldLevelEncryptionProfileConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetFieldLevelEncryptionProfileConfig", []))

    @jsii.member(jsii_name="toGetFunction")
    def to_get_function(self) -> "Cloudfront":
        '''(experimental) Grants permission to get a CloudFront function's code.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetFunction.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetFunction", []))

    @jsii.member(jsii_name="toGetInvalidation")
    def to_get_invalidation(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the information about an invalidation.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetInvalidation.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetInvalidation", []))

    @jsii.member(jsii_name="toGetKeyGroup")
    def to_get_key_group(self) -> "Cloudfront":
        '''(experimental) Grants permission to get a key group.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetKeyGroup.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetKeyGroup", []))

    @jsii.member(jsii_name="toGetKeyGroupConfig")
    def to_get_key_group_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to get a key group configuration.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetKeyGroupConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetKeyGroupConfig", []))

    @jsii.member(jsii_name="toGetMonitoringSubscription")
    def to_get_monitoring_subscription(self) -> "Cloudfront":
        '''(experimental) Grants permission to get information about whether additional CloudWatch metrics are enabled for the specified CloudFront distribution.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetMonitoringSubscription.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetMonitoringSubscription", []))

    @jsii.member(jsii_name="toGetOriginAccessControl")
    def to_get_origin_access_control(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the origin access control.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetOriginAccessControl.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetOriginAccessControl", []))

    @jsii.member(jsii_name="toGetOriginAccessControlConfig")
    def to_get_origin_access_control_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the origin access control configuration.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetOriginAccessControlConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetOriginAccessControlConfig", []))

    @jsii.member(jsii_name="toGetOriginRequestPolicy")
    def to_get_origin_request_policy(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the origin request policy.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetOriginRequestPolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetOriginRequestPolicy", []))

    @jsii.member(jsii_name="toGetOriginRequestPolicyConfig")
    def to_get_origin_request_policy_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the origin request policy configuration.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetOriginRequestPolicyConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetOriginRequestPolicyConfig", []))

    @jsii.member(jsii_name="toGetPublicKey")
    def to_get_public_key(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the public key information.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetPublicKey.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetPublicKey", []))

    @jsii.member(jsii_name="toGetPublicKeyConfig")
    def to_get_public_key_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the public key configuration information.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetPublicKeyConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetPublicKeyConfig", []))

    @jsii.member(jsii_name="toGetRealtimeLogConfig")
    def to_get_realtime_log_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to get a real-time log configuration.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetRealtimeLogConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetRealtimeLogConfig", []))

    @jsii.member(jsii_name="toGetResponseHeadersPolicy")
    def to_get_response_headers_policy(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the response headers policy.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetResponseHeadersPolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetResponseHeadersPolicy", []))

    @jsii.member(jsii_name="toGetResponseHeadersPolicyConfig")
    def to_get_response_headers_policy_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the response headers policy configuration.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetResponseHeadersPolicyConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetResponseHeadersPolicyConfig", []))

    @jsii.member(jsii_name="toGetSavingsPlan")
    def to_get_savings_plan(self) -> "Cloudfront":
        '''(experimental) Grants permission to get a savings plan.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cf-api-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetSavingsPlan", []))

    @jsii.member(jsii_name="toGetStreamingDistribution")
    def to_get_streaming_distribution(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the information about an RTMP distribution.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetStreamingDistribution.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetStreamingDistribution", []))

    @jsii.member(jsii_name="toGetStreamingDistributionConfig")
    def to_get_streaming_distribution_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to get the configuration information about a streaming distribution.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetStreamingDistributionConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toGetStreamingDistributionConfig", []))

    @jsii.member(jsii_name="toListCachePolicies")
    def to_list_cache_policies(self) -> "Cloudfront":
        '''(experimental) Grants permission to list all cache policies that have been created in CloudFront for this account.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListCachePolicies.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListCachePolicies", []))

    @jsii.member(jsii_name="toListCloudFrontOriginAccessIdentities")
    def to_list_cloud_front_origin_access_identities(self) -> "Cloudfront":
        '''(experimental) Grants permission to list your CloudFront origin access identities.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListCloudFrontOriginAccessIdentities.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListCloudFrontOriginAccessIdentities", []))

    @jsii.member(jsii_name="toListConflictingAliases")
    def to_list_conflicting_aliases(self) -> "Cloudfront":
        '''(experimental) Grants permission to list all aliases that conflict with the given alias in CloudFront.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListConflictingAliases.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListConflictingAliases", []))

    @jsii.member(jsii_name="toListContinuousDeploymentPolicies")
    def to_list_continuous_deployment_policies(self) -> "Cloudfront":
        '''(experimental) Grants permission to list all continuous-deployment policies in the account.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListContinuousDeploymentPolicies.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListContinuousDeploymentPolicies", []))

    @jsii.member(jsii_name="toListDistributions")
    def to_list_distributions(self) -> "Cloudfront":
        '''(experimental) Grants permission to list the distributions associated with your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListDistributions.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListDistributions", []))

    @jsii.member(jsii_name="toListDistributionsByCachePolicyId")
    def to_list_distributions_by_cache_policy_id(self) -> "Cloudfront":
        '''(experimental) Grants permission to list distribution IDs for distributions that have a cache behavior that's associated with the specified cache policy.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListDistributionsByCachePolicyId.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListDistributionsByCachePolicyId", []))

    @jsii.member(jsii_name="toListDistributionsByKeyGroup")
    def to_list_distributions_by_key_group(self) -> "Cloudfront":
        '''(experimental) Grants permission to list distribution IDs for distributions that have a cache behavior that's associated with the specified key group.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListDistributionsByKeyGroup.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListDistributionsByKeyGroup", []))

    @jsii.member(jsii_name="toListDistributionsByLambdaFunction")
    def to_list_distributions_by_lambda_function(self) -> "Cloudfront":
        '''(experimental) Grants permission to list the distributions associated a Lambda function.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cf-api-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListDistributionsByLambdaFunction", []))

    @jsii.member(jsii_name="toListDistributionsByOriginRequestPolicyId")
    def to_list_distributions_by_origin_request_policy_id(self) -> "Cloudfront":
        '''(experimental) Grants permission to list distribution IDs for distributions that have a cache behavior that's associated with the specified origin request policy.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListDistributionsByOriginRequestPolicyId.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListDistributionsByOriginRequestPolicyId", []))

    @jsii.member(jsii_name="toListDistributionsByRealtimeLogConfig")
    def to_list_distributions_by_realtime_log_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to get a list of distributions that have a cache behavior that’s associated with the specified real-time log configuration.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListDistributionsByRealtimeLogConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListDistributionsByRealtimeLogConfig", []))

    @jsii.member(jsii_name="toListDistributionsByResponseHeadersPolicyId")
    def to_list_distributions_by_response_headers_policy_id(self) -> "Cloudfront":
        '''(experimental) Grants permission to list distribution IDs for distributions that have a cache behavior that's associated with the specified response headers policy.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListDistributionsByResponseHeadersPolicyId.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListDistributionsByResponseHeadersPolicyId", []))

    @jsii.member(jsii_name="toListDistributionsByWebACLId")
    def to_list_distributions_by_web_acl_id(self) -> "Cloudfront":
        '''(experimental) Grants permission to list the distributions associated with your AWS account with given AWS WAF web ACL.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListDistributionsByWebACLId.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListDistributionsByWebACLId", []))

    @jsii.member(jsii_name="toListFieldLevelEncryptionConfigs")
    def to_list_field_level_encryption_configs(self) -> "Cloudfront":
        '''(experimental) Grants permission to list all field-level encryption configurations that have been created in CloudFront for this account.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListFieldLevelEncryptionConfigs.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListFieldLevelEncryptionConfigs", []))

    @jsii.member(jsii_name="toListFieldLevelEncryptionProfiles")
    def to_list_field_level_encryption_profiles(self) -> "Cloudfront":
        '''(experimental) Grants permission to list all field-level encryption profiles that have been created in CloudFront for this account.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListFieldLevelEncryptionProfiles.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListFieldLevelEncryptionProfiles", []))

    @jsii.member(jsii_name="toListFunctions")
    def to_list_functions(self) -> "Cloudfront":
        '''(experimental) Grants permission to get a list of CloudFront functions.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListFunctions.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListFunctions", []))

    @jsii.member(jsii_name="toListInvalidations")
    def to_list_invalidations(self) -> "Cloudfront":
        '''(experimental) Grants permission to list your invalidation batches.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListInvalidations.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListInvalidations", []))

    @jsii.member(jsii_name="toListKeyGroups")
    def to_list_key_groups(self) -> "Cloudfront":
        '''(experimental) Grants permission to list all key groups that have been created in CloudFront for this account.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListKeyGroups.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListKeyGroups", []))

    @jsii.member(jsii_name="toListOriginAccessControls")
    def to_list_origin_access_controls(self) -> "Cloudfront":
        '''(experimental) Grants permission to list all origin access controls in the account.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListOriginAccessControls.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListOriginAccessControls", []))

    @jsii.member(jsii_name="toListOriginRequestPolicies")
    def to_list_origin_request_policies(self) -> "Cloudfront":
        '''(experimental) Grants permission to list all origin request policies that have been created in CloudFront for this account.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListOriginRequestPolicies.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListOriginRequestPolicies", []))

    @jsii.member(jsii_name="toListPublicKeys")
    def to_list_public_keys(self) -> "Cloudfront":
        '''(experimental) Grants permission to list all public keys that have been added to CloudFront for this account.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListPublicKeys.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListPublicKeys", []))

    @jsii.member(jsii_name="toListRateCards")
    def to_list_rate_cards(self) -> "Cloudfront":
        '''(experimental) Grants permission to list CloudFront rate cards for the account.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cf-api-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListRateCards", []))

    @jsii.member(jsii_name="toListRealtimeLogConfigs")
    def to_list_realtime_log_configs(self) -> "Cloudfront":
        '''(experimental) Grants permission to get a list of real-time log configurations.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListRealtimeLogConfigs.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListRealtimeLogConfigs", []))

    @jsii.member(jsii_name="toListResponseHeadersPolicies")
    def to_list_response_headers_policies(self) -> "Cloudfront":
        '''(experimental) Grants permission to list all response headers policies that have been created in CloudFront for this account.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListResponseHeadersPolicies.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListResponseHeadersPolicies", []))

    @jsii.member(jsii_name="toListSavingsPlans")
    def to_list_savings_plans(self) -> "Cloudfront":
        '''(experimental) Grants permission to list savings plans in the account.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cf-api-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListSavingsPlans", []))

    @jsii.member(jsii_name="toListStreamingDistributions")
    def to_list_streaming_distributions(self) -> "Cloudfront":
        '''(experimental) Grants permission to list your RTMP distributions.

        Access Level: List

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListStreamingDistributions.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListStreamingDistributions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Cloudfront":
        '''(experimental) Grants permission to list tags for a CloudFront resource.

        Access Level: Read

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListUsages")
    def to_list_usages(self) -> "Cloudfront":
        '''(experimental) Grants permission to list CloudFront usage.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cf-api-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toListUsages", []))

    @jsii.member(jsii_name="toPublishFunction")
    def to_publish_function(self) -> "Cloudfront":
        '''(experimental) Grants permission to publish a CloudFront function.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_PublishFunction.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toPublishFunction", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Cloudfront":
        '''(experimental) Grants permission to add tags to a CloudFront resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestFunction")
    def to_test_function(self) -> "Cloudfront":
        '''(experimental) Grants permission to test a CloudFront function.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_TestFunction.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toTestFunction", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Cloudfront":
        '''(experimental) Grants permission to remove tags from a CloudFront resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateCachePolicy")
    def to_update_cache_policy(self) -> "Cloudfront":
        '''(experimental) Grants permission to update a cache policy.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateCachePolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateCachePolicy", []))

    @jsii.member(jsii_name="toUpdateCloudFrontOriginAccessIdentity")
    def to_update_cloud_front_origin_access_identity(self) -> "Cloudfront":
        '''(experimental) Grants permission to set the configuration for a CloudFront origin access identity.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateCloudFrontOriginAccessIdentity.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateCloudFrontOriginAccessIdentity", []))

    @jsii.member(jsii_name="toUpdateContinuousDeploymentPolicy")
    def to_update_continuous_deployment_policy(self) -> "Cloudfront":
        '''(experimental) Grants permission to update a continuous-deployment policy.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateContinuousDeploymentPolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateContinuousDeploymentPolicy", []))

    @jsii.member(jsii_name="toUpdateDistribution")
    def to_update_distribution(self) -> "Cloudfront":
        '''(experimental) Grants permission to update the configuration for a web distribution.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateDistribution.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateDistribution", []))

    @jsii.member(jsii_name="toUpdateDistributionWithStagingConfig")
    def to_update_distribution_with_staging_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to copy the staging distribution's configuration to its corresponding primary distribution.

        Access Level: Write

        Dependent actions:

        - cloudfront:GetDistribution
        - cloudfront:UpdateDistribution

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateDistributionWithStagingConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateDistributionWithStagingConfig", []))

    @jsii.member(jsii_name="toUpdateFieldLevelEncryptionConfig")
    def to_update_field_level_encryption_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to update a field-level encryption configuration.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateFieldLevelEncryptionConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateFieldLevelEncryptionConfig", []))

    @jsii.member(jsii_name="toUpdateFieldLevelEncryptionProfile")
    def to_update_field_level_encryption_profile(self) -> "Cloudfront":
        '''(experimental) Grants permission to update a field-level encryption profile.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateFieldLevelEncryptionProfile.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateFieldLevelEncryptionProfile", []))

    @jsii.member(jsii_name="toUpdateFunction")
    def to_update_function(self) -> "Cloudfront":
        '''(experimental) Grants permission to update a CloudFront function.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateFunction.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateFunction", []))

    @jsii.member(jsii_name="toUpdateKeyGroup")
    def to_update_key_group(self) -> "Cloudfront":
        '''(experimental) Grants permission to update a key group.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateKeyGroup.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateKeyGroup", []))

    @jsii.member(jsii_name="toUpdateOriginAccessControl")
    def to_update_origin_access_control(self) -> "Cloudfront":
        '''(experimental) Grants permission to update an origin access control.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateOriginAccessControl.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateOriginAccessControl", []))

    @jsii.member(jsii_name="toUpdateOriginRequestPolicy")
    def to_update_origin_request_policy(self) -> "Cloudfront":
        '''(experimental) Grants permission to update an origin request policy.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateOriginRequestPolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateOriginRequestPolicy", []))

    @jsii.member(jsii_name="toUpdatePublicKey")
    def to_update_public_key(self) -> "Cloudfront":
        '''(experimental) Grants permission to update public key information.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdatePublicKey.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdatePublicKey", []))

    @jsii.member(jsii_name="toUpdateRealtimeLogConfig")
    def to_update_realtime_log_config(self) -> "Cloudfront":
        '''(experimental) Grants permission to update a real-time log configuration.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateRealtimeLogConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateRealtimeLogConfig", []))

    @jsii.member(jsii_name="toUpdateResponseHeadersPolicy")
    def to_update_response_headers_policy(self) -> "Cloudfront":
        '''(experimental) Grants permission to update a response headers policy.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateResponseHeadersPolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateResponseHeadersPolicy", []))

    @jsii.member(jsii_name="toUpdateSavingsPlan")
    def to_update_savings_plan(self) -> "Cloudfront":
        '''(experimental) Grants permission to update a savings plan.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cf-api-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateSavingsPlan", []))

    @jsii.member(jsii_name="toUpdateStreamingDistribution")
    def to_update_streaming_distribution(self) -> "Cloudfront":
        '''(experimental) Grants permission to update the configuration for an RTMP distribution.

        Access Level: Write

        https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_UpdateStreamingDistribution.html

        :stability: experimental
        '''
        return typing.cast("Cloudfront", jsii.invoke(self, "toUpdateStreamingDistribution", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1549bcb70304660e4423237b06ae74e1b1bb9a4505b9accf1d0a4e33442be9be)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__819d06565119d1eef50329d633e8b52adc698e975d92e620e5343e523dda7f20)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Cloudhsm(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Cloudhsm",
):
    '''(experimental) Statement provider for service `cloudhsm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudhsm.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cloudhsm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudhsm.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c618325844edfcfca00d3df06d89ead301aa030fcdcc282e8183635a41874670)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onBackup")
    def on_backup(
        self,
        cloud_hsm_backup_instance_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudhsm":
        '''(experimental) Adds a resource of type backup to the statement.

        https://docs.aws.amazon.com/cloudhsm/latest/userguide/backups.html

        :param cloud_hsm_backup_instance_name: - Identifier for the cloudHsmBackupInstanceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cb9dbb292421b1ede29ea434b63c699233cf201f006985106a76edbdd10bd0b0)
            check_type(argname="argument cloud_hsm_backup_instance_name", value=cloud_hsm_backup_instance_name, expected_type=type_hints["cloud_hsm_backup_instance_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudhsm", jsii.invoke(self, "onBackup", [cloud_hsm_backup_instance_name, account, region, partition]))

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        cloud_hsm_cluster_instance_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudhsm":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/cloudhsm/latest/userguide/clusters.html

        :param cloud_hsm_cluster_instance_name: - Identifier for the cloudHsmClusterInstanceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7d005b7c766ec74132ba9ebfa655765282b6ab3f7bca5b14da360b3351ce75b9)
            check_type(argname="argument cloud_hsm_cluster_instance_name", value=cloud_hsm_cluster_instance_name, expected_type=type_hints["cloud_hsm_cluster_instance_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudhsm", jsii.invoke(self, "onCluster", [cloud_hsm_cluster_instance_name, account, region, partition]))

    @jsii.member(jsii_name="toAddTagsToResource")
    def to_add_tags_to_resource(self) -> "Cloudhsm":
        '''(experimental) Adds or overwrites one or more tags for the specified AWS CloudHSM resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_AddTagsToResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toAddTagsToResource", []))

    @jsii.member(jsii_name="toCopyBackupToRegion")
    def to_copy_backup_to_region(self) -> "Cloudhsm":
        '''(experimental) Creates a copy of a backup in the specified region.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_CopyBackupToRegion.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toCopyBackupToRegion", []))

    @jsii.member(jsii_name="toCreateCluster")
    def to_create_cluster(self) -> "Cloudhsm":
        '''(experimental) Creates a new AWS CloudHSM cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_CreateCluster.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toCreateCluster", []))

    @jsii.member(jsii_name="toCreateHapg")
    def to_create_hapg(self) -> "Cloudhsm":
        '''(experimental) Creates a high-availability partition group.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_CreateHapg.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toCreateHapg", []))

    @jsii.member(jsii_name="toCreateHsm")
    def to_create_hsm(self) -> "Cloudhsm":
        '''(experimental) Creates a new hardware security module (HSM) in the specified AWS CloudHSM cluster.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_CreateHsm.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toCreateHsm", []))

    @jsii.member(jsii_name="toCreateLunaClient")
    def to_create_luna_client(self) -> "Cloudhsm":
        '''(experimental) Creates an HSM client.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_CreateLunaClient.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toCreateLunaClient", []))

    @jsii.member(jsii_name="toDeleteBackup")
    def to_delete_backup(self) -> "Cloudhsm":
        '''(experimental) Deletes the specified CloudHSM backup.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DeleteBackup.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toDeleteBackup", []))

    @jsii.member(jsii_name="toDeleteCluster")
    def to_delete_cluster(self) -> "Cloudhsm":
        '''(experimental) Deletes the specified AWS CloudHSM cluster.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DeleteCluster.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toDeleteCluster", []))

    @jsii.member(jsii_name="toDeleteHapg")
    def to_delete_hapg(self) -> "Cloudhsm":
        '''(experimental) Deletes a high-availability partition group.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_DeleteHapg.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toDeleteHapg", []))

    @jsii.member(jsii_name="toDeleteHsm")
    def to_delete_hsm(self) -> "Cloudhsm":
        '''(experimental) Deletes the specified HSM.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DeleteHsm.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toDeleteHsm", []))

    @jsii.member(jsii_name="toDeleteLunaClient")
    def to_delete_luna_client(self) -> "Cloudhsm":
        '''(experimental) Deletes a client.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_DeleteLunaClient.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toDeleteLunaClient", []))

    @jsii.member(jsii_name="toDescribeBackups")
    def to_describe_backups(self) -> "Cloudhsm":
        '''(experimental) Gets information about backups of AWS CloudHSM clusters.

        Access Level: Read

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeBackups.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toDescribeBackups", []))

    @jsii.member(jsii_name="toDescribeClusters")
    def to_describe_clusters(self) -> "Cloudhsm":
        '''(experimental) Gets information about AWS CloudHSM clusters.

        Access Level: Read

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_DescribeClusters.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toDescribeClusters", []))

    @jsii.member(jsii_name="toDescribeHapg")
    def to_describe_hapg(self) -> "Cloudhsm":
        '''(experimental) Retrieves information about a high-availability partition group.

        Access Level: Read

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_DescribeHapg.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toDescribeHapg", []))

    @jsii.member(jsii_name="toDescribeHsm")
    def to_describe_hsm(self) -> "Cloudhsm":
        '''(experimental) Retrieves information about an HSM. You can identify the HSM by its ARN or its serial number.

        Access Level: Read

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_DescribeHsm.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toDescribeHsm", []))

    @jsii.member(jsii_name="toDescribeLunaClient")
    def to_describe_luna_client(self) -> "Cloudhsm":
        '''(experimental) Retrieves information about an HSM client.

        Access Level: Read

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_DescribeLunaClient.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toDescribeLunaClient", []))

    @jsii.member(jsii_name="toGetConfig")
    def to_get_config(self) -> "Cloudhsm":
        '''(experimental) Gets the configuration files necessary to connect to all high availability partition groups the client is associated with.

        Access Level: Read

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_GetConfig.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toGetConfig", []))

    @jsii.member(jsii_name="toInitializeCluster")
    def to_initialize_cluster(self) -> "Cloudhsm":
        '''(experimental) Claims an AWS CloudHSM cluster.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_InitializeCluster.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toInitializeCluster", []))

    @jsii.member(jsii_name="toListAvailableZones")
    def to_list_available_zones(self) -> "Cloudhsm":
        '''(experimental) Lists the Availability Zones that have available AWS CloudHSM capacity.

        Access Level: List

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_ListAvailableZones.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toListAvailableZones", []))

    @jsii.member(jsii_name="toListHapgs")
    def to_list_hapgs(self) -> "Cloudhsm":
        '''(experimental) Lists the high-availability partition groups for the account.

        Access Level: List

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_ListHapgs.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toListHapgs", []))

    @jsii.member(jsii_name="toListHsms")
    def to_list_hsms(self) -> "Cloudhsm":
        '''(experimental) Retrieves the identifiers of all of the HSMs provisioned for the current customer.

        Access Level: List

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_ListHsms.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toListHsms", []))

    @jsii.member(jsii_name="toListLunaClients")
    def to_list_luna_clients(self) -> "Cloudhsm":
        '''(experimental) Lists all of the clients.

        Access Level: List

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_ListLunaClients.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toListLunaClients", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Cloudhsm":
        '''(experimental) Gets a list of tags for the specified AWS CloudHSM cluster.

        Access Level: Read

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_ListTags.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Cloudhsm":
        '''(experimental) Returns a list of all tags for the specified AWS CloudHSM resource.

        Access Level: Read

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toModifyBackupAttributes")
    def to_modify_backup_attributes(self) -> "Cloudhsm":
        '''(experimental) Modifies attributes for AWS CloudHSM backup.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_ModifyBackupAttributes.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toModifyBackupAttributes", []))

    @jsii.member(jsii_name="toModifyCluster")
    def to_modify_cluster(self) -> "Cloudhsm":
        '''(experimental) Modifies AWS CloudHSM cluster.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_ModifyCluster.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toModifyCluster", []))

    @jsii.member(jsii_name="toModifyHapg")
    def to_modify_hapg(self) -> "Cloudhsm":
        '''(experimental) Modifies an existing high-availability partition group.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_ModifyHapg.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toModifyHapg", []))

    @jsii.member(jsii_name="toModifyHsm")
    def to_modify_hsm(self) -> "Cloudhsm":
        '''(experimental) Modifies an HSM.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_ModifyHsm.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toModifyHsm", []))

    @jsii.member(jsii_name="toModifyLunaClient")
    def to_modify_luna_client(self) -> "Cloudhsm":
        '''(experimental) Modifies the certificate used by the client.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_ModifyLunaClient.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toModifyLunaClient", []))

    @jsii.member(jsii_name="toRemoveTagsFromResource")
    def to_remove_tags_from_resource(self) -> "Cloudhsm":
        '''(experimental) Removes one or more tags from the specified AWS CloudHSM resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/cloudhsm/classic/APIReference/API_RemoveTagsFromResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toRemoveTagsFromResource", []))

    @jsii.member(jsii_name="toRestoreBackup")
    def to_restore_backup(self) -> "Cloudhsm":
        '''(experimental) Restores the specified CloudHSM backup.

        Access Level: Write

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_RestoreBackup.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toRestoreBackup", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Cloudhsm":
        '''(experimental) Adds or overwrites one or more tags for the specified AWS CloudHSM cluster.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Cloudhsm":
        '''(experimental) Removes the specified tag or tags from the specified AWS CloudHSM cluster.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudhsm/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudhsm", jsii.invoke(self, "toUntagResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1510cc6f96fc5f6d838591c94168c91f0b3ec239710b3afb69b8224977bb4124)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b708bd8aab1c0f79e6f82351fe6361ae73cb14111f459fa3a9d9a3eeb503c283)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Cloudsearch(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Cloudsearch",
):
    '''(experimental) Statement provider for service `cloudsearch <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudsearch.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cloudsearch <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudsearch.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3aaf97bb8837069758e8d5c58f625d2cfb8e46a6bda834ccd920d1f97a893ca2)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDomain")
    def on_domain(
        self,
        domain_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudsearch":
        '''(experimental) Adds a resource of type domain to the statement.

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/creating-domains.html

        :param domain_name: - Identifier for the domainName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6db74c930bc263498a0df36bfc36c3d8a374c37afc0d98facf05d37115fc128a)
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudsearch", jsii.invoke(self, "onDomain", [domain_name, account, region, partition]))

    @jsii.member(jsii_name="toAddTags")
    def to_add_tags(self) -> "Cloudsearch":
        '''(experimental) Attaches resource tags to an Amazon CloudSearch domain.

        Access Level: Tagging

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_AddTags.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toAddTags", []))

    @jsii.member(jsii_name="toBuildSuggesters")
    def to_build_suggesters(self) -> "Cloudsearch":
        '''(experimental) Indexes the search suggestions.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_BuildSuggesters.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toBuildSuggesters", []))

    @jsii.member(jsii_name="toCreateDomain")
    def to_create_domain(self) -> "Cloudsearch":
        '''(experimental) Creates a new search domain.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_CreateDomain.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toCreateDomain", []))

    @jsii.member(jsii_name="toDefineAnalysisScheme")
    def to_define_analysis_scheme(self) -> "Cloudsearch":
        '''(experimental) Configures an analysis scheme that can be applied to a text or text-array field to define language-specific text processing options.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DefineAnalysisScheme.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDefineAnalysisScheme", []))

    @jsii.member(jsii_name="toDefineExpression")
    def to_define_expression(self) -> "Cloudsearch":
        '''(experimental) Configures an Expression for the search domain.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DefineExpression.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDefineExpression", []))

    @jsii.member(jsii_name="toDefineIndexField")
    def to_define_index_field(self) -> "Cloudsearch":
        '''(experimental) Configures an IndexField for the search domain.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DefineIndexField.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDefineIndexField", []))

    @jsii.member(jsii_name="toDefineSuggester")
    def to_define_suggester(self) -> "Cloudsearch":
        '''(experimental) Configures a suggester for a domain.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DefineSuggester.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDefineSuggester", []))

    @jsii.member(jsii_name="toDeleteAnalysisScheme")
    def to_delete_analysis_scheme(self) -> "Cloudsearch":
        '''(experimental) Deletes an analysis scheme.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DeleteAnalysisScheme.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDeleteAnalysisScheme", []))

    @jsii.member(jsii_name="toDeleteDomain")
    def to_delete_domain(self) -> "Cloudsearch":
        '''(experimental) Permanently deletes a search domain and all of its data.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DeleteDomain.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDeleteDomain", []))

    @jsii.member(jsii_name="toDeleteExpression")
    def to_delete_expression(self) -> "Cloudsearch":
        '''(experimental) Removes an Expression from the search domain.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DeleteExpression.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDeleteExpression", []))

    @jsii.member(jsii_name="toDeleteIndexField")
    def to_delete_index_field(self) -> "Cloudsearch":
        '''(experimental) Removes an IndexField from the search domain.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DeleteIndexField.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDeleteIndexField", []))

    @jsii.member(jsii_name="toDeleteSuggester")
    def to_delete_suggester(self) -> "Cloudsearch":
        '''(experimental) Deletes a suggester.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DeleteSuggester.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDeleteSuggester", []))

    @jsii.member(jsii_name="toDescribeAnalysisSchemes")
    def to_describe_analysis_schemes(self) -> "Cloudsearch":
        '''(experimental) Gets the analysis schemes configured for a domain.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DescribeAnalysisSchemes.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDescribeAnalysisSchemes", []))

    @jsii.member(jsii_name="toDescribeAvailabilityOptions")
    def to_describe_availability_options(self) -> "Cloudsearch":
        '''(experimental) Gets the availability options configured for a domain.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DescribeAvailabilityOptions.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDescribeAvailabilityOptions", []))

    @jsii.member(jsii_name="toDescribeDomainEndpointOptions")
    def to_describe_domain_endpoint_options(self) -> "Cloudsearch":
        '''(experimental) Gets the domain endpoint options configured for a domain.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DescribeDomainEndpointOptions.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDescribeDomainEndpointOptions", []))

    @jsii.member(jsii_name="toDescribeDomains")
    def to_describe_domains(self) -> "Cloudsearch":
        '''(experimental) Gets information about the search domains owned by this account.

        Access Level: List

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DescribeDomains.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDescribeDomains", []))

    @jsii.member(jsii_name="toDescribeExpressions")
    def to_describe_expressions(self) -> "Cloudsearch":
        '''(experimental) Gets the expressions configured for the search domain.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DescribeExpressions.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDescribeExpressions", []))

    @jsii.member(jsii_name="toDescribeIndexFields")
    def to_describe_index_fields(self) -> "Cloudsearch":
        '''(experimental) Gets information about the index fields configured for the search domain.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DescribeIndexFields.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDescribeIndexFields", []))

    @jsii.member(jsii_name="toDescribeScalingParameters")
    def to_describe_scaling_parameters(self) -> "Cloudsearch":
        '''(experimental) Gets the scaling parameters configured for a domain.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DescribeScalingParameters.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDescribeScalingParameters", []))

    @jsii.member(jsii_name="toDescribeServiceAccessPolicies")
    def to_describe_service_access_policies(self) -> "Cloudsearch":
        '''(experimental) Gets information about the access policies that control access to the domain's document and search endpoints.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DescribeServiceAccessPolicies.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDescribeServiceAccessPolicies", []))

    @jsii.member(jsii_name="toDescribeSuggesters")
    def to_describe_suggesters(self) -> "Cloudsearch":
        '''(experimental) Gets the suggesters configured for a domain.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_DescribeSuggesters.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDescribeSuggesters", []))

    @jsii.member(jsii_name="toDocument")
    def to_document(self) -> "Cloudsearch":
        '''(experimental) Allows access to the document service operations.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/configuring-access.html#cloudsearch-actions

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toDocument", []))

    @jsii.member(jsii_name="toIndexDocuments")
    def to_index_documents(self) -> "Cloudsearch":
        '''(experimental) Tells the search domain to start indexing its documents using the latest indexing options.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_IndexDocuments.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toIndexDocuments", []))

    @jsii.member(jsii_name="toListDomainNames")
    def to_list_domain_names(self) -> "Cloudsearch":
        '''(experimental) Lists all search domains owned by an account.

        Access Level: List

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_ListDomainNames.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toListDomainNames", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Cloudsearch":
        '''(experimental) Displays all of the resource tags for an Amazon CloudSearch domain.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_ListTags.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toRemoveTags")
    def to_remove_tags(self) -> "Cloudsearch":
        '''(experimental) Removes the specified resource tags from an Amazon ES domain.

        Access Level: Tagging

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_RemoveTags.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toRemoveTags", []))

    @jsii.member(jsii_name="toSearch")
    def to_search(self) -> "Cloudsearch":
        '''(experimental) Allows access to the search operations.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/configuring-access.html#cloudsearch-actions

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toSearch", []))

    @jsii.member(jsii_name="toSuggest")
    def to_suggest(self) -> "Cloudsearch":
        '''(experimental) Allows access to the suggest operations.

        Access Level: Read

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/configuring-access.html#cloudsearch-actions

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toSuggest", []))

    @jsii.member(jsii_name="toUpdateAvailabilityOptions")
    def to_update_availability_options(self) -> "Cloudsearch":
        '''(experimental) Configures the availability options for a domain.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_UpdateAvailabilityOptions.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toUpdateAvailabilityOptions", []))

    @jsii.member(jsii_name="toUpdateDomainEndpointOptions")
    def to_update_domain_endpoint_options(self) -> "Cloudsearch":
        '''(experimental) Configures the domain endpoint options for a domain.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_UpdateDomainEndpointOptions.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toUpdateDomainEndpointOptions", []))

    @jsii.member(jsii_name="toUpdateScalingParameters")
    def to_update_scaling_parameters(self) -> "Cloudsearch":
        '''(experimental) Configures scaling parameters for a domain.

        Access Level: Write

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_UpdateScalingParameters.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toUpdateScalingParameters", []))

    @jsii.member(jsii_name="toUpdateServiceAccessPolicies")
    def to_update_service_access_policies(self) -> "Cloudsearch":
        '''(experimental) Configures the access rules that control access to the domain's document and search endpoints.

        Access Level: Permissions management

        https://docs.aws.amazon.com/cloudsearch/latest/developerguide/API_UpdateServiceAccessPolicies.html

        :stability: experimental
        '''
        return typing.cast("Cloudsearch", jsii.invoke(self, "toUpdateServiceAccessPolicies", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1be4cd245bd9ef109b08d4b483edc93ea2fc5317c14e098905e4cab714229425)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0a9aff3eca1fda0d4b8acd5440e118f45c36cdaed84111ce7fc809eee945a8c8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Cloudshell(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Cloudshell",
):
    '''(experimental) Statement provider for service `cloudshell <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudshell.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cloudshell <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudshell.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1a401be43645b82aa761c27ee65cad379ea2fe36915635579c5f3dd5e5bac63c)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onEnvironment")
    def on_environment(
        self,
        environment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudshell":
        '''(experimental) Adds a resource of type Environment to the statement.

        https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html#Environment

        :param environment_id: - Identifier for the environmentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__06e61fe1b7997b20bc7b20966f69b79aa36238a730df00ec0e3ed39621826927)
            check_type(argname="argument environment_id", value=environment_id, expected_type=type_hints["environment_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudshell", jsii.invoke(self, "onEnvironment", [environment_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateEnvironment")
    def to_create_environment(self) -> "Cloudshell":
        '''(experimental) Grants permissions to create a CloudShell environment.

        Access Level: Write

        https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html#CreateEnvironment

        :stability: experimental
        '''
        return typing.cast("Cloudshell", jsii.invoke(self, "toCreateEnvironment", []))

    @jsii.member(jsii_name="toCreateSession")
    def to_create_session(self) -> "Cloudshell":
        '''(experimental) Grants permissions to connect to a CloudShell environment from the AWS Management Console.

        Access Level: Write

        https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html#CreateSession

        :stability: experimental
        '''
        return typing.cast("Cloudshell", jsii.invoke(self, "toCreateSession", []))

    @jsii.member(jsii_name="toDeleteEnvironment")
    def to_delete_environment(self) -> "Cloudshell":
        '''(experimental) Grants permission to delete a CloudShell environment.

        Access Level: Write

        https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html#DeleteEnvironment

        :stability: experimental
        '''
        return typing.cast("Cloudshell", jsii.invoke(self, "toDeleteEnvironment", []))

    @jsii.member(jsii_name="toGetEnvironmentStatus")
    def to_get_environment_status(self) -> "Cloudshell":
        '''(experimental) Grants permission to read a CloudShell environment status.

        Access Level: Read

        https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html#GetEnvironmentStatus

        :stability: experimental
        '''
        return typing.cast("Cloudshell", jsii.invoke(self, "toGetEnvironmentStatus", []))

    @jsii.member(jsii_name="toGetFileDownloadUrls")
    def to_get_file_download_urls(self) -> "Cloudshell":
        '''(experimental) Grants permissions to download files from a CloudShell environment.

        Access Level: Write

        https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html#GetFileDownloadUrls

        :stability: experimental
        '''
        return typing.cast("Cloudshell", jsii.invoke(self, "toGetFileDownloadUrls", []))

    @jsii.member(jsii_name="toGetFileUploadUrls")
    def to_get_file_upload_urls(self) -> "Cloudshell":
        '''(experimental) Grants permissions to upload files to a CloudShell environment.

        Access Level: Write

        https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html#GetFileUploadUrls

        :stability: experimental
        '''
        return typing.cast("Cloudshell", jsii.invoke(self, "toGetFileUploadUrls", []))

    @jsii.member(jsii_name="toPutCredentials")
    def to_put_credentials(self) -> "Cloudshell":
        '''(experimental) Grants permissions to forward console credentials to the environment.

        Access Level: Write

        https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html#PutCredentials

        :stability: experimental
        '''
        return typing.cast("Cloudshell", jsii.invoke(self, "toPutCredentials", []))

    @jsii.member(jsii_name="toStartEnvironment")
    def to_start_environment(self) -> "Cloudshell":
        '''(experimental) Grants permission to start a stopped CloudShell environment.

        Access Level: Write

        https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html#StartEnvironment

        :stability: experimental
        '''
        return typing.cast("Cloudshell", jsii.invoke(self, "toStartEnvironment", []))

    @jsii.member(jsii_name="toStopEnvironment")
    def to_stop_environment(self) -> "Cloudshell":
        '''(experimental) Grants permission to stop a running CloudShell environment.

        Access Level: Write

        https://docs.aws.amazon.com/cloudshell/latest/userguide/sec-auth-with-identities.html#StopEnvironment

        :stability: experimental
        '''
        return typing.cast("Cloudshell", jsii.invoke(self, "toStopEnvironment", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__60e12a77bc5ae7d92f37b0092ec678197f89d616e1fe4517ea08f3af75952629)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9b1229bcf480fbfd238363d0c34e5ad683da2693577c7675c39655280f4f5da0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Cloudtrail(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Cloudtrail",
):
    '''(experimental) Statement provider for service `cloudtrail <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudtrail.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cloudtrail <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudtrail.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6adc3fe3fe96ef1de4fb7d10f08b66ae31a3682b01de28940dff7add48da10f7)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onChannel")
    def on_channel(
        self,
        channel_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudtrail":
        '''(experimental) Adds a resource of type channel to the statement.

        https://docs.aws.amazon.com/awscloudtrail/latest/userguide/how-cloudtrail-works.html#how-cloudtrail-works-channels

        :param channel_id: - Identifier for the channelId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d0f9d85097790bc043e691665bd6460ea0e9581ecd684c1388b671270f661e0a)
            check_type(argname="argument channel_id", value=channel_id, expected_type=type_hints["channel_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudtrail", jsii.invoke(self, "onChannel", [channel_id, account, region, partition]))

    @jsii.member(jsii_name="onEventdatastore")
    def on_eventdatastore(
        self,
        event_data_store_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudtrail":
        '''(experimental) Adds a resource of type eventdatastore to the statement.

        https://docs.aws.amazon.com/awscloudtrail/latest/userguide/how-cloudtrail-works.html#how-cloudtrail-works-lake

        :param event_data_store_id: - Identifier for the eventDataStoreId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7378630105bbaf29bf0ae4d2fe8993da469acd339fd00f172e8336a146fa5bfe)
            check_type(argname="argument event_data_store_id", value=event_data_store_id, expected_type=type_hints["event_data_store_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudtrail", jsii.invoke(self, "onEventdatastore", [event_data_store_id, account, region, partition]))

    @jsii.member(jsii_name="onTrail")
    def on_trail(
        self,
        trail_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudtrail":
        '''(experimental) Adds a resource of type trail to the statement.

        https://docs.aws.amazon.com/awscloudtrail/latest/userguide/how-cloudtrail-works.html#how-cloudtrail-works-trails

        :param trail_name: - Identifier for the trailName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e1bd325c0918b17901837459530824758daf15e218a92f5340e065de3bc8eaf7)
            check_type(argname="argument trail_name", value=trail_name, expected_type=type_hints["trail_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudtrail", jsii.invoke(self, "onTrail", [trail_name, account, region, partition]))

    @jsii.member(jsii_name="toAddTags")
    def to_add_tags(self) -> "Cloudtrail":
        '''(experimental) Grants permission to add one or more tags to a trail, event data store, or channel, up to a limit of 50.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AddTags.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toAddTags", []))

    @jsii.member(jsii_name="toCancelQuery")
    def to_cancel_query(self) -> "Cloudtrail":
        '''(experimental) Grants permission to cancel a running query.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_CancelQuery.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toCancelQuery", []))

    @jsii.member(jsii_name="toCreateChannel")
    def to_create_channel(self) -> "Cloudtrail":
        '''(experimental) Grants permission to create a channel.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - cloudtrail:AddTags

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_CreateChannel.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toCreateChannel", []))

    @jsii.member(jsii_name="toCreateEventDataStore")
    def to_create_event_data_store(self) -> "Cloudtrail":
        '''(experimental) Grants permission to create an event data store.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - cloudtrail:AddTags
        - iam:CreateServiceLinkedRole
        - iam:GetRole
        - kms:Decrypt
        - kms:GenerateDataKey
        - organizations:ListAWSServiceAccessForOrganization

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_CreateEventDataStore.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toCreateEventDataStore", []))

    @jsii.member(jsii_name="toCreateServiceLinkedChannel")
    def to_create_service_linked_channel(self) -> "Cloudtrail":
        '''(experimental) Grants permission to create a service-linked channel that specifies the settings for delivery of log data to an AWS service.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toCreateServiceLinkedChannel", []))

    @jsii.member(jsii_name="toCreateTrail")
    def to_create_trail(self) -> "Cloudtrail":
        '''(experimental) Grants permission to create a trail that specifies the settings for delivery of log data to an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - cloudtrail:AddTags
        - iam:CreateServiceLinkedRole
        - iam:GetRole
        - organizations:ListAWSServiceAccessForOrganization

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_CreateTrail.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toCreateTrail", []))

    @jsii.member(jsii_name="toDeleteChannel")
    def to_delete_channel(self) -> "Cloudtrail":
        '''(experimental) Grants permission to delete a channel.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DeleteChannel.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toDeleteChannel", []))

    @jsii.member(jsii_name="toDeleteEventDataStore")
    def to_delete_event_data_store(self) -> "Cloudtrail":
        '''(experimental) Grants permission to delete an event data store.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DeleteEventDataStore.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toDeleteEventDataStore", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "Cloudtrail":
        '''(experimental) Grants permission to delete a resource policy from the provided resource.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DeleteResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteServiceLinkedChannel")
    def to_delete_service_linked_channel(self) -> "Cloudtrail":
        '''(experimental) Grants permission to delete a service-linked channel.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toDeleteServiceLinkedChannel", []))

    @jsii.member(jsii_name="toDeleteTrail")
    def to_delete_trail(self) -> "Cloudtrail":
        '''(experimental) Grants permission to delete a trail.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DeleteTrail.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toDeleteTrail", []))

    @jsii.member(jsii_name="toDeregisterOrganizationDelegatedAdmin")
    def to_deregister_organization_delegated_admin(self) -> "Cloudtrail":
        '''(experimental) Grants permission to deregister an AWS Organizations member account as a delegated administrator.

        Access Level: Write

        Dependent actions:

        - organizations:DeregisterDelegatedAdministrator
        - organizations:ListAWSServiceAccessForOrganization

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DeregisterOrganizationDelegatedAdmin.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toDeregisterOrganizationDelegatedAdmin", []))

    @jsii.member(jsii_name="toDescribeQuery")
    def to_describe_query(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list details for the query.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DescribeQuery.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toDescribeQuery", []))

    @jsii.member(jsii_name="toDescribeTrails")
    def to_describe_trails(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list settings for the trails associated with the current region for your account.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DescribeTrails.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toDescribeTrails", []))

    @jsii.member(jsii_name="toGetChannel")
    def to_get_channel(self) -> "Cloudtrail":
        '''(experimental) Grants permission to return information about a specific channel.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_GetChannel.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toGetChannel", []))

    @jsii.member(jsii_name="toGetEventDataStore")
    def to_get_event_data_store(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list settings for the event data store.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_GetEventDataStore.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toGetEventDataStore", []))

    @jsii.member(jsii_name="toGetEventSelectors")
    def to_get_event_selectors(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list settings for event selectors configured for a trail.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_GetEventSelectors.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toGetEventSelectors", []))

    @jsii.member(jsii_name="toGetImport")
    def to_get_import(self) -> "Cloudtrail":
        '''(experimental) Grants permission to return information about a specific import.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_GetImport.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toGetImport", []))

    @jsii.member(jsii_name="toGetInsightSelectors")
    def to_get_insight_selectors(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list CloudTrail Insights selectors that are configured for a trail.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_GetInsightSelectors.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toGetInsightSelectors", []))

    @jsii.member(jsii_name="toGetQueryResults")
    def to_get_query_results(self) -> "Cloudtrail":
        '''(experimental) Grants permission to fetch results of a complete query.

        Access Level: Read

        Dependent actions:

        - kms:Decrypt
        - kms:GenerateDataKey

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_GetQueryResults.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toGetQueryResults", []))

    @jsii.member(jsii_name="toGetResourcePolicy")
    def to_get_resource_policy(self) -> "Cloudtrail":
        '''(experimental) Grants permission to get the resource policy attached to the provided resource.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_GetResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toGetResourcePolicy", []))

    @jsii.member(jsii_name="toGetServiceLinkedChannel")
    def to_get_service_linked_channel(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list settings for the service-linked channel.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toGetServiceLinkedChannel", []))

    @jsii.member(jsii_name="toGetTrail")
    def to_get_trail(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list settings for the trail.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_GetTrail.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toGetTrail", []))

    @jsii.member(jsii_name="toGetTrailStatus")
    def to_get_trail_status(self) -> "Cloudtrail":
        '''(experimental) Grants permission to retrieve a JSON-formatted list of information about the specified trail.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_GetTrailStatus.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toGetTrailStatus", []))

    @jsii.member(jsii_name="toListChannels")
    def to_list_channels(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list the channels in the current account, and their source names.

        Access Level: List

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_ListChannels.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toListChannels", []))

    @jsii.member(jsii_name="toListEventDataStores")
    def to_list_event_data_stores(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list event data stores associated with the current region for your account.

        Access Level: List

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_ListEventDataStores.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toListEventDataStores", []))

    @jsii.member(jsii_name="toListImportFailures")
    def to_list_import_failures(self) -> "Cloudtrail":
        '''(experimental) Grants permission to return a list of failures for the specified import.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_ListImportFailures.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toListImportFailures", []))

    @jsii.member(jsii_name="toListImports")
    def to_list_imports(self) -> "Cloudtrail":
        '''(experimental) Grants permission to return information on all imports, or a select set of imports by ImportStatus or Destination.

        Access Level: List

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_ListImports.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toListImports", []))

    @jsii.member(jsii_name="toListPublicKeys")
    def to_list_public_keys(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list the public keys whose private keys were used to sign trail digest files within a specified time range.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_ListPublicKeys.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toListPublicKeys", []))

    @jsii.member(jsii_name="toListQueries")
    def to_list_queries(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list queries associated with an event data store.

        Access Level: List

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_ListQueries.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toListQueries", []))

    @jsii.member(jsii_name="toListServiceLinkedChannels")
    def to_list_service_linked_channels(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list service-linked channels associated with the current region for a specified account.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toListServiceLinkedChannels", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list the tags for trails, event data stores, or channels in the current region.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_ListTags.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toListTrails")
    def to_list_trails(self) -> "Cloudtrail":
        '''(experimental) Grants permission to list trails associated with the current region for your account.

        Access Level: List

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_ListTrails.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toListTrails", []))

    @jsii.member(jsii_name="toLookupEvents")
    def to_lookup_events(self) -> "Cloudtrail":
        '''(experimental) Grants permission to look up API activity events captured by CloudTrail that create, update, or delete resources in your account.

        Access Level: Read

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_LookupEvents.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toLookupEvents", []))

    @jsii.member(jsii_name="toPutEventSelectors")
    def to_put_event_selectors(self) -> "Cloudtrail":
        '''(experimental) Grants permission to create and update event selectors for a trail.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_PutEventSelectors.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toPutEventSelectors", []))

    @jsii.member(jsii_name="toPutInsightSelectors")
    def to_put_insight_selectors(self) -> "Cloudtrail":
        '''(experimental) Grants permission to create and update CloudTrail Insights selectors for a trail.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_PutInsightSelectors.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toPutInsightSelectors", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "Cloudtrail":
        '''(experimental) Grants permission to attach a resource policy to the provided resource.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_PutResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toRegisterOrganizationDelegatedAdmin")
    def to_register_organization_delegated_admin(self) -> "Cloudtrail":
        '''(experimental) Grants permission to register an AWS Organizations member account as a delegated administrator.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - iam:GetRole
        - organizations:ListAWSServiceAccessForOrganization
        - organizations:RegisterDelegatedAdministrator

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_RegisterOrganizationDelegatedAdmin.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toRegisterOrganizationDelegatedAdmin", []))

    @jsii.member(jsii_name="toRemoveTags")
    def to_remove_tags(self) -> "Cloudtrail":
        '''(experimental) Grants permission to remove tags from a trail, event data store, or channel.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_RemoveTags.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toRemoveTags", []))

    @jsii.member(jsii_name="toRestoreEventDataStore")
    def to_restore_event_data_store(self) -> "Cloudtrail":
        '''(experimental) Grants permission to restore an event data store.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_RestoreEventDataStore.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toRestoreEventDataStore", []))

    @jsii.member(jsii_name="toStartImport")
    def to_start_import(self) -> "Cloudtrail":
        '''(experimental) Grants permission to start an import of logged trail events from a source S3 bucket to a destination event data store.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StartImport.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toStartImport", []))

    @jsii.member(jsii_name="toStartLogging")
    def to_start_logging(self) -> "Cloudtrail":
        '''(experimental) Grants permission to start the recording of AWS API calls and log file delivery for a trail.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StartLogging.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toStartLogging", []))

    @jsii.member(jsii_name="toStartQuery")
    def to_start_query(self) -> "Cloudtrail":
        '''(experimental) Grants permission to start a new query on a specified event data store.

        Access Level: Write

        Dependent actions:

        - kms:Decrypt
        - kms:GenerateDataKey

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StartQuery.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toStartQuery", []))

    @jsii.member(jsii_name="toStopImport")
    def to_stop_import(self) -> "Cloudtrail":
        '''(experimental) Grants permission to stop a specified import.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StopImport.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toStopImport", []))

    @jsii.member(jsii_name="toStopLogging")
    def to_stop_logging(self) -> "Cloudtrail":
        '''(experimental) Grants permission to stop the recording of AWS API calls and log file delivery for a trail.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StopLogging.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toStopLogging", []))

    @jsii.member(jsii_name="toUpdateChannel")
    def to_update_channel(self) -> "Cloudtrail":
        '''(experimental) Grants permission to update a channel.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_UpdateChannel.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toUpdateChannel", []))

    @jsii.member(jsii_name="toUpdateEventDataStore")
    def to_update_event_data_store(self) -> "Cloudtrail":
        '''(experimental) Grants permission to update an event data store.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - iam:GetRole
        - kms:Decrypt
        - kms:GenerateDataKey
        - organizations:ListAWSServiceAccessForOrganization

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_UpdateEventDataStore.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toUpdateEventDataStore", []))

    @jsii.member(jsii_name="toUpdateServiceLinkedChannel")
    def to_update_service_linked_channel(self) -> "Cloudtrail":
        '''(experimental) Grants permission to update the settings that specify delivery of log files.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toUpdateServiceLinkedChannel", []))

    @jsii.member(jsii_name="toUpdateTrail")
    def to_update_trail(self) -> "Cloudtrail":
        '''(experimental) Grants permission to update the settings that specify delivery of log files.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - iam:GetRole
        - organizations:ListAWSServiceAccessForOrganization

        https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_UpdateTrail.html

        :stability: experimental
        '''
        return typing.cast("Cloudtrail", jsii.invoke(self, "toUpdateTrail", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__aef4bb71b32ffb7d8e8bb177054308e078fd8492cd6483ea24c827e334fcf24b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__81e7aafd003377751fa0889b1f07680bb05aa7b7113332a9b1aa4498d316b058)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class CloudtrailData(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.CloudtrailData",
):
    '''(experimental) Statement provider for service `cloudtrail-data <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudtraildata.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cloudtrail-data <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudtraildata.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6d6e4f460e1a398f66a24bd5575959ed8ef3554704a24dc8af37c2b88db4aca3)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onChannel")
    def on_channel(
        self,
        channel_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CloudtrailData":
        '''(experimental) Adds a resource of type channel to the statement.

        https://docs.aws.amazon.com/awscloudtrail/latest/userguide/how-cloudtrail-works.html#how-cloudtrail-works-channels

        :param channel_id: - Identifier for the channelId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c1549d0732fda68480145bc72d0b4d96cd5c675e554304cb4f1ebfcabc3aa9e9)
            check_type(argname="argument channel_id", value=channel_id, expected_type=type_hints["channel_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("CloudtrailData", jsii.invoke(self, "onChannel", [channel_id, account, region, partition]))

    @jsii.member(jsii_name="toPutAuditEvents")
    def to_put_audit_events(self) -> "CloudtrailData":
        '''(experimental) Grants permission to ingest your application events into CloudTrail Lake.

        Access Level: Write

        https://docs.aws.amazon.com/awscloudtraildata/latest/APIReference/API_PutAuditEvents.html

        :stability: experimental
        '''
        return typing.cast("CloudtrailData", jsii.invoke(self, "toPutAuditEvents", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3185e90b098458d6536ec132c7c9e3a907458953b1ce2bd37c2dafe15b2cee97)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b75789dc662ab4e04dfb3e26ae28a10cc5c5f84760c514782fac51d63e60a1d4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Cloudwatch(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Cloudwatch",
):
    '''(experimental) Statement provider for service `cloudwatch <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatch.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cloudwatch <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatch.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__97c569f863eab5ff16c9e03cd232cad939f6831a528d0377d549965df7cbb798)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAlarmActions")
    def if_alarm_actions(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloudwatch":
        '''(experimental) Filters actions based on defined alarm actions.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/iam-cw-condition-keys-alarm-actions.html

        Applies to actions:

        - .toPutCompositeAlarm()
        - .toPutMetricAlarm()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3011eeb43915553a74d2e3117128425ceb108af80c68646019d7822c541b1dd3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Cloudwatch", jsii.invoke(self, "ifAlarmActions", [value, operator]))

    @jsii.member(jsii_name="ifNamespace")
    def if_namespace(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloudwatch":
        '''(experimental) Filters actions based on the presence of optional namespace values.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/iam-cw-condition-keys-namespace.html

        Applies to actions:

        - .toPutMetricData()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d493837bed52dcfe28f1559b68b09ee0122b33c684409450c9acf73ab940d105)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Cloudwatch", jsii.invoke(self, "ifNamespace", [value, operator]))

    @jsii.member(jsii_name="ifRequestInsightRuleLogGroups")
    def if_request_insight_rule_log_groups(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloudwatch":
        '''(experimental) Filters actions based on the Log Groups specified in an Insight Rule.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/iam-cw-condition-keys-contributor.html

        Applies to actions:

        - .toPutInsightRule()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8c52ffbb10a7670442bd00b801cfb9a3208207a1de1db870f2ba47417c4461eb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Cloudwatch", jsii.invoke(self, "ifRequestInsightRuleLogGroups", [value, operator]))

    @jsii.member(jsii_name="ifRequestManagedResourceARNs")
    def if_request_managed_resource_ar_ns(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Cloudwatch":
        '''(experimental) Filters access by the Resource ARNs specified in a managed Insight Rule.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/iam-cw-condition-keys-contributor.html

        Applies to actions:

        - .toListManagedInsightRules()
        - .toPutManagedInsightRules()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__986aded21503c397ec5d736cfcacf8a23b7d29ce6905f27e70dafb2b9091f30c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Cloudwatch", jsii.invoke(self, "ifRequestManagedResourceARNs", [value, operator]))

    @jsii.member(jsii_name="onAlarm")
    def on_alarm(
        self,
        alarm_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudwatch":
        '''(experimental) Adds a resource of type alarm to the statement.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/auth-and-access-control-cw.html

        :param alarm_name: - Identifier for the alarmName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a49a0ed65920d0d1fd569cf28183674a01f64ce83aff2ef965b7244ff60fd3cb)
            check_type(argname="argument alarm_name", value=alarm_name, expected_type=type_hints["alarm_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudwatch", jsii.invoke(self, "onAlarm", [alarm_name, account, region, partition]))

    @jsii.member(jsii_name="onDashboard")
    def on_dashboard(
        self,
        dashboard_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudwatch":
        '''(experimental) Adds a resource of type dashboard to the statement.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/auth-and-access-control-cw.html

        :param dashboard_name: - Identifier for the dashboardName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__72c9f11b0904d9c65a50854ca3af7c070b2cb7c68ec120031ada2af77ec2aa70)
            check_type(argname="argument dashboard_name", value=dashboard_name, expected_type=type_hints["dashboard_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudwatch", jsii.invoke(self, "onDashboard", [dashboard_name, account, partition]))

    @jsii.member(jsii_name="onInsightRule")
    def on_insight_rule(
        self,
        insight_rule_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudwatch":
        '''(experimental) Adds a resource of type insight-rule to the statement.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/auth-and-access-control-cw.html

        :param insight_rule_name: - Identifier for the insightRuleName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f41f613203e3a9d43a14c1dd898689f35bbb223511067b4c1b1cd3c811f07f28)
            check_type(argname="argument insight_rule_name", value=insight_rule_name, expected_type=type_hints["insight_rule_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudwatch", jsii.invoke(self, "onInsightRule", [insight_rule_name, account, region, partition]))

    @jsii.member(jsii_name="onMetricStream")
    def on_metric_stream(
        self,
        metric_stream_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cloudwatch":
        '''(experimental) Adds a resource of type metric-stream to the statement.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/auth-and-access-control-cw.html

        :param metric_stream_name: - Identifier for the metricStreamName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__244c6e840994d6073b8333bb116306a5394365e3d66bd8824b249fd2c6dff89f)
            check_type(argname="argument metric_stream_name", value=metric_stream_name, expected_type=type_hints["metric_stream_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cloudwatch", jsii.invoke(self, "onMetricStream", [metric_stream_name, account, region, partition]))

    @jsii.member(jsii_name="toDeleteAlarms")
    def to_delete_alarms(self) -> "Cloudwatch":
        '''(experimental) Grants permission to delete a collection of alarms.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DeleteAlarms.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDeleteAlarms", []))

    @jsii.member(jsii_name="toDeleteAnomalyDetector")
    def to_delete_anomaly_detector(self) -> "Cloudwatch":
        '''(experimental) Grants permission to delete the specified anomaly detection model from your account.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DeleteAnomalyDetector.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDeleteAnomalyDetector", []))

    @jsii.member(jsii_name="toDeleteDashboards")
    def to_delete_dashboards(self) -> "Cloudwatch":
        '''(experimental) Grants permission to delete all CloudWatch dashboards that you specify.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DeleteDashboards.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDeleteDashboards", []))

    @jsii.member(jsii_name="toDeleteInsightRules")
    def to_delete_insight_rules(self) -> "Cloudwatch":
        '''(experimental) Grants permission to delete a collection of insight rules.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DeleteInsightRules.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDeleteInsightRules", []))

    @jsii.member(jsii_name="toDeleteMetricStream")
    def to_delete_metric_stream(self) -> "Cloudwatch":
        '''(experimental) Grants permission to delete the CloudWatch metric stream that you specify.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DeleteMetricStream.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDeleteMetricStream", []))

    @jsii.member(jsii_name="toDescribeAlarmHistory")
    def to_describe_alarm_history(self) -> "Cloudwatch":
        '''(experimental) Grants permission to retrieve the history for the specified alarm.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DescribeAlarmHistory.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDescribeAlarmHistory", []))

    @jsii.member(jsii_name="toDescribeAlarms")
    def to_describe_alarms(self) -> "Cloudwatch":
        '''(experimental) Grants permission to describe all alarms, currently owned by the user's account.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DescribeAlarms.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDescribeAlarms", []))

    @jsii.member(jsii_name="toDescribeAlarmsForMetric")
    def to_describe_alarms_for_metric(self) -> "Cloudwatch":
        '''(experimental) Grants permission to describe all alarms configured on the specified metric, currently owned by the user's account.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DescribeAlarmsForMetric.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDescribeAlarmsForMetric", []))

    @jsii.member(jsii_name="toDescribeAnomalyDetectors")
    def to_describe_anomaly_detectors(self) -> "Cloudwatch":
        '''(experimental) Grants permission to list the anomaly detection models that you have created in your account.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DescribeAnomalyDetectors.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDescribeAnomalyDetectors", []))

    @jsii.member(jsii_name="toDescribeInsightRules")
    def to_describe_insight_rules(self) -> "Cloudwatch":
        '''(experimental) Grants permission to describe all insight rules, currently owned by the user's account.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DescribeInsightRules.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDescribeInsightRules", []))

    @jsii.member(jsii_name="toDisableAlarmActions")
    def to_disable_alarm_actions(self) -> "Cloudwatch":
        '''(experimental) Grants permission to disable actions for a collection of alarms.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DisableAlarmActions.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDisableAlarmActions", []))

    @jsii.member(jsii_name="toDisableInsightRules")
    def to_disable_insight_rules(self) -> "Cloudwatch":
        '''(experimental) Grants permission to disable a collection of insight rules.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DisableInsightRules.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toDisableInsightRules", []))

    @jsii.member(jsii_name="toEnableAlarmActions")
    def to_enable_alarm_actions(self) -> "Cloudwatch":
        '''(experimental) Grants permission to enable actions for a collection of alarms.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_EnableAlarmActions.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toEnableAlarmActions", []))

    @jsii.member(jsii_name="toEnableInsightRules")
    def to_enable_insight_rules(self) -> "Cloudwatch":
        '''(experimental) Grants permission to enable a collection of insight rules.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_EnableInsightRules.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toEnableInsightRules", []))

    @jsii.member(jsii_name="toGetDashboard")
    def to_get_dashboard(self) -> "Cloudwatch":
        '''(experimental) Grants permission to display the details of the CloudWatch dashboard you specify.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetDashboard.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toGetDashboard", []))

    @jsii.member(jsii_name="toGetInsightRuleReport")
    def to_get_insight_rule_report(self) -> "Cloudwatch":
        '''(experimental) Grants permission to return the top-N report of unique contributors over a time range for a given insight rule.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetInsightRuleReport.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toGetInsightRuleReport", []))

    @jsii.member(jsii_name="toGetMetricData")
    def to_get_metric_data(self) -> "Cloudwatch":
        '''(experimental) Grants permission to retrieve batch amounts of CloudWatch metric data and perform metric math on retrieved data.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricData.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toGetMetricData", []))

    @jsii.member(jsii_name="toGetMetricStatistics")
    def to_get_metric_statistics(self) -> "Cloudwatch":
        '''(experimental) Grants permission to retrieve statistics for the specified metric.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricStatistics.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toGetMetricStatistics", []))

    @jsii.member(jsii_name="toGetMetricStream")
    def to_get_metric_stream(self) -> "Cloudwatch":
        '''(experimental) Grants permission to return the details of a CloudWatch metric stream.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricStream.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toGetMetricStream", []))

    @jsii.member(jsii_name="toGetMetricWidgetImage")
    def to_get_metric_widget_image(self) -> "Cloudwatch":
        '''(experimental) Grants permission to retrieve snapshots of metric widgets.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricWidgetImage.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toGetMetricWidgetImage", []))

    @jsii.member(jsii_name="toLink")
    def to_link(self) -> "Cloudwatch":
        '''(experimental) Grants permission to share CloudWatch resources with a monitoring account.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Unified-Cross-Account-Setup.html#CloudWatch-Unified-Cross-Account-Setup-permissions

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toLink", []))

    @jsii.member(jsii_name="toListDashboards")
    def to_list_dashboards(self) -> "Cloudwatch":
        '''(experimental) Grants permission to return a list of all CloudWatch dashboards in your account.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListDashboards.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toListDashboards", []))

    @jsii.member(jsii_name="toListManagedInsightRules")
    def to_list_managed_insight_rules(self) -> "Cloudwatch":
        '''(experimental) Grants permission to list available managed Insight Rules for a given Resource ARN.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRequestManagedResourceARNs()

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListManagedInsightRules.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toListManagedInsightRules", []))

    @jsii.member(jsii_name="toListMetrics")
    def to_list_metrics(self) -> "Cloudwatch":
        '''(experimental) Grants permission to retrieve a list of valid metrics stored for the AWS account owner.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListMetrics.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toListMetrics", []))

    @jsii.member(jsii_name="toListMetricStreams")
    def to_list_metric_streams(self) -> "Cloudwatch":
        '''(experimental) Grants permission to return a list of all CloudWatch metric streams in your account.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListMetricStreams.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toListMetricStreams", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Cloudwatch":
        '''(experimental) Grants permission to list tags for an Amazon CloudWatch resource.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutAnomalyDetector")
    def to_put_anomaly_detector(self) -> "Cloudwatch":
        '''(experimental) Grants permission to create or update an anomaly detection model for a CloudWatch metric.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutAnomalyDetector.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toPutAnomalyDetector", []))

    @jsii.member(jsii_name="toPutCompositeAlarm")
    def to_put_composite_alarm(self) -> "Cloudwatch":
        '''(experimental) Grants permission to create or update a composite alarm.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAlarmActions()

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutCompositeAlarm.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toPutCompositeAlarm", []))

    @jsii.member(jsii_name="toPutDashboard")
    def to_put_dashboard(self) -> "Cloudwatch":
        '''(experimental) Grants permission to create a CloudWatch dashboard, or update an existing dashboard if it already exists.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutDashboard.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toPutDashboard", []))

    @jsii.member(jsii_name="toPutInsightRule")
    def to_put_insight_rule(self) -> "Cloudwatch":
        '''(experimental) Grants permission to create a new insight rule or replace an existing insight rule.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRequestInsightRuleLogGroups()

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutInsightRule.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toPutInsightRule", []))

    @jsii.member(jsii_name="toPutManagedInsightRules")
    def to_put_managed_insight_rules(self) -> "Cloudwatch":
        '''(experimental) Grants permission to create managed Insight Rules.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRequestManagedResourceARNs()

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutManagedInsightRules.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toPutManagedInsightRules", []))

    @jsii.member(jsii_name="toPutMetricAlarm")
    def to_put_metric_alarm(self) -> "Cloudwatch":
        '''(experimental) Grants permission to create or update an alarm and associates it with the specified Amazon CloudWatch metric.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAlarmActions()

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutMetricAlarm.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toPutMetricAlarm", []))

    @jsii.member(jsii_name="toPutMetricData")
    def to_put_metric_data(self) -> "Cloudwatch":
        '''(experimental) Grants permission to publish metric data points to Amazon CloudWatch.

        Access Level: Write

        Possible conditions:

        - .ifNamespace()

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutMetricData.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toPutMetricData", []))

    @jsii.member(jsii_name="toPutMetricStream")
    def to_put_metric_stream(self) -> "Cloudwatch":
        '''(experimental) Grants permission to create a CloudWatch metric stream, or update an existing metric stream if it already exists.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutMetricStream.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toPutMetricStream", []))

    @jsii.member(jsii_name="toSetAlarmState")
    def to_set_alarm_state(self) -> "Cloudwatch":
        '''(experimental) Grants permission to temporarily set the state of an alarm for testing purposes.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_SetAlarmState.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toSetAlarmState", []))

    @jsii.member(jsii_name="toStartMetricStreams")
    def to_start_metric_streams(self) -> "Cloudwatch":
        '''(experimental) Grants permission to start all CloudWatch metric streams that you specify.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_StartMetricStreams.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toStartMetricStreams", []))

    @jsii.member(jsii_name="toStopMetricStreams")
    def to_stop_metric_streams(self) -> "Cloudwatch":
        '''(experimental) Grants permission to stop all CloudWatch metric streams that you specify.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_StopMetricStreams.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toStopMetricStreams", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Cloudwatch":
        '''(experimental) Grants permission to add tags to an Amazon CloudWatch resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Cloudwatch":
        '''(experimental) Grants permission to remove a tag from an Amazon CloudWatch resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Cloudwatch", jsii.invoke(self, "toUntagResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__269d8cb01e6b695e8be38796fa8177d6bc6fa549a33ac727d1fb9cebfaac6294)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ef656465221d2369d3138e4575175349ad7ad1e4245673d6c6ffc17561bd6574)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Codeartifact(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Codeartifact",
):
    '''(experimental) Statement provider for service `codeartifact <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodeartifact.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codeartifact <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodeartifact.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9fbad76ad5dec94e2fca5aee9bfc09f1a83652b3ab4a4edf1fa492e43797473a)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDomain")
    def on_domain(
        self,
        domain_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codeartifact":
        '''(experimental) Adds a resource of type domain to the statement.

        https://docs.aws.amazon.com/codeartifact/latest/ug/auth-and-access-control-iam-access-control-identity-based.html#arn-formats

        :param domain_name: - Identifier for the domainName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__25e5d56049c1a9cd60a9d21f7f91a0816d77715065d272abfe8f6fecd66b26c0)
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codeartifact", jsii.invoke(self, "onDomain", [domain_name, account, region, partition]))

    @jsii.member(jsii_name="onPackage")
    def on_package(
        self,
        domain_name: builtins.str,
        repository_name: builtins.str,
        package_format: builtins.str,
        package_namespace: builtins.str,
        package_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codeartifact":
        '''(experimental) Adds a resource of type package to the statement.

        https://docs.aws.amazon.com/codeartifact/latest/ug/repo-policies.html

        :param domain_name: - Identifier for the domainName.
        :param repository_name: - Identifier for the repositoryName.
        :param package_format: - Identifier for the packageFormat.
        :param package_namespace: - Identifier for the packageNamespace.
        :param package_name: - Identifier for the packageName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a3e7e01ae6a55f8968f266e37425208e49044858a063ec85e34cf5f0dccfba4e)
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
            check_type(argname="argument repository_name", value=repository_name, expected_type=type_hints["repository_name"])
            check_type(argname="argument package_format", value=package_format, expected_type=type_hints["package_format"])
            check_type(argname="argument package_namespace", value=package_namespace, expected_type=type_hints["package_namespace"])
            check_type(argname="argument package_name", value=package_name, expected_type=type_hints["package_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codeartifact", jsii.invoke(self, "onPackage", [domain_name, repository_name, package_format, package_namespace, package_name, account, region, partition]))

    @jsii.member(jsii_name="onRepository")
    def on_repository(
        self,
        domain_name: builtins.str,
        repository_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codeartifact":
        '''(experimental) Adds a resource of type repository to the statement.

        https://docs.aws.amazon.com/codeartifact/latest/ug/repo-policies.html

        :param domain_name: - Identifier for the domainName.
        :param repository_name: - Identifier for the repositoryName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__459698c83b2adf482adb0db4d9e66bba2ffb76ee6240e7c52d16cacb6c432114)
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
            check_type(argname="argument repository_name", value=repository_name, expected_type=type_hints["repository_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codeartifact", jsii.invoke(self, "onRepository", [domain_name, repository_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateExternalConnection")
    def to_associate_external_connection(self) -> "Codeartifact":
        '''(experimental) Grants permission to add an external connection to a repository.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_AssociateExternalConnection.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toAssociateExternalConnection", []))

    @jsii.member(jsii_name="toAssociateWithDownstreamRepository")
    def to_associate_with_downstream_repository(self) -> "Codeartifact":
        '''(experimental) Grants permission to associate an existing repository as an upstream repository to another repository.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/ug/repos-upstream.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toAssociateWithDownstreamRepository", []))

    @jsii.member(jsii_name="toCopyPackageVersions")
    def to_copy_package_versions(self) -> "Codeartifact":
        '''(experimental) Grants permission to copy package versions from one repository to another repository in the same domain.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_CopyPackageVersions.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toCopyPackageVersions", []))

    @jsii.member(jsii_name="toCreateDomain")
    def to_create_domain(self) -> "Codeartifact":
        '''(experimental) Grants permission to create a new domain.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_CreateDomain.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toCreateDomain", []))

    @jsii.member(jsii_name="toCreateRepository")
    def to_create_repository(self) -> "Codeartifact":
        '''(experimental) Grants permission to create a new repository.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_CreateRepository.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toCreateRepository", []))

    @jsii.member(jsii_name="toDeleteDomain")
    def to_delete_domain(self) -> "Codeartifact":
        '''(experimental) Grants permission to delete a domain.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DeleteDomain.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDeleteDomain", []))

    @jsii.member(jsii_name="toDeleteDomainPermissionsPolicy")
    def to_delete_domain_permissions_policy(self) -> "Codeartifact":
        '''(experimental) Grants permission to delete the resource policy set on a domain.

        Access Level: Permissions management

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DeleteDomainPermissionsPolicy.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDeleteDomainPermissionsPolicy", []))

    @jsii.member(jsii_name="toDeletePackage")
    def to_delete_package(self) -> "Codeartifact":
        '''(experimental) Grants permission to delete a package.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DeletePackage.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDeletePackage", []))

    @jsii.member(jsii_name="toDeletePackageVersions")
    def to_delete_package_versions(self) -> "Codeartifact":
        '''(experimental) Grants permission to delete package versions.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DeletePackageVersions.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDeletePackageVersions", []))

    @jsii.member(jsii_name="toDeleteRepository")
    def to_delete_repository(self) -> "Codeartifact":
        '''(experimental) Grants permission to delete a repository.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DeleteRepository.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDeleteRepository", []))

    @jsii.member(jsii_name="toDeleteRepositoryPermissionsPolicy")
    def to_delete_repository_permissions_policy(self) -> "Codeartifact":
        '''(experimental) Grants permission to delete the resource policy set on a repository.

        Access Level: Permissions management

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DeleteRepositoryPermissionsPolicy.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDeleteRepositoryPermissionsPolicy", []))

    @jsii.member(jsii_name="toDescribeDomain")
    def to_describe_domain(self) -> "Codeartifact":
        '''(experimental) Grants permission to return information about a domain.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DescribeDomain.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDescribeDomain", []))

    @jsii.member(jsii_name="toDescribePackage")
    def to_describe_package(self) -> "Codeartifact":
        '''(experimental) Grants permission to retrieve information about a package.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DescribePackage.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDescribePackage", []))

    @jsii.member(jsii_name="toDescribePackageVersion")
    def to_describe_package_version(self) -> "Codeartifact":
        '''(experimental) Grants permission to return information about a package version.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DescribePackageVersion.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDescribePackageVersion", []))

    @jsii.member(jsii_name="toDescribeRepository")
    def to_describe_repository(self) -> "Codeartifact":
        '''(experimental) Grants permission to return detailed information about a repository.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DescribeRepository.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDescribeRepository", []))

    @jsii.member(jsii_name="toDisassociateExternalConnection")
    def to_disassociate_external_connection(self) -> "Codeartifact":
        '''(experimental) Grants permission to disassociate an external connection from a repository.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DisassociateExternalConnection.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDisassociateExternalConnection", []))

    @jsii.member(jsii_name="toDisposePackageVersions")
    def to_dispose_package_versions(self) -> "Codeartifact":
        '''(experimental) Grants permission to set the status of package versions to Disposed and delete their assets.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_DisposePackageVersions.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toDisposePackageVersions", []))

    @jsii.member(jsii_name="toGetAuthorizationToken")
    def to_get_authorization_token(self) -> "Codeartifact":
        '''(experimental) Grants permission to generate a temporary authentication token for accessing repositories in a domain.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_GetAuthorizationToken.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toGetAuthorizationToken", []))

    @jsii.member(jsii_name="toGetDomainPermissionsPolicy")
    def to_get_domain_permissions_policy(self) -> "Codeartifact":
        '''(experimental) Grants permission to return a domain's resource policy.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_GetDomainPermissionsPolicy.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toGetDomainPermissionsPolicy", []))

    @jsii.member(jsii_name="toGetPackageVersionAsset")
    def to_get_package_version_asset(self) -> "Codeartifact":
        '''(experimental) Grants permission to return an asset (or file) that is part of a package version.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_GetPackageVersionAsset.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toGetPackageVersionAsset", []))

    @jsii.member(jsii_name="toGetPackageVersionReadme")
    def to_get_package_version_readme(self) -> "Codeartifact":
        '''(experimental) Grants permission to return a package version's readme file.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_GetPackageVersionReadme.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toGetPackageVersionReadme", []))

    @jsii.member(jsii_name="toGetRepositoryEndpoint")
    def to_get_repository_endpoint(self) -> "Codeartifact":
        '''(experimental) Grants permission to return an endpoint for a repository.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_GetRepositoryEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toGetRepositoryEndpoint", []))

    @jsii.member(jsii_name="toGetRepositoryPermissionsPolicy")
    def to_get_repository_permissions_policy(self) -> "Codeartifact":
        '''(experimental) Grants permission to return a repository's resource policy.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_GetRepositoryPermissionsPolicy.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toGetRepositoryPermissionsPolicy", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Codeartifact":
        '''(experimental) Grants permission to list the domains in the current user's AWS account.

        Access Level: List

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_ListDomains.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toListPackages")
    def to_list_packages(self) -> "Codeartifact":
        '''(experimental) Grants permission to list the packages in a repository.

        Access Level: List

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_ListPackages.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toListPackages", []))

    @jsii.member(jsii_name="toListPackageVersionAssets")
    def to_list_package_version_assets(self) -> "Codeartifact":
        '''(experimental) Grants permission to list a package version's assets.

        Access Level: List

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_ListPackageVersionAssets.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toListPackageVersionAssets", []))

    @jsii.member(jsii_name="toListPackageVersionDependencies")
    def to_list_package_version_dependencies(self) -> "Codeartifact":
        '''(experimental) Grants permission to list the direct dependencies of a package version.

        Access Level: List

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_ListPackageVersionDependencies.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toListPackageVersionDependencies", []))

    @jsii.member(jsii_name="toListPackageVersions")
    def to_list_package_versions(self) -> "Codeartifact":
        '''(experimental) Grants permission to list a package's versions.

        Access Level: List

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_ListPackageVersions.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toListPackageVersions", []))

    @jsii.member(jsii_name="toListRepositories")
    def to_list_repositories(self) -> "Codeartifact":
        '''(experimental) Grants permission to list the repositories administered by the calling account.

        Access Level: List

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_ListRepositories.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toListRepositories", []))

    @jsii.member(jsii_name="toListRepositoriesInDomain")
    def to_list_repositories_in_domain(self) -> "Codeartifact":
        '''(experimental) Grants permission to list the repositories in a domain.

        Access Level: List

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_ListRepositoriesInDomain.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toListRepositoriesInDomain", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Codeartifact":
        '''(experimental) Grants permission to list tags for a CodeArtifact resource.

        Access Level: List

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPublishPackageVersion")
    def to_publish_package_version(self) -> "Codeartifact":
        '''(experimental) Grants permission to publish assets and metadata to a repository endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/ug/repo-policies.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toPublishPackageVersion", []))

    @jsii.member(jsii_name="toPutDomainPermissionsPolicy")
    def to_put_domain_permissions_policy(self) -> "Codeartifact":
        '''(experimental) Grants permission to attach a resource policy to a domain.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_PutDomainPermissionsPolicy.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toPutDomainPermissionsPolicy", []))

    @jsii.member(jsii_name="toPutPackageMetadata")
    def to_put_package_metadata(self) -> "Codeartifact":
        '''(experimental) Grants permission to add, modify or remove package metadata using a repository endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/ug/repo-policies.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toPutPackageMetadata", []))

    @jsii.member(jsii_name="toPutPackageOriginConfiguration")
    def to_put_package_origin_configuration(self) -> "Codeartifact":
        '''(experimental) Grants permission to set origin configuration for a package.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_PutPackageOriginConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toPutPackageOriginConfiguration", []))

    @jsii.member(jsii_name="toPutRepositoryPermissionsPolicy")
    def to_put_repository_permissions_policy(self) -> "Codeartifact":
        '''(experimental) Grants permission to attach a resource policy to a repository.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_PutRepositoryPermissionsPolicy.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toPutRepositoryPermissionsPolicy", []))

    @jsii.member(jsii_name="toReadFromRepository")
    def to_read_from_repository(self) -> "Codeartifact":
        '''(experimental) Grants permission to return package assets and metadata from a repository endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/codeartifact/latest/ug/repo-policies.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toReadFromRepository", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Codeartifact":
        '''(experimental) Grants permission to tag a CodeArtifact resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Codeartifact":
        '''(experimental) Grants permission to remove a tag from a CodeArtifact resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdatePackageVersionsStatus")
    def to_update_package_versions_status(self) -> "Codeartifact":
        '''(experimental) Grants permission to modify the status of one or more versions of a package.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_UpdatePackageVersionsStatus.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toUpdatePackageVersionsStatus", []))

    @jsii.member(jsii_name="toUpdateRepository")
    def to_update_repository(self) -> "Codeartifact":
        '''(experimental) Grants permission to modify the properties of a repository.

        Access Level: Write

        https://docs.aws.amazon.com/codeartifact/latest/APIReference/API_UpdateRepository.html

        :stability: experimental
        '''
        return typing.cast("Codeartifact", jsii.invoke(self, "toUpdateRepository", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ec28460b547d985a6d184a4e756369ff2fd8c6709b1c07a0bc7f69a02638be75)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__76d71c75f5019fc07080e272253894d2765a52c85c5e17ed68d6faf86968347d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Codebuild(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Codebuild",
):
    '''(experimental) Statement provider for service `codebuild <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodebuild.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codebuild <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodebuild.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5912f31dec319cf74757168123e8d8a452b4bb8ae4f8647196e65bb4ddcee72e)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onBuild")
    def on_build(
        self,
        build_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codebuild":
        '''(experimental) Adds a resource of type build to the statement.

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#arn-formats

        :param build_id: - Identifier for the buildId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0f29ece8a0e97a93833122f747a52d83c9c086a5d1ceec092afca57ee8a56f9b)
            check_type(argname="argument build_id", value=build_id, expected_type=type_hints["build_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codebuild", jsii.invoke(self, "onBuild", [build_id, account, region, partition]))

    @jsii.member(jsii_name="onBuildBatch")
    def on_build_batch(
        self,
        build_batch_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codebuild":
        '''(experimental) Adds a resource of type build-batch to the statement.

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#arn-formats

        :param build_batch_id: - Identifier for the buildBatchId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__42a54e4cb9091420f2cc6c01634f223eb91518d1cadcee03ecc926500d6a2248)
            check_type(argname="argument build_batch_id", value=build_batch_id, expected_type=type_hints["build_batch_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codebuild", jsii.invoke(self, "onBuildBatch", [build_batch_id, account, region, partition]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codebuild":
        '''(experimental) Adds a resource of type project to the statement.

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#arn-formats

        :param project_name: - Identifier for the projectName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bda5052a4e2f6e548b1e22237be00c24e5e13f4b2ec874ea2871f1512f34ba1a)
            check_type(argname="argument project_name", value=project_name, expected_type=type_hints["project_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codebuild", jsii.invoke(self, "onProject", [project_name, account, region, partition]))

    @jsii.member(jsii_name="onReport")
    def on_report(
        self,
        report_group_name: builtins.str,
        report_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codebuild":
        '''(experimental) Adds a resource of type report to the statement.

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#arn-formats

        :param report_group_name: - Identifier for the reportGroupName.
        :param report_id: - Identifier for the reportId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__96406c70f67432ab11aa00a7fba15affb22c30d15b2efaef9a4e305df1bfac74)
            check_type(argname="argument report_group_name", value=report_group_name, expected_type=type_hints["report_group_name"])
            check_type(argname="argument report_id", value=report_id, expected_type=type_hints["report_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codebuild", jsii.invoke(self, "onReport", [report_group_name, report_id, account, region, partition]))

    @jsii.member(jsii_name="onReportGroup")
    def on_report_group(
        self,
        report_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codebuild":
        '''(experimental) Adds a resource of type report-group to the statement.

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#arn-formats

        :param report_group_name: - Identifier for the reportGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4c6041f5e8b990ba82ce1a78073f0948d99cedfa69973cb7fd7f8ab9aac49c89)
            check_type(argname="argument report_group_name", value=report_group_name, expected_type=type_hints["report_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codebuild", jsii.invoke(self, "onReportGroup", [report_group_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchDeleteBuilds")
    def to_batch_delete_builds(self) -> "Codebuild":
        '''(experimental) Grants permission to delete one or more builds.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_BatchDeleteBuilds.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toBatchDeleteBuilds", []))

    @jsii.member(jsii_name="toBatchGetBuildBatches")
    def to_batch_get_build_batches(self) -> "Codebuild":
        '''(experimental) Grants permission to get information about one or more build batches.

        Access Level: Read

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_BatchGetBuildBatches.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toBatchGetBuildBatches", []))

    @jsii.member(jsii_name="toBatchGetBuilds")
    def to_batch_get_builds(self) -> "Codebuild":
        '''(experimental) Grants permission to get information about one or more builds.

        Access Level: Read

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_BatchGetBuilds.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toBatchGetBuilds", []))

    @jsii.member(jsii_name="toBatchGetProjects")
    def to_batch_get_projects(self) -> "Codebuild":
        '''(experimental) Grants permission to get information about one or more build projects.

        Access Level: Read

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_BatchGetProjects.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toBatchGetProjects", []))

    @jsii.member(jsii_name="toBatchGetReportGroups")
    def to_batch_get_report_groups(self) -> "Codebuild":
        '''(experimental) Grants permission to return an array of ReportGroup objects that are specified by the input reportGroupArns parameter.

        Access Level: Read

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_BatchGetReportGroups.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toBatchGetReportGroups", []))

    @jsii.member(jsii_name="toBatchGetReports")
    def to_batch_get_reports(self) -> "Codebuild":
        '''(experimental) Grants permission to return an array of the Report objects specified by the input reportArns parameter.

        Access Level: Read

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_BatchGetReports.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toBatchGetReports", []))

    @jsii.member(jsii_name="toBatchPutCodeCoverages")
    def to_batch_put_code_coverages(self) -> "Codebuild":
        '''(experimental) Grants permission to add or update information about a report.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#console-policies

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toBatchPutCodeCoverages", []))

    @jsii.member(jsii_name="toBatchPutTestCases")
    def to_batch_put_test_cases(self) -> "Codebuild":
        '''(experimental) Grants permission to add or update information about a report.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#console-policies

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toBatchPutTestCases", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Codebuild":
        '''(experimental) Grants permission to create a build project.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_CreateProject.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toCreateReport")
    def to_create_report(self) -> "Codebuild":
        '''(experimental) Grants permission to create a report.

        A report is created when tests specified in the buildspec file for a report groups run during the build of a project

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#console-policies

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toCreateReport", []))

    @jsii.member(jsii_name="toCreateReportGroup")
    def to_create_report_group(self) -> "Codebuild":
        '''(experimental) Grants permission to create a report group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_CreateReportGroup.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toCreateReportGroup", []))

    @jsii.member(jsii_name="toCreateWebhook")
    def to_create_webhook(self) -> "Codebuild":
        '''(experimental) Grants permission to create webhook.

        For an existing AWS CodeBuild build project that has its source code stored in a GitHub or Bitbucket repository, enables AWS CodeBuild to start rebuilding the source code every time a code change is pushed to the repository

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_CreateWebhook.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toCreateWebhook", []))

    @jsii.member(jsii_name="toDeleteBuildBatch")
    def to_delete_build_batch(self) -> "Codebuild":
        '''(experimental) Grants permission to delete a build batch.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_DeleteBuildBatch.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toDeleteBuildBatch", []))

    @jsii.member(jsii_name="toDeleteOAuthToken")
    def to_delete_o_auth_token(self) -> "Codebuild":
        '''(experimental) Grants permission to delete an OAuth token from a connected third-party OAuth provider.

        Only used in the AWS CodeBuild console

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#console-policies

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toDeleteOAuthToken", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Codebuild":
        '''(experimental) Grants permission to delete a build project.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_DeleteProject.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDeleteReport")
    def to_delete_report(self) -> "Codebuild":
        '''(experimental) Grants permission to delete a report.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_DeleteReport.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toDeleteReport", []))

    @jsii.member(jsii_name="toDeleteReportGroup")
    def to_delete_report_group(self) -> "Codebuild":
        '''(experimental) Grants permission to delete a report group.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_DeleteReportGroup.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toDeleteReportGroup", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "Codebuild":
        '''(experimental) Grants permission to delete a resource policy for the associated project or report group.

        Access Level: Permissions management

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_DeleteResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteSourceCredentials")
    def to_delete_source_credentials(self) -> "Codebuild":
        '''(experimental) Grants permission to delete a set of GitHub, GitHub Enterprise, or Bitbucket source credentials.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_DeleteSourceCredentials.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toDeleteSourceCredentials", []))

    @jsii.member(jsii_name="toDeleteWebhook")
    def to_delete_webhook(self) -> "Codebuild":
        '''(experimental) Grants permission to delete webhook.

        For an existing AWS CodeBuild build project that has its source code stored in a GitHub or Bitbucket repository, stops AWS CodeBuild from rebuilding the source code every time a code change is pushed to the repository

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_DeleteWebhook.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toDeleteWebhook", []))

    @jsii.member(jsii_name="toDescribeCodeCoverages")
    def to_describe_code_coverages(self) -> "Codebuild":
        '''(experimental) Grants permission to return an array of CodeCoverage objects.

        Access Level: Read

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_DescribeCodeCoverages.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toDescribeCodeCoverages", []))

    @jsii.member(jsii_name="toDescribeTestCases")
    def to_describe_test_cases(self) -> "Codebuild":
        '''(experimental) Grants permission to return an array of TestCase objects.

        Access Level: Read

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_DescribeTestCases.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toDescribeTestCases", []))

    @jsii.member(jsii_name="toGetReportGroupTrend")
    def to_get_report_group_trend(self) -> "Codebuild":
        '''(experimental) Grants permission to analyze and accumulate test report values for the test reports in the specified report group.

        Access Level: Read

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_GetReportGroupTrend.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toGetReportGroupTrend", []))

    @jsii.member(jsii_name="toGetResourcePolicy")
    def to_get_resource_policy(self) -> "Codebuild":
        '''(experimental) Grants permission to return a resource policy for the specified project or report group.

        Access Level: Read

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_GetResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toGetResourcePolicy", []))

    @jsii.member(jsii_name="toImportSourceCredentials")
    def to_import_source_credentials(self) -> "Codebuild":
        '''(experimental) Grants permission to import the source repository credentials for an AWS CodeBuild project that has its source code stored in a GitHub, GitHub Enterprise, or Bitbucket repository.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ImportSourceCredentials.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toImportSourceCredentials", []))

    @jsii.member(jsii_name="toInvalidateProjectCache")
    def to_invalidate_project_cache(self) -> "Codebuild":
        '''(experimental) Grants permission to reset the cache for a project.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_InvalidateProjectCache.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toInvalidateProjectCache", []))

    @jsii.member(jsii_name="toListBuildBatches")
    def to_list_build_batches(self) -> "Codebuild":
        '''(experimental) Grants permission to get a list of build batch IDs, with each build batch ID representing a single build batch.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListBuildBatches.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListBuildBatches", []))

    @jsii.member(jsii_name="toListBuildBatchesForProject")
    def to_list_build_batches_for_project(self) -> "Codebuild":
        '''(experimental) Grants permission to get a list of build batch IDs for the specified build project, with each build batch ID representing a single build batch.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListBuildBatchesForProject.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListBuildBatchesForProject", []))

    @jsii.member(jsii_name="toListBuilds")
    def to_list_builds(self) -> "Codebuild":
        '''(experimental) Grants permission to get a list of build IDs, with each build ID representing a single build.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListBuilds.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListBuilds", []))

    @jsii.member(jsii_name="toListBuildsForProject")
    def to_list_builds_for_project(self) -> "Codebuild":
        '''(experimental) Grants permission to get a list of build IDs for the specified build project, with each build ID representing a single build.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListBuildsForProject.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListBuildsForProject", []))

    @jsii.member(jsii_name="toListConnectedOAuthAccounts")
    def to_list_connected_o_auth_accounts(self) -> "Codebuild":
        '''(experimental) Grants permission to list connected third-party OAuth providers. Only used in the AWS CodeBuild console.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#console-policies

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListConnectedOAuthAccounts", []))

    @jsii.member(jsii_name="toListCuratedEnvironmentImages")
    def to_list_curated_environment_images(self) -> "Codebuild":
        '''(experimental) Grants permission to get information about Docker images that are managed by AWS CodeBuild.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListCuratedEnvironmentImages.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListCuratedEnvironmentImages", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Codebuild":
        '''(experimental) Grants permission to get a list of build project names, with each build project name representing a single build project.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListProjects.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListReportGroups")
    def to_list_report_groups(self) -> "Codebuild":
        '''(experimental) Grants permission to return a list of report group ARNs. Each report group ARN represents one report group.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListReportGroups.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListReportGroups", []))

    @jsii.member(jsii_name="toListReports")
    def to_list_reports(self) -> "Codebuild":
        '''(experimental) Grants permission to return a list of report ARNs. Each report ARN representing one report.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListReports.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListReports", []))

    @jsii.member(jsii_name="toListReportsForReportGroup")
    def to_list_reports_for_report_group(self) -> "Codebuild":
        '''(experimental) Grants permission to return a list of report ARNs that belong to the specified report group.

        Each report ARN represents one report

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListReportsForReportGroup.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListReportsForReportGroup", []))

    @jsii.member(jsii_name="toListRepositories")
    def to_list_repositories(self) -> "Codebuild":
        '''(experimental) Grants permission to list source code repositories from a connected third-party OAuth provider.

        Only used in the AWS CodeBuild console

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#console-policies

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListRepositories", []))

    @jsii.member(jsii_name="toListSharedProjects")
    def to_list_shared_projects(self) -> "Codebuild":
        '''(experimental) Grants permission to return a list of project ARNs that have been shared with the requester.

        Each project ARN represents one project

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListSharedProjects.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListSharedProjects", []))

    @jsii.member(jsii_name="toListSharedReportGroups")
    def to_list_shared_report_groups(self) -> "Codebuild":
        '''(experimental) Grants permission to return a list of report group ARNs that have been shared with the requester.

        Each report group ARN represents one report group

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListSharedReportGroups.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListSharedReportGroups", []))

    @jsii.member(jsii_name="toListSourceCredentials")
    def to_list_source_credentials(self) -> "Codebuild":
        '''(experimental) Grants permission to return a list of SourceCredentialsInfo objects.

        Access Level: List

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_ListSourceCredentials.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toListSourceCredentials", []))

    @jsii.member(jsii_name="toPersistOAuthToken")
    def to_persist_o_auth_token(self) -> "Codebuild":
        '''(experimental) Grants permission to save an OAuth token from a connected third-party OAuth provider.

        Only used in the AWS CodeBuild console

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#console-policies

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toPersistOAuthToken", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "Codebuild":
        '''(experimental) Grants permission to create a resource policy for the associated project or report group.

        Access Level: Permissions management

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_PutResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toRetryBuild")
    def to_retry_build(self) -> "Codebuild":
        '''(experimental) Grants permission to retry a build.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_RetryBuild.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toRetryBuild", []))

    @jsii.member(jsii_name="toRetryBuildBatch")
    def to_retry_build_batch(self) -> "Codebuild":
        '''(experimental) Grants permission to retry a build batch.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_RetryBuildBatch.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toRetryBuildBatch", []))

    @jsii.member(jsii_name="toStartBuild")
    def to_start_build(self) -> "Codebuild":
        '''(experimental) Grants permission to start running a build.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_StartBuild.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toStartBuild", []))

    @jsii.member(jsii_name="toStartBuildBatch")
    def to_start_build_batch(self) -> "Codebuild":
        '''(experimental) Grants permission to start running a build batch.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_StartBuildBatch.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toStartBuildBatch", []))

    @jsii.member(jsii_name="toStopBuild")
    def to_stop_build(self) -> "Codebuild":
        '''(experimental) Grants permission to attempt to stop running a build.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_StopBuild.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toStopBuild", []))

    @jsii.member(jsii_name="toStopBuildBatch")
    def to_stop_build_batch(self) -> "Codebuild":
        '''(experimental) Grants permission to attempt to stop running a build batch.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_StopBuildBatch.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toStopBuildBatch", []))

    @jsii.member(jsii_name="toUpdateProject")
    def to_update_project(self) -> "Codebuild":
        '''(experimental) Grants permission to change the settings of an existing build project.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_UpdateProject.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toUpdateProject", []))

    @jsii.member(jsii_name="toUpdateProjectVisibility")
    def to_update_project_visibility(self) -> "Codebuild":
        '''(experimental) Grants permission to change the public visibility of a project and its builds.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_UpdateProjectVisibility.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toUpdateProjectVisibility", []))

    @jsii.member(jsii_name="toUpdateReport")
    def to_update_report(self) -> "Codebuild":
        '''(experimental) Grants permission to update information about a report.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/userguide/auth-and-access-control-iam-identity-based-access-control.html#console-policies

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toUpdateReport", []))

    @jsii.member(jsii_name="toUpdateReportGroup")
    def to_update_report_group(self) -> "Codebuild":
        '''(experimental) Grants permission to change the settings of an existing report group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_UpdateReportGroup.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toUpdateReportGroup", []))

    @jsii.member(jsii_name="toUpdateWebhook")
    def to_update_webhook(self) -> "Codebuild":
        '''(experimental) Grants permission to update the webhook associated with an AWS CodeBuild build project.

        Access Level: Write

        https://docs.aws.amazon.com/codebuild/latest/APIReference/API_UpdateWebhook.html

        :stability: experimental
        '''
        return typing.cast("Codebuild", jsii.invoke(self, "toUpdateWebhook", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dc29a06bbdfc5d4dc9253622dbdc006e8344dfb1dc7fa9b722badb508346a8ec)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f9cdfe2512accf0792c91693a9899ab9aaa4525912079a9ea39e117961afac66)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Codecatalyst(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Codecatalyst",
):
    '''(experimental) Statement provider for service `codecatalyst <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncodecatalyst.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codecatalyst <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncodecatalyst.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1e528452326f6c7feda17df61ebe76c4bde30c6e36ad8a52d99f8f8b2d25c1f1)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onConnections")
    def on_connections(
        self,
        connection_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codecatalyst":
        '''(experimental) Adds a resource of type connections to the statement.

        https://docs.aws.amazon.com/codecatalyst/latest/userguide/#

        :param connection_id: - Identifier for the connectionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6fa91574ddaf9ab69399cf21e0cb92c7571062320921ec9dbfc3e5a7ed753dfb)
            check_type(argname="argument connection_id", value=connection_id, expected_type=type_hints["connection_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codecatalyst", jsii.invoke(self, "onConnections", [connection_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptConnection")
    def to_accept_connection(self) -> "Codecatalyst":
        '''(experimental) Grants permission to accept a request to connect this account to a CodeCatalyst space.

        Access Level: Write

        https://docs.aws.amazon.com/codecatalyst/latest/userguide/#

        :stability: experimental
        '''
        return typing.cast("Codecatalyst", jsii.invoke(self, "toAcceptConnection", []))

    @jsii.member(jsii_name="toAssociateIamRoleToConnection")
    def to_associate_iam_role_to_connection(self) -> "Codecatalyst":
        '''(experimental) Grants permission to associate an IAM role to a connection.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/codecatalyst/latest/userguide/#

        :stability: experimental
        '''
        return typing.cast("Codecatalyst", jsii.invoke(self, "toAssociateIamRoleToConnection", []))

    @jsii.member(jsii_name="toDeleteConnection")
    def to_delete_connection(self) -> "Codecatalyst":
        '''(experimental) Grants permission to delete a connection.

        Access Level: Write

        https://docs.aws.amazon.com/codecatalyst/latest/userguide/#

        :stability: experimental
        '''
        return typing.cast("Codecatalyst", jsii.invoke(self, "toDeleteConnection", []))

    @jsii.member(jsii_name="toDisassociateIamRoleFromConnection")
    def to_disassociate_iam_role_from_connection(self) -> "Codecatalyst":
        '''(experimental) Grants permission to disassociate an IAM role from a connection.

        Access Level: Write

        https://docs.aws.amazon.com/codecatalyst/latest/userguide/#

        :stability: experimental
        '''
        return typing.cast("Codecatalyst", jsii.invoke(self, "toDisassociateIamRoleFromConnection", []))

    @jsii.member(jsii_name="toGetBillingAuthorization")
    def to_get_billing_authorization(self) -> "Codecatalyst":
        '''(experimental) Grants permission to describe the billing authorization for a connection.

        Access Level: Read

        https://docs.aws.amazon.com/codecatalyst/latest/userguide/#

        :stability: experimental
        '''
        return typing.cast("Codecatalyst", jsii.invoke(self, "toGetBillingAuthorization", []))

    @jsii.member(jsii_name="toGetConnection")
    def to_get_connection(self) -> "Codecatalyst":
        '''(experimental) Grants permission to get a connection.

        Access Level: Read

        https://docs.aws.amazon.com/codecatalyst/latest/userguide/#

        :stability: experimental
        '''
        return typing.cast("Codecatalyst", jsii.invoke(self, "toGetConnection", []))

    @jsii.member(jsii_name="toGetPendingConnection")
    def to_get_pending_connection(self) -> "Codecatalyst":
        '''(experimental) Grants permission to get a pending request to connect this account to a CodeCatalyst space.

        Access Level: Read

        https://docs.aws.amazon.com/codecatalyst/latest/userguide/#

        :stability: experimental
        '''
        return typing.cast("Codecatalyst", jsii.invoke(self, "toGetPendingConnection", []))

    @jsii.member(jsii_name="toListConnections")
    def to_list_connections(self) -> "Codecatalyst":
        '''(experimental) Grants permission to list connections which are not pending.

        Access Level: List

        https://docs.aws.amazon.com/codecatalyst/latest/userguide/#

        :stability: experimental
        '''
        return typing.cast("Codecatalyst", jsii.invoke(self, "toListConnections", []))

    @jsii.member(jsii_name="toListIamRolesForConnection")
    def to_list_iam_roles_for_connection(self) -> "Codecatalyst":
        '''(experimental) Grants permission to list IAM roles associated with a connection.

        Access Level: List

        https://docs.aws.amazon.com/codecatalyst/latest/userguide/#

        :stability: experimental
        '''
        return typing.cast("Codecatalyst", jsii.invoke(self, "toListIamRolesForConnection", []))

    @jsii.member(jsii_name="toPutBillingAuthorization")
    def to_put_billing_authorization(self) -> "Codecatalyst":
        '''(experimental) Grants permission to creates or update the billing authorization for a connection.

        Access Level: Write

        https://docs.aws.amazon.com/codecatalyst/latest/userguide/#

        :stability: experimental
        '''
        return typing.cast("Codecatalyst", jsii.invoke(self, "toPutBillingAuthorization", []))

    @jsii.member(jsii_name="toRejectConnection")
    def to_reject_connection(self) -> "Codecatalyst":
        '''(experimental) Grants permission to reject a request to connect this account to a CodeCatalyst space.

        Access Level: Write

        https://docs.aws.amazon.com/codecatalyst/latest/userguide/#

        :stability: experimental
        '''
        return typing.cast("Codecatalyst", jsii.invoke(self, "toRejectConnection", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0bfdf85ee9929d543a111bcd4fcc91dae5e50eaa5959372f2c883675d7798a37)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dac1bf23ac373ce07e5241edeaaeea5bad51e670484810d6ad8a1d1c33e337f8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Codecommit(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Codecommit",
):
    '''(experimental) Statement provider for service `codecommit <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodecommit.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codecommit <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodecommit.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5c957abae8d161c35263140b141d60ee8dbd67071526f12a16ea1b3b3832f5c8)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifReferences")
    def if_references(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Codecommit":
        '''(experimental) Filters access by Git reference to specified AWS CodeCommit actions.

        https://docs.aws.amazon.com/codecommit/latest/userguide/how-to-conditional-branch.html

        Applies to actions:

        - .toCreateBranch()
        - .toCreateCommit()
        - .toCreateUnreferencedMergeCommit()
        - .toDeleteBranch()
        - .toDeleteFile()
        - .toGetMergeCommit()
        - .toGitPush()
        - .toMergeBranchesByFastForward()
        - .toMergeBranchesBySquash()
        - .toMergeBranchesByThreeWay()
        - .toMergePullRequestByFastForward()
        - .toMergePullRequestBySquash()
        - .toMergePullRequestByThreeWay()
        - .toPutFile()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b860a9613c60f5c7bcdff908af2fd9998c0eaf290087e9ebf9a9fbb2f885d9d0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Codecommit", jsii.invoke(self, "ifReferences", [value, operator]))

    @jsii.member(jsii_name="onRepository")
    def on_repository(
        self,
        repository_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codecommit":
        '''(experimental) Adds a resource of type repository to the statement.

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-iam-access-control-identity-based.html#arn-formats

        :param repository_name: - Identifier for the repositoryName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__94a31e727bd0cbd1ff9a5ba13cd000aa33785237713b835993ac3ed113575186)
            check_type(argname="argument repository_name", value=repository_name, expected_type=type_hints["repository_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codecommit", jsii.invoke(self, "onRepository", [repository_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateApprovalRuleTemplateWithRepository")
    def to_associate_approval_rule_template_with_repository(self) -> "Codecommit":
        '''(experimental) Grants permission to associate an approval rule template with a repository.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_AssociateApprovalRuleTemplateWithRepository.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toAssociateApprovalRuleTemplateWithRepository", []))

    @jsii.member(jsii_name="toBatchAssociateApprovalRuleTemplateWithRepositories")
    def to_batch_associate_approval_rule_template_with_repositories(
        self,
    ) -> "Codecommit":
        '''(experimental) Grants permission to associate an approval rule template with multiple repositories in a single operation.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_BatchAssociateApprovalRuleTemplateWithRepositories.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toBatchAssociateApprovalRuleTemplateWithRepositories", []))

    @jsii.member(jsii_name="toBatchDescribeMergeConflicts")
    def to_batch_describe_merge_conflicts(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about multiple merge conflicts when attempting to merge two commits using either the three-way merge or the squash merge option.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_BatchDescribeMergeConflicts.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toBatchDescribeMergeConflicts", []))

    @jsii.member(jsii_name="toBatchDisassociateApprovalRuleTemplateFromRepositories")
    def to_batch_disassociate_approval_rule_template_from_repositories(
        self,
    ) -> "Codecommit":
        '''(experimental) Grants permission to remove the association between an approval rule template and multiple repositories in a single operation.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_BatchDisassociateApprovalRuleTemplateFromRepositories.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toBatchDisassociateApprovalRuleTemplateFromRepositories", []))

    @jsii.member(jsii_name="toBatchGetCommits")
    def to_batch_get_commits(self) -> "Codecommit":
        '''(experimental) Grants permission to get return information about one or more commits in an AWS CodeCommit repository.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_BatchGetCommits.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toBatchGetCommits", []))

    @jsii.member(jsii_name="toBatchGetPullRequests")
    def to_batch_get_pull_requests(self) -> "Codecommit":
        '''(experimental) Grants permission to return information about one or more pull requests in an AWS CodeCommit repository.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-pr

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toBatchGetPullRequests", []))

    @jsii.member(jsii_name="toBatchGetRepositories")
    def to_batch_get_repositories(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about multiple repositories.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_BatchGetRepositories.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toBatchGetRepositories", []))

    @jsii.member(jsii_name="toCancelUploadArchive")
    def to_cancel_upload_archive(self) -> "Codecommit":
        '''(experimental) Grants permission to cancel the uploading of an archive to a pipeline in AWS CodePipeline.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-acp

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toCancelUploadArchive", []))

    @jsii.member(jsii_name="toCreateApprovalRuleTemplate")
    def to_create_approval_rule_template(self) -> "Codecommit":
        '''(experimental) Grants permission to create an approval rule template that will automatically create approval rules in pull requests that match the conditions defined in the template;

        does not grant permission to create approval rules for individual pull requests

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_CreateApprovalRuleTemplate.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toCreateApprovalRuleTemplate", []))

    @jsii.member(jsii_name="toCreateBranch")
    def to_create_branch(self) -> "Codecommit":
        '''(experimental) Grants permission to create a branch in an AWS CodeCommit repository with this API;

        does not control Git create branch actions

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_CreateBranch.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toCreateBranch", []))

    @jsii.member(jsii_name="toCreateCommit")
    def to_create_commit(self) -> "Codecommit":
        '''(experimental) Grants permission to add, copy, move or update single or multiple files in a branch in an AWS CodeCommit repository, and generate a commit for the changes in the specified branch.

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_CreateCommit.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toCreateCommit", []))

    @jsii.member(jsii_name="toCreatePullRequest")
    def to_create_pull_request(self) -> "Codecommit":
        '''(experimental) Grants permission to create a pull request in the specified repository.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_CreatePullRequest.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toCreatePullRequest", []))

    @jsii.member(jsii_name="toCreatePullRequestApprovalRule")
    def to_create_pull_request_approval_rule(self) -> "Codecommit":
        '''(experimental) Grants permission to create an approval rule specific to an individual pull request;

        does not grant permission to create approval rule templates

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_CreatePullRequestApprovalRule.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toCreatePullRequestApprovalRule", []))

    @jsii.member(jsii_name="toCreateRepository")
    def to_create_repository(self) -> "Codecommit":
        '''(experimental) Grants permission to create an AWS CodeCommit repository.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_CreateRepository.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toCreateRepository", []))

    @jsii.member(jsii_name="toCreateUnreferencedMergeCommit")
    def to_create_unreferenced_merge_commit(self) -> "Codecommit":
        '''(experimental) Grants permission to create an unreferenced commit that contains the result of merging two commits using either the three-way or the squash merge option;

        does not control Git merge actions

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_CreateUnreferencedMergeCommit.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toCreateUnreferencedMergeCommit", []))

    @jsii.member(jsii_name="toDeleteApprovalRuleTemplate")
    def to_delete_approval_rule_template(self) -> "Codecommit":
        '''(experimental) Grants permission to delete an approval rule template.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_DeleteApprovalRuleTemplate.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toDeleteApprovalRuleTemplate", []))

    @jsii.member(jsii_name="toDeleteBranch")
    def to_delete_branch(self) -> "Codecommit":
        '''(experimental) Grants permission to delete a branch in an AWS CodeCommit repository with this API;

        does not control Git delete branch actions

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_DeleteBranch.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toDeleteBranch", []))

    @jsii.member(jsii_name="toDeleteCommentContent")
    def to_delete_comment_content(self) -> "Codecommit":
        '''(experimental) Grants permission to delete the content of a comment made on a change, file, or commit in a repository.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_DeleteCommentContent.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toDeleteCommentContent", []))

    @jsii.member(jsii_name="toDeleteFile")
    def to_delete_file(self) -> "Codecommit":
        '''(experimental) Grants permission to delete a specified file from a specified branch.

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_DeleteFile.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toDeleteFile", []))

    @jsii.member(jsii_name="toDeletePullRequestApprovalRule")
    def to_delete_pull_request_approval_rule(self) -> "Codecommit":
        '''(experimental) Grants permission to delete approval rule created for a pull request if the rule was not created by an approval rule template.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_DeletePullRequestApprovalRule.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toDeletePullRequestApprovalRule", []))

    @jsii.member(jsii_name="toDeleteRepository")
    def to_delete_repository(self) -> "Codecommit":
        '''(experimental) Grants permission to delete an AWS CodeCommit repository.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_DeleteRepository.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toDeleteRepository", []))

    @jsii.member(jsii_name="toDescribeMergeConflicts")
    def to_describe_merge_conflicts(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about specific merge conflicts when attempting to merge two commits using either the three-way or the squash merge option.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_DescribeMergeConflicts.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toDescribeMergeConflicts", []))

    @jsii.member(jsii_name="toDescribePullRequestEvents")
    def to_describe_pull_request_events(self) -> "Codecommit":
        '''(experimental) Grants permission to return information about one or more pull request events.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_DescribePullRequestEvents.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toDescribePullRequestEvents", []))

    @jsii.member(jsii_name="toDisassociateApprovalRuleTemplateFromRepository")
    def to_disassociate_approval_rule_template_from_repository(self) -> "Codecommit":
        '''(experimental) Grants permission to remove the association between an approval rule template and a repository.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_DisassociateApprovalRuleTemplateFromRepository.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toDisassociateApprovalRuleTemplateFromRepository", []))

    @jsii.member(jsii_name="toEvaluatePullRequestApprovalRules")
    def to_evaluate_pull_request_approval_rules(self) -> "Codecommit":
        '''(experimental) Grants permission to evaluate whether a pull request is mergable based on its current approval state and approval rule requirements.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_EvaluatePullRequestApprovalRules.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toEvaluatePullRequestApprovalRules", []))

    @jsii.member(jsii_name="toGetApprovalRuleTemplate")
    def to_get_approval_rule_template(self) -> "Codecommit":
        '''(experimental) Grants permission to return information about an approval rule template.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetApprovalRuleTemplate.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetApprovalRuleTemplate", []))

    @jsii.member(jsii_name="toGetBlob")
    def to_get_blob(self) -> "Codecommit":
        '''(experimental) Grants permission to view the encoded content of an individual file in an AWS CodeCommit repository from the AWS CodeCommit console.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetBlob.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetBlob", []))

    @jsii.member(jsii_name="toGetBranch")
    def to_get_branch(self) -> "Codecommit":
        '''(experimental) Grants permission to get details about a branch in an AWS CodeCommit repository with this API;

        does not control Git branch actions

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetBranch.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetBranch", []))

    @jsii.member(jsii_name="toGetComment")
    def to_get_comment(self) -> "Codecommit":
        '''(experimental) Grants permission to get the content of a comment made on a change, file, or commit in a repository.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetComment.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetComment", []))

    @jsii.member(jsii_name="toGetCommentReactions")
    def to_get_comment_reactions(self) -> "Codecommit":
        '''(experimental) Grants permission to get the reactions on a comment.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetCommentReactions.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetCommentReactions", []))

    @jsii.member(jsii_name="toGetCommentsForComparedCommit")
    def to_get_comments_for_compared_commit(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about comments made on the comparison between two commits.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetCommentsForComparedCommit.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetCommentsForComparedCommit", []))

    @jsii.member(jsii_name="toGetCommentsForPullRequest")
    def to_get_comments_for_pull_request(self) -> "Codecommit":
        '''(experimental) Grants permission to get comments made on a pull request.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetCommentsForPullRequest.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetCommentsForPullRequest", []))

    @jsii.member(jsii_name="toGetCommit")
    def to_get_commit(self) -> "Codecommit":
        '''(experimental) Grants permission to return information about a commit, including commit message and committer information, with this API;

        does not control Git log actions

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetCommit.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetCommit", []))

    @jsii.member(jsii_name="toGetCommitHistory")
    def to_get_commit_history(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about the history of commits in a repository.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-code

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetCommitHistory", []))

    @jsii.member(jsii_name="toGetCommitsFromMergeBase")
    def to_get_commits_from_merge_base(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about the difference between commits in the context of a potential merge.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-pr

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetCommitsFromMergeBase", []))

    @jsii.member(jsii_name="toGetDifferences")
    def to_get_differences(self) -> "Codecommit":
        '''(experimental) Grants permission to view information about the differences between valid commit specifiers such as a branch, tag, HEAD, commit ID, or other fully qualified reference.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetDifferences.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetDifferences", []))

    @jsii.member(jsii_name="toGetFile")
    def to_get_file(self) -> "Codecommit":
        '''(experimental) Grants permission to return the base-64 encoded contents of a specified file and its metadata.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetFile.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetFile", []))

    @jsii.member(jsii_name="toGetFolder")
    def to_get_folder(self) -> "Codecommit":
        '''(experimental) Grants permission to return the contents of a specified folder in a repository.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetFolder.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetFolder", []))

    @jsii.member(jsii_name="toGetMergeCommit")
    def to_get_merge_commit(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about a merge commit created by one of the merge options for pull requests that creates merge commits.

        Not all merge options create merge commits. This permission does not control Git merge actions

        Access Level: Read

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetMergeCommit.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetMergeCommit", []))

    @jsii.member(jsii_name="toGetMergeConflicts")
    def to_get_merge_conflicts(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about merge conflicts between the before and after commit IDs for a pull request in a repository.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetMergeConflicts.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetMergeConflicts", []))

    @jsii.member(jsii_name="toGetMergeOptions")
    def to_get_merge_options(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about merge options for pull requests that can be used to merge two commits;

        does not control Git merge actions

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetMergeOptions.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetMergeOptions", []))

    @jsii.member(jsii_name="toGetObjectIdentifier")
    def to_get_object_identifier(self) -> "Codecommit":
        '''(experimental) Grants permission to resolve blobs, trees, and commits to their identifier.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-code

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetObjectIdentifier", []))

    @jsii.member(jsii_name="toGetPullRequest")
    def to_get_pull_request(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about a pull request in a specified repository.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetPullRequest.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetPullRequest", []))

    @jsii.member(jsii_name="toGetPullRequestApprovalStates")
    def to_get_pull_request_approval_states(self) -> "Codecommit":
        '''(experimental) Grants permission to retrieve the current approvals on an inputted pull request.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetPullRequestApprovalStates.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetPullRequestApprovalStates", []))

    @jsii.member(jsii_name="toGetPullRequestOverrideState")
    def to_get_pull_request_override_state(self) -> "Codecommit":
        '''(experimental) Grants permission to retrieve the current override state of a given pull request.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetPullRequestOverrideState.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetPullRequestOverrideState", []))

    @jsii.member(jsii_name="toGetReferences")
    def to_get_references(self) -> "Codecommit":
        '''(experimental) Grants permission to get details about references in an AWS CodeCommit repository; does not control Git reference actions.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-code

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetReferences", []))

    @jsii.member(jsii_name="toGetRepository")
    def to_get_repository(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about an AWS CodeCommit repository.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetRepository.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetRepository", []))

    @jsii.member(jsii_name="toGetRepositoryTriggers")
    def to_get_repository_triggers(self) -> "Codecommit":
        '''(experimental) Grants permission to get information about triggers configured for a repository.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_GetRepositoryTriggers.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetRepositoryTriggers", []))

    @jsii.member(jsii_name="toGetTree")
    def to_get_tree(self) -> "Codecommit":
        '''(experimental) Grants permission to view the contents of a specified tree in an AWS CodeCommit repository from the AWS CodeCommit console.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-code

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetTree", []))

    @jsii.member(jsii_name="toGetUploadArchiveStatus")
    def to_get_upload_archive_status(self) -> "Codecommit":
        '''(experimental) Grants permission to get status information about an archive upload to a pipeline in AWS CodePipeline.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-acp

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGetUploadArchiveStatus", []))

    @jsii.member(jsii_name="toGitPull")
    def to_git_pull(self) -> "Codecommit":
        '''(experimental) Grants permission to pull information from an AWS CodeCommit repository to a local repo.

        Access Level: Read

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-git

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGitPull", []))

    @jsii.member(jsii_name="toGitPush")
    def to_git_push(self) -> "Codecommit":
        '''(experimental) Grants permission to push information from a local repo to an AWS CodeCommit repository.

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-git

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toGitPush", []))

    @jsii.member(jsii_name="toListApprovalRuleTemplates")
    def to_list_approval_rule_templates(self) -> "Codecommit":
        '''(experimental) Grants permission to list all approval rule templates in an AWS Region for the AWS account.

        Access Level: List

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_ListApprovalRuleTemplates.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toListApprovalRuleTemplates", []))

    @jsii.member(jsii_name="toListAssociatedApprovalRuleTemplatesForRepository")
    def to_list_associated_approval_rule_templates_for_repository(self) -> "Codecommit":
        '''(experimental) Grants permission to list approval rule templates that are associated with a repository.

        Access Level: List

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_ListAssociatedApprovalRuleTemplatesForRepository.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toListAssociatedApprovalRuleTemplatesForRepository", []))

    @jsii.member(jsii_name="toListBranches")
    def to_list_branches(self) -> "Codecommit":
        '''(experimental) Grants permission to list branches for an AWS CodeCommit repository with this API; does not control Git branch actions.

        Access Level: List

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_ListBranches.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toListBranches", []))

    @jsii.member(jsii_name="toListPullRequests")
    def to_list_pull_requests(self) -> "Codecommit":
        '''(experimental) Grants permission to list pull requests for a specified repository.

        Access Level: List

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_ListPullRequests.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toListPullRequests", []))

    @jsii.member(jsii_name="toListRepositories")
    def to_list_repositories(self) -> "Codecommit":
        '''(experimental) Grants permission to list information about AWS CodeCommit repositories in the current Region for your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_ListRepositories.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toListRepositories", []))

    @jsii.member(jsii_name="toListRepositoriesForApprovalRuleTemplate")
    def to_list_repositories_for_approval_rule_template(self) -> "Codecommit":
        '''(experimental) Grants permission to list repositories that are associated with an approval rule template.

        Access Level: List

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_ListRepositoriesForApprovalRuleTemplate.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toListRepositoriesForApprovalRuleTemplate", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Codecommit":
        '''(experimental) Grants permission to list the resource attached to a CodeCommit resource ARN.

        Access Level: List

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toMergeBranchesByFastForward")
    def to_merge_branches_by_fast_forward(self) -> "Codecommit":
        '''(experimental) Grants permission to merge two commits into the specified destination branch using the fast-forward merge option.

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_MergeBranchesByFastForward.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toMergeBranchesByFastForward", []))

    @jsii.member(jsii_name="toMergeBranchesBySquash")
    def to_merge_branches_by_squash(self) -> "Codecommit":
        '''(experimental) Grants permission to merge two commits into the specified destination branch using the squash merge option.

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_MergeBranchesBySquash.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toMergeBranchesBySquash", []))

    @jsii.member(jsii_name="toMergeBranchesByThreeWay")
    def to_merge_branches_by_three_way(self) -> "Codecommit":
        '''(experimental) Grants permission to merge two commits into the specified destination branch using the three-way merge option.

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_MergeBranchesByThreeWay.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toMergeBranchesByThreeWay", []))

    @jsii.member(jsii_name="toMergePullRequestByFastForward")
    def to_merge_pull_request_by_fast_forward(self) -> "Codecommit":
        '''(experimental) Grants permission to close a pull request and attempt to merge it into the specified destination branch for that pull request at the specified commit using the fast-forward merge option.

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_MergePullRequestByFastForward.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toMergePullRequestByFastForward", []))

    @jsii.member(jsii_name="toMergePullRequestBySquash")
    def to_merge_pull_request_by_squash(self) -> "Codecommit":
        '''(experimental) Grants permission to close a pull request and attempt to merge it into the specified destination branch for that pull request at the specified commit using the squash merge option.

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_MergePullRequestBySquash.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toMergePullRequestBySquash", []))

    @jsii.member(jsii_name="toMergePullRequestByThreeWay")
    def to_merge_pull_request_by_three_way(self) -> "Codecommit":
        '''(experimental) Grants permission to close a pull request and attempt to merge it into the specified destination branch for that pull request at the specified commit using the three-way merge option.

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_MergePullRequestByThreeWay.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toMergePullRequestByThreeWay", []))

    @jsii.member(jsii_name="toOverridePullRequestApprovalRules")
    def to_override_pull_request_approval_rules(self) -> "Codecommit":
        '''(experimental) Grants permission to override all approval rules for a pull request, including approval rules created by a template.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_OverridePullRequestApprovalRules.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toOverridePullRequestApprovalRules", []))

    @jsii.member(jsii_name="toPostCommentForComparedCommit")
    def to_post_comment_for_compared_commit(self) -> "Codecommit":
        '''(experimental) Grants permission to post a comment on the comparison between two commits.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_PostCommentForComparedCommit.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toPostCommentForComparedCommit", []))

    @jsii.member(jsii_name="toPostCommentForPullRequest")
    def to_post_comment_for_pull_request(self) -> "Codecommit":
        '''(experimental) Grants permission to post a comment on a pull request.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_PostCommentForPullRequest.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toPostCommentForPullRequest", []))

    @jsii.member(jsii_name="toPostCommentReply")
    def to_post_comment_reply(self) -> "Codecommit":
        '''(experimental) Grants permission to post a comment in reply to a comment on a comparison between commits or a pull request.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_PostCommentReply.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toPostCommentReply", []))

    @jsii.member(jsii_name="toPutCommentReaction")
    def to_put_comment_reaction(self) -> "Codecommit":
        '''(experimental) Grants permission to post a reaction on a comment.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_PutCommentReaction.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toPutCommentReaction", []))

    @jsii.member(jsii_name="toPutFile")
    def to_put_file(self) -> "Codecommit":
        '''(experimental) Grants permission to add or update a file in a branch in an AWS CodeCommit repository, and generate a commit for the addition in the specified branch.

        Access Level: Write

        Possible conditions:

        - .ifReferences()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_PutFile.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toPutFile", []))

    @jsii.member(jsii_name="toPutRepositoryTriggers")
    def to_put_repository_triggers(self) -> "Codecommit":
        '''(experimental) Grants permission to create, update, or delete triggers for a repository.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_PutRepositoryTriggers.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toPutRepositoryTriggers", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Codecommit":
        '''(experimental) Grants permission to attach resource tags to a CodeCommit resource ARN.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestRepositoryTriggers")
    def to_test_repository_triggers(self) -> "Codecommit":
        '''(experimental) Grants permission to test the functionality of repository triggers by sending information to the trigger target.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_TestRepositoryTriggers.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toTestRepositoryTriggers", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Codecommit":
        '''(experimental) Grants permission to disassociate resource tags from a CodeCommit resource ARN.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApprovalRuleTemplateContent")
    def to_update_approval_rule_template_content(self) -> "Codecommit":
        '''(experimental) Grants permission to update the content of approval rule templates;

        does not grant permission to update content of approval rules created specifically for pull requests

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdateApprovalRuleTemplateContent.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdateApprovalRuleTemplateContent", []))

    @jsii.member(jsii_name="toUpdateApprovalRuleTemplateDescription")
    def to_update_approval_rule_template_description(self) -> "Codecommit":
        '''(experimental) Grants permission to update the description of approval rule templates.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdateApprovalRuleTemplateDescription.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdateApprovalRuleTemplateDescription", []))

    @jsii.member(jsii_name="toUpdateApprovalRuleTemplateName")
    def to_update_approval_rule_template_name(self) -> "Codecommit":
        '''(experimental) Grants permission to update the name of approval rule templates.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdateApprovalRuleTemplateName.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdateApprovalRuleTemplateName", []))

    @jsii.member(jsii_name="toUpdateComment")
    def to_update_comment(self) -> "Codecommit":
        '''(experimental) Grants permission to update the contents of a comment if the identity matches the identity used to create the comment.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdateComment.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdateComment", []))

    @jsii.member(jsii_name="toUpdateDefaultBranch")
    def to_update_default_branch(self) -> "Codecommit":
        '''(experimental) Grants permission to change the default branch in an AWS CodeCommit repository.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdateDefaultBranch.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdateDefaultBranch", []))

    @jsii.member(jsii_name="toUpdatePullRequestApprovalRuleContent")
    def to_update_pull_request_approval_rule_content(self) -> "Codecommit":
        '''(experimental) Grants permission to update the content for approval rules created for a specific pull requests;

        does not grant permission to update approval rule content for rules created with an approval rule template

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdatePullRequestApprovalRuleContent.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdatePullRequestApprovalRuleContent", []))

    @jsii.member(jsii_name="toUpdatePullRequestApprovalState")
    def to_update_pull_request_approval_state(self) -> "Codecommit":
        '''(experimental) Grants permission to update the approval state for pull requests.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdatePullRequestApprovalState.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdatePullRequestApprovalState", []))

    @jsii.member(jsii_name="toUpdatePullRequestDescription")
    def to_update_pull_request_description(self) -> "Codecommit":
        '''(experimental) Grants permission to update the description of a pull request.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdatePullRequestDescription.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdatePullRequestDescription", []))

    @jsii.member(jsii_name="toUpdatePullRequestStatus")
    def to_update_pull_request_status(self) -> "Codecommit":
        '''(experimental) Grants permission to update the status of a pull request.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdatePullRequestStatus.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdatePullRequestStatus", []))

    @jsii.member(jsii_name="toUpdatePullRequestTitle")
    def to_update_pull_request_title(self) -> "Codecommit":
        '''(experimental) Grants permission to update the title of a pull request.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdatePullRequestTitle.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdatePullRequestTitle", []))

    @jsii.member(jsii_name="toUpdateRepositoryDescription")
    def to_update_repository_description(self) -> "Codecommit":
        '''(experimental) Grants permission to change the description of an AWS CodeCommit repository.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdateRepositoryDescription.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdateRepositoryDescription", []))

    @jsii.member(jsii_name="toUpdateRepositoryName")
    def to_update_repository_name(self) -> "Codecommit":
        '''(experimental) Grants permission to change the name of an AWS CodeCommit repository.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/APIReference/API_UpdateRepositoryName.html

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUpdateRepositoryName", []))

    @jsii.member(jsii_name="toUploadArchive")
    def to_upload_archive(self) -> "Codecommit":
        '''(experimental) Grants permission to the service role for AWS CodePipeline to upload repository changes into a pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control-permissions-reference.html#aa-acp

        :stability: experimental
        '''
        return typing.cast("Codecommit", jsii.invoke(self, "toUploadArchive", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0258a325b9cb19a77c0840d2520572c02cf29c36bfc744d352cab329dea3ad5f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b3997ff6f894540d9f2cf3697594a5d661289a7703c1c8a31ee462ddcc204180)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Codedeploy(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Codedeploy",
):
    '''(experimental) Statement provider for service `codedeploy <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodedeploy.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codedeploy <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodedeploy.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__06aa6dedf802387a6e4e2c6e4b0c4d7212369014f481d0edb9aec7ae660956ef)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        application_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codedeploy":
        '''(experimental) Adds a resource of type application to the statement.

        https://docs.aws.amazon.com/codedeploy/latest/userguide/auth-and-access-control-permissions-reference.html

        :param application_name: - Identifier for the applicationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9acced9ba0046a9212949b2bbf3e947b8ebe5e16de2297c40ed98eed12be8420)
            check_type(argname="argument application_name", value=application_name, expected_type=type_hints["application_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codedeploy", jsii.invoke(self, "onApplication", [application_name, account, region, partition]))

    @jsii.member(jsii_name="onDeploymentconfig")
    def on_deploymentconfig(
        self,
        deployment_configuration_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codedeploy":
        '''(experimental) Adds a resource of type deploymentconfig to the statement.

        https://docs.aws.amazon.com/codedeploy/latest/userguide/auth-and-access-control-permissions-reference.html

        :param deployment_configuration_name: - Identifier for the deploymentConfigurationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__82501286b2848dfc296c40d559fa8ef59e5f5c6a11e50a76520817a58355d90f)
            check_type(argname="argument deployment_configuration_name", value=deployment_configuration_name, expected_type=type_hints["deployment_configuration_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codedeploy", jsii.invoke(self, "onDeploymentconfig", [deployment_configuration_name, account, region, partition]))

    @jsii.member(jsii_name="onDeploymentgroup")
    def on_deploymentgroup(
        self,
        application_name: builtins.str,
        deployment_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codedeploy":
        '''(experimental) Adds a resource of type deploymentgroup to the statement.

        https://docs.aws.amazon.com/codedeploy/latest/userguide/auth-and-access-control-permissions-reference.html

        :param application_name: - Identifier for the applicationName.
        :param deployment_group_name: - Identifier for the deploymentGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6744ec9e2fe9ec62450c735cc51f3125348cfb6395fc74a1d139f57476996549)
            check_type(argname="argument application_name", value=application_name, expected_type=type_hints["application_name"])
            check_type(argname="argument deployment_group_name", value=deployment_group_name, expected_type=type_hints["deployment_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codedeploy", jsii.invoke(self, "onDeploymentgroup", [application_name, deployment_group_name, account, region, partition]))

    @jsii.member(jsii_name="onInstance")
    def on_instance(
        self,
        instance_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codedeploy":
        '''(experimental) Adds a resource of type instance to the statement.

        https://docs.aws.amazon.com/codedeploy/latest/userguide/auth-and-access-control-permissions-reference.html

        :param instance_name: - Identifier for the instanceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__010f2df40b04b7326c88dd6225a8af6d1fac9bbd14b1d39719bc780e18baa65a)
            check_type(argname="argument instance_name", value=instance_name, expected_type=type_hints["instance_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codedeploy", jsii.invoke(self, "onInstance", [instance_name, account, region, partition]))

    @jsii.member(jsii_name="toAddTagsToOnPremisesInstances")
    def to_add_tags_to_on_premises_instances(self) -> "Codedeploy":
        '''(experimental) Grants permission to add tags to one or more on-premises instances.

        Access Level: Tagging

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_AddTagsToOnPremisesInstances.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toAddTagsToOnPremisesInstances", []))

    @jsii.member(jsii_name="toBatchGetApplicationRevisions")
    def to_batch_get_application_revisions(self) -> "Codedeploy":
        '''(experimental) Grants permission to get information about one or more application revisions.

        Access Level: Read

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetApplicationRevisions.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toBatchGetApplicationRevisions", []))

    @jsii.member(jsii_name="toBatchGetApplications")
    def to_batch_get_applications(self) -> "Codedeploy":
        '''(experimental) Grants permission to get information about multiple applications associated with the IAM user.

        Access Level: Read

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetApplications.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toBatchGetApplications", []))

    @jsii.member(jsii_name="toBatchGetDeploymentGroups")
    def to_batch_get_deployment_groups(self) -> "Codedeploy":
        '''(experimental) Grants permission to get information about one or more deployment groups.

        Access Level: Read

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetDeploymentGroups.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toBatchGetDeploymentGroups", []))

    @jsii.member(jsii_name="toBatchGetDeploymentInstances")
    def to_batch_get_deployment_instances(self) -> "Codedeploy":
        '''(experimental) Grants permission to get information about one or more instance that are part of a deployment group.

        Access Level: Read

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetDeploymentInstances.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toBatchGetDeploymentInstances", []))

    @jsii.member(jsii_name="toBatchGetDeployments")
    def to_batch_get_deployments(self) -> "Codedeploy":
        '''(experimental) Grants permission to get information about multiple deployments associated with the IAM user.

        Access Level: Read

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetDeployments.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toBatchGetDeployments", []))

    @jsii.member(jsii_name="toBatchGetDeploymentTargets")
    def to_batch_get_deployment_targets(self) -> "Codedeploy":
        '''(experimental) Grants permission to return an array of one or more targets associated with a deployment.

        This method works with all compute types and should be used instead of the deprecated BatchGetDeploymentInstances. The maximum number of targets that can be returned is 25

        Access Level: Read

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetDeploymentTargets.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toBatchGetDeploymentTargets", []))

    @jsii.member(jsii_name="toBatchGetOnPremisesInstances")
    def to_batch_get_on_premises_instances(self) -> "Codedeploy":
        '''(experimental) Grants permission to get information about one or more on-premises instances.

        Access Level: Read

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetOnPremisesInstances.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toBatchGetOnPremisesInstances", []))

    @jsii.member(jsii_name="toContinueDeployment")
    def to_continue_deployment(self) -> "Codedeploy":
        '''(experimental) Grants permission to start the process of rerouting traffic from instances in the original environment to instances in thereplacement environment without waiting for a specified wait time to elapse.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ContinueDeployment.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toContinueDeployment", []))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "Codedeploy":
        '''(experimental) Grants permission to create an application associated with the IAM user.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toCreateCloudFormationDeployment")
    def to_create_cloud_formation_deployment(self) -> "Codedeploy":
        '''(experimental) Grants permission to create CloudFormation deployment to cooperate ochestration for a CloudFormation stack update.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toCreateCloudFormationDeployment", []))

    @jsii.member(jsii_name="toCreateDeployment")
    def to_create_deployment(self) -> "Codedeploy":
        '''(experimental) Grants permission to create a deployment for an application associated with the IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_CreateDeployment.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toCreateDeployment", []))

    @jsii.member(jsii_name="toCreateDeploymentConfig")
    def to_create_deployment_config(self) -> "Codedeploy":
        '''(experimental) Grants permission to create a custom deployment configuration associated with the IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_CreateDeploymentConfig.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toCreateDeploymentConfig", []))

    @jsii.member(jsii_name="toCreateDeploymentGroup")
    def to_create_deployment_group(self) -> "Codedeploy":
        '''(experimental) Grants permission to create a deployment group for an application associated with the IAM user.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_CreateDeploymentGroup.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toCreateDeploymentGroup", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "Codedeploy":
        '''(experimental) Grants permission to delete an application associated with the IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toDeleteDeploymentConfig")
    def to_delete_deployment_config(self) -> "Codedeploy":
        '''(experimental) Grants permission to delete a custom deployment configuration associated with the IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeleteDeploymentConfig.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toDeleteDeploymentConfig", []))

    @jsii.member(jsii_name="toDeleteDeploymentGroup")
    def to_delete_deployment_group(self) -> "Codedeploy":
        '''(experimental) Grants permission to delete a deployment group for an application associated with the IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeleteDeploymentGroup.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toDeleteDeploymentGroup", []))

    @jsii.member(jsii_name="toDeleteGitHubAccountToken")
    def to_delete_git_hub_account_token(self) -> "Codedeploy":
        '''(experimental) Grants permission to delete a GitHub account connection.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeleteGitHubAccountToken.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toDeleteGitHubAccountToken", []))

    @jsii.member(jsii_name="toDeleteResourcesByExternalId")
    def to_delete_resources_by_external_id(self) -> "Codedeploy":
        '''(experimental) Grants permission to delete resources associated with the given external Id.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeleteResourcesByExternalId.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toDeleteResourcesByExternalId", []))

    @jsii.member(jsii_name="toDeregisterOnPremisesInstance")
    def to_deregister_on_premises_instance(self) -> "Codedeploy":
        '''(experimental) Grants permission to deregister an on-premises instance.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeregisterOnPremisesInstance.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toDeregisterOnPremisesInstance", []))

    @jsii.member(jsii_name="toGetApplication")
    def to_get_application(self) -> "Codedeploy":
        '''(experimental) Grants permission to get information about a single application associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetApplication.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toGetApplication", []))

    @jsii.member(jsii_name="toGetApplicationRevision")
    def to_get_application_revision(self) -> "Codedeploy":
        '''(experimental) Grants permission to get information about a single application revision for an application associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetApplicationRevision.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toGetApplicationRevision", []))

    @jsii.member(jsii_name="toGetDeployment")
    def to_get_deployment(self) -> "Codedeploy":
        '''(experimental) Grants permission to get information about a single deployment to a deployment group for an application associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeployment.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toGetDeployment", []))

    @jsii.member(jsii_name="toGetDeploymentConfig")
    def to_get_deployment_config(self) -> "Codedeploy":
        '''(experimental) Grants permission to get information about a single deployment configuration associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeploymentConfig.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toGetDeploymentConfig", []))

    @jsii.member(jsii_name="toGetDeploymentGroup")
    def to_get_deployment_group(self) -> "Codedeploy":
        '''(experimental) Grants permission to get information about a single deployment group for an application associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeploymentGroup.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toGetDeploymentGroup", []))

    @jsii.member(jsii_name="toGetDeploymentInstance")
    def to_get_deployment_instance(self) -> "Codedeploy":
        '''(experimental) Grants permission to get information about a single instance in a deployment associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeploymentInstance.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toGetDeploymentInstance", []))

    @jsii.member(jsii_name="toGetDeploymentTarget")
    def to_get_deployment_target(self) -> "Codedeploy":
        '''(experimental) Grants permission to return information about a deployment target.

        Access Level: Read

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeploymentTarget.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toGetDeploymentTarget", []))

    @jsii.member(jsii_name="toGetOnPremisesInstance")
    def to_get_on_premises_instance(self) -> "Codedeploy":
        '''(experimental) Grants permission to get information about a single on-premises instance.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetOnPremisesInstance.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toGetOnPremisesInstance", []))

    @jsii.member(jsii_name="toListApplicationRevisions")
    def to_list_application_revisions(self) -> "Codedeploy":
        '''(experimental) Grants permission to get information about all application revisions for an application associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListApplicationRevisions.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toListApplicationRevisions", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "Codedeploy":
        '''(experimental) Grants permission to get information about all applications associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListApplications.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListDeploymentConfigs")
    def to_list_deployment_configs(self) -> "Codedeploy":
        '''(experimental) Grants permission to get information about all deployment configurations associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeploymentConfigs.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toListDeploymentConfigs", []))

    @jsii.member(jsii_name="toListDeploymentGroups")
    def to_list_deployment_groups(self) -> "Codedeploy":
        '''(experimental) Grants permission to get information about all deployment groups for an application associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeploymentGroups.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toListDeploymentGroups", []))

    @jsii.member(jsii_name="toListDeploymentInstances")
    def to_list_deployment_instances(self) -> "Codedeploy":
        '''(experimental) Grants permission to get information about all instances in a deployment associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeploymentInstances.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toListDeploymentInstances", []))

    @jsii.member(jsii_name="toListDeployments")
    def to_list_deployments(self) -> "Codedeploy":
        '''(experimental) Grants permission to get information about all deployments to a deployment group associated with the IAM user, or to get all deployments associated with the IAM user.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeployments.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toListDeployments", []))

    @jsii.member(jsii_name="toListDeploymentTargets")
    def to_list_deployment_targets(self) -> "Codedeploy":
        '''(experimental) Grants permission to return an array of target IDs that are associated a deployment.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeploymentTargets.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toListDeploymentTargets", []))

    @jsii.member(jsii_name="toListGitHubAccountTokenNames")
    def to_list_git_hub_account_token_names(self) -> "Codedeploy":
        '''(experimental) Grants permission to list the names of stored connections to GitHub accounts.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListGitHubAccountTokenNames.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toListGitHubAccountTokenNames", []))

    @jsii.member(jsii_name="toListOnPremisesInstances")
    def to_list_on_premises_instances(self) -> "Codedeploy":
        '''(experimental) Grants permission to get a list of one or more on-premises instance names.

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListOnPremisesInstances.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toListOnPremisesInstances", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Codedeploy":
        '''(experimental) Grants permission to return a list of tags for the resource identified by a specified ARN.

        Tags are used to organize and categorize your CodeDeploy resources

        Access Level: List

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutLifecycleEventHookExecutionStatus")
    def to_put_lifecycle_event_hook_execution_status(self) -> "Codedeploy":
        '''(experimental) Grants permission to notify a lifecycle event hook execution status for associated deployment with the IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_PutLifecycleEventHookExecutionStatus.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toPutLifecycleEventHookExecutionStatus", []))

    @jsii.member(jsii_name="toRegisterApplicationRevision")
    def to_register_application_revision(self) -> "Codedeploy":
        '''(experimental) Grants permission to register information about an application revision for an application associated with the IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_RegisterApplicationRevision.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toRegisterApplicationRevision", []))

    @jsii.member(jsii_name="toRegisterOnPremisesInstance")
    def to_register_on_premises_instance(self) -> "Codedeploy":
        '''(experimental) Grants permission to register an on-premises instance.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_RegisterOnPremisesInstance.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toRegisterOnPremisesInstance", []))

    @jsii.member(jsii_name="toRemoveTagsFromOnPremisesInstances")
    def to_remove_tags_from_on_premises_instances(self) -> "Codedeploy":
        '''(experimental) Grants permission to remove tags from one or more on-premises instances.

        Access Level: Tagging

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_RemoveTagsFromOnPremisesInstances.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toRemoveTagsFromOnPremisesInstances", []))

    @jsii.member(jsii_name="toSkipWaitTimeForInstanceTermination")
    def to_skip_wait_time_for_instance_termination(self) -> "Codedeploy":
        '''(experimental) Grants permission to override any specified wait time and starts terminating instances immediately after the traffic routing is complete.

        This action applies to blue-green deployments only

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_SkipWaitTimeForInstanceTermination.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toSkipWaitTimeForInstanceTermination", []))

    @jsii.member(jsii_name="toStopDeployment")
    def to_stop_deployment(self) -> "Codedeploy":
        '''(experimental) Grants permission to stop a deployment.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_StopDeployment.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toStopDeployment", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Codedeploy":
        '''(experimental) Grants permission to associate the list of tags in the input Tags parameter with the resource identified by the ResourceArn input parameter.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Codedeploy":
        '''(experimental) Grants permission to disassociate a resource from a list of tags.

        The resource is identified by the ResourceArn input parameter. The tags are identfied by the list of keys in the TagKeys input parameter

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "Codedeploy":
        '''(experimental) Grants permission to update an application.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toUpdateApplication", []))

    @jsii.member(jsii_name="toUpdateDeploymentGroup")
    def to_update_deployment_group(self) -> "Codedeploy":
        '''(experimental) Grants permission to change information about a single deployment group for an application associated with the IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_UpdateDeploymentGroup.html

        :stability: experimental
        '''
        return typing.cast("Codedeploy", jsii.invoke(self, "toUpdateDeploymentGroup", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a882e75e584d87eecadce14c68b27fd374820e1d4289d4e2147fdacbfae3f8b3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b82da6474c11bf7c2d6db975db4ac0aa644c4fd0d6f305dc87540ce4da534d66)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class CodedeployCommandsSecure(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.CodedeployCommandsSecure",
):
    '''(experimental) Statement provider for service `codedeploy-commands-secure <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodedeploysecurehostcommandsservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codedeploy-commands-secure <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodedeploysecurehostcommandsservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6b11d62533a9c864894b187283e92365414c117e28a9fe13084cb3f852bbd322)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toGetDeploymentSpecification")
    def to_get_deployment_specification(self) -> "CodedeployCommandsSecure":
        '''(experimental) Grants permission to get deployment specification.

        Access Level: Read

        https://docs.aws.amazon.com/codedeploy/latest/userguide/vpc-endpoints.html#vpc-codedeploy-agent-configuration

        :stability: experimental
        '''
        return typing.cast("CodedeployCommandsSecure", jsii.invoke(self, "toGetDeploymentSpecification", []))

    @jsii.member(jsii_name="toPollHostCommand")
    def to_poll_host_command(self) -> "CodedeployCommandsSecure":
        '''(experimental) Grants permission to request host agent commands.

        Access Level: Read

        https://docs.aws.amazon.com/codedeploy/latest/userguide/vpc-endpoints.html#vpc-codedeploy-agent-configuration

        :stability: experimental
        '''
        return typing.cast("CodedeployCommandsSecure", jsii.invoke(self, "toPollHostCommand", []))

    @jsii.member(jsii_name="toPutHostCommandAcknowledgement")
    def to_put_host_command_acknowledgement(self) -> "CodedeployCommandsSecure":
        '''(experimental) Grants permission to mark host agent commands acknowledged.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/userguide/vpc-endpoints.html#vpc-codedeploy-agent-configuration

        :stability: experimental
        '''
        return typing.cast("CodedeployCommandsSecure", jsii.invoke(self, "toPutHostCommandAcknowledgement", []))

    @jsii.member(jsii_name="toPutHostCommandComplete")
    def to_put_host_command_complete(self) -> "CodedeployCommandsSecure":
        '''(experimental) Grants permission to mark host agent commands completed.

        Access Level: Write

        https://docs.aws.amazon.com/codedeploy/latest/userguide/vpc-endpoints.html#vpc-codedeploy-agent-configuration

        :stability: experimental
        '''
        return typing.cast("CodedeployCommandsSecure", jsii.invoke(self, "toPutHostCommandComplete", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2203b21641bf6c0e780c69096daf94510330159c94231456780ade602f326da9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__893b2624813d11a65b509ba905699c80c5e4ab49244e7c68e1ad0d7e803b6cef)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Codeguru(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Codeguru",
):
    '''(experimental) Statement provider for service `codeguru <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncodeguru.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codeguru <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncodeguru.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__50261d62adc64dd381673a1cf7d0fb7ceeacbe6cb390a621e6b90f7d32c0803a)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toGetCodeGuruFreeTrialSummary")
    def to_get_code_guru_free_trial_summary(self) -> "Codeguru":
        '''(experimental) Grants permission to get free trial summary for the CodeGuru service which includes expiration date.

        Access Level: Read

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_GetCodeGuruFreeTrialSummary.html

        :stability: experimental
        '''
        return typing.cast("Codeguru", jsii.invoke(self, "toGetCodeGuruFreeTrialSummary", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6b609efbf0a575a41636822a7301cf807d2573095e89f61b51edbba1ca7638f1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d2024c04b20c0a5cf68d80b40d7a6a198b8737b9ea56309c3d1659371aaf6974)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class CodeguruProfiler(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.CodeguruProfiler",
):
    '''(experimental) Statement provider for service `codeguru-profiler <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncodeguruprofiler.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codeguru-profiler <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncodeguruprofiler.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fa9956816b9d7e2fe23d8a462c910386fad3b746600822390fda293830bd3582)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onProfilingGroup")
    def on_profiling_group(
        self,
        profiling_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CodeguruProfiler":
        '''(experimental) Adds a resource of type ProfilingGroup to the statement.

        https://docs.aws.amazon.com/codeguru/latest/profiler-ug/working-with-profiling-groups.html

        :param profiling_group_name: - Identifier for the profilingGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__46ac148611e7ba807077e6b90279183e6dae31a8bb73be8dfb3d425528524319)
            check_type(argname="argument profiling_group_name", value=profiling_group_name, expected_type=type_hints["profiling_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "onProfilingGroup", [profiling_group_name, account, region, partition]))

    @jsii.member(jsii_name="toAddNotificationChannels")
    def to_add_notification_channels(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to add up to 2 topic ARNs of existing AWS SNS topics to publish notifications.

        Access Level: Write

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_AddNotificationChannels.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toAddNotificationChannels", []))

    @jsii.member(jsii_name="toBatchGetFrameMetricData")
    def to_batch_get_frame_metric_data(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to get the frame metric data for a Profiling Group.

        Access Level: List

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_BatchGetFrameMetricData.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toBatchGetFrameMetricData", []))

    @jsii.member(jsii_name="toConfigureAgent")
    def to_configure_agent(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to register with the orchestration service and retrieve profiling configuration information, used by agents.

        Access Level: Write

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_ConfigureAgent.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toConfigureAgent", []))

    @jsii.member(jsii_name="toCreateProfilingGroup")
    def to_create_profiling_group(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to create a profiling group.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_CreateProfilingGroup.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toCreateProfilingGroup", []))

    @jsii.member(jsii_name="toDeleteProfilingGroup")
    def to_delete_profiling_group(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to delete a profiling group.

        Access Level: Write

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_DeleteProfilingGroup.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toDeleteProfilingGroup", []))

    @jsii.member(jsii_name="toDescribeProfilingGroup")
    def to_describe_profiling_group(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to describe a profiling group.

        Access Level: Read

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_DescribeProfilingGroup.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toDescribeProfilingGroup", []))

    @jsii.member(jsii_name="toGetFindingsReportAccountSummary")
    def to_get_findings_report_account_summary(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to get a summary of recent recommendations for each profiling group in the account.

        Access Level: Read

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_GetFindingsReportAccountSummary.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toGetFindingsReportAccountSummary", []))

    @jsii.member(jsii_name="toGetNotificationConfiguration")
    def to_get_notification_configuration(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to get the notification configuration.

        Access Level: Read

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_GetNotificationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toGetNotificationConfiguration", []))

    @jsii.member(jsii_name="toGetPolicy")
    def to_get_policy(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to get the resource policy associated with the specified Profiling Group.

        Access Level: Read

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_GetPolicy.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toGetPolicy", []))

    @jsii.member(jsii_name="toGetProfile")
    def to_get_profile(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to get aggregated profiles for a specific profiling group.

        Access Level: Read

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_GetProfile.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toGetProfile", []))

    @jsii.member(jsii_name="toGetRecommendations")
    def to_get_recommendations(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to get recommendations.

        Access Level: Read

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_GetRecommendations.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toGetRecommendations", []))

    @jsii.member(jsii_name="toListFindingsReports")
    def to_list_findings_reports(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to list the available recommendations reports for a specific profiling group.

        Access Level: List

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_ListFindingsReports.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toListFindingsReports", []))

    @jsii.member(jsii_name="toListProfileTimes")
    def to_list_profile_times(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to list the start times of the available aggregated profiles for a specific profiling group.

        Access Level: List

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_ListProfileTimes.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toListProfileTimes", []))

    @jsii.member(jsii_name="toListProfilingGroups")
    def to_list_profiling_groups(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to list profiling groups in the account.

        Access Level: List

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_ListProfilingGroups.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toListProfilingGroups", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to list tags for a Profiling Group.

        Access Level: List

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPostAgentProfile")
    def to_post_agent_profile(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to submit a profile collected by an agent belonging to a specific profiling group for aggregation.

        Access Level: Write

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_PostAgentProfile.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toPostAgentProfile", []))

    @jsii.member(jsii_name="toPutPermission")
    def to_put_permission(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to update the list of principals allowed for an action group in the resource policy associated with the specified Profiling Group.

        Access Level: Permissions management

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_PutPermission.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toPutPermission", []))

    @jsii.member(jsii_name="toRemoveNotificationChannel")
    def to_remove_notification_channel(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to delete an already configured SNStopic arn from the notification configuration.

        Access Level: Write

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_RemoveNotificationChannel.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toRemoveNotificationChannel", []))

    @jsii.member(jsii_name="toRemovePermission")
    def to_remove_permission(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to remove the permission of specified Action Group from the resource policy associated with the specified Profiling Group.

        Access Level: Permissions management

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_RemovePermission.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toRemovePermission", []))

    @jsii.member(jsii_name="toSubmitFeedback")
    def to_submit_feedback(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to submit user feedback for useful or non useful anomaly.

        Access Level: Write

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_SubmitFeedback.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toSubmitFeedback", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to add or overwrite tags to a Profiling Group.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to remove tags from a Profiling Group.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateProfilingGroup")
    def to_update_profiling_group(self) -> "CodeguruProfiler":
        '''(experimental) Grants permission to update a specific profiling group.

        Access Level: Write

        https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_UpdateProfilingGroup.html

        :stability: experimental
        '''
        return typing.cast("CodeguruProfiler", jsii.invoke(self, "toUpdateProfilingGroup", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c7343b479c5bb7ccb48a7f5feba4a4a412daa1f2106c60c7f3640cfe49d2b32b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4cf69bce53160c45c75c879790713beaa16f74084fb32ae04f593e1b3a714ecc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class CodeguruReviewer(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.CodeguruReviewer",
):
    '''(experimental) Statement provider for service `codeguru-reviewer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncodegurureviewer.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codeguru-reviewer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncodegurureviewer.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b90e71675cd3736d230ab5f52703f25bb20a96783226b08310aff906298b245a)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAssociation")
    def on_association(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CodeguruReviewer":
        '''(experimental) Adds a resource of type association to the statement.

        https://docs.aws.amazon.com/codeguru/latest/reviewer-ug/working-with-repositories.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__709703b08fb862474b31e76b4bdbc973876cffe49e7d250f4b8d0b285d380f0e)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "onAssociation", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onCodereview")
    def on_codereview(
        self,
        code_review_uuid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CodeguruReviewer":
        '''(experimental) Adds a resource of type codereview to the statement.

        https://docs.aws.amazon.com/codeguru/latest/reviewer-ug/code-reviews.html

        :param code_review_uuid: - Identifier for the codeReviewUuid.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8ef25f1527fd4124143ae35ddacd94fc2aeeb51196cae2e439c32773b2d5b921)
            check_type(argname="argument code_review_uuid", value=code_review_uuid, expected_type=type_hints["code_review_uuid"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "onCodereview", [code_review_uuid, account, region, partition]))

    @jsii.member(jsii_name="toAssociateRepository")
    def to_associate_repository(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to associates a repository with Amazon CodeGuru Reviewer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - codecommit:GetRepository
        - codecommit:ListRepositories
        - codecommit:TagResource
        - codestar-connections:PassConnection
        - events:PutRule
        - events:PutTargets
        - iam:CreateServiceLinkedRole
        - s3:CreateBucket
        - s3:ListBucket
        - s3:PutBucketPolicy
        - s3:PutLifecycleConfiguration

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_AssociateRepository.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toAssociateRepository", []))

    @jsii.member(jsii_name="toCreateCodeReview")
    def to_create_code_review(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to create a code review.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_CreateCodeReview.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toCreateCodeReview", []))

    @jsii.member(jsii_name="toCreateConnectionToken")
    def to_create_connection_token(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to perform webbased oauth handshake for 3rd party providers.

        Access Level: Read

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/Welcome.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toCreateConnectionToken", []))

    @jsii.member(jsii_name="toDescribeCodeReview")
    def to_describe_code_review(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to describe a code review.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_DescribeCodeReview.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toDescribeCodeReview", []))

    @jsii.member(jsii_name="toDescribeRecommendationFeedback")
    def to_describe_recommendation_feedback(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to describe a recommendation feedback on a code review.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_DescribeRecommendationFeedback.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toDescribeRecommendationFeedback", []))

    @jsii.member(jsii_name="toDescribeRepositoryAssociation")
    def to_describe_repository_association(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to describe a repository association.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_DescribeRepositoryAssociation.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toDescribeRepositoryAssociation", []))

    @jsii.member(jsii_name="toDisassociateRepository")
    def to_disassociate_repository(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to disassociate a repository with Amazon CodeGuru Reviewer.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - codecommit:UntagResource
        - events:DeleteRule
        - events:RemoveTargets

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_DisassociateRepository.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toDisassociateRepository", []))

    @jsii.member(jsii_name="toGetMetricsData")
    def to_get_metrics_data(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to view pull request metrics in console.

        Access Level: Read

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/Welcome.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toGetMetricsData", []))

    @jsii.member(jsii_name="toListCodeReviews")
    def to_list_code_reviews(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to list summary of code reviews.

        Access Level: List

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_ListCodeReviews.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toListCodeReviews", []))

    @jsii.member(jsii_name="toListRecommendationFeedback")
    def to_list_recommendation_feedback(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to list summary of recommendation feedback on a code review.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_ListRecommendationFeedback.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toListRecommendationFeedback", []))

    @jsii.member(jsii_name="toListRecommendations")
    def to_list_recommendations(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to list summary of recommendations on a code review.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_ListRecommendations.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toListRecommendations", []))

    @jsii.member(jsii_name="toListRepositoryAssociations")
    def to_list_repository_associations(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to list summary of repository associations.

        Access Level: List

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_ListRepositoryAssociations.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toListRepositoryAssociations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to list the resource attached to a associated repository ARN.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListThirdPartyRepositories")
    def to_list_third_party_repositories(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to list 3rd party providers repositories in console.

        Access Level: Read

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/Welcome.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toListThirdPartyRepositories", []))

    @jsii.member(jsii_name="toPutRecommendationFeedback")
    def to_put_recommendation_feedback(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to put feedback for a recommendation on a code review.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_PutRecommendationFeedback.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toPutRecommendationFeedback", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to attach resource tags to an associated repository ARN.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUnTagResource")
    def to_un_tag_resource(self) -> "CodeguruReviewer":
        '''(experimental) Grants permission to disassociate resource tags from an associated repository ARN.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("CodeguruReviewer", jsii.invoke(self, "toUnTagResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f63268c46e506235a60c43a252b0b55e5357d2cabc1674d195b1fb9d3bdf10ab)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f614f1b6e33ff523b994444ad0406b00b75bbb28ad9d4c97a08948cfcf1509d6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class CodeguruSecurity(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.CodeguruSecurity",
):
    '''(experimental) Statement provider for service `codeguru-security <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncodegurusecurity.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codeguru-security <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncodegurusecurity.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9073eb1536dc71c56c9bfd03a8ce16f0fd91d74f67fe2548256338d745cd5dc2)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toBatchGetFindings")
    def to_batch_get_findings(self) -> "CodeguruSecurity":
        '''(experimental) Grants permission to batch retrieve specific findings generated by CodeGuru Security.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("CodeguruSecurity", jsii.invoke(self, "toBatchGetFindings", []))

    @jsii.member(jsii_name="toCreateScan")
    def to_create_scan(self) -> "CodeguruSecurity":
        '''(experimental) Grants permission to create CodeGuru Security scan.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("CodeguruSecurity", jsii.invoke(self, "toCreateScan", []))

    @jsii.member(jsii_name="toCreateUploadUrl")
    def to_create_upload_url(self) -> "CodeguruSecurity":
        '''(experimental) Grants permission to generate a presigned url for uploading code archives.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("CodeguruSecurity", jsii.invoke(self, "toCreateUploadUrl", []))

    @jsii.member(jsii_name="toDeleteScansByCategory")
    def to_delete_scans_by_category(self) -> "CodeguruSecurity":
        '''(experimental) Grants permission to delete all the scans and related findings from CodeGuru Security by given category.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("CodeguruSecurity", jsii.invoke(self, "toDeleteScansByCategory", []))

    @jsii.member(jsii_name="toGetScan")
    def to_get_scan(self) -> "CodeguruSecurity":
        '''(experimental) Grants permission to retrieve CodeGuru Security scan metadata.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("CodeguruSecurity", jsii.invoke(self, "toGetScan", []))

    @jsii.member(jsii_name="toListFindings")
    def to_list_findings(self) -> "CodeguruSecurity":
        '''(experimental) Grants permission to retrieve findings generated by CodeGuru Security.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("CodeguruSecurity", jsii.invoke(self, "toListFindings", []))

    @jsii.member(jsii_name="toListScans")
    def to_list_scans(self) -> "CodeguruSecurity":
        '''(experimental) Grants permission to retrieve list of CodeGuru Security scan metadata.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("CodeguruSecurity", jsii.invoke(self, "toListScans", []))

    @jsii.member(jsii_name="toUpdateAccountConfiguration")
    def to_update_account_configuration(self) -> "CodeguruSecurity":
        '''(experimental) Grants permission to update the account level configurations.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("CodeguruSecurity", jsii.invoke(self, "toUpdateAccountConfiguration", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f24efb0a76216f2a0d5d97f70dc3148b09606f073ab4d6457331155383ea9b36)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d22a6a75ac5df3e266b69cb5a4419e6d2079675606188b74f398a54943e595aa)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Codepipeline(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Codepipeline",
):
    '''(experimental) Statement provider for service `codepipeline <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodepipeline.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codepipeline <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodepipeline.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__961ed013a26167fcd77e0421cf67c5224baab87219b470857bce11c20aacbd82)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAction")
    def on_action(
        self,
        pipeline_name: builtins.str,
        stage_name: builtins.str,
        action_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codepipeline":
        '''(experimental) Adds a resource of type action to the statement.

        https://docs.aws.amazon.com/codepipeline/latest/userguide/iam-access-control-identity-based.html#ACP_ARN_Format

        :param pipeline_name: - Identifier for the pipelineName.
        :param stage_name: - Identifier for the stageName.
        :param action_name: - Identifier for the actionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bca61aedbf11fc6194b86f49f22ba22a35223508d64008f43e3f89cadb3eeda5)
            check_type(argname="argument pipeline_name", value=pipeline_name, expected_type=type_hints["pipeline_name"])
            check_type(argname="argument stage_name", value=stage_name, expected_type=type_hints["stage_name"])
            check_type(argname="argument action_name", value=action_name, expected_type=type_hints["action_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codepipeline", jsii.invoke(self, "onAction", [pipeline_name, stage_name, action_name, account, region, partition]))

    @jsii.member(jsii_name="onActiontype")
    def on_actiontype(
        self,
        owner: builtins.str,
        category: builtins.str,
        provider: builtins.str,
        version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codepipeline":
        '''(experimental) Adds a resource of type actiontype to the statement.

        https://docs.aws.amazon.com/codepipeline/latest/userguide/iam-access-control-identity-based.html#ACP_ARN_Format

        :param owner: - Identifier for the owner.
        :param category: - Identifier for the category.
        :param provider: - Identifier for the provider.
        :param version: - Identifier for the version.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__282ca84ca16aad9f97bfccb9bd13de49ff30e60e98bb27fd01c8115a8970fa1b)
            check_type(argname="argument owner", value=owner, expected_type=type_hints["owner"])
            check_type(argname="argument category", value=category, expected_type=type_hints["category"])
            check_type(argname="argument provider", value=provider, expected_type=type_hints["provider"])
            check_type(argname="argument version", value=version, expected_type=type_hints["version"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codepipeline", jsii.invoke(self, "onActiontype", [owner, category, provider, version, account, region, partition]))

    @jsii.member(jsii_name="onPipeline")
    def on_pipeline(
        self,
        pipeline_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codepipeline":
        '''(experimental) Adds a resource of type pipeline to the statement.

        https://docs.aws.amazon.com/codepipeline/latest/userguide/iam-access-control-identity-based.html#ACP_ARN_Format

        :param pipeline_name: - Identifier for the pipelineName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bf0751660e6d5e8a58c06bc0c901e96140b8360d879b0eaa88c0f4817d120482)
            check_type(argname="argument pipeline_name", value=pipeline_name, expected_type=type_hints["pipeline_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codepipeline", jsii.invoke(self, "onPipeline", [pipeline_name, account, region, partition]))

    @jsii.member(jsii_name="onStage")
    def on_stage(
        self,
        pipeline_name: builtins.str,
        stage_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codepipeline":
        '''(experimental) Adds a resource of type stage to the statement.

        https://docs.aws.amazon.com/codepipeline/latest/userguide/iam-access-control-identity-based.html#ACP_ARN_Format

        :param pipeline_name: - Identifier for the pipelineName.
        :param stage_name: - Identifier for the stageName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8250ad5686eb7c92af73b6ecc995d91bb97f1709fc65019040e633c1370c8708)
            check_type(argname="argument pipeline_name", value=pipeline_name, expected_type=type_hints["pipeline_name"])
            check_type(argname="argument stage_name", value=stage_name, expected_type=type_hints["stage_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codepipeline", jsii.invoke(self, "onStage", [pipeline_name, stage_name, account, region, partition]))

    @jsii.member(jsii_name="onWebhook")
    def on_webhook(
        self,
        webhook_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codepipeline":
        '''(experimental) Adds a resource of type webhook to the statement.

        https://docs.aws.amazon.com/codepipeline/latest/userguide/iam-access-control-identity-based.html#ACP_ARN_Format

        :param webhook_name: - Identifier for the webhookName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9ab6d70a130118bc8cb55969bccafd1f480121f6f169f41a8e5d7ca5e52e7700)
            check_type(argname="argument webhook_name", value=webhook_name, expected_type=type_hints["webhook_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codepipeline", jsii.invoke(self, "onWebhook", [webhook_name, account, region, partition]))

    @jsii.member(jsii_name="toAcknowledgeJob")
    def to_acknowledge_job(self) -> "Codepipeline":
        '''(experimental) Grants permission to view information about a specified job and whether that job has been received by the job worker.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_AcknowledgeJob.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toAcknowledgeJob", []))

    @jsii.member(jsii_name="toAcknowledgeThirdPartyJob")
    def to_acknowledge_third_party_job(self) -> "Codepipeline":
        '''(experimental) Grants permission to confirm that a job worker has received the specified job (partner actions only).

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_AcknowledgeThirdPartyJob.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toAcknowledgeThirdPartyJob", []))

    @jsii.member(jsii_name="toCreateCustomActionType")
    def to_create_custom_action_type(self) -> "Codepipeline":
        '''(experimental) Grants permission to create a custom action that you can use in the pipelines associated with your AWS account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_CreateCustomActionType.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toCreateCustomActionType", []))

    @jsii.member(jsii_name="toCreatePipeline")
    def to_create_pipeline(self) -> "Codepipeline":
        '''(experimental) Grants permission to create a uniquely named pipeline.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_CreatePipeline.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toCreatePipeline", []))

    @jsii.member(jsii_name="toDeleteCustomActionType")
    def to_delete_custom_action_type(self) -> "Codepipeline":
        '''(experimental) Grants permission to delete a custom action.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_DeleteCustomActionType.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toDeleteCustomActionType", []))

    @jsii.member(jsii_name="toDeletePipeline")
    def to_delete_pipeline(self) -> "Codepipeline":
        '''(experimental) Grants permission to delete a specified pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_DeletePipeline.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toDeletePipeline", []))

    @jsii.member(jsii_name="toDeleteWebhook")
    def to_delete_webhook(self) -> "Codepipeline":
        '''(experimental) Grants permission to delete a specified webhook.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_DeleteWebhook.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toDeleteWebhook", []))

    @jsii.member(jsii_name="toDeregisterWebhookWithThirdParty")
    def to_deregister_webhook_with_third_party(self) -> "Codepipeline":
        '''(experimental) Grants permission to remove the registration of a webhook with the third party specified in its configuration.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_DeregisterWebhookWithThirdParty.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toDeregisterWebhookWithThirdParty", []))

    @jsii.member(jsii_name="toDisableStageTransition")
    def to_disable_stage_transition(self) -> "Codepipeline":
        '''(experimental) Grants permission to prevent revisions from transitioning to the next stage in a pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_DisableStageTransition.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toDisableStageTransition", []))

    @jsii.member(jsii_name="toEnableStageTransition")
    def to_enable_stage_transition(self) -> "Codepipeline":
        '''(experimental) Grants permission to allow revisions to transition to the next stage in a pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_EnableStageTransition.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toEnableStageTransition", []))

    @jsii.member(jsii_name="toGetActionType")
    def to_get_action_type(self) -> "Codepipeline":
        '''(experimental) Grants permission to view information about an action type.

        Access Level: Read

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_GetActionType.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toGetActionType", []))

    @jsii.member(jsii_name="toGetJobDetails")
    def to_get_job_details(self) -> "Codepipeline":
        '''(experimental) Grants permission to view information about a job (custom actions only).

        Access Level: Read

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_GetJobDetails.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toGetJobDetails", []))

    @jsii.member(jsii_name="toGetPipeline")
    def to_get_pipeline(self) -> "Codepipeline":
        '''(experimental) Grants permission to retrieve information about a pipeline structure.

        Access Level: Read

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_GetPipeline.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toGetPipeline", []))

    @jsii.member(jsii_name="toGetPipelineExecution")
    def to_get_pipeline_execution(self) -> "Codepipeline":
        '''(experimental) Grants permission to view information about an execution of a pipeline, including details about artifacts, the pipeline execution ID, and the name, version, and status of the pipeline.

        Access Level: Read

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_GetPipelineExecution.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toGetPipelineExecution", []))

    @jsii.member(jsii_name="toGetPipelineState")
    def to_get_pipeline_state(self) -> "Codepipeline":
        '''(experimental) Grants permission to view information about the current state of the stages and actions of a pipeline.

        Access Level: Read

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_GetPipelineState.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toGetPipelineState", []))

    @jsii.member(jsii_name="toGetThirdPartyJobDetails")
    def to_get_third_party_job_details(self) -> "Codepipeline":
        '''(experimental) Grants permission to view the details of a job for a third-party action (partner actions only).

        Access Level: Read

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_GetThirdPartyJobDetails.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toGetThirdPartyJobDetails", []))

    @jsii.member(jsii_name="toListActionExecutions")
    def to_list_action_executions(self) -> "Codepipeline":
        '''(experimental) Grants permission to list the action executions that have occurred in a pipeline.

        Access Level: Read

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_ListActionExecutions.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toListActionExecutions", []))

    @jsii.member(jsii_name="toListActionTypes")
    def to_list_action_types(self) -> "Codepipeline":
        '''(experimental) Grants permission to list a summary of all the action types available for pipelines in your account.

        Access Level: Read

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_ListActionTypes.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toListActionTypes", []))

    @jsii.member(jsii_name="toListPipelineExecutions")
    def to_list_pipeline_executions(self) -> "Codepipeline":
        '''(experimental) Grants permission to list a summary of the most recent executions for a pipeline.

        Access Level: List

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_ListPipelineExecutions.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toListPipelineExecutions", []))

    @jsii.member(jsii_name="toListPipelines")
    def to_list_pipelines(self) -> "Codepipeline":
        '''(experimental) Grants permission to list a summary of all the pipelines associated with your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_ListPipelines.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toListPipelines", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Codepipeline":
        '''(experimental) Grants permission to list tags for a CodePipeline resource.

        Access Level: Read

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWebhooks")
    def to_list_webhooks(self) -> "Codepipeline":
        '''(experimental) Grants permission to list all of the webhooks associated with your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_ListWebhooks.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toListWebhooks", []))

    @jsii.member(jsii_name="toPollForJobs")
    def to_poll_for_jobs(self) -> "Codepipeline":
        '''(experimental) Grants permission to view information about any jobs for CodePipeline to act on.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PollForJobs.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toPollForJobs", []))

    @jsii.member(jsii_name="toPollForThirdPartyJobs")
    def to_poll_for_third_party_jobs(self) -> "Codepipeline":
        '''(experimental) Grants permission to determine whether there are any third-party jobs for a job worker to act on (partner actions only).

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PollForThirdPartyJobs.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toPollForThirdPartyJobs", []))

    @jsii.member(jsii_name="toPutActionRevision")
    def to_put_action_revision(self) -> "Codepipeline":
        '''(experimental) Grants permission to edit actions in a pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PutActionRevision.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toPutActionRevision", []))

    @jsii.member(jsii_name="toPutApprovalResult")
    def to_put_approval_result(self) -> "Codepipeline":
        '''(experimental) Grants permission to provide a response (Approved or Rejected) to a manual approval request in CodePipeline.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PutApprovalResult.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toPutApprovalResult", []))

    @jsii.member(jsii_name="toPutJobFailureResult")
    def to_put_job_failure_result(self) -> "Codepipeline":
        '''(experimental) Grants permission to represent the failure of a job as returned to the pipeline by a job worker (custom actions only).

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PutJobFailureResult.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toPutJobFailureResult", []))

    @jsii.member(jsii_name="toPutJobSuccessResult")
    def to_put_job_success_result(self) -> "Codepipeline":
        '''(experimental) Grants permission to represent the success of a job as returned to the pipeline by a job worker (custom actions only).

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PutJobSuccessResult.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toPutJobSuccessResult", []))

    @jsii.member(jsii_name="toPutThirdPartyJobFailureResult")
    def to_put_third_party_job_failure_result(self) -> "Codepipeline":
        '''(experimental) Grants permission to represent the failure of a third-party job as returned to the pipeline by a job worker (partner actions only).

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PutThirdPartyJobFailureResult.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toPutThirdPartyJobFailureResult", []))

    @jsii.member(jsii_name="toPutThirdPartyJobSuccessResult")
    def to_put_third_party_job_success_result(self) -> "Codepipeline":
        '''(experimental) Grants permission to represent the success of a third-party job as returned to the pipeline by a job worker (partner actions only).

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PutThirdPartyJobSuccessResult.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toPutThirdPartyJobSuccessResult", []))

    @jsii.member(jsii_name="toPutWebhook")
    def to_put_webhook(self) -> "Codepipeline":
        '''(experimental) Grants permission to create or update a webhook.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_PutWebhook.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toPutWebhook", []))

    @jsii.member(jsii_name="toRegisterWebhookWithThirdParty")
    def to_register_webhook_with_third_party(self) -> "Codepipeline":
        '''(experimental) Grants permission to register a webhook with the third party specified in its configuration.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_RegisterWebhookWithThirdParty.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toRegisterWebhookWithThirdParty", []))

    @jsii.member(jsii_name="toRetryStageExecution")
    def to_retry_stage_execution(self) -> "Codepipeline":
        '''(experimental) Grants permission to resume the pipeline execution by retrying the last failed actions in a stage.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_RetryStageExecution.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toRetryStageExecution", []))

    @jsii.member(jsii_name="toStartPipelineExecution")
    def to_start_pipeline_execution(self) -> "Codepipeline":
        '''(experimental) Grants permission to run the most recent revision through the pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_StartPipelineExecution.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toStartPipelineExecution", []))

    @jsii.member(jsii_name="toStopPipelineExecution")
    def to_stop_pipeline_execution(self) -> "Codepipeline":
        '''(experimental) Grants permission to stop an in-progress pipeline execution.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_StopPipelineExecution.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toStopPipelineExecution", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Codepipeline":
        '''(experimental) Grants permission to tag a CodePipeline resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Codepipeline":
        '''(experimental) Grants permission to remove a tag from a CodePipeline resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateActionType")
    def to_update_action_type(self) -> "Codepipeline":
        '''(experimental) Grants permission to update an action type.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_UpdateActionType.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toUpdateActionType", []))

    @jsii.member(jsii_name="toUpdatePipeline")
    def to_update_pipeline(self) -> "Codepipeline":
        '''(experimental) Grants permission to update a pipeline with changes to the structure of the pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_UpdatePipeline.html

        :stability: experimental
        '''
        return typing.cast("Codepipeline", jsii.invoke(self, "toUpdatePipeline", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c3440d4b3893f363d1bd26d195ad16e13e8bd5ca269be99c9a2226647cd6ea2d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4198741edafb3689f46ee951242bda5dce4581e556903d9b9f0f1b5e93c1362f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Codestar(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Codestar",
):
    '''(experimental) Statement provider for service `codestar <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodestar.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codestar <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodestar.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d225b031d2f7c9cd0c1ab3b872ca91874222f19668f43143a2332141732c5782)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifIamResourceTag")
    def if_iam_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Codestar":
        '''(experimental) Filters access by actions based on tag-value associated with the resource.

        Applies to resource types:

        - user

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bec2741790cc29810b8f8bd6478162651fd2569f5a6b2150d556e8382421e656)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Codestar", jsii.invoke(self, "ifIamResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codestar":
        '''(experimental) Adds a resource of type project to the statement.

        https://docs.aws.amazon.com/codestar/latest/userguide/working-with-projects.html

        :param project_id: - Identifier for the projectId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5dce08edf9cd751f65a30dda41e638ea100815ac08cf3a5d0bf8abc9750b56e2)
            check_type(argname="argument project_id", value=project_id, expected_type=type_hints["project_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codestar", jsii.invoke(self, "onProject", [project_id, account, region, partition]))

    @jsii.member(jsii_name="onUser")
    def on_user(
        self,
        user_name_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codestar":
        '''(experimental) Adds a resource of type user to the statement.

        https://docs.aws.amazon.com/codestar/latest/userguide/working-with-user-info.html

        :param user_name_with_path: - Identifier for the userNameWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifIamResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__55b1daf24942cd1ecc773235dab458f0a730c081bbca43efc6c356eb2c65dc05)
            check_type(argname="argument user_name_with_path", value=user_name_with_path, expected_type=type_hints["user_name_with_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codestar", jsii.invoke(self, "onUser", [user_name_with_path, account, region, partition]))

    @jsii.member(jsii_name="toAssociateTeamMember")
    def to_associate_team_member(self) -> "Codestar":
        '''(experimental) Grants permission to add a user to the team for an AWS CodeStar project.

        Access Level: Permissions management

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_AssociateTeamMember.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toAssociateTeamMember", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Codestar":
        '''(experimental) Grants permission to create a project with minimal structure, customer policies, and no resources.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_CreateProject.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toCreateUserProfile")
    def to_create_user_profile(self) -> "Codestar":
        '''(experimental) Grants permission to create a profile for a user that includes user preferences, display name, and email.

        Access Level: Write

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_CreateUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toCreateUserProfile", []))

    @jsii.member(jsii_name="toDeleteExtendedAccess")
    def to_delete_extended_access(self) -> "Codestar":
        '''(experimental) Grants permission to extended delete APIs.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toDeleteExtendedAccess", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Codestar":
        '''(experimental) Grants permission to delete a project, including project resources.

        Does not delete users associated with the project, but does delete the IAM roles that allowed access to the project

        Access Level: Permissions management

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_DeleteProject.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDeleteUserProfile")
    def to_delete_user_profile(self) -> "Codestar":
        '''(experimental) Grants permission to delete a user profile in AWS CodeStar, including all personal preference data associated with that profile, such as display name and email address.

        It does not delete the history of that user, for example the history of commits made by that user

        Access Level: Write

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_DeleteUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toDeleteUserProfile", []))

    @jsii.member(jsii_name="toDescribeProject")
    def to_describe_project(self) -> "Codestar":
        '''(experimental) Grants permission to describe a project and its resources.

        Access Level: Read

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_DescribeProject.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toDescribeProject", []))

    @jsii.member(jsii_name="toDescribeUserProfile")
    def to_describe_user_profile(self) -> "Codestar":
        '''(experimental) Grants permission to describe a user in AWS CodeStar and the user attributes across all projects.

        Access Level: Read

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_DescribeUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toDescribeUserProfile", []))

    @jsii.member(jsii_name="toDisassociateTeamMember")
    def to_disassociate_team_member(self) -> "Codestar":
        '''(experimental) Grants permission to remove a user from a project.

        Removing a user from a project also removes the IAM policies from that user that allowed access to the project and its resources

        Access Level: Permissions management

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_DisassociateTeamMember.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toDisassociateTeamMember", []))

    @jsii.member(jsii_name="toGetExtendedAccess")
    def to_get_extended_access(self) -> "Codestar":
        '''(experimental) Grants permission to extended read APIs.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toGetExtendedAccess", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Codestar":
        '''(experimental) Grants permission to list all projects in CodeStar associated with your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_ListProjects.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListResources")
    def to_list_resources(self) -> "Codestar":
        '''(experimental) Grants permission to list all resources associated with a project in CodeStar.

        Access Level: List

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_ListResources.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toListResources", []))

    @jsii.member(jsii_name="toListTagsForProject")
    def to_list_tags_for_project(self) -> "Codestar":
        '''(experimental) Grants permission to list the tags associated with a project in CodeStar.

        Access Level: List

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_ListTagsForProject.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toListTagsForProject", []))

    @jsii.member(jsii_name="toListTeamMembers")
    def to_list_team_members(self) -> "Codestar":
        '''(experimental) Grants permission to list all team members associated with a project.

        Access Level: List

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_ListTeamMembers.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toListTeamMembers", []))

    @jsii.member(jsii_name="toListUserProfiles")
    def to_list_user_profiles(self) -> "Codestar":
        '''(experimental) Grants permission to list user profiles in AWS CodeStar.

        Access Level: List

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_ListUserProfiles.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toListUserProfiles", []))

    @jsii.member(jsii_name="toPutExtendedAccess")
    def to_put_extended_access(self) -> "Codestar":
        '''(experimental) Grants permission to extended write APIs.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toPutExtendedAccess", []))

    @jsii.member(jsii_name="toTagProject")
    def to_tag_project(self) -> "Codestar":
        '''(experimental) Grants permission to add tags to a project in CodeStar.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_TagProject.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toTagProject", []))

    @jsii.member(jsii_name="toUntagProject")
    def to_untag_project(self) -> "Codestar":
        '''(experimental) Grants permission to remove tags from a project in CodeStar.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_UntagProject.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toUntagProject", []))

    @jsii.member(jsii_name="toUpdateProject")
    def to_update_project(self) -> "Codestar":
        '''(experimental) Grants permission to update a project in CodeStar.

        Access Level: Write

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_UpdateProject.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toUpdateProject", []))

    @jsii.member(jsii_name="toUpdateTeamMember")
    def to_update_team_member(self) -> "Codestar":
        '''(experimental) Grants permission to update team member attributes within a CodeStar project.

        Access Level: Permissions management

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_UpdateTeamMember.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toUpdateTeamMember", []))

    @jsii.member(jsii_name="toUpdateUserProfile")
    def to_update_user_profile(self) -> "Codestar":
        '''(experimental) Grants permission to update a profile for a user that includes user preferences, display name, and email.

        Access Level: Write

        https://docs.aws.amazon.com/codestar/latest/APIReference/API_UpdateUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toUpdateUserProfile", []))

    @jsii.member(jsii_name="toVerifyServiceRole")
    def to_verify_service_role(self) -> "Codestar":
        '''(experimental) Grants permission to verify whether the AWS CodeStar service role exists in the customer's account.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Codestar", jsii.invoke(self, "toVerifyServiceRole", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c1e36811f4c1ce6e5d6406a68f763226e27ceff0b6eb9433ac724a7505a6c85e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a6edd243b1c5143a5b535ebdbe2dc64faadaffb7aceda1d9b5719c74ea2e39d4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class CodestarConnections(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.CodestarConnections",
):
    '''(experimental) Statement provider for service `codestar-connections <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodestarconnections.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codestar-connections <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodestarconnections.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7135e87b2ce48b556ddb418f096de9c252f56ea4c3a7cf94844f8ba4975379e3)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifBranchName")
    def if_branch_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the branch name that is passed in the request.

        Applies only to UseConnection requests for access to a specific repository branch

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-use

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8b29f35309612c0c584a103e35972462a79b9c29f212dc991f049423242c0a45)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifBranchName", [value, operator]))

    @jsii.member(jsii_name="ifFullRepositoryId")
    def if_full_repository_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the repository that is passed in the request.

        Applies only to UseConnection requests for access to a specific repository

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-use

        Applies to actions:

        - .toUseConnection()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0b51d68408883bfa90d1ca3f36ca565cba894caf18bc5904ab32eedc3774965f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifFullRepositoryId", [value, operator]))

    @jsii.member(jsii_name="ifHostArn")
    def if_host_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the host resource associated with the connection used in the request.

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-hosts

        Applies to actions:

        - .toRegisterAppCode()
        - .toStartAppRegistrationHandshake()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3accca27f1f7c511942488d1f8771e439ca5bec0267a0ee9e363051089bdb025)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifHostArn", [value, operator]))

    @jsii.member(jsii_name="ifInstallationId")
    def if_installation_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the third-party ID (such as the Bitbucket App installation ID for CodeStar Connections) that is used to update a Connection.

        Allows you to restrict which third-party App installations can be used to make a Connection

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-handshake

        Applies to actions:

        - .toUpdateConnectionInstallation()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9050fd0c96966c21c3795f249521c8e1d19f73539a6f17842b29b81375ab8076)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifInstallationId", [value, operator]))

    @jsii.member(jsii_name="ifOwnerId")
    def if_owner_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the owner of the third-party repository.

        Applies only to UseConnection requests for access to repositories owned by a specific user

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-use

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c05e086157c823822ed2490557b863120671d87c7de98f9dd0be7bc7893e5f4f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifOwnerId", [value, operator]))

    @jsii.member(jsii_name="ifPassedToService")
    def if_passed_to_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the service to which the principal is allowed to pass a Connection.

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-passconnection

        Applies to actions:

        - .toPassConnection()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__27fe27c260d9ca82a7b1984be4ef0791fef12ee32dccc7df7dbc09468936884e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifPassedToService", [value, operator]))

    @jsii.member(jsii_name="ifProviderAction")
    def if_provider_action(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the provider action in a UseConnection request such as ListRepositories. See documentation for all valid values.

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-access

        Applies to actions:

        - .toUseConnection()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4c7f038fdfc7b4a180dc6f046b512400034ab697c2b33fa5fcd3ebe2722887aa)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifProviderAction", [value, operator]))

    @jsii.member(jsii_name="ifProviderPermissionsRequired")
    def if_provider_permissions_required(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the write permissions of a provider action in a UseConnection request.

        Valid types include read_only and read_write

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-use

        Applies to actions:

        - .toUseConnection()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__492c219bb059f3848481b3c3c50813e6db6a3849d8a349b542f87737cad53ff6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifProviderPermissionsRequired", [value, operator]))

    @jsii.member(jsii_name="ifProviderType")
    def if_provider_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the type of third-party provider passed in the request.

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-managing

        Applies to actions:

        - .toCreateConnection()
        - .toCreateHost()
        - .toGetIndividualAccessToken()
        - .toGetInstallationUrl()
        - .toStartOAuthHandshake()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4ed4d8859bdd7ee18c9f90ec901801630cd3f7f535ce0843e25fe7cb4aebd2c5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifProviderType", [value, operator]))

    @jsii.member(jsii_name="ifProviderTypeFilter")
    def if_provider_type_filter(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the type of third-party provider used to filter results.

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-managing

        Applies to actions:

        - .toListConnections()
        - .toListHosts()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e2d6f912b3958fbadc6e41bd767aa5d5933c1cae678f39ee614a46e001e14bee)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifProviderTypeFilter", [value, operator]))

    @jsii.member(jsii_name="ifRepositoryName")
    def if_repository_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarConnections":
        '''(experimental) Filters access by the repository name that is passed in the request.

        Applies only to UseConnection requests for creating new repositories

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-use

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5c433b34b7ad3fed78409f039de278a55820d49ddaf9300a0e5612ee5533b98b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("CodestarConnections", jsii.invoke(self, "ifRepositoryName", [value, operator]))

    @jsii.member(jsii_name="onConnection")
    def on_connection(
        self,
        connection_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CodestarConnections":
        '''(experimental) Adds a resource of type Connection to the statement.

        https://docs.aws.amazon.com/dtconsole/latest/userguide/connections.html

        :param connection_id: - Identifier for the connectionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__32d989810e90dfbf9bf4d8f873f69930811b1781d7e7ae9d7cba99d085e6cbef)
            check_type(argname="argument connection_id", value=connection_id, expected_type=type_hints["connection_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("CodestarConnections", jsii.invoke(self, "onConnection", [connection_id, account, region, partition]))

    @jsii.member(jsii_name="onHost")
    def on_host(
        self,
        host_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CodestarConnections":
        '''(experimental) Adds a resource of type Host to the statement.

        https://docs.aws.amazon.com/dtconsole/latest/userguide/connections-hosts.html

        :param host_id: - Identifier for the hostId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5e8fe310cbc32236dc992d37407610730b26a8aa3c1b66dcb06dfcf67f38235c)
            check_type(argname="argument host_id", value=host_id, expected_type=type_hints["host_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("CodestarConnections", jsii.invoke(self, "onHost", [host_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateConnection")
    def to_create_connection(self) -> "CodestarConnections":
        '''(experimental) Grants permission to create a Connection resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifProviderType()

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_CreateConnection.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toCreateConnection", []))

    @jsii.member(jsii_name="toCreateHost")
    def to_create_host(self) -> "CodestarConnections":
        '''(experimental) Grants permission to create a host resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifProviderType()

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_CreateHost.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toCreateHost", []))

    @jsii.member(jsii_name="toDeleteConnection")
    def to_delete_connection(self) -> "CodestarConnections":
        '''(experimental) Grants permission to delete a Connection resource.

        Access Level: Write

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_DeleteConnection.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toDeleteConnection", []))

    @jsii.member(jsii_name="toDeleteHost")
    def to_delete_host(self) -> "CodestarConnections":
        '''(experimental) Grants permission to delete a host resource.

        Access Level: Write

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_DeleteHost.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toDeleteHost", []))

    @jsii.member(jsii_name="toGetConnection")
    def to_get_connection(self) -> "CodestarConnections":
        '''(experimental) Grants permission to get details about a Connection resource.

        Access Level: Read

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_GetConnection.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toGetConnection", []))

    @jsii.member(jsii_name="toGetHost")
    def to_get_host(self) -> "CodestarConnections":
        '''(experimental) Grants permission to get details about a host resource.

        Access Level: Read

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_GetHost.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toGetHost", []))

    @jsii.member(jsii_name="toGetIndividualAccessToken")
    def to_get_individual_access_token(self) -> "CodestarConnections":
        '''(experimental) Grants permission to associate a third party, such as a Bitbucket App installation, with a Connection.

        Access Level: Read

        Possible conditions:

        - .ifProviderType()

        Dependent actions:

        - codestar-connections:StartOAuthHandshake

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-handshake

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toGetIndividualAccessToken", []))

    @jsii.member(jsii_name="toGetInstallationUrl")
    def to_get_installation_url(self) -> "CodestarConnections":
        '''(experimental) Grants permission to associate a third party, such as a Bitbucket App installation, with a Connection.

        Access Level: Read

        Possible conditions:

        - .ifProviderType()

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-handshake

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toGetInstallationUrl", []))

    @jsii.member(jsii_name="toListConnections")
    def to_list_connections(self) -> "CodestarConnections":
        '''(experimental) Grants permission to list Connection resources.

        Access Level: List

        Possible conditions:

        - .ifProviderTypeFilter()

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_ListConnections.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toListConnections", []))

    @jsii.member(jsii_name="toListHosts")
    def to_list_hosts(self) -> "CodestarConnections":
        '''(experimental) Grants permission to list host resources.

        Access Level: List

        Possible conditions:

        - .ifProviderTypeFilter()

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_ListHosts.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toListHosts", []))

    @jsii.member(jsii_name="toListInstallationTargets")
    def to_list_installation_targets(self) -> "CodestarConnections":
        '''(experimental) Grants permission to associate a third party, such as a Bitbucket App installation, with a Connection.

        Access Level: List

        Dependent actions:

        - codestar-connections:GetIndividualAccessToken
        - codestar-connections:StartOAuthHandshake

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-handshake

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toListInstallationTargets", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "CodestarConnections":
        '''(experimental) Gets the set of key-value pairs that are used to manage the resource.

        Access Level: List

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPassConnection")
    def to_pass_connection(self) -> "CodestarConnections":
        '''(experimental) Grants permission to pass a Connection resource to an AWS service that accepts a Connection ARN as input, such as codepipeline:CreatePipeline.

        Access Level: Read

        Possible conditions:

        - .ifPassedToService()

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-passconnection

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toPassConnection", []))

    @jsii.member(jsii_name="toRegisterAppCode")
    def to_register_app_code(self) -> "CodestarConnections":
        '''(experimental) Grants permission to associate a third party server, such as a GitHub Enterprise Server instance, with a Host.

        Access Level: Read

        Possible conditions:

        - .ifHostArn()

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#connections-permissions-actions-host-registration

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toRegisterAppCode", []))

    @jsii.member(jsii_name="toStartAppRegistrationHandshake")
    def to_start_app_registration_handshake(self) -> "CodestarConnections":
        '''(experimental) Grants permission to associate a third party server, such as a GitHub Enterprise Server instance, with a Host.

        Access Level: Read

        Possible conditions:

        - .ifHostArn()

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#connections-permissions-actions-host-registration

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toStartAppRegistrationHandshake", []))

    @jsii.member(jsii_name="toStartOAuthHandshake")
    def to_start_o_auth_handshake(self) -> "CodestarConnections":
        '''(experimental) Grants permission to associate a third party, such as a Bitbucket App installation, with a Connection.

        Access Level: Read

        Possible conditions:

        - .ifProviderType()

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-handshake

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toStartOAuthHandshake", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "CodestarConnections":
        '''(experimental) Adds to or modifies the tags of the given resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "CodestarConnections":
        '''(experimental) Removes tags from an AWS resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateConnectionInstallation")
    def to_update_connection_installation(self) -> "CodestarConnections":
        '''(experimental) Grants permission to update a Connection resource with an installation of the CodeStar Connections App.

        Access Level: Write

        Possible conditions:

        - .ifInstallationId()

        Dependent actions:

        - codestar-connections:GetIndividualAccessToken
        - codestar-connections:GetInstallationUrl
        - codestar-connections:ListInstallationTargets
        - codestar-connections:StartOAuthHandshake

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-handshake

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toUpdateConnectionInstallation", []))

    @jsii.member(jsii_name="toUpdateHost")
    def to_update_host(self) -> "CodestarConnections":
        '''(experimental) Grants permission to update a host resource.

        Access Level: Write

        https://docs.aws.amazon.com/codestar-connections/latest/APIReference/API_UpdateHost.html

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toUpdateHost", []))

    @jsii.member(jsii_name="toUseConnection")
    def to_use_connection(self) -> "CodestarConnections":
        '''(experimental) Grants permission to use a Connection resource to call provider actions.

        Access Level: Read

        Possible conditions:

        - .ifFullRepositoryId()
        - .ifProviderAction()
        - .ifProviderPermissionsRequired()

        https://docs.aws.amazon.com/dtconsole/latest/userguide/security-iam.html#permissions-reference-connections-use

        :stability: experimental
        '''
        return typing.cast("CodestarConnections", jsii.invoke(self, "toUseConnection", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fa07f1186b7d9b9fbf363d6a5b683d0d50965920c8a63d32e4faac8a7b3c27ee)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9240e9637b79fce9449a928d6d4932d5f2ef21c3438529d37da05e49195dc0b4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class CodestarNotifications(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.CodestarNotifications",
):
    '''(experimental) Statement provider for service `codestar-notifications <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodestarnotifications.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codestar-notifications <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodestarnotifications.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0ba12f594eaed71bd624782a765c1110c23fb79c86b973fd74299121156152a2)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifNotificationsForResource")
    def if_notifications_for_resource(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "CodestarNotifications":
        '''(experimental) Filters access based on the ARN of the resource for which notifications are configured.

        https://docs.aws.amazon.com/codestar-notifications/latest/userguide/security_iam_id-based-policy-examples.html

        Applies to actions:

        - .toCreateNotificationRule()
        - .toDeleteNotificationRule()
        - .toDescribeNotificationRule()
        - .toSubscribe()
        - .toUnsubscribe()
        - .toUpdateNotificationRule()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0daefac47925bb0312dff751ea1c5bcbf78df4e7f5a59f87f1d19f5df28ecbd9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("CodestarNotifications", jsii.invoke(self, "ifNotificationsForResource", [value, operator]))

    @jsii.member(jsii_name="onNotificationrule")
    def on_notificationrule(
        self,
        notification_rule_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CodestarNotifications":
        '''(experimental) Adds a resource of type notificationrule to the statement.

        https://docs.aws.amazon.com/codestar-notifications/latest/userguide/security_iam_service-with-iam.html

        :param notification_rule_id: - Identifier for the notificationRuleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__42cc194ebc87f1a66a5abd15124b64c62416b81a3a91e37784c03c9e9ed3911b)
            check_type(argname="argument notification_rule_id", value=notification_rule_id, expected_type=type_hints["notification_rule_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("CodestarNotifications", jsii.invoke(self, "onNotificationrule", [notification_rule_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateNotificationRule")
    def to_create_notification_rule(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to create a notification rule for a resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifNotificationsForResource()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_CreateNotificationRule.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toCreateNotificationRule", []))

    @jsii.member(jsii_name="toDeleteNotificationRule")
    def to_delete_notification_rule(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to delete a notification rule for a resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifNotificationsForResource()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_DeleteNotificationRule.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toDeleteNotificationRule", []))

    @jsii.member(jsii_name="toDeleteTarget")
    def to_delete_target(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to delete a target for a notification rule.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_DeleteTarget.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toDeleteTarget", []))

    @jsii.member(jsii_name="toDescribeNotificationRule")
    def to_describe_notification_rule(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to get information about a notification rule.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifNotificationsForResource()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_DescribeNotificationRule.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toDescribeNotificationRule", []))

    @jsii.member(jsii_name="toListEventTypes")
    def to_list_event_types(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to list notifications event types.

        Access Level: List

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_ListEventTypes.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toListEventTypes", []))

    @jsii.member(jsii_name="toListNotificationRules")
    def to_list_notification_rules(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to list notification rules in an AWS account.

        Access Level: List

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_ListNotificationRules.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toListNotificationRules", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to list the tags attached to a notification rule resource ARN.

        Access Level: List

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTargets")
    def to_list_targets(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to list the notification rule targets for an AWS account.

        Access Level: List

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_ListTargets.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toListTargets", []))

    @jsii.member(jsii_name="toSubscribe")
    def to_subscribe(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to create an association between a notification rule and an Amazon SNS topic.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifNotificationsForResource()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_Subscribe.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toSubscribe", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to attach resource tags to a notification rule resource ARN.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUnsubscribe")
    def to_unsubscribe(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to remove an association between a notification rule and an Amazon SNS topic.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifNotificationsForResource()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_Unsubscribe.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toUnsubscribe", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to disassociate resource tags from a notification rule resource ARN.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateNotificationRule")
    def to_update_notification_rule(self) -> "CodestarNotifications":
        '''(experimental) Grants permission to change a notification rule for a resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifNotificationsForResource()

        https://docs.aws.amazon.com/codestar-notifications/latest/APIReference/API_UpdateNotificationRule.html

        :stability: experimental
        '''
        return typing.cast("CodestarNotifications", jsii.invoke(self, "toUpdateNotificationRule", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__407cd49d23a2c5e9d8d28e72817e04da2724784366c289c643c789a9adbcc5e1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__76c753ef462ba4fdea4cd8bbe3aca8fdc4df71fc14686bb81f020b07b7d95930)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Codewhisperer(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Codewhisperer",
):
    '''(experimental) Statement provider for service `codewhisperer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncodewhisperer.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `codewhisperer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncodewhisperer.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__13a6869838895aefdb07d45a1e3ec269421fd24694387e26cb61b49f97dc655f)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onProfile")
    def on_profile(
        self,
        identifier: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Codewhisperer":
        '''(experimental) Adds a resource of type profile to the statement.

        https://docs.aws.amazon.com/codewhisperer/latest/dg/profile.html

        :param identifier: - Identifier for the identifier.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e150183a95c54a1df64eb98b7fd1ad3dd76e2f5603feab416470f3822cc21773)
            check_type(argname="argument identifier", value=identifier, expected_type=type_hints["identifier"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Codewhisperer", jsii.invoke(self, "onProfile", [identifier, account, partition]))

    @jsii.member(jsii_name="toCreateProfile")
    def to_create_profile(self) -> "Codewhisperer":
        '''(experimental) Grants permission to invoke CreateProfile on CodeWhisperer.

        Access Level: Write

        https://docs.aws.amazon.com/codewhisperer/latest/dg/API_CreateProfile.html

        :stability: experimental
        '''
        return typing.cast("Codewhisperer", jsii.invoke(self, "toCreateProfile", []))

    @jsii.member(jsii_name="toGenerateRecommendations")
    def to_generate_recommendations(self) -> "Codewhisperer":
        '''(experimental) Grants permission to invoke GenerateRecommendations on CodeWhisperer.

        Access Level: Read

        https://docs.aws.amazon.com/codewhisperer/latest/dg/API_GenerateRecommendations.html

        :stability: experimental
        '''
        return typing.cast("Codewhisperer", jsii.invoke(self, "toGenerateRecommendations", []))

    @jsii.member(jsii_name="toListProfiles")
    def to_list_profiles(self) -> "Codewhisperer":
        '''(experimental) Grants permission to invoke ListProfiles on CodeWhisperer.

        Access Level: List

        https://docs.aws.amazon.com/codewhisperer/latest/dg/API_ListProfiles.html

        :stability: experimental
        '''
        return typing.cast("Codewhisperer", jsii.invoke(self, "toListProfiles", []))

    @jsii.member(jsii_name="toUpdateProfile")
    def to_update_profile(self) -> "Codewhisperer":
        '''(experimental) Grants permission to invoke UpdateProfile on CodeWhisperer.

        Access Level: Write

        https://docs.aws.amazon.com/codewhisperer/latest/dg/API_UpdateProfile.html

        :stability: experimental
        '''
        return typing.cast("Codewhisperer", jsii.invoke(self, "toUpdateProfile", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e4aba20f1e2d4834a59dfdb7430ebdab2df66154ad04526acd4f3cdc943afd3e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1abb797db9d10abb0995e23fc4329997d562e182191ee370f3ee8961519f3f0d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class CognitoIdentity(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.CognitoIdentity",
):
    '''(experimental) Statement provider for service `cognito-identity <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncognitoidentity.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cognito-identity <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncognitoidentity.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__af0416c9d600c5960e68094a5fee9a46e2c5eca92e64ecad7bd4e357a3853c51)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onIdentitypool")
    def on_identitypool(
        self,
        identity_pool_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CognitoIdentity":
        '''(experimental) Adds a resource of type identitypool to the statement.

        https://docs.aws.amazon.com/cognito/latest/developerguide/identity-pools.html

        :param identity_pool_id: - Identifier for the identityPoolId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__60f69bf526a3fdef13798ca4efac7f665544c90fb8adeb1b6d7fad449fa1e975)
            check_type(argname="argument identity_pool_id", value=identity_pool_id, expected_type=type_hints["identity_pool_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("CognitoIdentity", jsii.invoke(self, "onIdentitypool", [identity_pool_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateIdentityPool")
    def to_create_identity_pool(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to create a new identity pool.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_CreateIdentityPool.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toCreateIdentityPool", []))

    @jsii.member(jsii_name="toDeleteIdentities")
    def to_delete_identities(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to delete identities from an identity pool.

        You can specify a list of 1-60 identities that you want to delete

        Access Level: Write

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_DeleteIdentities.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toDeleteIdentities", []))

    @jsii.member(jsii_name="toDeleteIdentityPool")
    def to_delete_identity_pool(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to delete a user pool.

        Once a pool is deleted, users will not be able to authenticate with the pool

        Access Level: Write

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_DeleteIdentityPool.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toDeleteIdentityPool", []))

    @jsii.member(jsii_name="toDescribeIdentity")
    def to_describe_identity(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to return metadata related to the given identity, including when the identity was created and any associated linked logins.

        Access Level: Read

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_DescribeIdentity.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toDescribeIdentity", []))

    @jsii.member(jsii_name="toDescribeIdentityPool")
    def to_describe_identity_pool(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to get details about a particular identity pool, including the pool name, ID description, creation date, and current number of users.

        Access Level: Read

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_DescribeIdentityPool.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toDescribeIdentityPool", []))

    @jsii.member(jsii_name="toGetCredentialsForIdentity")
    def to_get_credentials_for_identity(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to return credentials for the provided identity ID.

        Access Level: Read

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetCredentialsForIdentity.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toGetCredentialsForIdentity", []))

    @jsii.member(jsii_name="toGetId")
    def to_get_id(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to generate (or retrieve) a Cognito ID. Supplying multiple logins will create an implicit linked account.

        Access Level: Write

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetId.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toGetId", []))

    @jsii.member(jsii_name="toGetIdentityPoolRoles")
    def to_get_identity_pool_roles(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to get the roles for an identity pool.

        Access Level: Read

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetIdentityPoolRoles.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toGetIdentityPoolRoles", []))

    @jsii.member(jsii_name="toGetOpenIdToken")
    def to_get_open_id_token(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to get an OpenID token, using a known Cognito ID.

        Access Level: Read

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetOpenIdToken.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toGetOpenIdToken", []))

    @jsii.member(jsii_name="toGetOpenIdTokenForDeveloperIdentity")
    def to_get_open_id_token_for_developer_identity(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to register (or retrieve) a Cognito IdentityId and an OpenID Connect token for a user authenticated by your backend authentication process.

        Access Level: Read

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetOpenIdTokenForDeveloperIdentity.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toGetOpenIdTokenForDeveloperIdentity", []))

    @jsii.member(jsii_name="toGetPrincipalTagAttributeMap")
    def to_get_principal_tag_attribute_map(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to get the principal tags for an identity pool and provider.

        Access Level: Read

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetPrincipalTagAttributeMap.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toGetPrincipalTagAttributeMap", []))

    @jsii.member(jsii_name="toListIdentities")
    def to_list_identities(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to list the identities in an identity pool.

        Access Level: List

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_ListIdentities.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toListIdentities", []))

    @jsii.member(jsii_name="toListIdentityPools")
    def to_list_identity_pools(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to list all of the Cognito identity pools registered for your account.

        Access Level: List

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_ListIdentityPools.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toListIdentityPools", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to list the tags that are assigned to an Amazon Cognito identity pool.

        Access Level: Read

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toLookupDeveloperIdentity")
    def to_lookup_developer_identity(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to retrieve the IdentityId associated with a DeveloperUserIdentifier or the list of DeveloperUserIdentifiers associated with an IdentityId for an existing identity.

        Access Level: Read

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_LookupDeveloperIdentity.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toLookupDeveloperIdentity", []))

    @jsii.member(jsii_name="toMergeDeveloperIdentities")
    def to_merge_developer_identities(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to merge two users having different IdentityIds, existing in the same identity pool, and identified by the same developer provider.

        Access Level: Write

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_MergeDeveloperIdentities.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toMergeDeveloperIdentities", []))

    @jsii.member(jsii_name="toSetIdentityPoolRoles")
    def to_set_identity_pool_roles(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to set the roles for an identity pool.

        These roles are used when making calls to GetCredentialsForIdentity action

        Access Level: Write

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_SetIdentityPoolRoles.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toSetIdentityPoolRoles", []))

    @jsii.member(jsii_name="toSetPrincipalTagAttributeMap")
    def to_set_principal_tag_attribute_map(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to set the principal tags for an identity pool and provider.

        These tags are used when making calls to GetOpenIdToken action

        Access Level: Write

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_SetPrincipalTagAttributeMap.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toSetPrincipalTagAttributeMap", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to assign a set of tags to an Amazon Cognito identity pool.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUnlinkDeveloperIdentity")
    def to_unlink_developer_identity(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to unlink a DeveloperUserIdentifier from an existing identity.

        Access Level: Write

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_UnlinkDeveloperIdentity.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toUnlinkDeveloperIdentity", []))

    @jsii.member(jsii_name="toUnlinkIdentity")
    def to_unlink_identity(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to unlink a federated identity from an existing account.

        Access Level: Write

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_UnlinkIdentity.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toUnlinkIdentity", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to remove the specified tags from an Amazon Cognito identity pool.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateIdentityPool")
    def to_update_identity_pool(self) -> "CognitoIdentity":
        '''(experimental) Grants permission to update an identity pool.

        Access Level: Write

        https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_UpdateIdentityPool.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdentity", jsii.invoke(self, "toUpdateIdentityPool", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2e7366885a602fd6fd0f6eb8997d1885db1631b9de273da234a633eeeba5a6e0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e9b694e41dbadb273d231301c95c4af0c84b40831594bf4cd80dc6c256ce8df0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class CognitoIdp(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.CognitoIdp",
):
    '''(experimental) Statement provider for service `cognito-idp <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncognitouserpools.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cognito-idp <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncognitouserpools.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cbc276c1386ec26e00e6d9a8830300f36ea3094ac763e2b3caea293bc98ae5ec)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onUserpool")
    def on_userpool(
        self,
        user_pool_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CognitoIdp":
        '''(experimental) Adds a resource of type userpool to the statement.

        https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools.html

        :param user_pool_id: - Identifier for the userPoolId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f1c1b737e6991114f3508eb75ecfb9b538af87138f6257875354de8224418a0b)
            check_type(argname="argument user_pool_id", value=user_pool_id, expected_type=type_hints["user_pool_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("CognitoIdp", jsii.invoke(self, "onUserpool", [user_pool_id, account, region, partition]))

    @jsii.member(jsii_name="onWebacl")
    def on_webacl(
        self,
        scope: builtins.str,
        name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CognitoIdp":
        '''(experimental) Adds a resource of type webacl to the statement.

        https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-waf.html

        :param scope: - Identifier for the scope.
        :param name: - Identifier for the name.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__20b149cc1e7214fac9177621450779fae33bed6006c72e1d0ef18f2d79d72022)
            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("CognitoIdp", jsii.invoke(self, "onWebacl", [scope, name, id, account, region, partition]))

    @jsii.member(jsii_name="toAddCustomAttributes")
    def to_add_custom_attributes(self) -> "CognitoIdp":
        '''(experimental) Grants permission to add user attributes to the user pool schema.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AddCustomAttributes.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAddCustomAttributes", []))

    @jsii.member(jsii_name="toAdminAddUserToGroup")
    def to_admin_add_user_to_group(self) -> "CognitoIdp":
        '''(experimental) Grants permission to add any user to any group.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminAddUserToGroup.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminAddUserToGroup", []))

    @jsii.member(jsii_name="toAdminConfirmSignUp")
    def to_admin_confirm_sign_up(self) -> "CognitoIdp":
        '''(experimental) Grants permission to confirm any user's registration without a confirmation code.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminConfirmSignUp.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminConfirmSignUp", []))

    @jsii.member(jsii_name="toAdminCreateUser")
    def to_admin_create_user(self) -> "CognitoIdp":
        '''(experimental) Grants permission to create new users and send welcome messages via email or SMS.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminCreateUser.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminCreateUser", []))

    @jsii.member(jsii_name="toAdminDeleteUser")
    def to_admin_delete_user(self) -> "CognitoIdp":
        '''(experimental) Grants permission to delete any user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDeleteUser.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminDeleteUser", []))

    @jsii.member(jsii_name="toAdminDeleteUserAttributes")
    def to_admin_delete_user_attributes(self) -> "CognitoIdp":
        '''(experimental) Grants permission to delete attributes from any user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDeleteUserAttributes.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminDeleteUserAttributes", []))

    @jsii.member(jsii_name="toAdminDisableProviderForUser")
    def to_admin_disable_provider_for_user(self) -> "CognitoIdp":
        '''(experimental) Grants permission to unlink any user pool user from a third-party identity provider (IdP) user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDisableProviderForUser.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminDisableProviderForUser", []))

    @jsii.member(jsii_name="toAdminDisableUser")
    def to_admin_disable_user(self) -> "CognitoIdp":
        '''(experimental) Grants permission to deactivate any user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDisableUser.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminDisableUser", []))

    @jsii.member(jsii_name="toAdminEnableUser")
    def to_admin_enable_user(self) -> "CognitoIdp":
        '''(experimental) Grants permission to activate any user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminEnableUser.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminEnableUser", []))

    @jsii.member(jsii_name="toAdminForgetDevice")
    def to_admin_forget_device(self) -> "CognitoIdp":
        '''(experimental) Grants permission to deregister any user's devices.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminForgetDevice.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminForgetDevice", []))

    @jsii.member(jsii_name="toAdminGetDevice")
    def to_admin_get_device(self) -> "CognitoIdp":
        '''(experimental) Grants permission to get information about any user's devices.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminGetDevice.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminGetDevice", []))

    @jsii.member(jsii_name="toAdminGetUser")
    def to_admin_get_user(self) -> "CognitoIdp":
        '''(experimental) Grants permission to look up any user by user name.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminGetUser.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminGetUser", []))

    @jsii.member(jsii_name="toAdminInitiateAuth")
    def to_admin_initiate_auth(self) -> "CognitoIdp":
        '''(experimental) Grants permission to authenticate any user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminInitiateAuth.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminInitiateAuth", []))

    @jsii.member(jsii_name="toAdminLinkProviderForUser")
    def to_admin_link_provider_for_user(self) -> "CognitoIdp":
        '''(experimental) Grants permission to link any user pool user to a third-party IdP user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminLinkProviderForUser.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminLinkProviderForUser", []))

    @jsii.member(jsii_name="toAdminListDevices")
    def to_admin_list_devices(self) -> "CognitoIdp":
        '''(experimental) Grants permission to list any user's remembered devices.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminListDevices.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminListDevices", []))

    @jsii.member(jsii_name="toAdminListGroupsForUser")
    def to_admin_list_groups_for_user(self) -> "CognitoIdp":
        '''(experimental) Grants permission to list the groups that any user belongs to.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminListGroupsForUser.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminListGroupsForUser", []))

    @jsii.member(jsii_name="toAdminListUserAuthEvents")
    def to_admin_list_user_auth_events(self) -> "CognitoIdp":
        '''(experimental) Grants permission to lists sign-in events for any user.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminListUserAuthEvents.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminListUserAuthEvents", []))

    @jsii.member(jsii_name="toAdminRemoveUserFromGroup")
    def to_admin_remove_user_from_group(self) -> "CognitoIdp":
        '''(experimental) Grants permission to remove any user from any group.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminRemoveUserFromGroup.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminRemoveUserFromGroup", []))

    @jsii.member(jsii_name="toAdminResetUserPassword")
    def to_admin_reset_user_password(self) -> "CognitoIdp":
        '''(experimental) Grants permission to reset any user's password.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminResetUserPassword.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminResetUserPassword", []))

    @jsii.member(jsii_name="toAdminRespondToAuthChallenge")
    def to_admin_respond_to_auth_challenge(self) -> "CognitoIdp":
        '''(experimental) Grants permission to respond to an authentication challenge during the authentication of any user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminRespondToAuthChallenge.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminRespondToAuthChallenge", []))

    @jsii.member(jsii_name="toAdminSetUserMFAPreference")
    def to_admin_set_user_mfa_preference(self) -> "CognitoIdp":
        '''(experimental) Grants permission to set any user's preferred MFA method.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminSetUserMFAPreference.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminSetUserMFAPreference", []))

    @jsii.member(jsii_name="toAdminSetUserPassword")
    def to_admin_set_user_password(self) -> "CognitoIdp":
        '''(experimental) Grants permission to set any user's password.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminSetUserPassword.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminSetUserPassword", []))

    @jsii.member(jsii_name="toAdminSetUserSettings")
    def to_admin_set_user_settings(self) -> "CognitoIdp":
        '''(experimental) Grants permission to set user settings for any user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminSetUserSettings.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminSetUserSettings", []))

    @jsii.member(jsii_name="toAdminUpdateAuthEventFeedback")
    def to_admin_update_auth_event_feedback(self) -> "CognitoIdp":
        '''(experimental) Grants permission to update advanced security feedback for any user's authentication event.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUpdateAuthEventFeedback.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminUpdateAuthEventFeedback", []))

    @jsii.member(jsii_name="toAdminUpdateDeviceStatus")
    def to_admin_update_device_status(self) -> "CognitoIdp":
        '''(experimental) Grants permission to update the status of any user's remembered devices.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUpdateDeviceStatus.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminUpdateDeviceStatus", []))

    @jsii.member(jsii_name="toAdminUpdateUserAttributes")
    def to_admin_update_user_attributes(self) -> "CognitoIdp":
        '''(experimental) Grants permission to updates any user's standard or custom attributes.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUpdateUserAttributes.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminUpdateUserAttributes", []))

    @jsii.member(jsii_name="toAdminUserGlobalSignOut")
    def to_admin_user_global_sign_out(self) -> "CognitoIdp":
        '''(experimental) Grants permission to sign out any user from all sessions.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUserGlobalSignOut.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAdminUserGlobalSignOut", []))

    @jsii.member(jsii_name="toAssociateSoftwareToken")
    def to_associate_software_token(self) -> "CognitoIdp":
        '''(experimental) Returns a unique generated shared secret key code for the user account.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AssociateSoftwareToken.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAssociateSoftwareToken", []))

    @jsii.member(jsii_name="toAssociateWebACL")
    def to_associate_web_acl(self) -> "CognitoIdp":
        '''(experimental) Grants permission to associate the user pool with an AWS WAF web ACL.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toAssociateWebACL", []))

    @jsii.member(jsii_name="toChangePassword")
    def to_change_password(self) -> "CognitoIdp":
        '''(experimental) Changes the password for a specified user in a user pool.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ChangePassword.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toChangePassword", []))

    @jsii.member(jsii_name="toConfirmDevice")
    def to_confirm_device(self) -> "CognitoIdp":
        '''(experimental) Confirms tracking of the device. This API call is the call that begins device tracking.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ConfirmDevice.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toConfirmDevice", []))

    @jsii.member(jsii_name="toConfirmForgotPassword")
    def to_confirm_forgot_password(self) -> "CognitoIdp":
        '''(experimental) Allows a user to enter a confirmation code to reset a forgotten password.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ConfirmForgotPassword.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toConfirmForgotPassword", []))

    @jsii.member(jsii_name="toConfirmSignUp")
    def to_confirm_sign_up(self) -> "CognitoIdp":
        '''(experimental) Confirms registration of a user and handles the existing alias from a previous user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ConfirmSignUp.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toConfirmSignUp", []))

    @jsii.member(jsii_name="toCreateGroup")
    def to_create_group(self) -> "CognitoIdp":
        '''(experimental) Grants permission to create new user pool groups.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateGroup.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toCreateGroup", []))

    @jsii.member(jsii_name="toCreateIdentityProvider")
    def to_create_identity_provider(self) -> "CognitoIdp":
        '''(experimental) Grants permission to add identity providers to user pools.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateIdentityProvider.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toCreateIdentityProvider", []))

    @jsii.member(jsii_name="toCreateResourceServer")
    def to_create_resource_server(self) -> "CognitoIdp":
        '''(experimental) Grants permission to create and configure scopes for OAuth 2.0 resource servers.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateResourceServer.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toCreateResourceServer", []))

    @jsii.member(jsii_name="toCreateUserImportJob")
    def to_create_user_import_job(self) -> "CognitoIdp":
        '''(experimental) Grants permission to create user CSV import jobs.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserImportJob.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toCreateUserImportJob", []))

    @jsii.member(jsii_name="toCreateUserPool")
    def to_create_user_pool(self) -> "CognitoIdp":
        '''(experimental) Grants permission to create and set password policy for user pools.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPool.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toCreateUserPool", []))

    @jsii.member(jsii_name="toCreateUserPoolClient")
    def to_create_user_pool_client(self) -> "CognitoIdp":
        '''(experimental) Grants permission to create user pool app clients.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPoolClient.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toCreateUserPoolClient", []))

    @jsii.member(jsii_name="toCreateUserPoolDomain")
    def to_create_user_pool_domain(self) -> "CognitoIdp":
        '''(experimental) Grants permission to add user pool domains.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPoolDomain.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toCreateUserPoolDomain", []))

    @jsii.member(jsii_name="toDeleteGroup")
    def to_delete_group(self) -> "CognitoIdp":
        '''(experimental) Grants permission to delete any empty user pool group.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteGroup.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDeleteGroup", []))

    @jsii.member(jsii_name="toDeleteIdentityProvider")
    def to_delete_identity_provider(self) -> "CognitoIdp":
        '''(experimental) Grants permission to delete any identity provider from user pools.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteIdentityProvider.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDeleteIdentityProvider", []))

    @jsii.member(jsii_name="toDeleteResourceServer")
    def to_delete_resource_server(self) -> "CognitoIdp":
        '''(experimental) Grants permission to delete any OAuth 2.0 resource server from user pools.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteResourceServer.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDeleteResourceServer", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "CognitoIdp":
        '''(experimental) Allows a user to delete one's self.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDeleteUserAttributes")
    def to_delete_user_attributes(self) -> "CognitoIdp":
        '''(experimental) Deletes the attributes for a user.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserAttributes.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDeleteUserAttributes", []))

    @jsii.member(jsii_name="toDeleteUserPool")
    def to_delete_user_pool(self) -> "CognitoIdp":
        '''(experimental) Grants permission to delete user pools.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPool.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDeleteUserPool", []))

    @jsii.member(jsii_name="toDeleteUserPoolClient")
    def to_delete_user_pool_client(self) -> "CognitoIdp":
        '''(experimental) Grants permission to delete any user pool app client.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPoolClient.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDeleteUserPoolClient", []))

    @jsii.member(jsii_name="toDeleteUserPoolDomain")
    def to_delete_user_pool_domain(self) -> "CognitoIdp":
        '''(experimental) Grants permission to delete any user pool domain.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPoolDomain.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDeleteUserPoolDomain", []))

    @jsii.member(jsii_name="toDescribeIdentityProvider")
    def to_describe_identity_provider(self) -> "CognitoIdp":
        '''(experimental) Grants permission to describe any user pool identity provider.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeIdentityProvider.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDescribeIdentityProvider", []))

    @jsii.member(jsii_name="toDescribeResourceServer")
    def to_describe_resource_server(self) -> "CognitoIdp":
        '''(experimental) Grants permission to describe any OAuth 2.0 resource server.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeResourceServer.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDescribeResourceServer", []))

    @jsii.member(jsii_name="toDescribeRiskConfiguration")
    def to_describe_risk_configuration(self) -> "CognitoIdp":
        '''(experimental) Grants permission to describe the risk configuration settings of user pools and app clients.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeRiskConfiguration.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDescribeRiskConfiguration", []))

    @jsii.member(jsii_name="toDescribeUserImportJob")
    def to_describe_user_import_job(self) -> "CognitoIdp":
        '''(experimental) Grants permission to describe any user import job.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserImportJob.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDescribeUserImportJob", []))

    @jsii.member(jsii_name="toDescribeUserPool")
    def to_describe_user_pool(self) -> "CognitoIdp":
        '''(experimental) Grants permission to describe user pools.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserPool.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDescribeUserPool", []))

    @jsii.member(jsii_name="toDescribeUserPoolClient")
    def to_describe_user_pool_client(self) -> "CognitoIdp":
        '''(experimental) Grants permission to describe any user pool app client.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserPoolClient.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDescribeUserPoolClient", []))

    @jsii.member(jsii_name="toDescribeUserPoolDomain")
    def to_describe_user_pool_domain(self) -> "CognitoIdp":
        '''(experimental) Grants permission to describe any user pool domain.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserPoolDomain.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDescribeUserPoolDomain", []))

    @jsii.member(jsii_name="toDisassociateWebACL")
    def to_disassociate_web_acl(self) -> "CognitoIdp":
        '''(experimental) Grants permission to disassociate the user pool with an AWS WAF web ACL.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toDisassociateWebACL", []))

    @jsii.member(jsii_name="toForgetDevice")
    def to_forget_device(self) -> "CognitoIdp":
        '''(experimental) Forgets the specified device.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ForgetDevice.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toForgetDevice", []))

    @jsii.member(jsii_name="toForgotPassword")
    def to_forgot_password(self) -> "CognitoIdp":
        '''(experimental) Calling this API causes a message to be sent to the end user with a confirmation code that is required to change the user's password.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ForgotPassword.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toForgotPassword", []))

    @jsii.member(jsii_name="toGetCSVHeader")
    def to_get_csv_header(self) -> "CognitoIdp":
        '''(experimental) Grants permission to generate headers for a user import .csv file.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetCSVHeader.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGetCSVHeader", []))

    @jsii.member(jsii_name="toGetDevice")
    def to_get_device(self) -> "CognitoIdp":
        '''(experimental) Gets the device.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetDevice.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGetDevice", []))

    @jsii.member(jsii_name="toGetGroup")
    def to_get_group(self) -> "CognitoIdp":
        '''(experimental) Grants permission to describe a user pool group.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetGroup.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGetGroup", []))

    @jsii.member(jsii_name="toGetIdentityProviderByIdentifier")
    def to_get_identity_provider_by_identifier(self) -> "CognitoIdp":
        '''(experimental) Grants permission to correlate a user pool IdP identifier to the IdP Name.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetIdentityProviderByIdentifier.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGetIdentityProviderByIdentifier", []))

    @jsii.member(jsii_name="toGetSigningCertificate")
    def to_get_signing_certificate(self) -> "CognitoIdp":
        '''(experimental) Grants permission to look up signing certificates for user pools.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetSigningCertificate.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGetSigningCertificate", []))

    @jsii.member(jsii_name="toGetUICustomization")
    def to_get_ui_customization(self) -> "CognitoIdp":
        '''(experimental) Grants permission to get UI customization information for the hosted UI of any app client.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUICustomization.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGetUICustomization", []))

    @jsii.member(jsii_name="toGetUser")
    def to_get_user(self) -> "CognitoIdp":
        '''(experimental) Gets the user attributes and metadata for a user.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUser.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGetUser", []))

    @jsii.member(jsii_name="toGetUserAttributeVerificationCode")
    def to_get_user_attribute_verification_code(self) -> "CognitoIdp":
        '''(experimental) Gets the user attribute verification code for the specified attribute name.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUserAttributeVerificationCode.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGetUserAttributeVerificationCode", []))

    @jsii.member(jsii_name="toGetUserPoolMfaConfig")
    def to_get_user_pool_mfa_config(self) -> "CognitoIdp":
        '''(experimental) Grants permission to look up the MFA configuration of user pools.

        Access Level: Read

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUserPoolMfaConfig.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGetUserPoolMfaConfig", []))

    @jsii.member(jsii_name="toGetWebACLForResource")
    def to_get_web_acl_for_resource(self) -> "CognitoIdp":
        '''(experimental) Grants permission to get the AWS WAF web ACL that is associated with an Amazon Cognito user pool.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGetWebACLForResource", []))

    @jsii.member(jsii_name="toGlobalSignOut")
    def to_global_sign_out(self) -> "CognitoIdp":
        '''(experimental) Signs out users from all devices.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GlobalSignOut.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toGlobalSignOut", []))

    @jsii.member(jsii_name="toInitiateAuth")
    def to_initiate_auth(self) -> "CognitoIdp":
        '''(experimental) Initiates the authentication flow.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_InitiateAuth.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toInitiateAuth", []))

    @jsii.member(jsii_name="toListDevices")
    def to_list_devices(self) -> "CognitoIdp":
        '''(experimental) Lists the devices.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListDevices.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListDevices", []))

    @jsii.member(jsii_name="toListGroups")
    def to_list_groups(self) -> "CognitoIdp":
        '''(experimental) Grants permission to list all groups in user pools.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListGroups.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListGroups", []))

    @jsii.member(jsii_name="toListIdentityProviders")
    def to_list_identity_providers(self) -> "CognitoIdp":
        '''(experimental) Grants permission to list all identity providers in user pools.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListIdentityProviders.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListIdentityProviders", []))

    @jsii.member(jsii_name="toListResourceServers")
    def to_list_resource_servers(self) -> "CognitoIdp":
        '''(experimental) Grants permission to list all resource servers in user pools.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListResourceServers.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListResourceServers", []))

    @jsii.member(jsii_name="toListResourcesForWebACL")
    def to_list_resources_for_web_acl(self) -> "CognitoIdp":
        '''(experimental) Grants permission to list the user pools that are associated with an AWS WAF web ACL.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListResourcesForWebACL", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "CognitoIdp":
        '''(experimental) Grants permission to list the tags that are assigned to an Amazon Cognito user pool.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListUserImportJobs")
    def to_list_user_import_jobs(self) -> "CognitoIdp":
        '''(experimental) Grants permission to list all user import jobs.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUserImportJobs.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListUserImportJobs", []))

    @jsii.member(jsii_name="toListUserPoolClients")
    def to_list_user_pool_clients(self) -> "CognitoIdp":
        '''(experimental) Grants permission to list all app clients in user pools.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUserPoolClients.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListUserPoolClients", []))

    @jsii.member(jsii_name="toListUserPools")
    def to_list_user_pools(self) -> "CognitoIdp":
        '''(experimental) Grants permission to list all user pools.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUserPools.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListUserPools", []))

    @jsii.member(jsii_name="toListUsers")
    def to_list_users(self) -> "CognitoIdp":
        '''(experimental) Grants permission to list all user pool users.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUsers.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListUsers", []))

    @jsii.member(jsii_name="toListUsersInGroup")
    def to_list_users_in_group(self) -> "CognitoIdp":
        '''(experimental) Grants permission to list the users in any group.

        Access Level: List

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUsersInGroup.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toListUsersInGroup", []))

    @jsii.member(jsii_name="toResendConfirmationCode")
    def to_resend_confirmation_code(self) -> "CognitoIdp":
        '''(experimental) Resends the confirmation (for confirmation of registration) to a specific user in the user pool.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ResendConfirmationCode.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toResendConfirmationCode", []))

    @jsii.member(jsii_name="toRespondToAuthChallenge")
    def to_respond_to_auth_challenge(self) -> "CognitoIdp":
        '''(experimental) Responds to the authentication challenge.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_RespondToAuthChallenge.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toRespondToAuthChallenge", []))

    @jsii.member(jsii_name="toRevokeToken")
    def to_revoke_token(self) -> "CognitoIdp":
        '''(experimental) Revokes all of the access tokens generated by the specified refresh token.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_RevokeToken.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toRevokeToken", []))

    @jsii.member(jsii_name="toSetRiskConfiguration")
    def to_set_risk_configuration(self) -> "CognitoIdp":
        '''(experimental) Grants permission to set risk configuration for user pools and app clients.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetRiskConfiguration.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toSetRiskConfiguration", []))

    @jsii.member(jsii_name="toSetUICustomization")
    def to_set_ui_customization(self) -> "CognitoIdp":
        '''(experimental) Grants permission to customize the hosted UI for any app client.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetUICustomization.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toSetUICustomization", []))

    @jsii.member(jsii_name="toSetUserMFAPreference")
    def to_set_user_mfa_preference(self) -> "CognitoIdp":
        '''(experimental) Sets MFA preference for the user in the userpool.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetUserMFAPreference.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toSetUserMFAPreference", []))

    @jsii.member(jsii_name="toSetUserPoolMfaConfig")
    def to_set_user_pool_mfa_config(self) -> "CognitoIdp":
        '''(experimental) Grants permission to set user pool MFA configuration.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetUserPoolMfaConfig.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toSetUserPoolMfaConfig", []))

    @jsii.member(jsii_name="toSetUserSettings")
    def to_set_user_settings(self) -> "CognitoIdp":
        '''(experimental) Sets the user settings like multi-factor authentication (MFA).

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetUserSettings.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toSetUserSettings", []))

    @jsii.member(jsii_name="toSignUp")
    def to_sign_up(self) -> "CognitoIdp":
        '''(experimental) Registers the user in the specified user pool and creates a user name, password, and user attributes.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SignUp.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toSignUp", []))

    @jsii.member(jsii_name="toStartUserImportJob")
    def to_start_user_import_job(self) -> "CognitoIdp":
        '''(experimental) Grants permission to start any user import job.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_StartUserImportJob.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toStartUserImportJob", []))

    @jsii.member(jsii_name="toStopUserImportJob")
    def to_stop_user_import_job(self) -> "CognitoIdp":
        '''(experimental) Grants permission to stop any user import job.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_StopUserImportJob.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toStopUserImportJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "CognitoIdp":
        '''(experimental) Grants permission to tag a user pool.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "CognitoIdp":
        '''(experimental) Grants permission to untag a user pool.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAuthEventFeedback")
    def to_update_auth_event_feedback(self) -> "CognitoIdp":
        '''(experimental) Updates the feedback for the user authentication event.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateAuthEventFeedback.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toUpdateAuthEventFeedback", []))

    @jsii.member(jsii_name="toUpdateDeviceStatus")
    def to_update_device_status(self) -> "CognitoIdp":
        '''(experimental) Updates the device status.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateDeviceStatus.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toUpdateDeviceStatus", []))

    @jsii.member(jsii_name="toUpdateGroup")
    def to_update_group(self) -> "CognitoIdp":
        '''(experimental) Grants permission to update the configuration of any group.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateGroup.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toUpdateGroup", []))

    @jsii.member(jsii_name="toUpdateIdentityProvider")
    def to_update_identity_provider(self) -> "CognitoIdp":
        '''(experimental) Grants permission to update the configuration of any user pool IdP.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateIdentityProvider.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toUpdateIdentityProvider", []))

    @jsii.member(jsii_name="toUpdateResourceServer")
    def to_update_resource_server(self) -> "CognitoIdp":
        '''(experimental) Grants permission to update the configuration of any OAuth 2.0 resource server.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateResourceServer.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toUpdateResourceServer", []))

    @jsii.member(jsii_name="toUpdateUserAttributes")
    def to_update_user_attributes(self) -> "CognitoIdp":
        '''(experimental) Allows a user to update a specific attribute (one at a time).

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserAttributes.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toUpdateUserAttributes", []))

    @jsii.member(jsii_name="toUpdateUserPool")
    def to_update_user_pool(self) -> "CognitoIdp":
        '''(experimental) Grants permission to updates the configuration of user pools.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserPool.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toUpdateUserPool", []))

    @jsii.member(jsii_name="toUpdateUserPoolClient")
    def to_update_user_pool_client(self) -> "CognitoIdp":
        '''(experimental) Grants permission to update any user pool client.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserPoolClient.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toUpdateUserPoolClient", []))

    @jsii.member(jsii_name="toUpdateUserPoolDomain")
    def to_update_user_pool_domain(self) -> "CognitoIdp":
        '''(experimental) Grants permission to replace the certificate for any custom domain.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserPoolDomain.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toUpdateUserPoolDomain", []))

    @jsii.member(jsii_name="toVerifySoftwareToken")
    def to_verify_software_token(self) -> "CognitoIdp":
        '''(experimental) Registers a user's entered TOTP code and mark the user's software token MFA status as verified if successful.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_VerifySoftwareToken.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toVerifySoftwareToken", []))

    @jsii.member(jsii_name="toVerifyUserAttribute")
    def to_verify_user_attribute(self) -> "CognitoIdp":
        '''(experimental) Verifies a user attribute using a one time verification code.

        Access Level: Write

        https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_VerifyUserAttribute.html

        :stability: experimental
        '''
        return typing.cast("CognitoIdp", jsii.invoke(self, "toVerifyUserAttribute", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__594cee336dac514aecd1eb0b78a2d22dce2cf3bf51a4cfb180b4fec11171192c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__76d7f25e0091ce81b21cf65fddd4b54f79e028130919268bafae6694c360cbc1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class CognitoSync(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.CognitoSync",
):
    '''(experimental) Statement provider for service `cognito-sync <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncognitosync.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cognito-sync <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncognitosync.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2a26780bb898528affa80fc0603a1242d45f5a69fdcfb6483059f1e0f66a3cde)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDataset")
    def on_dataset(
        self,
        identity_pool_id: builtins.str,
        identity_id: builtins.str,
        dataset_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CognitoSync":
        '''(experimental) Adds a resource of type dataset to the statement.

        https://docs.aws.amazon.com/cognito/latest/developerguide/synchronizing-data.html#understanding-datasets

        :param identity_pool_id: - Identifier for the identityPoolId.
        :param identity_id: - Identifier for the identityId.
        :param dataset_name: - Identifier for the datasetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__121062d5d4be719395bdb4df636ac5eda902bebc86f649826bbcb5a42dc0751c)
            check_type(argname="argument identity_pool_id", value=identity_pool_id, expected_type=type_hints["identity_pool_id"])
            check_type(argname="argument identity_id", value=identity_id, expected_type=type_hints["identity_id"])
            check_type(argname="argument dataset_name", value=dataset_name, expected_type=type_hints["dataset_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("CognitoSync", jsii.invoke(self, "onDataset", [identity_pool_id, identity_id, dataset_name, account, region, partition]))

    @jsii.member(jsii_name="onIdentity")
    def on_identity(
        self,
        identity_pool_id: builtins.str,
        identity_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CognitoSync":
        '''(experimental) Adds a resource of type identity to the statement.

        https://docs.aws.amazon.com/cognito/latest/developerguide/identity-pools.html#authenticated-and-unauthenticated-identities

        :param identity_pool_id: - Identifier for the identityPoolId.
        :param identity_id: - Identifier for the identityId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__704369765323fd7eb22cf70bb87a08eea8be0b550d37c6d6d1453b64874387af)
            check_type(argname="argument identity_pool_id", value=identity_pool_id, expected_type=type_hints["identity_pool_id"])
            check_type(argname="argument identity_id", value=identity_id, expected_type=type_hints["identity_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("CognitoSync", jsii.invoke(self, "onIdentity", [identity_pool_id, identity_id, account, region, partition]))

    @jsii.member(jsii_name="onIdentitypool")
    def on_identitypool(
        self,
        identity_pool_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "CognitoSync":
        '''(experimental) Adds a resource of type identitypool to the statement.

        https://docs.aws.amazon.com/cognito/latest/developerguide/identity-pools.html

        :param identity_pool_id: - Identifier for the identityPoolId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__61970d1d124d0ec0cb38323ca2bd118bceb1835f8d777b7193b5330dd51884a0)
            check_type(argname="argument identity_pool_id", value=identity_pool_id, expected_type=type_hints["identity_pool_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("CognitoSync", jsii.invoke(self, "onIdentitypool", [identity_pool_id, account, region, partition]))

    @jsii.member(jsii_name="toBulkPublish")
    def to_bulk_publish(self) -> "CognitoSync":
        '''(experimental) Grants permission to initiate a bulk publish of all existing datasets for an Identity Pool to the configured stream.

        Access Level: Write

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_BulkPublish.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toBulkPublish", []))

    @jsii.member(jsii_name="toDeleteDataset")
    def to_delete_dataset(self) -> "CognitoSync":
        '''(experimental) Grants permission to delete a specific dataset.

        Access Level: Write

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_DeleteDataset.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toDeleteDataset", []))

    @jsii.member(jsii_name="toDescribeDataset")
    def to_describe_dataset(self) -> "CognitoSync":
        '''(experimental) Grants permission to get metadata about a dataset by identity and dataset name.

        Access Level: Read

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_DescribeDataset.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toDescribeDataset", []))

    @jsii.member(jsii_name="toDescribeIdentityPoolUsage")
    def to_describe_identity_pool_usage(self) -> "CognitoSync":
        '''(experimental) Grants permission to get usage details (for example, data storage) about a particular identity pool.

        Access Level: Read

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_DescribeIdentityPoolUsage.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toDescribeIdentityPoolUsage", []))

    @jsii.member(jsii_name="toDescribeIdentityUsage")
    def to_describe_identity_usage(self) -> "CognitoSync":
        '''(experimental) Grants permission to get usage information for an identity, including number of datasets and data usage.

        Access Level: Read

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_DescribeIdentityUsage.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toDescribeIdentityUsage", []))

    @jsii.member(jsii_name="toGetBulkPublishDetails")
    def to_get_bulk_publish_details(self) -> "CognitoSync":
        '''(experimental) Grants permission to get the status of the last BulkPublish operation for an identity pool.

        Access Level: Read

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_GetBulkPublishDetails.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toGetBulkPublishDetails", []))

    @jsii.member(jsii_name="toGetCognitoEvents")
    def to_get_cognito_events(self) -> "CognitoSync":
        '''(experimental) Grants permission to get the events and the corresponding Lambda functions associated with an identity pool.

        Access Level: Read

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_GetCognitoEvents.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toGetCognitoEvents", []))

    @jsii.member(jsii_name="toGetIdentityPoolConfiguration")
    def to_get_identity_pool_configuration(self) -> "CognitoSync":
        '''(experimental) Grants permission to get the configuration settings of an identity pool.

        Access Level: Read

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_GetIdentityPoolConfiguration.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toGetIdentityPoolConfiguration", []))

    @jsii.member(jsii_name="toListDatasets")
    def to_list_datasets(self) -> "CognitoSync":
        '''(experimental) Grants permission to list datasets for an identity.

        Access Level: List

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_ListDatasets.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toListDatasets", []))

    @jsii.member(jsii_name="toListIdentityPoolUsage")
    def to_list_identity_pool_usage(self) -> "CognitoSync":
        '''(experimental) Grants permission to get a list of identity pools registered with Cognito.

        Access Level: Read

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_ListIdentityPoolUsage.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toListIdentityPoolUsage", []))

    @jsii.member(jsii_name="toListRecords")
    def to_list_records(self) -> "CognitoSync":
        '''(experimental) Grants permission to get paginated records, optionally changed after a particular sync count for a dataset and identity.

        Access Level: Read

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_ListRecords.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toListRecords", []))

    @jsii.member(jsii_name="toQueryRecords")
    def to_query_records(self) -> "CognitoSync":
        '''(experimental) Grants permission to query records.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toQueryRecords", []))

    @jsii.member(jsii_name="toRegisterDevice")
    def to_register_device(self) -> "CognitoSync":
        '''(experimental) Grants permission to register a device to receive push sync notifications.

        Access Level: Write

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_RegisterDevice.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toRegisterDevice", []))

    @jsii.member(jsii_name="toSetCognitoEvents")
    def to_set_cognito_events(self) -> "CognitoSync":
        '''(experimental) Grants permission to set the AWS Lambda function for a given event type for an identity pool.

        Access Level: Write

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_SetCognitoEvents.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toSetCognitoEvents", []))

    @jsii.member(jsii_name="toSetDatasetConfiguration")
    def to_set_dataset_configuration(self) -> "CognitoSync":
        '''(experimental) Grants permission to configure datasets.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toSetDatasetConfiguration", []))

    @jsii.member(jsii_name="toSetIdentityPoolConfiguration")
    def to_set_identity_pool_configuration(self) -> "CognitoSync":
        '''(experimental) Grants permission to set the necessary configuration for push sync.

        Access Level: Write

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_SetIdentityPoolConfiguration.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toSetIdentityPoolConfiguration", []))

    @jsii.member(jsii_name="toSubscribeToDataset")
    def to_subscribe_to_dataset(self) -> "CognitoSync":
        '''(experimental) Grants permission to subscribe to receive notifications when a dataset is modified by another device.

        Access Level: Write

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_SubscribeToDataset.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toSubscribeToDataset", []))

    @jsii.member(jsii_name="toUnsubscribeFromDataset")
    def to_unsubscribe_from_dataset(self) -> "CognitoSync":
        '''(experimental) Grants permission to unsubscribe from receiving notifications when a dataset is modified by another device.

        Access Level: Write

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_UnsubscribeFromDataset.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toUnsubscribeFromDataset", []))

    @jsii.member(jsii_name="toUpdateRecords")
    def to_update_records(self) -> "CognitoSync":
        '''(experimental) Grants permission to post updates to records and add and delete records for a dataset and user.

        Access Level: Write

        https://docs.aws.amazon.com/cognitosync/latest/APIReference/API_UpdateRecords.html

        :stability: experimental
        '''
        return typing.cast("CognitoSync", jsii.invoke(self, "toUpdateRecords", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6ed11f708d557036c551cbd6c72ff3ea3d4ee7192378c8bbee042cfdb75caa11)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__88ac78adf44cb408b3b110c91740ed5214ea08a62a0332b73c52eb6b327a0ecf)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Comprehend(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Comprehend",
):
    '''(experimental) Statement provider for service `comprehend <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncomprehend.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `comprehend <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncomprehend.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c130948d975e9afaa1e4a528bf32b9be5a02fb7c7b73f1f08327487a59168183)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifDataLakeKmsKey")
    def if_data_lake_kms_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Comprehend":
        '''(experimental) Filters access by the DataLake Kms Key associated with the flywheel resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazoncomprehend.html#amazoncomprehend-policy-keys

        Applies to actions:

        - .toCreateFlywheel()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1fabc923583fe768ea68bc398aecae36b4a2aa87eea593b5cf896916f1e74891)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Comprehend", jsii.invoke(self, "ifDataLakeKmsKey", [value, operator]))

    @jsii.member(jsii_name="ifFlywheelIterationId")
    def if_flywheel_iteration_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Comprehend":
        '''(experimental) Filters access by particular Iteration Id for a flywheel.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazoncomprehend.html#amazoncomprehend-policy-keys

        Applies to actions:

        - .toDescribeFlywheelIteration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b164a26a21b2eed0fe85ab55c7bed0ad0d0259c58fb016df998a9e572a7c79f9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Comprehend", jsii.invoke(self, "ifFlywheelIterationId", [value, operator]))

    @jsii.member(jsii_name="ifModelKmsKey")
    def if_model_kms_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Comprehend":
        '''(experimental) Filters access by the model KMS key associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazoncomprehend.html#amazoncomprehend-policy-keys

        Applies to actions:

        - .toCreateDocumentClassifier()
        - .toCreateEntityRecognizer()
        - .toCreateFlywheel()
        - .toImportModel()
        - .toUpdateFlywheel()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7815e1d8335fcf6700cbeeb7943066038893ad24b08429f8fa4e2ab6d1d222c4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Comprehend", jsii.invoke(self, "ifModelKmsKey", [value, operator]))

    @jsii.member(jsii_name="ifOutputKmsKey")
    def if_output_kms_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Comprehend":
        '''(experimental) Filters access by the output KMS key associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazoncomprehend.html#amazoncomprehend-policy-keys

        Applies to actions:

        - .toCreateDocumentClassifier()
        - .toStartDocumentClassificationJob()
        - .toStartDominantLanguageDetectionJob()
        - .toStartEntitiesDetectionJob()
        - .toStartEventsDetectionJob()
        - .toStartKeyPhrasesDetectionJob()
        - .toStartPiiEntitiesDetectionJob()
        - .toStartSentimentDetectionJob()
        - .toStartTargetedSentimentDetectionJob()
        - .toStartTopicsDetectionJob()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__98e4e66f112bcaf47ad372b5402e049b5c97525029b8971e6279ad7ec2ae5f56)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Comprehend", jsii.invoke(self, "ifOutputKmsKey", [value, operator]))

    @jsii.member(jsii_name="ifVolumeKmsKey")
    def if_volume_kms_key(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Comprehend":
        '''(experimental) Filters access by the volume KMS key associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazoncomprehend.html#amazoncomprehend-policy-keys

        Applies to actions:

        - .toCreateDocumentClassifier()
        - .toCreateEntityRecognizer()
        - .toCreateFlywheel()
        - .toStartDocumentClassificationJob()
        - .toStartDominantLanguageDetectionJob()
        - .toStartEntitiesDetectionJob()
        - .toStartKeyPhrasesDetectionJob()
        - .toStartSentimentDetectionJob()
        - .toStartTargetedSentimentDetectionJob()
        - .toStartTopicsDetectionJob()
        - .toUpdateFlywheel()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e061f5526e9bd9e1524330d7b4906efe0f1bb5221e4573c90154a4503ecbaa3f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Comprehend", jsii.invoke(self, "ifVolumeKmsKey", [value, operator]))

    @jsii.member(jsii_name="ifVpcSecurityGroupIds")
    def if_vpc_security_group_ids(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Comprehend":
        '''(experimental) Filters access by the list of all VPC security group ids associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazoncomprehend.html#amazoncomprehend-policy-keys

        Applies to actions:

        - .toCreateDocumentClassifier()
        - .toCreateEntityRecognizer()
        - .toCreateFlywheel()
        - .toStartDocumentClassificationJob()
        - .toStartDominantLanguageDetectionJob()
        - .toStartEntitiesDetectionJob()
        - .toStartKeyPhrasesDetectionJob()
        - .toStartSentimentDetectionJob()
        - .toStartTargetedSentimentDetectionJob()
        - .toStartTopicsDetectionJob()
        - .toUpdateFlywheel()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__65a7452392153398ead0722974c12b8ec7162684a9c2107b8b867ad13510141a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Comprehend", jsii.invoke(self, "ifVpcSecurityGroupIds", [value, operator]))

    @jsii.member(jsii_name="ifVpcSubnets")
    def if_vpc_subnets(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Comprehend":
        '''(experimental) Filters access by the list of all VPC subnets associated with the resource in the request.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazoncomprehend.html#amazoncomprehend-policy-keys

        Applies to actions:

        - .toCreateDocumentClassifier()
        - .toCreateEntityRecognizer()
        - .toCreateFlywheel()
        - .toStartDocumentClassificationJob()
        - .toStartDominantLanguageDetectionJob()
        - .toStartEntitiesDetectionJob()
        - .toStartKeyPhrasesDetectionJob()
        - .toStartSentimentDetectionJob()
        - .toStartTargetedSentimentDetectionJob()
        - .toStartTopicsDetectionJob()
        - .toUpdateFlywheel()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__03f58f279b03c5c21612d61fe97c462919f2893d5e9a7459c0499e4096d5f3c7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Comprehend", jsii.invoke(self, "ifVpcSubnets", [value, operator]))

    @jsii.member(jsii_name="onDocumentClassificationJob")
    def on_document_classification_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Comprehend":
        '''(experimental) Adds a resource of type document-classification-job to the statement.

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StartDocumentClassificationJob.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a6c3236fe022f22cd17ae7e6ab0ef4deb0a12e759aee5c69f55e6815964734e7)
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Comprehend", jsii.invoke(self, "onDocumentClassificationJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onDocumentClassifier")
    def on_document_classifier(
        self,
        document_classifier_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Comprehend":
        '''(experimental) Adds a resource of type document-classifier to the statement.

        https://docs.aws.amazon.com/comprehend/latest/dg/how-document-classification-training.html

        :param document_classifier_name: - Identifier for the documentClassifierName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__27f06fde4bd289bde36117c3a779c9ff404bd925c24a99e79a16ebfc88f86482)
            check_type(argname="argument document_classifier_name", value=document_classifier_name, expected_type=type_hints["document_classifier_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Comprehend", jsii.invoke(self, "onDocumentClassifier", [document_classifier_name, account, region, partition]))

    @jsii.member(jsii_name="onDocumentClassifierEndpoint")
    def on_document_classifier_endpoint(
        self,
        document_classifier_endpoint_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Comprehend":
        '''(experimental) Adds a resource of type document-classifier-endpoint to the statement.

        https://docs.aws.amazon.com/comprehend/latest/dg/manage-endpoints.html

        :param document_classifier_endpoint_name: - Identifier for the documentClassifierEndpointName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5208915eb453451c12bb859759f0e38997d7d17d1ea51c412b0ef7af547faf83)
            check_type(argname="argument document_classifier_endpoint_name", value=document_classifier_endpoint_name, expected_type=type_hints["document_classifier_endpoint_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Comprehend", jsii.invoke(self, "onDocumentClassifierEndpoint", [document_classifier_endpoint_name, account, region, partition]))

    @jsii.member(jsii_name="onDominantLanguageDetectionJob")
    def on_dominant_language_detection_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Comprehend":
        '''(experimental) Adds a resource of type dominant-language-detection-job to the statement.

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StartDominantLanguageDetectionJob.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__04886549e1201603c1137ee495a1e91bd1cb0b8e81d8db697c6522a09f2ed8c3)
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Comprehend", jsii.invoke(self, "onDominantLanguageDetectionJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onEntitiesDetectionJob")
    def on_entities_detection_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Comprehend":
        '''(experimental) Adds a resource of type entities-detection-job to the statement.

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StartEntitiesDetectionJob.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c27e136665688165e70a7a9b251f4df3b76483106e90b4be7012f103f116a16c)
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Comprehend", jsii.invoke(self, "onEntitiesDetectionJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onEntityRecognizer")
    def on_entity_recognizer(
        self,
        entity_recognizer_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Comprehend":
        '''(experimental) Adds a resource of type entity-recognizer to the statement.

        https://docs.aws.amazon.com/comprehend/latest/dg/training-recognizers.html

        :param entity_recognizer_name: - Identifier for the entityRecognizerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4db18c5e59efc0a3bfd63fa8207a8ac539dfa925cafe6eacfd5b7a6e8eb5ad54)
            check_type(argname="argument entity_recognizer_name", value=entity_recognizer_name, expected_type=type_hints["entity_recognizer_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Comprehend", jsii.invoke(self, "onEntityRecognizer", [entity_recognizer_name, account, region, partition]))

    @jsii.member(jsii_name="onEntityRecognizerEndpoint")
    def on_entity_recognizer_endpoint(
        self,
        entity_recognizer_endpoint_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Comprehend":
        '''(experimental) Adds a resource of type entity-recognizer-endpoint to the statement.

        https://docs.aws.amazon.com/comprehend/latest/dg/manage-endpoints.html

        :param entity_recognizer_endpoint_name: - Identifier for the entityRecognizerEndpointName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f3350ae06773fc7dc2ce501187e04b3024f8fae45059e05c70b85fa588a38cbf)
            check_type(argname="argument entity_recognizer_endpoint_name", value=entity_recognizer_endpoint_name, expected_type=type_hints["entity_recognizer_endpoint_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Comprehend", jsii.invoke(self, "onEntityRecognizerEndpoint", [entity_recognizer_endpoint_name, account, region, partition]))

    @jsii.member(jsii_name="onEventsDetectionJob")
    def on_events_detection_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Comprehend":
        '''(experimental) Adds a resource of type events-detection-job to the statement.

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StartEventsDetectionJob.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__59394272f23a8bdbe337b3e70db63755fa3eb5a08cf7fe7cd9ad09b90f1e5c15)
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Comprehend", jsii.invoke(self, "onEventsDetectionJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onFlywheel")
    def on_flywheel(
        self,
        flywheel_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Comprehend":
        '''(experimental) Adds a resource of type flywheel to the statement.

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_CreateFlywheel.html

        :param flywheel_name: - Identifier for the flywheelName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1a5cdc0788476cc38ee70b029a9498c1355331b905c6d5a418df6c13a3481a18)
            check_type(argname="argument flywheel_name", value=flywheel_name, expected_type=type_hints["flywheel_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Comprehend", jsii.invoke(self, "onFlywheel", [flywheel_name, account, region, partition]))

    @jsii.member(jsii_name="onFlywheelDataset")
    def on_flywheel_dataset(
        self,
        flywheel_name: builtins.str,
        dataset_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Comprehend":
        '''(experimental) Adds a resource of type flywheel-dataset to the statement.

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_CreateDataset.html

        :param flywheel_name: - Identifier for the flywheelName.
        :param dataset_name: - Identifier for the datasetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ad2fe0606086f6e1cedac906cbf3be8cb6d393ac36c47a62c8a16b8f4026725c)
            check_type(argname="argument flywheel_name", value=flywheel_name, expected_type=type_hints["flywheel_name"])
            check_type(argname="argument dataset_name", value=dataset_name, expected_type=type_hints["dataset_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Comprehend", jsii.invoke(self, "onFlywheelDataset", [flywheel_name, dataset_name, account, region, partition]))

    @jsii.member(jsii_name="onKeyPhrasesDetectionJob")
    def on_key_phrases_detection_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Comprehend":
        '''(experimental) Adds a resource of type key-phrases-detection-job to the statement.

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StartKeyPhrasesDetectionJob.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__229bb39361db522de69ee50b7595d375d4fc88eb594ebba8bc166dfe130094f3)
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Comprehend", jsii.invoke(self, "onKeyPhrasesDetectionJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onPiiEntitiesDetectionJob")
    def on_pii_entities_detection_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Comprehend":
        '''(experimental) Adds a resource of type pii-entities-detection-job to the statement.

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StartPiiEntitiesDetectionJob.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b83c1db9c893a515ab32fb0166a613893f1f94a7853c2f0e8a45362c12f3e38b)
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Comprehend", jsii.invoke(self, "onPiiEntitiesDetectionJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onSentimentDetectionJob")
    def on_sentiment_detection_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Comprehend":
        '''(experimental) Adds a resource of type sentiment-detection-job to the statement.

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StartSentimentDetectionJob.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c2f6e64c1d8dacd1158e3e8a3ce787046b1949792ed6f0a8f27da85b1d402904)
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Comprehend", jsii.invoke(self, "onSentimentDetectionJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onTargetedSentimentDetectionJob")
    def on_targeted_sentiment_detection_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Comprehend":
        '''(experimental) Adds a resource of type targeted-sentiment-detection-job to the statement.

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StartTargetedSentimentDetectionJob.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d21494cb080bc6cd87ca444ca7be3eb399e9762112d33db25ff006adb9037ae5)
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Comprehend", jsii.invoke(self, "onTargetedSentimentDetectionJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onTopicsDetectionJob")
    def on_topics_detection_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Comprehend":
        '''(experimental) Adds a resource of type topics-detection-job to the statement.

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StartTopicsDetectionJob.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d00545b1934e6f4038b55189fe7fb382ba7b95e477c5cb1aac05f09b42436c1c)
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Comprehend", jsii.invoke(self, "onTopicsDetectionJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="toBatchDetectDominantLanguage")
    def to_batch_detect_dominant_language(self) -> "Comprehend":
        '''(experimental) Grants permission to detect the language or languages present in the list of text documents.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_BatchDetectDominantLanguage.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toBatchDetectDominantLanguage", []))

    @jsii.member(jsii_name="toBatchDetectEntities")
    def to_batch_detect_entities(self) -> "Comprehend":
        '''(experimental) Grants permission to detect the named entities ("People", "Places", "Locations", etc) within the given list of text documents.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_BatchDetectEntities.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toBatchDetectEntities", []))

    @jsii.member(jsii_name="toBatchDetectKeyPhrases")
    def to_batch_detect_key_phrases(self) -> "Comprehend":
        '''(experimental) Grants permission to detect the phrases in the list of text documents that are most indicative of the content.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_BatchDetectKeyPhrases.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toBatchDetectKeyPhrases", []))

    @jsii.member(jsii_name="toBatchDetectSentiment")
    def to_batch_detect_sentiment(self) -> "Comprehend":
        '''(experimental) Grants permission to detect the sentiment of a text in the list of documents (Positive, Negative, Neutral, or Mixed).

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_BatchDetectSentiment.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toBatchDetectSentiment", []))

    @jsii.member(jsii_name="toBatchDetectSyntax")
    def to_batch_detect_syntax(self) -> "Comprehend":
        '''(experimental) Grants permission to detect syntactic information (like Part of Speech, Tokens) in a list of text documents.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_BatchDetectSyntax.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toBatchDetectSyntax", []))

    @jsii.member(jsii_name="toBatchDetectTargetedSentiment")
    def to_batch_detect_targeted_sentiment(self) -> "Comprehend":
        '''(experimental) Grants permission to detect the sentiments associated with specific entities (such as brands or products) within the given list of text documents.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_BatchDetectTargetedSentiment.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toBatchDetectTargetedSentiment", []))

    @jsii.member(jsii_name="toClassifyDocument")
    def to_classify_document(self) -> "Comprehend":
        '''(experimental) Grants permission to create a new document classification request to analyze a single document in real-time, using a previously created and trained custom model and an endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ClassifyDocument.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toClassifyDocument", []))

    @jsii.member(jsii_name="toContainsPiiEntities")
    def to_contains_pii_entities(self) -> "Comprehend":
        '''(experimental) Grants permission to classify the personally identifiable information within given documents in real-time.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ContainsPiiEntities.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toContainsPiiEntities", []))

    @jsii.member(jsii_name="toCreateDataset")
    def to_create_dataset(self) -> "Comprehend":
        '''(experimental) Grants permission to create a new dataset within a flywheel.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_CreateDataset.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toCreateDataset", []))

    @jsii.member(jsii_name="toCreateDocumentClassifier")
    def to_create_document_classifier(self) -> "Comprehend":
        '''(experimental) Grants permission to create a new document classifier that you can use to categorize documents.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifVolumeKmsKey()
        - .ifModelKmsKey()
        - .ifOutputKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_CreateDocumentClassifier.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toCreateDocumentClassifier", []))

    @jsii.member(jsii_name="toCreateEndpoint")
    def to_create_endpoint(self) -> "Comprehend":
        '''(experimental) Grants permission to create a model-specific endpoint for synchronous inference for a previously trained custom model.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_CreateEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toCreateEndpoint", []))

    @jsii.member(jsii_name="toCreateEntityRecognizer")
    def to_create_entity_recognizer(self) -> "Comprehend":
        '''(experimental) Grants permission to create an entity recognizer using submitted files.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifVolumeKmsKey()
        - .ifModelKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_CreateEntityRecognizer.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toCreateEntityRecognizer", []))

    @jsii.member(jsii_name="toCreateFlywheel")
    def to_create_flywheel(self) -> "Comprehend":
        '''(experimental) Grants permission to create a new flywheel that you can use to train model versions.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifVolumeKmsKey()
        - .ifModelKmsKey()
        - .ifDataLakeKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_CreateFlywheel.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toCreateFlywheel", []))

    @jsii.member(jsii_name="toDeleteDocumentClassifier")
    def to_delete_document_classifier(self) -> "Comprehend":
        '''(experimental) Grants permission to delete a previously created document classifier.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DeleteDocumentClassifier.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDeleteDocumentClassifier", []))

    @jsii.member(jsii_name="toDeleteEndpoint")
    def to_delete_endpoint(self) -> "Comprehend":
        '''(experimental) Grants permission to delete a model-specific endpoint for a previously-trained custom model.

        All endpoints must be deleted in order for the model to be deleted

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DeleteEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDeleteEndpoint", []))

    @jsii.member(jsii_name="toDeleteEntityRecognizer")
    def to_delete_entity_recognizer(self) -> "Comprehend":
        '''(experimental) Grants permission to delete a submitted entity recognizer.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DeleteEntityRecognizer.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDeleteEntityRecognizer", []))

    @jsii.member(jsii_name="toDeleteFlywheel")
    def to_delete_flywheel(self) -> "Comprehend":
        '''(experimental) Grants permission to Delete a flywheel.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DeleteFlywheel.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDeleteFlywheel", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "Comprehend":
        '''(experimental) Grants permission to remove policy on resource.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DeleteResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDescribeDataset")
    def to_describe_dataset(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with a dataset.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DescribeDataset.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeDataset", []))

    @jsii.member(jsii_name="toDescribeDocumentClassificationJob")
    def to_describe_document_classification_job(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with a document classification job.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DescribeDocumentClassificationJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeDocumentClassificationJob", []))

    @jsii.member(jsii_name="toDescribeDocumentClassifier")
    def to_describe_document_classifier(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with a document classifier.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DescribeDocumentClassifier.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeDocumentClassifier", []))

    @jsii.member(jsii_name="toDescribeDominantLanguageDetectionJob")
    def to_describe_dominant_language_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with a dominant language detection job.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DescribeDominantLanguageDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeDominantLanguageDetectionJob", []))

    @jsii.member(jsii_name="toDescribeEndpoint")
    def to_describe_endpoint(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with a specific endpoint.

        Use this operation to get the status of an endpoint

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DescribeEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeEndpoint", []))

    @jsii.member(jsii_name="toDescribeEntitiesDetectionJob")
    def to_describe_entities_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with an entities detection job.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DescribeEntitiesDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeEntitiesDetectionJob", []))

    @jsii.member(jsii_name="toDescribeEntityRecognizer")
    def to_describe_entity_recognizer(self) -> "Comprehend":
        '''(experimental) Grants permission to provide details about an entity recognizer including status, S3 buckets containing training data, recognizer metadata, metrics, and so on.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DescribeEntityRecognizer.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeEntityRecognizer", []))

    @jsii.member(jsii_name="toDescribeEventsDetectionJob")
    def to_describe_events_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with an Events detection job.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DescribeEventsDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeEventsDetectionJob", []))

    @jsii.member(jsii_name="toDescribeFlywheel")
    def to_describe_flywheel(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with a flywheel.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DescribeFlywheel.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeFlywheel", []))

    @jsii.member(jsii_name="toDescribeFlywheelIteration")
    def to_describe_flywheel_iteration(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with a flywheel iteration for a flywheel.

        Access Level: Read

        Possible conditions:

        - .ifFlywheelIterationId()

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DescribeFlywheelIteration.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeFlywheelIteration", []))

    @jsii.member(jsii_name="toDescribeKeyPhrasesDetectionJob")
    def to_describe_key_phrases_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with a key phrases detection job.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DescribeKeyPhrasesDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeKeyPhrasesDetectionJob", []))

    @jsii.member(jsii_name="toDescribePiiEntitiesDetectionJob")
    def to_describe_pii_entities_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with a PII entities detection job.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DescribePiiEntitiesDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribePiiEntitiesDetectionJob", []))

    @jsii.member(jsii_name="toDescribeResourcePolicy")
    def to_describe_resource_policy(self) -> "Comprehend":
        '''(experimental) Grants permission to read attached policy on resource.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DescribeResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeResourcePolicy", []))

    @jsii.member(jsii_name="toDescribeSentimentDetectionJob")
    def to_describe_sentiment_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with a sentiment detection job.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DescribeSentimentDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeSentimentDetectionJob", []))

    @jsii.member(jsii_name="toDescribeTargetedSentimentDetectionJob")
    def to_describe_targeted_sentiment_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with a targeted sentiment detection job.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DescribeTargetedSentimentDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeTargetedSentimentDetectionJob", []))

    @jsii.member(jsii_name="toDescribeTopicsDetectionJob")
    def to_describe_topics_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to get the properties associated with a topic detection job.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DescribeTopicsDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDescribeTopicsDetectionJob", []))

    @jsii.member(jsii_name="toDetectDominantLanguage")
    def to_detect_dominant_language(self) -> "Comprehend":
        '''(experimental) Grants permission to detect the language or languages present in the text.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DetectDominantLanguage.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDetectDominantLanguage", []))

    @jsii.member(jsii_name="toDetectEntities")
    def to_detect_entities(self) -> "Comprehend":
        '''(experimental) Grants permission to detect the named entities ("People", "Places", "Locations", etc) within the given text document.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DetectEntities.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDetectEntities", []))

    @jsii.member(jsii_name="toDetectKeyPhrases")
    def to_detect_key_phrases(self) -> "Comprehend":
        '''(experimental) Grants permission to detect the phrases in the text that are most indicative of the content.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DetectKeyPhrases.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDetectKeyPhrases", []))

    @jsii.member(jsii_name="toDetectPiiEntities")
    def to_detect_pii_entities(self) -> "Comprehend":
        '''(experimental) Grants permission to detect the personally identifiable information entities ("Name", "SSN", "PIN", etc) within the given text document.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DetectPiiEntities.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDetectPiiEntities", []))

    @jsii.member(jsii_name="toDetectSentiment")
    def to_detect_sentiment(self) -> "Comprehend":
        '''(experimental) Grants permission to detect the sentiment of a text in a document (Positive, Negative, Neutral, or Mixed).

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DetectSentiment.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDetectSentiment", []))

    @jsii.member(jsii_name="toDetectSyntax")
    def to_detect_syntax(self) -> "Comprehend":
        '''(experimental) Grants permission to detect syntactic information (like Part of Speech, Tokens) in a text document.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DetectSyntax.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDetectSyntax", []))

    @jsii.member(jsii_name="toDetectTargetedSentiment")
    def to_detect_targeted_sentiment(self) -> "Comprehend":
        '''(experimental) Grants permission to detect the sentiments associated with specific entities (such as brands or products) in a document.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_DetectTargetedSentiment.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toDetectTargetedSentiment", []))

    @jsii.member(jsii_name="toImportModel")
    def to_import_model(self) -> "Comprehend":
        '''(experimental) Grants permission to import a trained Comprehend model.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifModelKmsKey()

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ImportModel.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toImportModel", []))

    @jsii.member(jsii_name="toListDatasets")
    def to_list_datasets(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of the Datasets associated with a flywheel.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ListDatasets.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListDatasets", []))

    @jsii.member(jsii_name="toListDocumentClassificationJobs")
    def to_list_document_classification_jobs(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of the document classification jobs that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ListDocumentClassificationJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListDocumentClassificationJobs", []))

    @jsii.member(jsii_name="toListDocumentClassifiers")
    def to_list_document_classifiers(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of the document classifiers that you have created.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ListDocumentClassifiers.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListDocumentClassifiers", []))

    @jsii.member(jsii_name="toListDocumentClassifierSummaries")
    def to_list_document_classifier_summaries(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of summaries of the document classifiers that you have created.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ListDocumentClassifierSummaries.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListDocumentClassifierSummaries", []))

    @jsii.member(jsii_name="toListDominantLanguageDetectionJobs")
    def to_list_dominant_language_detection_jobs(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of the dominant language detection jobs that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ListDominantLanguageDetectionJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListDominantLanguageDetectionJobs", []))

    @jsii.member(jsii_name="toListEndpoints")
    def to_list_endpoints(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of all existing endpoints that you've created.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ListEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListEndpoints", []))

    @jsii.member(jsii_name="toListEntitiesDetectionJobs")
    def to_list_entities_detection_jobs(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of the entity detection jobs that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ListEntitiesDetectionJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListEntitiesDetectionJobs", []))

    @jsii.member(jsii_name="toListEntityRecognizers")
    def to_list_entity_recognizers(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of the properties of all entity recognizers that you created, including recognizers currently in training.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ListEntityRecognizers.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListEntityRecognizers", []))

    @jsii.member(jsii_name="toListEntityRecognizerSummaries")
    def to_list_entity_recognizer_summaries(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of summaries for the entity recognizers that you have created.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ListEntityRecognizerSummaries.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListEntityRecognizerSummaries", []))

    @jsii.member(jsii_name="toListEventsDetectionJobs")
    def to_list_events_detection_jobs(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of Events detection jobs that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ListEventsDetectionJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListEventsDetectionJobs", []))

    @jsii.member(jsii_name="toListFlywheelIterationHistory")
    def to_list_flywheel_iteration_history(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of iterations associated for a flywheel.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ListFlywheelIterationHistory.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListFlywheelIterationHistory", []))

    @jsii.member(jsii_name="toListFlywheels")
    def to_list_flywheels(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of the flywheels that you have created.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ListFlywheels.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListFlywheels", []))

    @jsii.member(jsii_name="toListKeyPhrasesDetectionJobs")
    def to_list_key_phrases_detection_jobs(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of key phrase detection jobs that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ListKeyPhrasesDetectionJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListKeyPhrasesDetectionJobs", []))

    @jsii.member(jsii_name="toListPiiEntitiesDetectionJobs")
    def to_list_pii_entities_detection_jobs(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of PII entities detection jobs that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ListPiiEntitiesDetectionJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListPiiEntitiesDetectionJobs", []))

    @jsii.member(jsii_name="toListSentimentDetectionJobs")
    def to_list_sentiment_detection_jobs(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of sentiment detection jobs that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ListSentimentDetectionJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListSentimentDetectionJobs", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Comprehend":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTargetedSentimentDetectionJobs")
    def to_list_targeted_sentiment_detection_jobs(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of targeted sentiment detection jobs that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ListTargetedSentimentDetectionJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListTargetedSentimentDetectionJobs", []))

    @jsii.member(jsii_name="toListTopicsDetectionJobs")
    def to_list_topics_detection_jobs(self) -> "Comprehend":
        '''(experimental) Grants permission to get a list of the topic detection jobs that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_ListTopicsDetectionJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toListTopicsDetectionJobs", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "Comprehend":
        '''(experimental) Grants permission to attach policy to resource.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_PutResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toStartDocumentClassificationJob")
    def to_start_document_classification_job(self) -> "Comprehend":
        '''(experimental) Grants permission to start an asynchronous document classification job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifVolumeKmsKey()
        - .ifOutputKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StartDocumentClassificationJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStartDocumentClassificationJob", []))

    @jsii.member(jsii_name="toStartDominantLanguageDetectionJob")
    def to_start_dominant_language_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to start an asynchronous dominant language detection job for a collection of documents.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifVolumeKmsKey()
        - .ifOutputKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StartDominantLanguageDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStartDominantLanguageDetectionJob", []))

    @jsii.member(jsii_name="toStartEntitiesDetectionJob")
    def to_start_entities_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to start an asynchronous entity detection job for a collection of documents.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifVolumeKmsKey()
        - .ifOutputKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StartEntitiesDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStartEntitiesDetectionJob", []))

    @jsii.member(jsii_name="toStartEventsDetectionJob")
    def to_start_events_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to start an asynchronous Events detection job for a collection of documents.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifOutputKmsKey()

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StartEventsDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStartEventsDetectionJob", []))

    @jsii.member(jsii_name="toStartFlywheelIteration")
    def to_start_flywheel_iteration(self) -> "Comprehend":
        '''(experimental) Grants permission to start a flywheel iteration for a flywheel.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StartFlywheelIteration.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStartFlywheelIteration", []))

    @jsii.member(jsii_name="toStartKeyPhrasesDetectionJob")
    def to_start_key_phrases_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to start an asynchronous key phrase detection job for a collection of documents.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifVolumeKmsKey()
        - .ifOutputKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StartKeyPhrasesDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStartKeyPhrasesDetectionJob", []))

    @jsii.member(jsii_name="toStartPiiEntitiesDetectionJob")
    def to_start_pii_entities_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to start an asynchronous PII entities detection job for a collection of documents.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifOutputKmsKey()

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StartPiiEntitiesDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStartPiiEntitiesDetectionJob", []))

    @jsii.member(jsii_name="toStartSentimentDetectionJob")
    def to_start_sentiment_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to start an asynchronous sentiment detection job for a collection of documents.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifVolumeKmsKey()
        - .ifOutputKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StartSentimentDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStartSentimentDetectionJob", []))

    @jsii.member(jsii_name="toStartTargetedSentimentDetectionJob")
    def to_start_targeted_sentiment_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to start an asynchronous targeted sentiment detection job for a collection of documents.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifVolumeKmsKey()
        - .ifOutputKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StartTargetedSentimentDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStartTargetedSentimentDetectionJob", []))

    @jsii.member(jsii_name="toStartTopicsDetectionJob")
    def to_start_topics_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to start an asynchronous job to detect the most common topics in the collection of documents and the phrases associated with each topic.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifVolumeKmsKey()
        - .ifOutputKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StartTopicsDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStartTopicsDetectionJob", []))

    @jsii.member(jsii_name="toStopDominantLanguageDetectionJob")
    def to_stop_dominant_language_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to stop a dominant language detection job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StopDominantLanguageDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStopDominantLanguageDetectionJob", []))

    @jsii.member(jsii_name="toStopEntitiesDetectionJob")
    def to_stop_entities_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to stop an entity detection job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StopEntitiesDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStopEntitiesDetectionJob", []))

    @jsii.member(jsii_name="toStopEventsDetectionJob")
    def to_stop_events_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to stop an Events detection job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StopEventsDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStopEventsDetectionJob", []))

    @jsii.member(jsii_name="toStopKeyPhrasesDetectionJob")
    def to_stop_key_phrases_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to stop a key phrase detection job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StopKeyPhrasesDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStopKeyPhrasesDetectionJob", []))

    @jsii.member(jsii_name="toStopPiiEntitiesDetectionJob")
    def to_stop_pii_entities_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to stop a PII entities detection job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StopPiiEntitiesDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStopPiiEntitiesDetectionJob", []))

    @jsii.member(jsii_name="toStopSentimentDetectionJob")
    def to_stop_sentiment_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to stop a sentiment detection job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StopSentimentDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStopSentimentDetectionJob", []))

    @jsii.member(jsii_name="toStopTargetedSentimentDetectionJob")
    def to_stop_targeted_sentiment_detection_job(self) -> "Comprehend":
        '''(experimental) Grants permission to stop a targeted sentiment detection job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StopTargetedSentimentDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStopTargetedSentimentDetectionJob", []))

    @jsii.member(jsii_name="toStopTrainingDocumentClassifier")
    def to_stop_training_document_classifier(self) -> "Comprehend":
        '''(experimental) Grants permission to stop a previously created document classifier training job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StopTrainingDocumentClassifier.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStopTrainingDocumentClassifier", []))

    @jsii.member(jsii_name="toStopTrainingEntityRecognizer")
    def to_stop_training_entity_recognizer(self) -> "Comprehend":
        '''(experimental) Grants permission to stop a previously created entity recognizer training job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_StopTrainingEntityRecognizer.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toStopTrainingEntityRecognizer", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Comprehend":
        '''(experimental) Grants permission to tag a resource with given key value pairs.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Comprehend":
        '''(experimental) Grants permission to untag a resource with given key.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateEndpoint")
    def to_update_endpoint(self) -> "Comprehend":
        '''(experimental) Grants permission to update information about the specified endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_UpdateEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toUpdateEndpoint", []))

    @jsii.member(jsii_name="toUpdateFlywheel")
    def to_update_flywheel(self) -> "Comprehend":
        '''(experimental) Grants permission to Update a flywheel's configuration.

        Access Level: Write

        Possible conditions:

        - .ifVolumeKmsKey()
        - .ifModelKmsKey()
        - .ifVpcSecurityGroupIds()
        - .ifVpcSubnets()

        https://docs.aws.amazon.com/comprehend/latest/APIReference/API_UpdateFlywheel.html

        :stability: experimental
        '''
        return typing.cast("Comprehend", jsii.invoke(self, "toUpdateFlywheel", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f4affec4ec5dfd6285ea1a1501f5e1f01fbe89987a480c694f065223f92630af)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__61488b8469c41d52821db25e6b70212dce3b84331e73b69929fdfc8e59ef1f42)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Comprehendmedical(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Comprehendmedical",
):
    '''(experimental) Statement provider for service `comprehendmedical <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncomprehendmedical.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `comprehendmedical <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncomprehendmedical.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__013716d4ece2226345b5679e473ed9a92cc881fe5c6b129d9f4b6d87b09c693f)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toDescribeEntitiesDetectionV2Job")
    def to_describe_entities_detection_v2_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to describe the properties of a medical entity detection job that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_DescribeEntitiesDetectionV2Job.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toDescribeEntitiesDetectionV2Job", []))

    @jsii.member(jsii_name="toDescribeICD10CMInferenceJob")
    def to_describe_icd10_cm_inference_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to describe the properties of an ICD-10-CM linking job that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_DescribeICD10CMInferenceJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toDescribeICD10CMInferenceJob", []))

    @jsii.member(jsii_name="toDescribePHIDetectionJob")
    def to_describe_phi_detection_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to describe the properties of a PHI entity detection job that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_DescribePHIDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toDescribePHIDetectionJob", []))

    @jsii.member(jsii_name="toDescribeRxNormInferenceJob")
    def to_describe_rx_norm_inference_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to describe the properties of an RxNorm linking job that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_DescribeRxNormInferenceJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toDescribeRxNormInferenceJob", []))

    @jsii.member(jsii_name="toDescribeSNOMEDCTInferenceJob")
    def to_describe_snomedct_inference_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to describe the properties of a SNOMED-CT linking job that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_DescribeSNOMEDCTInferenceJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toDescribeSNOMEDCTInferenceJob", []))

    @jsii.member(jsii_name="toDetectEntitiesV2")
    def to_detect_entities_v2(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to detect the named medical entities, and their relationships and traits within the given text document.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_DetectEntitiesV2.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toDetectEntitiesV2", []))

    @jsii.member(jsii_name="toDetectPHI")
    def to_detect_phi(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to detect the protected health information (PHI) entities within the given text document.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_DetectPHI.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toDetectPHI", []))

    @jsii.member(jsii_name="toInferICD10CM")
    def to_infer_icd10_cm(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to detect the medical condition entities within the given text document and link them to ICD-10-CM codes.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_InferICD10CM.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toInferICD10CM", []))

    @jsii.member(jsii_name="toInferRxNorm")
    def to_infer_rx_norm(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to detect the medication entities within the given text document and link them to RxCUI concept identifiers from the National Library of Medicine RxNorm database.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_InferRxNorm.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toInferRxNorm", []))

    @jsii.member(jsii_name="toInferSNOMEDCT")
    def to_infer_snomedct(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to detect the medical condition, anatomy, and test, treatment, and procedure entities within the given text document and link them to SNOMED-CT codes.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_InferSNOMEDCT.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toInferSNOMEDCT", []))

    @jsii.member(jsii_name="toListEntitiesDetectionV2Jobs")
    def to_list_entities_detection_v2_jobs(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to list the medical entity detection jobs that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_ListEntitiesDetectionV2Jobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toListEntitiesDetectionV2Jobs", []))

    @jsii.member(jsii_name="toListICD10CMInferenceJobs")
    def to_list_icd10_cm_inference_jobs(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to list the ICD-10-CM linking jobs that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_ListICD10CMInferenceJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toListICD10CMInferenceJobs", []))

    @jsii.member(jsii_name="toListPHIDetectionJobs")
    def to_list_phi_detection_jobs(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to list the PHI entity detection jobs that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_ListPHIDetectionJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toListPHIDetectionJobs", []))

    @jsii.member(jsii_name="toListRxNormInferenceJobs")
    def to_list_rx_norm_inference_jobs(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to list the RxNorm linking jobs that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_ListRxNormInferenceJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toListRxNormInferenceJobs", []))

    @jsii.member(jsii_name="toListSNOMEDCTInferenceJobs")
    def to_list_snomedct_inference_jobs(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to list the SNOMED-CT linking jobs that you have submitted.

        Access Level: Read

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_ListSNOMEDCTInferenceJobs.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toListSNOMEDCTInferenceJobs", []))

    @jsii.member(jsii_name="toStartEntitiesDetectionV2Job")
    def to_start_entities_detection_v2_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to start an asynchronous medical entity detection job for a collection of documents.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_StartEntitiesDetectionV2Job.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toStartEntitiesDetectionV2Job", []))

    @jsii.member(jsii_name="toStartICD10CMInferenceJob")
    def to_start_icd10_cm_inference_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to start an asynchronous ICD-10-CM linking job for a collection of documents.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_StartICD10CMInferenceJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toStartICD10CMInferenceJob", []))

    @jsii.member(jsii_name="toStartPHIDetectionJob")
    def to_start_phi_detection_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to start an asynchronous PHI entity detection job for a collection of documents.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_StartPHIDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toStartPHIDetectionJob", []))

    @jsii.member(jsii_name="toStartRxNormInferenceJob")
    def to_start_rx_norm_inference_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to start an asynchronous RxNorm linking job for a collection of documents.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_StartRxNormInferenceJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toStartRxNormInferenceJob", []))

    @jsii.member(jsii_name="toStartSNOMEDCTInferenceJob")
    def to_start_snomedct_inference_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to start an asynchronous SNOMED-CT linking job for a collection of documents.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_StartSNOMEDCTInferenceJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toStartSNOMEDCTInferenceJob", []))

    @jsii.member(jsii_name="toStopEntitiesDetectionV2Job")
    def to_stop_entities_detection_v2_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to stop a medical entity detection job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_StopEntitiesDetectionV2Job.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toStopEntitiesDetectionV2Job", []))

    @jsii.member(jsii_name="toStopICD10CMInferenceJob")
    def to_stop_icd10_cm_inference_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to stop an ICD-10-CM linking job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_StopICD10CMInferenceJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toStopICD10CMInferenceJob", []))

    @jsii.member(jsii_name="toStopPHIDetectionJob")
    def to_stop_phi_detection_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to stop a PHI entity detection job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_StopPHIDetectionJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toStopPHIDetectionJob", []))

    @jsii.member(jsii_name="toStopRxNormInferenceJob")
    def to_stop_rx_norm_inference_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to stop an RxNorm linking job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_StopRxNormInferenceJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toStopRxNormInferenceJob", []))

    @jsii.member(jsii_name="toStopSNOMEDCTInferenceJob")
    def to_stop_snomedct_inference_job(self) -> "Comprehendmedical":
        '''(experimental) Grants permission to stop a SNOMED-CT linking job.

        Access Level: Write

        https://docs.aws.amazon.com/comprehend-medical/latest/api/API_StopSNOMEDCTInferenceJob.html

        :stability: experimental
        '''
        return typing.cast("Comprehendmedical", jsii.invoke(self, "toStopSNOMEDCTInferenceJob", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6425e418c01aca557544771dd1ef06bdef2ba8e899948c55d987cb8a2863d413)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__23498e5732b821c470ad23e57266ced6598ed65b21a5a31e99d32aa21bebfabd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class ComputeOptimizer(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ComputeOptimizer",
):
    '''(experimental) Statement provider for service `compute-optimizer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscomputeoptimizer.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `compute-optimizer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscomputeoptimizer.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a7d3dee663229d49604e9ead97c6ae353404d2ea752bf7a7cd695c686333957c)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifResourceType")
    def if_resource_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ComputeOptimizer":
        '''(experimental) Filters access by the resource type.

        https://docs.aws.amazon.com/compute-optimizer/latest/ug/security-iam.html

        Applies to actions:

        - .toDeleteRecommendationPreferences()
        - .toGetEffectiveRecommendationPreferences()
        - .toGetRecommendationPreferences()
        - .toPutRecommendationPreferences()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__633ba91d59b1180568d27e5f4bcdcb46b9130873e78917f7d4a6fe5f3b46a1fa)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "ifResourceType", [value, operator]))

    @jsii.member(jsii_name="toDeleteRecommendationPreferences")
    def to_delete_recommendation_preferences(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to delete recommendation preferences.

        Access Level: Write

        Possible conditions:

        - .ifResourceType()

        Dependent actions:

        - autoscaling:DescribeAutoScalingGroups
        - ec2:DescribeInstances

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_DeleteRecommendationPreferences.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toDeleteRecommendationPreferences", []))

    @jsii.member(jsii_name="toDescribeRecommendationExportJobs")
    def to_describe_recommendation_export_jobs(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to view the status of recommendation export jobs.

        Access Level: List

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_DescribeRecommendationExportJobs.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toDescribeRecommendationExportJobs", []))

    @jsii.member(jsii_name="toExportAutoScalingGroupRecommendations")
    def to_export_auto_scaling_group_recommendations(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to export AutoScaling group recommendations to S3 for the provided accounts.

        Access Level: Write

        Dependent actions:

        - autoscaling:DescribeAutoScalingGroups
        - compute-optimizer:GetAutoScalingGroupRecommendations

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_ExportAutoScalingGroupRecommendations.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toExportAutoScalingGroupRecommendations", []))

    @jsii.member(jsii_name="toExportEBSVolumeRecommendations")
    def to_export_ebs_volume_recommendations(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to export EBS volume recommendations to S3 for the provided accounts.

        Access Level: Write

        Dependent actions:

        - compute-optimizer:GetEBSVolumeRecommendations
        - ec2:DescribeVolumes

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_ExportEBSVolumeRecommendations.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toExportEBSVolumeRecommendations", []))

    @jsii.member(jsii_name="toExportEC2InstanceRecommendations")
    def to_export_ec2_instance_recommendations(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to export EC2 instance recommendations to S3 for the provided accounts.

        Access Level: Write

        Dependent actions:

        - compute-optimizer:GetEC2InstanceRecommendations
        - ec2:DescribeInstances

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_ExportEC2InstanceRecommendations.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toExportEC2InstanceRecommendations", []))

    @jsii.member(jsii_name="toExportECSServiceRecommendations")
    def to_export_ecs_service_recommendations(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to export ECS service recommendations to S3 for the provided accounts.

        Access Level: Write

        Dependent actions:

        - compute-optimizer:GetECSServiceRecommendations
        - ecs:ListClusters
        - ecs:ListServices

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_ExportECSServiceRecommendations.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toExportECSServiceRecommendations", []))

    @jsii.member(jsii_name="toExportLambdaFunctionRecommendations")
    def to_export_lambda_function_recommendations(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to export Lambda function recommendations to S3 for the provided accounts.

        Access Level: Write

        Dependent actions:

        - compute-optimizer:GetLambdaFunctionRecommendations
        - lambda:ListFunctions
        - lambda:ListProvisionedConcurrencyConfigs

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_ExportLambdaFunctionRecommendations.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toExportLambdaFunctionRecommendations", []))

    @jsii.member(jsii_name="toGetAutoScalingGroupRecommendations")
    def to_get_auto_scaling_group_recommendations(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to get recommendations for the provided AutoScaling groups.

        Access Level: List

        Dependent actions:

        - autoscaling:DescribeAutoScalingGroups

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_GetAutoScalingGroupRecommendations.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toGetAutoScalingGroupRecommendations", []))

    @jsii.member(jsii_name="toGetEBSVolumeRecommendations")
    def to_get_ebs_volume_recommendations(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to get recommendations for the provided EBS volumes.

        Access Level: List

        Dependent actions:

        - ec2:DescribeVolumes

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_GetEBSVolumeRecommendations.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toGetEBSVolumeRecommendations", []))

    @jsii.member(jsii_name="toGetEC2InstanceRecommendations")
    def to_get_ec2_instance_recommendations(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to get recommendations for the provided EC2 instances.

        Access Level: List

        Dependent actions:

        - ec2:DescribeInstances

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_GetEC2InstanceRecommendations.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toGetEC2InstanceRecommendations", []))

    @jsii.member(jsii_name="toGetEC2RecommendationProjectedMetrics")
    def to_get_ec2_recommendation_projected_metrics(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to get the recommendation projected metrics of the specified instance.

        Access Level: List

        Dependent actions:

        - ec2:DescribeInstances

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_GetEC2RecommendationProjectedMetrics.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toGetEC2RecommendationProjectedMetrics", []))

    @jsii.member(jsii_name="toGetECSServiceRecommendationProjectedMetrics")
    def to_get_ecs_service_recommendation_projected_metrics(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to get the recommendation projected metrics of the specified ECS service.

        Access Level: List

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_GetECSServiceRecommendationProjectedMetrics.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toGetECSServiceRecommendationProjectedMetrics", []))

    @jsii.member(jsii_name="toGetECSServiceRecommendations")
    def to_get_ecs_service_recommendations(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to get recommendations for the provided ECS services.

        Access Level: List

        Dependent actions:

        - ecs:ListClusters
        - ecs:ListServices

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_GetECSServiceRecommendations.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toGetECSServiceRecommendations", []))

    @jsii.member(jsii_name="toGetEffectiveRecommendationPreferences")
    def to_get_effective_recommendation_preferences(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to get recommendation preferences that are in effect.

        Access Level: Read

        Possible conditions:

        - .ifResourceType()

        Dependent actions:

        - autoscaling:DescribeAutoScalingGroups
        - autoscaling:DescribeAutoScalingInstances
        - ec2:DescribeInstances

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_GetEffectiveRecommendationPreferences.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toGetEffectiveRecommendationPreferences", []))

    @jsii.member(jsii_name="toGetEnrollmentStatus")
    def to_get_enrollment_status(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to get the enrollment status for the specified account.

        Access Level: List

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_GetEnrollmentStatus.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toGetEnrollmentStatus", []))

    @jsii.member(jsii_name="toGetEnrollmentStatusesForOrganization")
    def to_get_enrollment_statuses_for_organization(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to get the enrollment statuses for member accounts of the organization.

        Access Level: List

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_GetEnrollmentStatusesForOrganization.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toGetEnrollmentStatusesForOrganization", []))

    @jsii.member(jsii_name="toGetLambdaFunctionRecommendations")
    def to_get_lambda_function_recommendations(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to get recommendations for the provided Lambda functions.

        Access Level: List

        Dependent actions:

        - lambda:ListFunctions
        - lambda:ListProvisionedConcurrencyConfigs

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_GetLambdaFunctionRecommendations.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toGetLambdaFunctionRecommendations", []))

    @jsii.member(jsii_name="toGetRecommendationPreferences")
    def to_get_recommendation_preferences(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to get recommendation preferences.

        Access Level: Read

        Possible conditions:

        - .ifResourceType()

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_GetRecommendationPreferences.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toGetRecommendationPreferences", []))

    @jsii.member(jsii_name="toGetRecommendationSummaries")
    def to_get_recommendation_summaries(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to get the recommendation summaries for the specified account(s).

        Access Level: List

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_GetRecommendationSummaries.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toGetRecommendationSummaries", []))

    @jsii.member(jsii_name="toPutRecommendationPreferences")
    def to_put_recommendation_preferences(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to put recommendation preferences.

        Access Level: Write

        Possible conditions:

        - .ifResourceType()

        Dependent actions:

        - autoscaling:DescribeAutoScalingGroups
        - autoscaling:DescribeAutoScalingInstances
        - ec2:DescribeInstances

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_PutRecommendationPreferences.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toPutRecommendationPreferences", []))

    @jsii.member(jsii_name="toUpdateEnrollmentStatus")
    def to_update_enrollment_status(self) -> "ComputeOptimizer":
        '''(experimental) Grants permission to update the enrollment status.

        Access Level: Write

        https://docs.aws.amazon.com/compute-optimizer/latest/APIReference/API_UpdateEnrollmentStatus.html

        :stability: experimental
        '''
        return typing.cast("ComputeOptimizer", jsii.invoke(self, "toUpdateEnrollmentStatus", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e7554b4f2e6a6a403d2828dd5fe53d6c886ecceed67e7be0cfb5f8fcae4028dd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7ccff432ce13596e0cf8907bde628c359763685e31eee26cac3f61850b262ac4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Config(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Config"):
    '''(experimental) Statement provider for service `config <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsconfig.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `config <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsconfig.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8ab359b30cfe48dfba1a8814c5d3f19f7d37172f70800f27f8daaadb5ccf5a60)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAggregationAuthorization")
    def on_aggregation_authorization(
        self,
        aggregator_account: builtins.str,
        aggregator_region: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Config":
        '''(experimental) Adds a resource of type AggregationAuthorization to the statement.

        https://docs.aws.amazon.com/config/latest/APIReference/API_AggregationAuthorization.html

        :param aggregator_account: - Identifier for the aggregatorAccount.
        :param aggregator_region: - Identifier for the aggregatorRegion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4400a19ef1d3d835148c0b52a88da1b8f99db73caafb202754f6b6a0cdf4aaf7)
            check_type(argname="argument aggregator_account", value=aggregator_account, expected_type=type_hints["aggregator_account"])
            check_type(argname="argument aggregator_region", value=aggregator_region, expected_type=type_hints["aggregator_region"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Config", jsii.invoke(self, "onAggregationAuthorization", [aggregator_account, aggregator_region, account, region, partition]))

    @jsii.member(jsii_name="onConfigRule")
    def on_config_rule(
        self,
        config_rule_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Config":
        '''(experimental) Adds a resource of type ConfigRule to the statement.

        https://docs.aws.amazon.com/config/latest/APIReference/API_ConfigRule.html

        :param config_rule_id: - Identifier for the configRuleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8df99ec1f48a3bc5cae813ab84191d9b3d28b90e93f003d16db552c96f5603c1)
            check_type(argname="argument config_rule_id", value=config_rule_id, expected_type=type_hints["config_rule_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Config", jsii.invoke(self, "onConfigRule", [config_rule_id, account, region, partition]))

    @jsii.member(jsii_name="onConfigurationAggregator")
    def on_configuration_aggregator(
        self,
        aggregator_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Config":
        '''(experimental) Adds a resource of type ConfigurationAggregator to the statement.

        https://docs.aws.amazon.com/config/latest/APIReference/API_ConfigurationAggregator.html

        :param aggregator_id: - Identifier for the aggregatorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f03d1e7ecea2057f97062bb52c3829d06d37110ae59ca319f07f04b08b33b12a)
            check_type(argname="argument aggregator_id", value=aggregator_id, expected_type=type_hints["aggregator_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Config", jsii.invoke(self, "onConfigurationAggregator", [aggregator_id, account, region, partition]))

    @jsii.member(jsii_name="onConformancePack")
    def on_conformance_pack(
        self,
        conformance_pack_name: builtins.str,
        conformance_pack_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Config":
        '''(experimental) Adds a resource of type ConformancePack to the statement.

        https://docs.aws.amazon.com/config/latest/APIReference/API_ConformancePack.html

        :param conformance_pack_name: - Identifier for the conformancePackName.
        :param conformance_pack_id: - Identifier for the conformancePackId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__101397e27c5dae8c935deab5f7302b3c021f44ee2b6d944d09c6bb997faed43f)
            check_type(argname="argument conformance_pack_name", value=conformance_pack_name, expected_type=type_hints["conformance_pack_name"])
            check_type(argname="argument conformance_pack_id", value=conformance_pack_id, expected_type=type_hints["conformance_pack_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Config", jsii.invoke(self, "onConformancePack", [conformance_pack_name, conformance_pack_id, account, region, partition]))

    @jsii.member(jsii_name="onOrganizationConfigRule")
    def on_organization_config_rule(
        self,
        organization_config_rule_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Config":
        '''(experimental) Adds a resource of type OrganizationConfigRule to the statement.

        https://docs.aws.amazon.com/config/latest/APIReference/API_OrganizationConfigRule.html

        :param organization_config_rule_id: - Identifier for the organizationConfigRuleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ce4946478ee1bcb7b74391ffd5e5cd4d12c9251ae89925a52d036274890ba8cd)
            check_type(argname="argument organization_config_rule_id", value=organization_config_rule_id, expected_type=type_hints["organization_config_rule_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Config", jsii.invoke(self, "onOrganizationConfigRule", [organization_config_rule_id, account, region, partition]))

    @jsii.member(jsii_name="onOrganizationConformancePack")
    def on_organization_conformance_pack(
        self,
        organization_conformance_pack_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Config":
        '''(experimental) Adds a resource of type OrganizationConformancePack to the statement.

        https://docs.aws.amazon.com/config/latest/APIReference/API_OrganizationConformancePack.html

        :param organization_conformance_pack_id: - Identifier for the organizationConformancePackId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d9b51c297de38b16ebf5d61ccae2a545d99461e29b9510911635553bb5da1bbb)
            check_type(argname="argument organization_conformance_pack_id", value=organization_conformance_pack_id, expected_type=type_hints["organization_conformance_pack_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Config", jsii.invoke(self, "onOrganizationConformancePack", [organization_conformance_pack_id, account, region, partition]))

    @jsii.member(jsii_name="onRemediationConfiguration")
    def on_remediation_configuration(
        self,
        remediation_configuration_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Config":
        '''(experimental) Adds a resource of type RemediationConfiguration to the statement.

        https://docs.aws.amazon.com/config/latest/APIReference/API_RemediationConfiguration.html

        :param remediation_configuration_id: - Identifier for the remediationConfigurationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__deba6f49f7eb1aa4544a55d3d074f9ac69789ecda1506b58b58e1a4626fcf1f7)
            check_type(argname="argument remediation_configuration_id", value=remediation_configuration_id, expected_type=type_hints["remediation_configuration_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Config", jsii.invoke(self, "onRemediationConfiguration", [remediation_configuration_id, account, region, partition]))

    @jsii.member(jsii_name="onStoredQuery")
    def on_stored_query(
        self,
        stored_query_name: builtins.str,
        stored_query_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Config":
        '''(experimental) Adds a resource of type StoredQuery to the statement.

        https://docs.aws.amazon.com/config/latest/APIReference/API_StoredQuery.html

        :param stored_query_name: - Identifier for the storedQueryName.
        :param stored_query_id: - Identifier for the storedQueryId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1879b2a9f052574dd43f163cc3129c25d9683d3d39cd558b41116d7cbe6242f2)
            check_type(argname="argument stored_query_name", value=stored_query_name, expected_type=type_hints["stored_query_name"])
            check_type(argname="argument stored_query_id", value=stored_query_id, expected_type=type_hints["stored_query_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Config", jsii.invoke(self, "onStoredQuery", [stored_query_name, stored_query_id, account, region, partition]))

    @jsii.member(jsii_name="toBatchGetAggregateResourceConfig")
    def to_batch_get_aggregate_resource_config(self) -> "Config":
        '''(experimental) Grants permission to return the current configuration items for resources that are present in your AWS Config aggregator.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_BatchGetAggregateResourceConfig.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toBatchGetAggregateResourceConfig", []))

    @jsii.member(jsii_name="toBatchGetResourceConfig")
    def to_batch_get_resource_config(self) -> "Config":
        '''(experimental) Grants permission to return the current configuration for one or more requested resources.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_BatchGetResourceConfig.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toBatchGetResourceConfig", []))

    @jsii.member(jsii_name="toDeleteAggregationAuthorization")
    def to_delete_aggregation_authorization(self) -> "Config":
        '''(experimental) Grants permission to delete the authorization granted to the specified configuration aggregator account in a specified region.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteAggregationAuthorization.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteAggregationAuthorization", []))

    @jsii.member(jsii_name="toDeleteConfigRule")
    def to_delete_config_rule(self) -> "Config":
        '''(experimental) Grants permission to delete the specified AWS Config rule and all of its evaluation results.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteConfigRule.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteConfigRule", []))

    @jsii.member(jsii_name="toDeleteConfigurationAggregator")
    def to_delete_configuration_aggregator(self) -> "Config":
        '''(experimental) Grants permission to delete the specified configuration aggregator and the aggregated data associated with the aggregator.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteConfigurationAggregator.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteConfigurationAggregator", []))

    @jsii.member(jsii_name="toDeleteConfigurationRecorder")
    def to_delete_configuration_recorder(self) -> "Config":
        '''(experimental) Grants permission to delete the configuration recorder.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteConfigurationRecorder.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteConfigurationRecorder", []))

    @jsii.member(jsii_name="toDeleteConformancePack")
    def to_delete_conformance_pack(self) -> "Config":
        '''(experimental) Grants permission to delete the specified conformance pack and all the AWS Config rules and all evaluation results within that conformance pack.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteConformancePack.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteConformancePack", []))

    @jsii.member(jsii_name="toDeleteDeliveryChannel")
    def to_delete_delivery_channel(self) -> "Config":
        '''(experimental) Grants permission to delete the delivery channel.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteDeliveryChannel.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteDeliveryChannel", []))

    @jsii.member(jsii_name="toDeleteEvaluationResults")
    def to_delete_evaluation_results(self) -> "Config":
        '''(experimental) Grants permission to delete the evaluation results for the specified Config rule.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteEvaluationResults.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteEvaluationResults", []))

    @jsii.member(jsii_name="toDeleteOrganizationConfigRule")
    def to_delete_organization_config_rule(self) -> "Config":
        '''(experimental) Grants permission to delete the specified organization config rule and all of its evaluation results from all member accounts in that organization.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteOrganizationConfigRule.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteOrganizationConfigRule", []))

    @jsii.member(jsii_name="toDeleteOrganizationConformancePack")
    def to_delete_organization_conformance_pack(self) -> "Config":
        '''(experimental) Grants permission to delete the specified organization conformance pack and all of its evaluation results from all member accounts in that organization.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteOrganizationConformancePack.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteOrganizationConformancePack", []))

    @jsii.member(jsii_name="toDeletePendingAggregationRequest")
    def to_delete_pending_aggregation_request(self) -> "Config":
        '''(experimental) Grants permission to delete pending authorization requests for a specified aggregator account in a specified region.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeletePendingAggregationRequest.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeletePendingAggregationRequest", []))

    @jsii.member(jsii_name="toDeleteRemediationConfiguration")
    def to_delete_remediation_configuration(self) -> "Config":
        '''(experimental) Grants permission to delete the remediation configuration.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteRemediationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteRemediationConfiguration", []))

    @jsii.member(jsii_name="toDeleteRemediationExceptions")
    def to_delete_remediation_exceptions(self) -> "Config":
        '''(experimental) Grants permission to delete one or more remediation exceptions for specific resource keys for a specific AWS Config Rule.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteRemediationExceptions.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteRemediationExceptions", []))

    @jsii.member(jsii_name="toDeleteResourceConfig")
    def to_delete_resource_config(self) -> "Config":
        '''(experimental) Grants permission to record the configuration state for a custom resource that has been deleted.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteResourceConfig.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteResourceConfig", []))

    @jsii.member(jsii_name="toDeleteRetentionConfiguration")
    def to_delete_retention_configuration(self) -> "Config":
        '''(experimental) Grants permission to delete the retention configuration.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteRetentionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteRetentionConfiguration", []))

    @jsii.member(jsii_name="toDeleteStoredQuery")
    def to_delete_stored_query(self) -> "Config":
        '''(experimental) Grants permission to delete the stored query for an AWS account in an AWS Region.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeleteStoredQuery.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeleteStoredQuery", []))

    @jsii.member(jsii_name="toDeliverConfigSnapshot")
    def to_deliver_config_snapshot(self) -> "Config":
        '''(experimental) Grants permission to schedule delivery of a configuration snapshot to the Amazon S3 bucket in the specified delivery channel.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DeliverConfigSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDeliverConfigSnapshot", []))

    @jsii.member(jsii_name="toDescribeAggregateComplianceByConfigRules")
    def to_describe_aggregate_compliance_by_config_rules(self) -> "Config":
        '''(experimental) Grants permission to return a list of compliant and noncompliant rules with the number of resources for compliant and noncompliant rules.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeAggregateComplianceByConfigRules.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeAggregateComplianceByConfigRules", []))

    @jsii.member(jsii_name="toDescribeAggregateComplianceByConformancePacks")
    def to_describe_aggregate_compliance_by_conformance_packs(self) -> "Config":
        '''(experimental) Grants permission to return a list of compliant and noncompliant conformance packs along with count of compliant, non-compliant and total rules within each conformance pack.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeAggregateComplianceByConformancePacks.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeAggregateComplianceByConformancePacks", []))

    @jsii.member(jsii_name="toDescribeAggregationAuthorizations")
    def to_describe_aggregation_authorizations(self) -> "Config":
        '''(experimental) Grants permission to return a list of authorizations granted to various aggregator accounts and regions.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeAggregationAuthorizations.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeAggregationAuthorizations", []))

    @jsii.member(jsii_name="toDescribeComplianceByConfigRule")
    def to_describe_compliance_by_config_rule(self) -> "Config":
        '''(experimental) Grants permission to indicate whether the specified AWS Config rules are compliant.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeComplianceByConfigRule.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeComplianceByConfigRule", []))

    @jsii.member(jsii_name="toDescribeComplianceByResource")
    def to_describe_compliance_by_resource(self) -> "Config":
        '''(experimental) Grants permission to indicate whether the specified AWS resources are compliant.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeComplianceByResource.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeComplianceByResource", []))

    @jsii.member(jsii_name="toDescribeConfigRuleEvaluationStatus")
    def to_describe_config_rule_evaluation_status(self) -> "Config":
        '''(experimental) Grants permission to return status information for each of your AWS managed Config rules.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeConfigRuleEvaluationStatus.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeConfigRuleEvaluationStatus", []))

    @jsii.member(jsii_name="toDescribeConfigRules")
    def to_describe_config_rules(self) -> "Config":
        '''(experimental) Grants permission to return details about your AWS Config rules.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeConfigRules.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeConfigRules", []))

    @jsii.member(jsii_name="toDescribeConfigurationAggregators")
    def to_describe_configuration_aggregators(self) -> "Config":
        '''(experimental) Grants permission to return the details of one or more configuration aggregators.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeConfigurationAggregators.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeConfigurationAggregators", []))

    @jsii.member(jsii_name="toDescribeConfigurationAggregatorSourcesStatus")
    def to_describe_configuration_aggregator_sources_status(self) -> "Config":
        '''(experimental) Grants permission to return status information for sources within an aggregator.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeConfigurationAggregatorSourcesStatus.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeConfigurationAggregatorSourcesStatus", []))

    @jsii.member(jsii_name="toDescribeConfigurationRecorders")
    def to_describe_configuration_recorders(self) -> "Config":
        '''(experimental) Grants permission to return the names of one or more specified configuration recorders.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeConfigurationRecorders.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeConfigurationRecorders", []))

    @jsii.member(jsii_name="toDescribeConfigurationRecorderStatus")
    def to_describe_configuration_recorder_status(self) -> "Config":
        '''(experimental) Grants permission to return the current status of the specified configuration recorder.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeConfigurationRecorderStatus.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeConfigurationRecorderStatus", []))

    @jsii.member(jsii_name="toDescribeConformancePackCompliance")
    def to_describe_conformance_pack_compliance(self) -> "Config":
        '''(experimental) Grants permission to return compliance information for each rule in that conformance pack.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeConformancePackCompliance.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeConformancePackCompliance", []))

    @jsii.member(jsii_name="toDescribeConformancePacks")
    def to_describe_conformance_packs(self) -> "Config":
        '''(experimental) Grants permission to return a list of one or more conformance packs.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeConformancePacks.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeConformancePacks", []))

    @jsii.member(jsii_name="toDescribeConformancePackStatus")
    def to_describe_conformance_pack_status(self) -> "Config":
        '''(experimental) Grants permission to provide one or more conformance packs deployment status.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeConformancePackStatus.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeConformancePackStatus", []))

    @jsii.member(jsii_name="toDescribeDeliveryChannels")
    def to_describe_delivery_channels(self) -> "Config":
        '''(experimental) Grants permission to return details about the specified delivery channel.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeDeliveryChannels.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeDeliveryChannels", []))

    @jsii.member(jsii_name="toDescribeDeliveryChannelStatus")
    def to_describe_delivery_channel_status(self) -> "Config":
        '''(experimental) Grants permission to return the current status of the specified delivery channel.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeDeliveryChannelStatus.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeDeliveryChannelStatus", []))

    @jsii.member(jsii_name="toDescribeOrganizationConfigRules")
    def to_describe_organization_config_rules(self) -> "Config":
        '''(experimental) Grants permission to return a list of organization config rules.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeOrganizationConfigRules.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeOrganizationConfigRules", []))

    @jsii.member(jsii_name="toDescribeOrganizationConfigRuleStatuses")
    def to_describe_organization_config_rule_statuses(self) -> "Config":
        '''(experimental) Grants permission to provide organization config rule deployment status for an organization.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeOrganizationConfigRuleStatuses.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeOrganizationConfigRuleStatuses", []))

    @jsii.member(jsii_name="toDescribeOrganizationConformancePacks")
    def to_describe_organization_conformance_packs(self) -> "Config":
        '''(experimental) Grants permission to return a list of organization conformance packs.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeOrganizationConformancePacks.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeOrganizationConformancePacks", []))

    @jsii.member(jsii_name="toDescribeOrganizationConformancePackStatuses")
    def to_describe_organization_conformance_pack_statuses(self) -> "Config":
        '''(experimental) Grants permission to provide organization conformance pack deployment status for an organization.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeOrganizationConformancePackStatuses.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeOrganizationConformancePackStatuses", []))

    @jsii.member(jsii_name="toDescribePendingAggregationRequests")
    def to_describe_pending_aggregation_requests(self) -> "Config":
        '''(experimental) Grants permission to return a list of all pending aggregation requests.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribePendingAggregationRequests.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribePendingAggregationRequests", []))

    @jsii.member(jsii_name="toDescribeRemediationConfigurations")
    def to_describe_remediation_configurations(self) -> "Config":
        '''(experimental) Grants permission to return the details of one or more remediation configurations.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeRemediationConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeRemediationConfigurations", []))

    @jsii.member(jsii_name="toDescribeRemediationExceptions")
    def to_describe_remediation_exceptions(self) -> "Config":
        '''(experimental) Grants permission to return the details of one or more remediation exceptions.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeRemediationExceptions.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeRemediationExceptions", []))

    @jsii.member(jsii_name="toDescribeRemediationExecutionStatus")
    def to_describe_remediation_execution_status(self) -> "Config":
        '''(experimental) Grants permission to provide a detailed view of a Remediation Execution for a set of resources including state, timestamps and any error messages for steps that have failed.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeRemediationExecutionStatus.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeRemediationExecutionStatus", []))

    @jsii.member(jsii_name="toDescribeRetentionConfigurations")
    def to_describe_retention_configurations(self) -> "Config":
        '''(experimental) Grants permission to return the details of one or more retention configurations.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_DescribeRetentionConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toDescribeRetentionConfigurations", []))

    @jsii.member(jsii_name="toGetAggregateComplianceDetailsByConfigRule")
    def to_get_aggregate_compliance_details_by_config_rule(self) -> "Config":
        '''(experimental) Grants permission to return the evaluation results for the specified AWS Config rule for a specific resource in a rule.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetAggregateComplianceDetailsByConfigRule.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetAggregateComplianceDetailsByConfigRule", []))

    @jsii.member(jsii_name="toGetAggregateConfigRuleComplianceSummary")
    def to_get_aggregate_config_rule_compliance_summary(self) -> "Config":
        '''(experimental) Grants permission to return the number of compliant and noncompliant rules for one or more accounts and regions in an aggregator.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetAggregateConfigRuleComplianceSummary.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetAggregateConfigRuleComplianceSummary", []))

    @jsii.member(jsii_name="toGetAggregateConformancePackComplianceSummary")
    def to_get_aggregate_conformance_pack_compliance_summary(self) -> "Config":
        '''(experimental) Grants permission to return the number of compliant and noncompliant conformance packs for one or more accounts and regions in an aggregator.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetAggregateConformancePackComplianceSummary.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetAggregateConformancePackComplianceSummary", []))

    @jsii.member(jsii_name="toGetAggregateDiscoveredResourceCounts")
    def to_get_aggregate_discovered_resource_counts(self) -> "Config":
        '''(experimental) Grants permission to return the resource counts across accounts and regions that are present in your AWS Config aggregator.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetAggregateDiscoveredResourceCounts.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetAggregateDiscoveredResourceCounts", []))

    @jsii.member(jsii_name="toGetAggregateResourceConfig")
    def to_get_aggregate_resource_config(self) -> "Config":
        '''(experimental) Grants permission to return configuration item that is aggregated for your specific resource in a specific source account and region.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetAggregateResourceConfig.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetAggregateResourceConfig", []))

    @jsii.member(jsii_name="toGetComplianceDetailsByConfigRule")
    def to_get_compliance_details_by_config_rule(self) -> "Config":
        '''(experimental) Grants permission to return the evaluation results for the specified AWS Config rule.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetComplianceDetailsByConfigRule.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetComplianceDetailsByConfigRule", []))

    @jsii.member(jsii_name="toGetComplianceDetailsByResource")
    def to_get_compliance_details_by_resource(self) -> "Config":
        '''(experimental) Grants permission to return the evaluation results for the specified AWS resource.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetComplianceDetailsByResource.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetComplianceDetailsByResource", []))

    @jsii.member(jsii_name="toGetComplianceSummaryByConfigRule")
    def to_get_compliance_summary_by_config_rule(self) -> "Config":
        '''(experimental) Grants permission to return the number of AWS Config rules that are compliant and noncompliant, up to a maximum of 25 for each.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetComplianceSummaryByConfigRule.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetComplianceSummaryByConfigRule", []))

    @jsii.member(jsii_name="toGetComplianceSummaryByResourceType")
    def to_get_compliance_summary_by_resource_type(self) -> "Config":
        '''(experimental) Grants permission to return the number of resources that are compliant and the number that are noncompliant.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetComplianceSummaryByResourceType.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetComplianceSummaryByResourceType", []))

    @jsii.member(jsii_name="toGetConformancePackComplianceDetails")
    def to_get_conformance_pack_compliance_details(self) -> "Config":
        '''(experimental) Grants permission to return compliance details of a conformance pack for all AWS resources that are monitered by conformance pack.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetConformancePackComplianceDetails.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetConformancePackComplianceDetails", []))

    @jsii.member(jsii_name="toGetConformancePackComplianceSummary")
    def to_get_conformance_pack_compliance_summary(self) -> "Config":
        '''(experimental) Grants permission to provide compliance summary for one or more conformance packs.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetConformancePackComplianceSummary.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetConformancePackComplianceSummary", []))

    @jsii.member(jsii_name="toGetCustomRulePolicy")
    def to_get_custom_rule_policy(self) -> "Config":
        '''(experimental) Grants permission to return the policy definition containing the logic for your AWS Config Custom Policy rule.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetCustomRulePolicy.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetCustomRulePolicy", []))

    @jsii.member(jsii_name="toGetDiscoveredResourceCounts")
    def to_get_discovered_resource_counts(self) -> "Config":
        '''(experimental) Grants permission to return the resource types, the number of each resource type, and the total number of resources that AWS Config is recording in this region for your AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetDiscoveredResourceCounts.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetDiscoveredResourceCounts", []))

    @jsii.member(jsii_name="toGetOrganizationConfigRuleDetailedStatus")
    def to_get_organization_config_rule_detailed_status(self) -> "Config":
        '''(experimental) Grants permission to return detailed status for each member account within an organization for a given organization config rule.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetOrganizationConfigRuleDetailedStatus.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetOrganizationConfigRuleDetailedStatus", []))

    @jsii.member(jsii_name="toGetOrganizationConformancePackDetailedStatus")
    def to_get_organization_conformance_pack_detailed_status(self) -> "Config":
        '''(experimental) Grants permission to return detailed status for each member account within an organization for a given organization conformance pack.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetOrganizationConformancePackDetailedStatus.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetOrganizationConformancePackDetailedStatus", []))

    @jsii.member(jsii_name="toGetOrganizationCustomRulePolicy")
    def to_get_organization_custom_rule_policy(self) -> "Config":
        '''(experimental) Grants permission to return the policy definition containing the logic for your organization AWS Config Custom Policy rule.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetOrganizationCustomRulePolicy.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetOrganizationCustomRulePolicy", []))

    @jsii.member(jsii_name="toGetResourceConfigHistory")
    def to_get_resource_config_history(self) -> "Config":
        '''(experimental) Grants permission to return a list of configuration items for the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetResourceConfigHistory.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetResourceConfigHistory", []))

    @jsii.member(jsii_name="toGetResourceEvaluationSummary")
    def to_get_resource_evaluation_summary(self) -> "Config":
        '''(experimental) Grants permission to return the summary of resource evaluations for a specific resource evaluation ID.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetResourceEvaluationSummary.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetResourceEvaluationSummary", []))

    @jsii.member(jsii_name="toGetStoredQuery")
    def to_get_stored_query(self) -> "Config":
        '''(experimental) Grants permission to return the details of a specific stored query.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_GetStoredQuery.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toGetStoredQuery", []))

    @jsii.member(jsii_name="toListAggregateDiscoveredResources")
    def to_list_aggregate_discovered_resources(self) -> "Config":
        '''(experimental) Grants permission to accept a resource type and returns a list of resource identifiers that are aggregated for a specific resource type across accounts and regions.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_ListAggregateDiscoveredResources.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toListAggregateDiscoveredResources", []))

    @jsii.member(jsii_name="toListConformancePackComplianceScores")
    def to_list_conformance_pack_compliance_scores(self) -> "Config":
        '''(experimental) Grants permission to return the percentage of compliant rule-resource combinations in a conformance pack compared to the number of total possible rule-resource combinations.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_ListConformancePackComplianceScores.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toListConformancePackComplianceScores", []))

    @jsii.member(jsii_name="toListDiscoveredResources")
    def to_list_discovered_resources(self) -> "Config":
        '''(experimental) Grants permission to accept a resource type and returns a list of resource identifiers for the resources of that type.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_ListDiscoveredResources.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toListDiscoveredResources", []))

    @jsii.member(jsii_name="toListResourceEvaluations")
    def to_list_resource_evaluations(self) -> "Config":
        '''(experimental) Grants permission to list the resource evaluation summaries for an AWS account in an AWS Region.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_ListResourceEvaluations.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toListResourceEvaluations", []))

    @jsii.member(jsii_name="toListStoredQueries")
    def to_list_stored_queries(self) -> "Config":
        '''(experimental) Grants permission to list the stored queries for an AWS account in an AWS Region.

        Access Level: List

        https://docs.aws.amazon.com/config/latest/APIReference/API_ListStoredQueries.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toListStoredQueries", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Config":
        '''(experimental) Grants permission to list the tags for AWS Config resource.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutAggregationAuthorization")
    def to_put_aggregation_authorization(self) -> "Config":
        '''(experimental) Grants permission to authorize the aggregator account and region to collect data from the source account and region.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutAggregationAuthorization.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutAggregationAuthorization", []))

    @jsii.member(jsii_name="toPutConfigRule")
    def to_put_config_rule(self) -> "Config":
        '''(experimental) Grants permission to add or update an AWS Config rule for evaluating whether your AWS resources comply with your desired configurations.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutConfigRule.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutConfigRule", []))

    @jsii.member(jsii_name="toPutConfigurationAggregator")
    def to_put_configuration_aggregator(self) -> "Config":
        '''(experimental) Grants permission to create and update the configuration aggregator with the selected source accounts and regions.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole
        - organizations:EnableAWSServiceAccess
        - organizations:ListDelegatedAdministrators

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutConfigurationAggregator.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutConfigurationAggregator", []))

    @jsii.member(jsii_name="toPutConfigurationRecorder")
    def to_put_configuration_recorder(self) -> "Config":
        '''(experimental) Grants permission to create a new configuration recorder to record the selected resource configurations.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutConfigurationRecorder.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutConfigurationRecorder", []))

    @jsii.member(jsii_name="toPutConformancePack")
    def to_put_conformance_pack(self) -> "Config":
        '''(experimental) Grants permission to create or update a conformance pack.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - iam:PassRole
        - s3:GetObject
        - s3:ListBucket
        - ssm:GetDocument

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutConformancePack.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutConformancePack", []))

    @jsii.member(jsii_name="toPutDeliveryChannel")
    def to_put_delivery_channel(self) -> "Config":
        '''(experimental) Grants permission to create a delivery channel object to deliver configuration information to an Amazon S3 bucket and Amazon SNS topic.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutDeliveryChannel.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutDeliveryChannel", []))

    @jsii.member(jsii_name="toPutEvaluations")
    def to_put_evaluations(self) -> "Config":
        '''(experimental) Grants permission to be used by an AWS Lambda function to deliver evaluation results to AWS Config.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutEvaluations.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutEvaluations", []))

    @jsii.member(jsii_name="toPutExternalEvaluation")
    def to_put_external_evaluation(self) -> "Config":
        '''(experimental) Grants permission to deliver evaluation result to AWS Config.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutExternalEvaluation.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutExternalEvaluation", []))

    @jsii.member(jsii_name="toPutOrganizationConfigRule")
    def to_put_organization_config_rule(self) -> "Config":
        '''(experimental) Grants permission to add or update organization config rule for your entire organization evaluating whether your AWS resources comply with your desired configurations.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - iam:PassRole
        - organizations:EnableAWSServiceAccess
        - organizations:ListDelegatedAdministrators

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutOrganizationConfigRule.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutOrganizationConfigRule", []))

    @jsii.member(jsii_name="toPutOrganizationConformancePack")
    def to_put_organization_conformance_pack(self) -> "Config":
        '''(experimental) Grants permission to add or update organization conformance pack for your entire organization evaluating whether your AWS resources comply with your desired configurations.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - iam:PassRole
        - organizations:EnableAWSServiceAccess
        - organizations:ListDelegatedAdministrators
        - s3:GetObject

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutOrganizationConformancePack.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutOrganizationConformancePack", []))

    @jsii.member(jsii_name="toPutRemediationConfigurations")
    def to_put_remediation_configurations(self) -> "Config":
        '''(experimental) Grants permission to add or update the remediation configuration with a specific AWS Config rule with the selected target or action.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutRemediationConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutRemediationConfigurations", []))

    @jsii.member(jsii_name="toPutRemediationExceptions")
    def to_put_remediation_exceptions(self) -> "Config":
        '''(experimental) Grants permission to add or update remediation exceptions for specific resources for a specific AWS Config rule.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutRemediationExceptions.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutRemediationExceptions", []))

    @jsii.member(jsii_name="toPutResourceConfig")
    def to_put_resource_config(self) -> "Config":
        '''(experimental) Grants permission to record the configuration state for the resource provided in the request.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutResourceConfig.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutResourceConfig", []))

    @jsii.member(jsii_name="toPutRetentionConfiguration")
    def to_put_retention_configuration(self) -> "Config":
        '''(experimental) Grants permission to create and update the retention configuration with details about retention period (number of days) that AWS Config stores your historical information.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutRetentionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutRetentionConfiguration", []))

    @jsii.member(jsii_name="toPutStoredQuery")
    def to_put_stored_query(self) -> "Config":
        '''(experimental) Grants permission to save a new query or updates an existing saved query.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/config/latest/APIReference/API_PutStoredQuery.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toPutStoredQuery", []))

    @jsii.member(jsii_name="toSelectAggregateResourceConfig")
    def to_select_aggregate_resource_config(self) -> "Config":
        '''(experimental) Grants permission to accept a structured query language (SQL) SELECT command and an aggregator to query configuration state of AWS resources across multiple accounts and regions, performs the corresponding search, and returns resource configurations matching the properties.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_SelectAggregateResourceConfig.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toSelectAggregateResourceConfig", []))

    @jsii.member(jsii_name="toSelectResourceConfig")
    def to_select_resource_config(self) -> "Config":
        '''(experimental) Grants permission to accept a structured query language (SQL) SELECT command, performs the corresponding search, and returns resource configurations matching the properties.

        Access Level: Read

        https://docs.aws.amazon.com/config/latest/APIReference/API_SelectResourceConfig.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toSelectResourceConfig", []))

    @jsii.member(jsii_name="toStartConfigRulesEvaluation")
    def to_start_config_rules_evaluation(self) -> "Config":
        '''(experimental) Grants permission to evaluate your resources against the specified Config rules.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_StartConfigRulesEvaluation.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toStartConfigRulesEvaluation", []))

    @jsii.member(jsii_name="toStartConfigurationRecorder")
    def to_start_configuration_recorder(self) -> "Config":
        '''(experimental) Grants permission to start recording configurations of the AWS resources you have selected to record in your AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_StartConfigurationRecorder.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toStartConfigurationRecorder", []))

    @jsii.member(jsii_name="toStartRemediationExecution")
    def to_start_remediation_execution(self) -> "Config":
        '''(experimental) Grants permission to run an on-demand remediation for the specified AWS Config rules against the last known remediation configuration.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/config/latest/APIReference/API_StartRemediationExecution.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toStartRemediationExecution", []))

    @jsii.member(jsii_name="toStartResourceEvaluation")
    def to_start_resource_evaluation(self) -> "Config":
        '''(experimental) Grants permission to evaluate your resource details against the AWS Config rules in your account.

        Access Level: Write

        Dependent actions:

        - cloudformation:DescribeType

        https://docs.aws.amazon.com/config/latest/APIReference/API_StartResourceEvaluation.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toStartResourceEvaluation", []))

    @jsii.member(jsii_name="toStopConfigurationRecorder")
    def to_stop_configuration_recorder(self) -> "Config":
        '''(experimental) Grants permission to stop recording configurations of the AWS resources you have selected to record in your AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/config/latest/APIReference/API_StopConfigurationRecorder.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toStopConfigurationRecorder", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Config":
        '''(experimental) Grants permission to associate the specified tags to a resource with the specified resourceArn.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/config/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Config":
        '''(experimental) Grants permission to delete specified tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/config/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Config", jsii.invoke(self, "toUntagResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e78d8061b8ed152138f7cac4ff3e7071a4d87d5b436f074067b03a0ca6dd22af)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b487fb0eeca04e758da8195d9278fccf6f58eda190b0677d76062c11000d1185)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Connect(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Connect"):
    '''(experimental) Statement provider for service `connect <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonconnect.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `connect <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonconnect.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2f76cbf77b6d70680934c8c5f184b1bce7d68d80a96da467de875c112d6f8631)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAttributeType")
    def if_attribute_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Connect":
        '''(experimental) Filters access by the attribute type of the Amazon Connect instance.

        https://docs.aws.amazon.com/connect/latest/adminguide/security_iam_service-with-iam.html

        Applies to actions:

        - .toDescribeInstanceAttribute()
        - .toUpdateInstanceAttribute()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c43c5d2c5bdd08ef921a96007f9bfbfcac14164011216b3207ffa133b28206f6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Connect", jsii.invoke(self, "ifAttributeType", [value, operator]))

    @jsii.member(jsii_name="ifInstanceId")
    def if_instance_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Connect":
        '''(experimental) Filters access by restricting federation into specified Amazon Connect instances.

        https://docs.aws.amazon.com/connect/latest/adminguide/security_iam_service-with-iam.html

        Applies to actions:

        - .toAssociateApprovedOrigin()
        - .toAssociateBot()
        - .toAssociateDefaultVocabulary()
        - .toAssociateInstanceStorageConfig()
        - .toAssociateLambdaFunction()
        - .toAssociateLexBot()
        - .toAssociatePhoneNumberContactFlow()
        - .toAssociateQueueQuickConnects()
        - .toAssociateRoutingProfileQueues()
        - .toAssociateSecurityKey()
        - .toBatchAssociateAnalyticsDataSet()
        - .toBatchDisassociateAnalyticsDataSet()
        - .toCreateAgentStatus()
        - .toCreateContactFlow()
        - .toCreateContactFlowModule()
        - .toCreateHoursOfOperation()
        - .toCreateIntegrationAssociation()
        - .toCreateQueue()
        - .toCreateQuickConnect()
        - .toCreateRoutingProfile()
        - .toCreateRule()
        - .toCreateSecurityProfile()
        - .toCreateTrafficDistributionGroup()
        - .toCreateUseCase()
        - .toCreateUser()
        - .toCreateUserHierarchyGroup()
        - .toCreateVocabulary()
        - .toDeleteContactFlow()
        - .toDeleteContactFlowModule()
        - .toDeleteHoursOfOperation()
        - .toDeleteInstance()
        - .toDeleteIntegrationAssociation()
        - .toDeleteQuickConnect()
        - .toDeleteRule()
        - .toDeleteSecurityProfile()
        - .toDeleteTaskTemplate()
        - .toDeleteUseCase()
        - .toDeleteUser()
        - .toDeleteUserHierarchyGroup()
        - .toDeleteVocabulary()
        - .toDescribeAgentStatus()
        - .toDescribeContact()
        - .toDescribeContactFlow()
        - .toDescribeContactFlowModule()
        - .toDescribeForecastingPlanningSchedulingIntegration()
        - .toDescribeHoursOfOperation()
        - .toDescribeInstance()
        - .toDescribeInstanceAttribute()
        - .toDescribeInstanceStorageConfig()
        - .toDescribeQueue()
        - .toDescribeQuickConnect()
        - .toDescribeRoutingProfile()
        - .toDescribeRule()
        - .toDescribeSecurityProfile()
        - .toDescribeUser()
        - .toDescribeUserHierarchyGroup()
        - .toDescribeUserHierarchyStructure()
        - .toDescribeVocabulary()
        - .toDisassociateApprovedOrigin()
        - .toDisassociateBot()
        - .toDisassociateInstanceStorageConfig()
        - .toDisassociateLambdaFunction()
        - .toDisassociateLexBot()
        - .toDisassociatePhoneNumberContactFlow()
        - .toDisassociateQueueQuickConnects()
        - .toDisassociateRoutingProfileQueues()
        - .toDisassociateSecurityKey()
        - .toDismissUserContact()
        - .toGetContactAttributes()
        - .toGetCurrentMetricData()
        - .toGetCurrentUserData()
        - .toGetFederationToken()
        - .toGetMetricData()
        - .toGetTaskTemplate()
        - .toListApprovedOrigins()
        - .toListBots()
        - .toListContactReferences()
        - .toListDefaultVocabularies()
        - .toListHoursOfOperations()
        - .toListInstanceAttributes()
        - .toListInstanceStorageConfigs()
        - .toListIntegrationAssociations()
        - .toListLambdaFunctions()
        - .toListLexBots()
        - .toListPrompts()
        - .toListQueueQuickConnects()
        - .toListRoutingProfileQueues()
        - .toListRoutingProfiles()
        - .toListRules()
        - .toListSecurityKeys()
        - .toListSecurityProfilePermissions()
        - .toListSecurityProfiles()
        - .toListUseCases()
        - .toListUserHierarchyGroups()
        - .toListUsers()
        - .toMonitorContact()
        - .toPutUserStatus()
        - .toSearchQueues()
        - .toSearchRoutingProfiles()
        - .toSearchSecurityProfiles()
        - .toSearchUsers()
        - .toSearchVocabularies()
        - .toStartChatContact()
        - .toStartForecastingPlanningSchedulingIntegration()
        - .toStartTaskContact()
        - .toStopContact()
        - .toStopForecastingPlanningSchedulingIntegration()
        - .toTransferContact()
        - .toUpdateAgentStatus()
        - .toUpdateContact()
        - .toUpdateContactAttributes()
        - .toUpdateContactFlowContent()
        - .toUpdateContactFlowMetadata()
        - .toUpdateContactFlowModuleContent()
        - .toUpdateContactFlowModuleMetadata()
        - .toUpdateContactFlowName()
        - .toUpdateContactSchedule()
        - .toUpdateHoursOfOperation()
        - .toUpdateInstanceAttribute()
        - .toUpdateInstanceStorageConfig()
        - .toUpdateParticipantRoleConfig()
        - .toUpdateQueueHoursOfOperation()
        - .toUpdateQueueMaxContacts()
        - .toUpdateQueueName()
        - .toUpdateQueueOutboundCallerConfig()
        - .toUpdateQueueStatus()
        - .toUpdateQuickConnectConfig()
        - .toUpdateQuickConnectName()
        - .toUpdateRoutingProfileConcurrency()
        - .toUpdateRoutingProfileDefaultOutboundQueue()
        - .toUpdateRoutingProfileName()
        - .toUpdateRoutingProfileQueues()
        - .toUpdateRule()
        - .toUpdateSecurityProfile()
        - .toUpdateTaskTemplate()
        - .toUpdateUserHierarchy()
        - .toUpdateUserHierarchyGroupName()
        - .toUpdateUserHierarchyStructure()
        - .toUpdateUserIdentityInfo()
        - .toUpdateUserPhoneConfig()
        - .toUpdateUserRoutingProfile()
        - .toUpdateUserSecurityProfiles()
        - .toUpdatedescribeContent()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__23a23f0cea9725e45396744178c8db1e879000add90a239d480c6b363db918fa)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Connect", jsii.invoke(self, "ifInstanceId", [value, operator]))

    @jsii.member(jsii_name="ifMonitorCapabilities")
    def if_monitor_capabilities(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Connect":
        '''(experimental) Filters access by restricting the monitor capabilities of the user in the request.

        https://docs.aws.amazon.com/connect/latest/adminguide/security_iam_service-with-iam.html

        Applies to actions:

        - .toMonitorContact()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__75757a49c2f856cb24915dfc6472d0875d8cf7285497e8f19172b9bd341c80e3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Connect", jsii.invoke(self, "ifMonitorCapabilities", [value, operator]))

    @jsii.member(jsii_name="ifSearchTag")
    def if_search_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Connect":
        '''(experimental) Filters access by TagFilter condition passed in the search request.

        https://docs.aws.amazon.com/connect/latest/adminguide/security_iam_service-with-iam.html

        Applies to actions:

        - .toSearchQueues()
        - .toSearchRoutingProfiles()
        - .toSearchSecurityProfiles()
        - .toSearchUsers()

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7874d06e497f1a2c94b975b2acbf9d3d62cede1f1e758735027f806db7f6d83b)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Connect", jsii.invoke(self, "ifSearchTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifStorageResourceType")
    def if_storage_resource_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Connect":
        '''(experimental) Filters access by restricting the storage resource type of the Amazon Connect instance storage configuration.

        https://docs.aws.amazon.com/connect/latest/adminguide/security_iam_service-with-iam.html

        Applies to actions:

        - .toAssociateInstanceStorageConfig()
        - .toDescribeInstanceStorageConfig()
        - .toDisassociateInstanceStorageConfig()
        - .toUpdateInstanceStorageConfig()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__80ac32b63796e215c83ebb4bfa6c65039a4b7c0b1c676298b36c0dde5e99415f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Connect", jsii.invoke(self, "ifStorageResourceType", [value, operator]))

    @jsii.member(jsii_name="onAgentStatus")
    def on_agent_status(
        self,
        instance_id: builtins.str,
        agent_status_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type agent-status to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/metrics-agent-status.html

        :param instance_id: - Identifier for the instanceId.
        :param agent_status_id: - Identifier for the agentStatusId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fddec106ee169d8eb52784d92e727f9b597a2a08af8883d287a069439f1f479b)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument agent_status_id", value=agent_status_id, expected_type=type_hints["agent_status_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onAgentStatus", [instance_id, agent_status_id, account, region, partition]))

    @jsii.member(jsii_name="onContact")
    def on_contact(
        self,
        instance_id: builtins.str,
        contact_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type contact to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/connect-contact-attributes.html

        :param instance_id: - Identifier for the instanceId.
        :param contact_id: - Identifier for the contactId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__37eddfeab8e28a6a706b0991f2532eb82f2883999b7e353b66e0c1b7e67fb3c2)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument contact_id", value=contact_id, expected_type=type_hints["contact_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onContact", [instance_id, contact_id, account, region, partition]))

    @jsii.member(jsii_name="onContactFlow")
    def on_contact_flow(
        self,
        instance_id: builtins.str,
        contact_flow_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type contact-flow to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/connect-contact-flows.html

        :param instance_id: - Identifier for the instanceId.
        :param contact_flow_id: - Identifier for the contactFlowId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__64530d828a719cc6b367cb9258bb0f10b81e56e927800fc8401a219ec10d98f5)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument contact_flow_id", value=contact_flow_id, expected_type=type_hints["contact_flow_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onContactFlow", [instance_id, contact_flow_id, account, region, partition]))

    @jsii.member(jsii_name="onContactFlowModule")
    def on_contact_flow_module(
        self,
        instance_id: builtins.str,
        contact_flow_module_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type contact-flow-module to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/contact-flow-modules.html

        :param instance_id: - Identifier for the instanceId.
        :param contact_flow_module_id: - Identifier for the contactFlowModuleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8d746c75ca07fb24f24beb4c729a021dc5dcb3c5fd1ab776c4d1702940de9412)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument contact_flow_module_id", value=contact_flow_module_id, expected_type=type_hints["contact_flow_module_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onContactFlowModule", [instance_id, contact_flow_module_id, account, region, partition]))

    @jsii.member(jsii_name="onHierarchyGroup")
    def on_hierarchy_group(
        self,
        instance_id: builtins.str,
        hierarchy_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type hierarchy-group to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/agent-hierarchy.html

        :param instance_id: - Identifier for the instanceId.
        :param hierarchy_group_id: - Identifier for the hierarchyGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__31558c404504e6b551d880c0384710d336a8639a59766e42a6accee87413724e)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument hierarchy_group_id", value=hierarchy_group_id, expected_type=type_hints["hierarchy_group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onHierarchyGroup", [instance_id, hierarchy_group_id, account, region, partition]))

    @jsii.member(jsii_name="onHoursOfOperation")
    def on_hours_of_operation(
        self,
        instance_id: builtins.str,
        hours_of_operation_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type hours-of-operation to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/set-hours-operation.html

        :param instance_id: - Identifier for the instanceId.
        :param hours_of_operation_id: - Identifier for the hoursOfOperationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c77fc77b09578f01951ef778a4060cf16e57db0d80f52d30691a07dfc9d888ca)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument hours_of_operation_id", value=hours_of_operation_id, expected_type=type_hints["hours_of_operation_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onHoursOfOperation", [instance_id, hours_of_operation_id, account, region, partition]))

    @jsii.member(jsii_name="onInstance")
    def on_instance(
        self,
        instance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type instance to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/amazon-connect-instances.html

        :param instance_id: - Identifier for the instanceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b6b2fcde0b37adab9a1f221d4ed7603efe961a9d2b2caafd738a8f58911d3c84)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onInstance", [instance_id, account, region, partition]))

    @jsii.member(jsii_name="onIntegrationAssociation")
    def on_integration_association(
        self,
        instance_id: builtins.str,
        integration_association_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type integration-association to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/API_IntegrationAssociationSummary.html

        :param instance_id: - Identifier for the instanceId.
        :param integration_association_id: - Identifier for the integrationAssociationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b60b75c77fb2c4f40375c43100361188d96b4174d9b12e4bdddfdcedb93efcf4)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument integration_association_id", value=integration_association_id, expected_type=type_hints["integration_association_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onIntegrationAssociation", [instance_id, integration_association_id, account, region, partition]))

    @jsii.member(jsii_name="onLegacyPhoneNumber")
    def on_legacy_phone_number(
        self,
        instance_id: builtins.str,
        phone_number_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type legacy-phone-number to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/contact-center-phone-number.html

        :param instance_id: - Identifier for the instanceId.
        :param phone_number_id: - Identifier for the phoneNumberId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__72d7809ebab9b633bcf4e119f168932e6af082c922e2c01ba86aacb4e78540f1)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument phone_number_id", value=phone_number_id, expected_type=type_hints["phone_number_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onLegacyPhoneNumber", [instance_id, phone_number_id, account, region, partition]))

    @jsii.member(jsii_name="onPhoneNumber")
    def on_phone_number(
        self,
        phone_number_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type phone-number to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/contact-center-phone-number.html

        :param phone_number_id: - Identifier for the phoneNumberId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ccf49ba4080d2d1f975a38a7bb7ca0b2a7be8bd4346d40ba27ea6aca04ed0d84)
            check_type(argname="argument phone_number_id", value=phone_number_id, expected_type=type_hints["phone_number_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onPhoneNumber", [phone_number_id, account, region, partition]))

    @jsii.member(jsii_name="onQueue")
    def on_queue(
        self,
        instance_id: builtins.str,
        queue_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type queue to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/create-queue.html

        :param instance_id: - Identifier for the instanceId.
        :param queue_id: - Identifier for the queueId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__21d09fab16ec15379eae4aee2d8d776ffb339b7096caf31c904c4016d4f43a8d)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument queue_id", value=queue_id, expected_type=type_hints["queue_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onQueue", [instance_id, queue_id, account, region, partition]))

    @jsii.member(jsii_name="onQuickConnect")
    def on_quick_connect(
        self,
        instance_id: builtins.str,
        quick_connect_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type quick-connect to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/quick-connects.html

        :param instance_id: - Identifier for the instanceId.
        :param quick_connect_id: - Identifier for the quickConnectId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__453c2a347f787c0918ce24440c4be72774229057869934969424b0e503902ccc)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument quick_connect_id", value=quick_connect_id, expected_type=type_hints["quick_connect_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onQuickConnect", [instance_id, quick_connect_id, account, region, partition]))

    @jsii.member(jsii_name="onRoutingProfile")
    def on_routing_profile(
        self,
        instance_id: builtins.str,
        routing_profile_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type routing-profile to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/routing-profiles.html

        :param instance_id: - Identifier for the instanceId.
        :param routing_profile_id: - Identifier for the routingProfileId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b8124620022667da018d99af85226c9b53de5f19dee1d02bd14e783a3cc21fc0)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument routing_profile_id", value=routing_profile_id, expected_type=type_hints["routing_profile_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onRoutingProfile", [instance_id, routing_profile_id, account, region, partition]))

    @jsii.member(jsii_name="onRule")
    def on_rule(
        self,
        instance_id: builtins.str,
        rule_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type rule to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/connect-rules.html

        :param instance_id: - Identifier for the instanceId.
        :param rule_id: - Identifier for the ruleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e2bf873b62ed83c92d81ad6f2ee6edb300faac548418b9bb559d9d8f22792b64)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument rule_id", value=rule_id, expected_type=type_hints["rule_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onRule", [instance_id, rule_id, account, region, partition]))

    @jsii.member(jsii_name="onSecurityProfile")
    def on_security_profile(
        self,
        instance_id: builtins.str,
        security_profile_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type security-profile to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/connect-security-profiles.html

        :param instance_id: - Identifier for the instanceId.
        :param security_profile_id: - Identifier for the securityProfileId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d72c07a62ba17b5b4c28d57a0b6259f8c93a5c74c5c988e6f3d14e5b0614dba9)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument security_profile_id", value=security_profile_id, expected_type=type_hints["security_profile_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onSecurityProfile", [instance_id, security_profile_id, account, region, partition]))

    @jsii.member(jsii_name="onTaskTemplate")
    def on_task_template(
        self,
        instance_id: builtins.str,
        task_template_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type task-template to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/task-templates.html

        :param instance_id: - Identifier for the instanceId.
        :param task_template_id: - Identifier for the taskTemplateId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__522794ce543d573f242c1d7c0134cb7c030634df78b5cd957892cc6349186693)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument task_template_id", value=task_template_id, expected_type=type_hints["task_template_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onTaskTemplate", [instance_id, task_template_id, account, region, partition]))

    @jsii.member(jsii_name="onTrafficDistributionGroup")
    def on_traffic_distribution_group(
        self,
        traffic_distribution_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type traffic-distribution-group to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/traffic-distribution-groups.html

        :param traffic_distribution_group_id: - Identifier for the trafficDistributionGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9ca3e4ddae4d5d509196e5cbea50373f758938610ffa87c80256c6fbcba87853)
            check_type(argname="argument traffic_distribution_group_id", value=traffic_distribution_group_id, expected_type=type_hints["traffic_distribution_group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onTrafficDistributionGroup", [traffic_distribution_group_id, account, region, partition]))

    @jsii.member(jsii_name="onUseCase")
    def on_use_case(
        self,
        instance_id: builtins.str,
        use_case_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type use-case to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/API_UseCase.html

        :param instance_id: - Identifier for the instanceId.
        :param use_case_id: - Identifier for the useCaseId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__79f9940b4c9ce873ab69c295c481e8296ffab57872d4a4f8a350250aff271e8d)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument use_case_id", value=use_case_id, expected_type=type_hints["use_case_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onUseCase", [instance_id, use_case_id, account, region, partition]))

    @jsii.member(jsii_name="onUser")
    def on_user(
        self,
        instance_id: builtins.str,
        user_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type user to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/connect-agents.html

        :param instance_id: - Identifier for the instanceId.
        :param user_id: - Identifier for the userId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a4dd5abdf59dfa4fad02b588c0e6b63494da063b812996724689ca2202f97898)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument user_id", value=user_id, expected_type=type_hints["user_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onUser", [instance_id, user_id, account, region, partition]))

    @jsii.member(jsii_name="onVocabulary")
    def on_vocabulary(
        self,
        instance_id: builtins.str,
        vocabulary_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type vocabulary to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/API_Vocabulary.html

        :param instance_id: - Identifier for the instanceId.
        :param vocabulary_id: - Identifier for the vocabularyId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9f6236a84b4a789e76466dd6e16bb1b31e9a2871f576cfc5aa8e8623e6b22e57)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument vocabulary_id", value=vocabulary_id, expected_type=type_hints["vocabulary_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onVocabulary", [instance_id, vocabulary_id, account, region, partition]))

    @jsii.member(jsii_name="onWildcardAgentStatus")
    def on_wildcard_agent_status(
        self,
        instance_id: builtins.str,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type wildcard-agent-status to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/metrics-agent-status.html

        :param instance_id: - Identifier for the instanceId.
        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1e38f57fdd0d411134cc6d92585c957cf2e7dc6707993f9a3fd0e6eddb78d68a)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onWildcardAgentStatus", [instance_id, resource_name, account, region, partition]))

    @jsii.member(jsii_name="onWildcardContactFlow")
    def on_wildcard_contact_flow(
        self,
        instance_id: builtins.str,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type wildcard-contact-flow to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/connect-contact-flows.html

        :param instance_id: - Identifier for the instanceId.
        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7dc23399c3ce26f2ad120c9e635e25e2211d60854916c6b05c647686fd62ea1f)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onWildcardContactFlow", [instance_id, resource_name, account, region, partition]))

    @jsii.member(jsii_name="onWildcardLegacyPhoneNumber")
    def on_wildcard_legacy_phone_number(
        self,
        instance_id: builtins.str,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type wildcard-legacy-phone-number to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/contact-center-phone-number.html

        :param instance_id: - Identifier for the instanceId.
        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__497b05b75657aa7230afe0d3ded01b1ea5e05eea89bf330be8ee6a052df74bb7)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onWildcardLegacyPhoneNumber", [instance_id, resource_name, account, region, partition]))

    @jsii.member(jsii_name="onWildcardPhoneNumber")
    def on_wildcard_phone_number(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type wildcard-phone-number to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/contact-center-phone-number.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__96d0efe78b4287c270702960ae9f132a05497b3337798955a893683d53ca710f)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onWildcardPhoneNumber", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onWildcardQueue")
    def on_wildcard_queue(
        self,
        instance_id: builtins.str,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type wildcard-queue to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/create-queue.html

        :param instance_id: - Identifier for the instanceId.
        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7618e27e18b62cc1747c871f3d602152e3b3a17b3f791f27b357845dedb66a2c)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onWildcardQueue", [instance_id, resource_name, account, region, partition]))

    @jsii.member(jsii_name="onWildcardQuickConnect")
    def on_wildcard_quick_connect(
        self,
        instance_id: builtins.str,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Connect":
        '''(experimental) Adds a resource of type wildcard-quick-connect to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/quick-connects.html

        :param instance_id: - Identifier for the instanceId.
        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ef53334681556515aad6c88d03841dd16c579c96b3aa1e3156bd060ecece0cdc)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Connect", jsii.invoke(self, "onWildcardQuickConnect", [instance_id, resource_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateApprovedOrigin")
    def to_associate_approved_origin(self) -> "Connect":
        '''(experimental) Grants permission to associate approved origin for an existing Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toAssociateApprovedOrigin", []))

    @jsii.member(jsii_name="toAssociateBot")
    def to_associate_bot(self) -> "Connect":
        '''(experimental) Grants permission to associate a Lex bot for an existing Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        Dependent actions:

        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy
        - lex:CreateResourcePolicy
        - lex:DescribeBotAlias
        - lex:GetBot
        - lex:UpdateResourcePolicy

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toAssociateBot", []))

    @jsii.member(jsii_name="toAssociateCustomerProfilesDomain")
    def to_associate_customer_profiles_domain(self) -> "Connect":
        '''(experimental) Grants permission to associate a Customer Profiles domain for an existing Amazon Connect instance.

        Access Level: Write

        Dependent actions:

        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy
        - profile:GetDomain

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toAssociateCustomerProfilesDomain", []))

    @jsii.member(jsii_name="toAssociateDefaultVocabulary")
    def to_associate_default_vocabulary(self) -> "Connect":
        '''(experimental) Grants permission to default vocabulary for an existing Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toAssociateDefaultVocabulary", []))

    @jsii.member(jsii_name="toAssociateInstanceStorageConfig")
    def to_associate_instance_storage_config(self) -> "Connect":
        '''(experimental) Grants permission to associate instance storage for an existing Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifStorageResourceType()
        - .ifInstanceId()

        Dependent actions:

        - ds:DescribeDirectories
        - firehose:DescribeDeliveryStream
        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy
        - kinesis:DescribeStream
        - kms:CreateGrant
        - kms:DescribeKey
        - s3:GetBucketAcl
        - s3:GetBucketLocation

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toAssociateInstanceStorageConfig", []))

    @jsii.member(jsii_name="toAssociateLambdaFunction")
    def to_associate_lambda_function(self) -> "Connect":
        '''(experimental) Grants permission to associate a Lambda function for an existing Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        Dependent actions:

        - lambda:AddPermission

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toAssociateLambdaFunction", []))

    @jsii.member(jsii_name="toAssociateLexBot")
    def to_associate_lex_bot(self) -> "Connect":
        '''(experimental) Grants permission to associate a Lex bot for an existing Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        Dependent actions:

        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy
        - lex:GetBot

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toAssociateLexBot", []))

    @jsii.member(jsii_name="toAssociatePhoneNumberContactFlow")
    def to_associate_phone_number_contact_flow(self) -> "Connect":
        '''(experimental) Grants permission to associate contact flow resources to phone number resources in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_AssociatePhoneNumberContactFlow.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toAssociatePhoneNumberContactFlow", []))

    @jsii.member(jsii_name="toAssociateQueueQuickConnects")
    def to_associate_queue_quick_connects(self) -> "Connect":
        '''(experimental) Grants permission to associate quick connects with a queue in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_AssociateQueueQuickConnects.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toAssociateQueueQuickConnects", []))

    @jsii.member(jsii_name="toAssociateRoutingProfileQueues")
    def to_associate_routing_profile_queues(self) -> "Connect":
        '''(experimental) Grants permission to associate queues with a routing profile in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_AssociateRoutingProfileQueues.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toAssociateRoutingProfileQueues", []))

    @jsii.member(jsii_name="toAssociateSecurityKey")
    def to_associate_security_key(self) -> "Connect":
        '''(experimental) Grants permission to associate a security key for an existing Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toAssociateSecurityKey", []))

    @jsii.member(jsii_name="toBatchAssociateAnalyticsDataSet")
    def to_batch_associate_analytics_data_set(self) -> "Connect":
        '''(experimental) Grants permission to grant access and to associate the datasets with the specified AWS account.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/adminguide/optimization-apis.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toBatchAssociateAnalyticsDataSet", []))

    @jsii.member(jsii_name="toBatchDisassociateAnalyticsDataSet")
    def to_batch_disassociate_analytics_data_set(self) -> "Connect":
        '''(experimental) Grants permission to revoke access and to disassociate the datasets with the specified AWS account.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/adminguide/optimization-apis.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toBatchDisassociateAnalyticsDataSet", []))

    @jsii.member(jsii_name="toClaimPhoneNumber")
    def to_claim_phone_number(self) -> "Connect":
        '''(experimental) Grants permission to claim phone number resources in an Amazon Connect instance or traffic distribution group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ClaimPhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toClaimPhoneNumber", []))

    @jsii.member(jsii_name="toCreateAgentStatus")
    def to_create_agent_status(self) -> "Connect":
        '''(experimental) Grants permission to create agent status in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateAgentStatus.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateAgentStatus", []))

    @jsii.member(jsii_name="toCreateContactFlow")
    def to_create_contact_flow(self) -> "Connect":
        '''(experimental) Grants permission to create a contact flow in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateContactFlow.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateContactFlow", []))

    @jsii.member(jsii_name="toCreateContactFlowModule")
    def to_create_contact_flow_module(self) -> "Connect":
        '''(experimental) Grants permission to create a contact flow module in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateContactFlowModule.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateContactFlowModule", []))

    @jsii.member(jsii_name="toCreateHoursOfOperation")
    def to_create_hours_of_operation(self) -> "Connect":
        '''(experimental) Grants permission to create hours of operation in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateHoursOfOperation.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateHoursOfOperation", []))

    @jsii.member(jsii_name="toCreateInstance")
    def to_create_instance(self) -> "Connect":
        '''(experimental) Grants permission to create a new Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ds:AuthorizeApplication
        - ds:CheckAlias
        - ds:CreateAlias
        - ds:CreateDirectory
        - ds:CreateIdentityPoolDirectory
        - ds:DeleteDirectory
        - ds:DescribeDirectories
        - ds:UnauthorizeApplication
        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateInstance", []))

    @jsii.member(jsii_name="toCreateIntegrationAssociation")
    def to_create_integration_association(self) -> "Connect":
        '''(experimental) Grants permission to create an integration association with an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - app-integrations:CreateEventIntegrationAssociation
        - cases:GetDomain
        - connect:DescribeInstance
        - ds:DescribeDirectories
        - events:PutRule
        - events:PutTargets
        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy
        - mobiletargeting:GetApp
        - voiceid:DescribeDomain
        - wisdom:GetAssistant
        - wisdom:GetKnowledgeBase

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateIntegrationAssociation.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateIntegrationAssociation", []))

    @jsii.member(jsii_name="toCreateQueue")
    def to_create_queue(self) -> "Connect":
        '''(experimental) Grants permission to create a queue in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateQueue.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateQueue", []))

    @jsii.member(jsii_name="toCreateQuickConnect")
    def to_create_quick_connect(self) -> "Connect":
        '''(experimental) Grants permission to create a quick connect in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateQuickConnect.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateQuickConnect", []))

    @jsii.member(jsii_name="toCreateRoutingProfile")
    def to_create_routing_profile(self) -> "Connect":
        '''(experimental) Grants permission to create a routing profile in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateRoutingProfile.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateRoutingProfile", []))

    @jsii.member(jsii_name="toCreateRule")
    def to_create_rule(self) -> "Connect":
        '''(experimental) Grants permission to create a rule in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateRule.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateRule", []))

    @jsii.member(jsii_name="toCreateSecurityProfile")
    def to_create_security_profile(self) -> "Connect":
        '''(experimental) Grants permission to create a security profile for the specified Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateSecurityProfile.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateSecurityProfile", []))

    @jsii.member(jsii_name="toCreateTaskTemplate")
    def to_create_task_template(self) -> "Connect":
        '''(experimental) Grants permission to create a task template in an Amazon Connect instance.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateTaskTemplate.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateTaskTemplate", []))

    @jsii.member(jsii_name="toCreateTrafficDistributionGroup")
    def to_create_traffic_distribution_group(self) -> "Connect":
        '''(experimental) Grants permission to create a traffic distribution group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateTrafficDistributionGroup.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateTrafficDistributionGroup", []))

    @jsii.member(jsii_name="toCreateUseCase")
    def to_create_use_case(self) -> "Connect":
        '''(experimental) Grants permission to create a use case for an integration association.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - connect:DescribeInstance
        - ds:DescribeDirectories

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateUseCase.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateUseCase", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Connect":
        '''(experimental) Grants permission to create a user for the specified Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateUser.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toCreateUserHierarchyGroup")
    def to_create_user_hierarchy_group(self) -> "Connect":
        '''(experimental) Grants permission to create a user hierarchy group in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateUserHierarchyGroup.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateUserHierarchyGroup", []))

    @jsii.member(jsii_name="toCreateVocabulary")
    def to_create_vocabulary(self) -> "Connect":
        '''(experimental) Grants permission to create a vocabulary in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateVocabulary.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toCreateVocabulary", []))

    @jsii.member(jsii_name="toDeleteContactFlow")
    def to_delete_contact_flow(self) -> "Connect":
        '''(experimental) Grants permission to delete a contact flow in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DeleteContactFlow.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDeleteContactFlow", []))

    @jsii.member(jsii_name="toDeleteContactFlowModule")
    def to_delete_contact_flow_module(self) -> "Connect":
        '''(experimental) Grants permission to delete a contact flow module in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DeleteContactFlowModule.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDeleteContactFlowModule", []))

    @jsii.member(jsii_name="toDeleteHoursOfOperation")
    def to_delete_hours_of_operation(self) -> "Connect":
        '''(experimental) Grants permission to delete hours of operation in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DeleteHoursOfOperation.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDeleteHoursOfOperation", []))

    @jsii.member(jsii_name="toDeleteInstance")
    def to_delete_instance(self) -> "Connect":
        '''(experimental) Grants permission to delete an Amazon Connect instance.

        When you remove an instance, the link to an existing AWS directory is also removed

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()
        - .ifAwsResourceTag()

        Dependent actions:

        - ds:DeleteDirectory
        - ds:DescribeDirectories
        - ds:UnauthorizeApplication

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDeleteInstance", []))

    @jsii.member(jsii_name="toDeleteIntegrationAssociation")
    def to_delete_integration_association(self) -> "Connect":
        '''(experimental) Grants permission to delete an integration association from an Amazon Connect instance.

        The association must not have any use cases associated with it

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        Dependent actions:

        - app-integrations:DeleteEventIntegrationAssociation
        - connect:DescribeInstance
        - ds:DescribeDirectories
        - events:DeleteRule
        - events:ListTargetsByRule
        - events:RemoveTargets

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DeleteIntegrationAssociation.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDeleteIntegrationAssociation", []))

    @jsii.member(jsii_name="toDeleteQuickConnect")
    def to_delete_quick_connect(self) -> "Connect":
        '''(experimental) Grants permission to delete a quick connect in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DeleteQuickConnect.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDeleteQuickConnect", []))

    @jsii.member(jsii_name="toDeleteRule")
    def to_delete_rule(self) -> "Connect":
        '''(experimental) Grants permission to delete a rule in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DeleteRule.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDeleteRule", []))

    @jsii.member(jsii_name="toDeleteSecurityProfile")
    def to_delete_security_profile(self) -> "Connect":
        '''(experimental) Grants permission to delete a security profile in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DeleteSecurityProfile.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDeleteSecurityProfile", []))

    @jsii.member(jsii_name="toDeleteTaskTemplate")
    def to_delete_task_template(self) -> "Connect":
        '''(experimental) Grants permission to delete a task template in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DeleteTaskTemplate.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDeleteTaskTemplate", []))

    @jsii.member(jsii_name="toDeleteTrafficDistributionGroup")
    def to_delete_traffic_distribution_group(self) -> "Connect":
        '''(experimental) Grants permission to delete a traffic distribution group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DeleteTrafficDistributionGroup.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDeleteTrafficDistributionGroup", []))

    @jsii.member(jsii_name="toDeleteUseCase")
    def to_delete_use_case(self) -> "Connect":
        '''(experimental) Grants permission to delete a use case from an integration association.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        Dependent actions:

        - connect:DescribeInstance
        - ds:DescribeDirectories

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DeleteUseCase.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDeleteUseCase", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "Connect":
        '''(experimental) Grants permission to delete a user in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDeleteUserHierarchyGroup")
    def to_delete_user_hierarchy_group(self) -> "Connect":
        '''(experimental) Grants permission to delete a user hierarchy group in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DeleteUserHierarchyGroup.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDeleteUserHierarchyGroup", []))

    @jsii.member(jsii_name="toDeleteVocabulary")
    def to_delete_vocabulary(self) -> "Connect":
        '''(experimental) Grants permission to delete a vocabulary in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DeleteVocabulary.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDeleteVocabulary", []))

    @jsii.member(jsii_name="toDescribeAgentStatus")
    def to_describe_agent_status(self) -> "Connect":
        '''(experimental) Grants permission to describe agent status in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeAgentStatus.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeAgentStatus", []))

    @jsii.member(jsii_name="toDescribeContact")
    def to_describe_contact(self) -> "Connect":
        '''(experimental) Grants permission to describe a contact in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeContact.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeContact", []))

    @jsii.member(jsii_name="toDescribeContactFlow")
    def to_describe_contact_flow(self) -> "Connect":
        '''(experimental) Grants permission to describe a contact flow in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeContactFlow.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeContactFlow", []))

    @jsii.member(jsii_name="toDescribeContactFlowModule")
    def to_describe_contact_flow_module(self) -> "Connect":
        '''(experimental) Grants permission to describe a contact flow module in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeContactFlowModule.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeContactFlowModule", []))

    @jsii.member(jsii_name="toDescribeForecastingPlanningSchedulingIntegration")
    def to_describe_forecasting_planning_scheduling_integration(self) -> "Connect":
        '''(experimental) Grants permission to describe the status of forecasting, planning, and scheduling integration on an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/adminguide/optimization-apis.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeForecastingPlanningSchedulingIntegration", []))

    @jsii.member(jsii_name="toDescribeHoursOfOperation")
    def to_describe_hours_of_operation(self) -> "Connect":
        '''(experimental) Grants permission to describe hours of operation in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeHoursOfOperation.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeHoursOfOperation", []))

    @jsii.member(jsii_name="toDescribeInstance")
    def to_describe_instance(self) -> "Connect":
        '''(experimental) Grants permission to view details of an Amazon Connect instance and is also required to create an instance.

        Access Level: Read

        Possible conditions:

        - .ifInstanceId()
        - .ifAwsResourceTag()

        Dependent actions:

        - ds:DescribeDirectories

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeInstance", []))

    @jsii.member(jsii_name="toDescribeInstanceAttribute")
    def to_describe_instance_attribute(self) -> "Connect":
        '''(experimental) Grants permission to view the attribute details of an existing Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifAttributeType()
        - .ifInstanceId()

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeInstanceAttribute", []))

    @jsii.member(jsii_name="toDescribeInstanceStorageConfig")
    def to_describe_instance_storage_config(self) -> "Connect":
        '''(experimental) Grants permission to view the instance storage configuration for an existing Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifStorageResourceType()
        - .ifInstanceId()

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeInstanceStorageConfig", []))

    @jsii.member(jsii_name="toDescribePhoneNumber")
    def to_describe_phone_number(self) -> "Connect":
        '''(experimental) Grants permission to describe phone number resources in an Amazon Connect instance or traffic distribution group.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribePhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribePhoneNumber", []))

    @jsii.member(jsii_name="toDescribeQueue")
    def to_describe_queue(self) -> "Connect":
        '''(experimental) Grants permission to describe a queue in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeQueue.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeQueue", []))

    @jsii.member(jsii_name="toDescribeQuickConnect")
    def to_describe_quick_connect(self) -> "Connect":
        '''(experimental) Grants permission to describe a quick connect in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeQuickConnect.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeQuickConnect", []))

    @jsii.member(jsii_name="toDescribeRoutingProfile")
    def to_describe_routing_profile(self) -> "Connect":
        '''(experimental) Grants permission to describe a routing profile in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeRoutingProfile.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeRoutingProfile", []))

    @jsii.member(jsii_name="toDescribeRule")
    def to_describe_rule(self) -> "Connect":
        '''(experimental) Grants permission to describe a rule in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeRule.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeRule", []))

    @jsii.member(jsii_name="toDescribeSecurityProfile")
    def to_describe_security_profile(self) -> "Connect":
        '''(experimental) Grants permission to describe a security profile in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeSecurityProfile.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeSecurityProfile", []))

    @jsii.member(jsii_name="toDescribeTrafficDistributionGroup")
    def to_describe_traffic_distribution_group(self) -> "Connect":
        '''(experimental) Grants permission to describe a traffic distribution group.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeTrafficDistributionGroup.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeTrafficDistributionGroup", []))

    @jsii.member(jsii_name="toDescribeUser")
    def to_describe_user(self) -> "Connect":
        '''(experimental) Grants permission to describe a user in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeUser.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeUser", []))

    @jsii.member(jsii_name="toDescribeUserHierarchyGroup")
    def to_describe_user_hierarchy_group(self) -> "Connect":
        '''(experimental) Grants permission to describe a hierarchy group for an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeUserHierarchyGroup.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeUserHierarchyGroup", []))

    @jsii.member(jsii_name="toDescribeUserHierarchyStructure")
    def to_describe_user_hierarchy_structure(self) -> "Connect":
        '''(experimental) Grants permission to describe the hierarchy structure for an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeUserHierarchyStructure.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeUserHierarchyStructure", []))

    @jsii.member(jsii_name="toDescribeVocabulary")
    def to_describe_vocabulary(self) -> "Connect":
        '''(experimental) Grants permission to describe a vocabulary in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DescribeVocabulary.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDescribeVocabulary", []))

    @jsii.member(jsii_name="toDisassociateApprovedOrigin")
    def to_disassociate_approved_origin(self) -> "Connect":
        '''(experimental) Grants permission to disassociate approved origin for an existing Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDisassociateApprovedOrigin", []))

    @jsii.member(jsii_name="toDisassociateBot")
    def to_disassociate_bot(self) -> "Connect":
        '''(experimental) Grants permission to disassociate a Lex bot for an existing Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        Dependent actions:

        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy
        - lex:DeleteResourcePolicy
        - lex:UpdateResourcePolicy

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDisassociateBot", []))

    @jsii.member(jsii_name="toDisassociateCustomerProfilesDomain")
    def to_disassociate_customer_profiles_domain(self) -> "Connect":
        '''(experimental) Grants permission to disassociate a Customer Profiles domain for an existing Amazon Connect instance.

        Access Level: Write

        Dependent actions:

        - iam:AttachRolePolicy
        - iam:DeleteRolePolicy
        - iam:DetachRolePolicy
        - iam:GetPolicy
        - iam:GetPolicyVersion
        - iam:GetRolePolicy

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDisassociateCustomerProfilesDomain", []))

    @jsii.member(jsii_name="toDisassociateInstanceStorageConfig")
    def to_disassociate_instance_storage_config(self) -> "Connect":
        '''(experimental) Grants permission to disassociate instance storage for an existing Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifStorageResourceType()
        - .ifInstanceId()

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDisassociateInstanceStorageConfig", []))

    @jsii.member(jsii_name="toDisassociateLambdaFunction")
    def to_disassociate_lambda_function(self) -> "Connect":
        '''(experimental) Grants permission to disassociate a Lambda function for an existing Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        Dependent actions:

        - lambda:RemovePermission

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDisassociateLambdaFunction", []))

    @jsii.member(jsii_name="toDisassociateLexBot")
    def to_disassociate_lex_bot(self) -> "Connect":
        '''(experimental) Grants permission to disassociate a Lex bot for an existing Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        Dependent actions:

        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDisassociateLexBot", []))

    @jsii.member(jsii_name="toDisassociatePhoneNumberContactFlow")
    def to_disassociate_phone_number_contact_flow(self) -> "Connect":
        '''(experimental) Grants permission to disassociate contact flow resources from phone number resources in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DisassociatePhoneNumberContactFlow.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDisassociatePhoneNumberContactFlow", []))

    @jsii.member(jsii_name="toDisassociateQueueQuickConnects")
    def to_disassociate_queue_quick_connects(self) -> "Connect":
        '''(experimental) Grants permission to disassociate quick connects from a queue in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DisassociateQueueQuickConnects.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDisassociateQueueQuickConnects", []))

    @jsii.member(jsii_name="toDisassociateRoutingProfileQueues")
    def to_disassociate_routing_profile_queues(self) -> "Connect":
        '''(experimental) Grants permission to disassociate queues from a routing profile in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DisassociateRoutingProfileQueues.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDisassociateRoutingProfileQueues", []))

    @jsii.member(jsii_name="toDisassociateSecurityKey")
    def to_disassociate_security_key(self) -> "Connect":
        '''(experimental) Grants permission to disassociate the security key for an existing Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDisassociateSecurityKey", []))

    @jsii.member(jsii_name="toDismissUserContact")
    def to_dismiss_user_contact(self) -> "Connect":
        '''(experimental) Grants permission to dismiss terminated Contact from Agent CCP.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_DismissUserContact.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toDismissUserContact", []))

    @jsii.member(jsii_name="toGetContactAttributes")
    def to_get_contact_attributes(self) -> "Connect":
        '''(experimental) Grants permission to retrieve the contact attributes for the specified contact.

        Access Level: Read

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_GetContactAttributes.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toGetContactAttributes", []))

    @jsii.member(jsii_name="toGetCurrentMetricData")
    def to_get_current_metric_data(self) -> "Connect":
        '''(experimental) Grants permission to retrieve current metric data for queues and routing profiles in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_GetCurrentMetricData.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toGetCurrentMetricData", []))

    @jsii.member(jsii_name="toGetCurrentUserData")
    def to_get_current_user_data(self) -> "Connect":
        '''(experimental) Grants permission to retrieve current user data in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_GetCurrentUserData.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toGetCurrentUserData", []))

    @jsii.member(jsii_name="toGetFederationToken")
    def to_get_federation_token(self) -> "Connect":
        '''(experimental) Grants permission to federate into an Amazon Connect instance when using SAML-based authentication for identity management.

        Access Level: Read

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_GetFederationToken.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toGetFederationToken", []))

    @jsii.member(jsii_name="toGetFederationTokens")
    def to_get_federation_tokens(self) -> "Connect":
        '''(experimental) Grants permission to federate into an Amazon Connect instance (Log in for emergency access functionality in the Amazon Connect console).

        Access Level: Write

        Dependent actions:

        - connect:DescribeInstance
        - connect:ListInstances
        - ds:DescribeDirectories

        https://docs.aws.amazon.com/connect/latest/APIReference/emergency-admin-login.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toGetFederationTokens", []))

    @jsii.member(jsii_name="toGetMetricData")
    def to_get_metric_data(self) -> "Connect":
        '''(experimental) Grants permission to retrieve historical metric data for queues in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_GetMetricData.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toGetMetricData", []))

    @jsii.member(jsii_name="toGetMetricDataV2")
    def to_get_metric_data_v2(self) -> "Connect":
        '''(experimental) Grants permission to retrieve metric data in an Amazon Connect instance.

        Access Level: Read

        https://docs.aws.amazon.com/connect/latest/APIReference/API_GetMetricDataV2.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toGetMetricDataV2", []))

    @jsii.member(jsii_name="toGetTaskTemplate")
    def to_get_task_template(self) -> "Connect":
        '''(experimental) Grants permission to get details about specified task template in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_GetTaskTemplate.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toGetTaskTemplate", []))

    @jsii.member(jsii_name="toGetTrafficDistribution")
    def to_get_traffic_distribution(self) -> "Connect":
        '''(experimental) Grants permission to read traffic distribution for a traffic distribution group.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_GetTrafficDistribution.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toGetTrafficDistribution", []))

    @jsii.member(jsii_name="toListAgentStatuses")
    def to_list_agent_statuses(self) -> "Connect":
        '''(experimental) Grants permission to list agent statuses in an Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListAgentStatuses.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListAgentStatuses", []))

    @jsii.member(jsii_name="toListApprovedOrigins")
    def to_list_approved_origins(self) -> "Connect":
        '''(experimental) Grants permission to view approved origins of an existing Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListApprovedOrigins", []))

    @jsii.member(jsii_name="toListBots")
    def to_list_bots(self) -> "Connect":
        '''(experimental) Grants permission to view the Lex bots of an existing Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListBots", []))

    @jsii.member(jsii_name="toListContactFlowModules")
    def to_list_contact_flow_modules(self) -> "Connect":
        '''(experimental) Grants permission to list contact flow module resources in an Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListContactFlowModules.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListContactFlowModules", []))

    @jsii.member(jsii_name="toListContactFlows")
    def to_list_contact_flows(self) -> "Connect":
        '''(experimental) Grants permission to list contact flow resources in an Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListContactFlows.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListContactFlows", []))

    @jsii.member(jsii_name="toListContactReferences")
    def to_list_contact_references(self) -> "Connect":
        '''(experimental) Grants permission to list references associated with a contact in an Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListContactReferences.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListContactReferences", []))

    @jsii.member(jsii_name="toListDefaultVocabularies")
    def to_list_default_vocabularies(self) -> "Connect":
        '''(experimental) Grants permission to list default vocabularies associated with a Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListDefaultVocabularies.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListDefaultVocabularies", []))

    @jsii.member(jsii_name="toListHoursOfOperations")
    def to_list_hours_of_operations(self) -> "Connect":
        '''(experimental) Grants permission to list hours of operation resources in an Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListHoursOfOperations.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListHoursOfOperations", []))

    @jsii.member(jsii_name="toListInstanceAttributes")
    def to_list_instance_attributes(self) -> "Connect":
        '''(experimental) Grants permission to view the attributes of an existing Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListInstanceAttributes", []))

    @jsii.member(jsii_name="toListInstances")
    def to_list_instances(self) -> "Connect":
        '''(experimental) Grants permission to view the Amazon Connect instances associated with an AWS account.

        Access Level: List

        Dependent actions:

        - ds:DescribeDirectories

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListInstances", []))

    @jsii.member(jsii_name="toListInstanceStorageConfigs")
    def to_list_instance_storage_configs(self) -> "Connect":
        '''(experimental) Grants permission to view storage configurations of an existing Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListInstanceStorageConfigs", []))

    @jsii.member(jsii_name="toListIntegrationAssociations")
    def to_list_integration_associations(self) -> "Connect":
        '''(experimental) Grants permission to list summary information about the integration associations for the specified Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifInstanceId()

        Dependent actions:

        - connect:DescribeInstance
        - ds:DescribeDirectories

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListIntegrationAssociations.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListIntegrationAssociations", []))

    @jsii.member(jsii_name="toListLambdaFunctions")
    def to_list_lambda_functions(self) -> "Connect":
        '''(experimental) Grants permission to view the Lambda functions of an existing Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListLambdaFunctions", []))

    @jsii.member(jsii_name="toListLexBots")
    def to_list_lex_bots(self) -> "Connect":
        '''(experimental) Grants permission to view the Lex bots of an existing Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListLexBots", []))

    @jsii.member(jsii_name="toListPhoneNumbers")
    def to_list_phone_numbers(self) -> "Connect":
        '''(experimental) Grants permission to list phone number resources in an Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListPhoneNumbers.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListPhoneNumbers", []))

    @jsii.member(jsii_name="toListPhoneNumbersV2")
    def to_list_phone_numbers_v2(self) -> "Connect":
        '''(experimental) Grants permission to list phone number resources in an Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListPhoneNumbersV2.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListPhoneNumbersV2", []))

    @jsii.member(jsii_name="toListPrompts")
    def to_list_prompts(self) -> "Connect":
        '''(experimental) Grants permission to list prompt resources in an Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListPrompts.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListPrompts", []))

    @jsii.member(jsii_name="toListQueueQuickConnects")
    def to_list_queue_quick_connects(self) -> "Connect":
        '''(experimental) Grants permission to list quick connect resources in a queue in an Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListQueueQuickConnects.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListQueueQuickConnects", []))

    @jsii.member(jsii_name="toListQueues")
    def to_list_queues(self) -> "Connect":
        '''(experimental) Grants permission to list queue resources in an Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListQueues.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListQueues", []))

    @jsii.member(jsii_name="toListQuickConnects")
    def to_list_quick_connects(self) -> "Connect":
        '''(experimental) Grants permission to list quick connect resources in an Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListQuickConnects.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListQuickConnects", []))

    @jsii.member(jsii_name="toListRealtimeContactAnalysisSegments")
    def to_list_realtime_contact_analysis_segments(self) -> "Connect":
        '''(experimental) Grants permission to list the analysis segments for a real-time analysis session.

        Access Level: Read

        https://docs.aws.amazon.com/contact-lens/latest/APIReference/API_ListRealtimeContactAnalysisSegments.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListRealtimeContactAnalysisSegments", []))

    @jsii.member(jsii_name="toListRoutingProfileQueues")
    def to_list_routing_profile_queues(self) -> "Connect":
        '''(experimental) Grants permission to list queue resources in a routing profile in an Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListRoutingProfileQueues.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListRoutingProfileQueues", []))

    @jsii.member(jsii_name="toListRoutingProfiles")
    def to_list_routing_profiles(self) -> "Connect":
        '''(experimental) Grants permission to list routing profile resources in an Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListRoutingProfiles.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListRoutingProfiles", []))

    @jsii.member(jsii_name="toListRules")
    def to_list_rules(self) -> "Connect":
        '''(experimental) Grants permission to list rules associated with a Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListRules.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListRules", []))

    @jsii.member(jsii_name="toListSecurityKeys")
    def to_list_security_keys(self) -> "Connect":
        '''(experimental) Grants permission to view the security keys of an existing Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListSecurityKeys", []))

    @jsii.member(jsii_name="toListSecurityProfilePermissions")
    def to_list_security_profile_permissions(self) -> "Connect":
        '''(experimental) Grants permission to list permissions associated with security profile in an Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListSecurityProfilePermissions.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListSecurityProfilePermissions", []))

    @jsii.member(jsii_name="toListSecurityProfiles")
    def to_list_security_profiles(self) -> "Connect":
        '''(experimental) Grants permission to list security profile resources in an Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListSecurityProfiles.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListSecurityProfiles", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Connect":
        '''(experimental) Grants permission to list tags for an Amazon Connect resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTaskTemplates")
    def to_list_task_templates(self) -> "Connect":
        '''(experimental) Grants permission to list task template resources in an Amazon Connect instance.

        Access Level: List

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListTaskTemplates.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListTaskTemplates", []))

    @jsii.member(jsii_name="toListTrafficDistributionGroups")
    def to_list_traffic_distribution_groups(self) -> "Connect":
        '''(experimental) Grants permission to list traffic distribution groups.

        Access Level: List

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListTrafficDistributionGroups.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListTrafficDistributionGroups", []))

    @jsii.member(jsii_name="toListUseCases")
    def to_list_use_cases(self) -> "Connect":
        '''(experimental) Grants permission to list the use cases of an integration association.

        Access Level: List

        Possible conditions:

        - .ifInstanceId()

        Dependent actions:

        - connect:DescribeInstance
        - ds:DescribeDirectories

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListUseCases.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListUseCases", []))

    @jsii.member(jsii_name="toListUserHierarchyGroups")
    def to_list_user_hierarchy_groups(self) -> "Connect":
        '''(experimental) Grants permission to list the hierarchy group resources in an Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListUserHierarchyGroups.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListUserHierarchyGroups", []))

    @jsii.member(jsii_name="toListUsers")
    def to_list_users(self) -> "Connect":
        '''(experimental) Grants permission to list user resources in an Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ListUsers.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toListUsers", []))

    @jsii.member(jsii_name="toMonitorContact")
    def to_monitor_contact(self) -> "Connect":
        '''(experimental) Grants permission to monitor an ongoing contact.

        Access Level: Write

        Possible conditions:

        - .ifMonitorCapabilities()
        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_MonitorContact.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toMonitorContact", []))

    @jsii.member(jsii_name="toPutUserStatus")
    def to_put_user_status(self) -> "Connect":
        '''(experimental) Grants permission to switch User Status in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_PutUserStatus.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toPutUserStatus", []))

    @jsii.member(jsii_name="toReleasePhoneNumber")
    def to_release_phone_number(self) -> "Connect":
        '''(experimental) Grants permission to release phone number resources in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ReleasePhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toReleasePhoneNumber", []))

    @jsii.member(jsii_name="toReplicateInstance")
    def to_replicate_instance(self) -> "Connect":
        '''(experimental) Grants permission to create a replica of an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ds:AuthorizeApplication
        - ds:CheckAlias
        - ds:CreateAlias
        - ds:CreateDirectory
        - ds:CreateIdentityPoolDirectory
        - ds:DeleteDirectory
        - ds:DescribeDirectories
        - ds:UnauthorizeApplication
        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toReplicateInstance", []))

    @jsii.member(jsii_name="toResumeContactRecording")
    def to_resume_contact_recording(self) -> "Connect":
        '''(experimental) Grants permission to resume recording for the specified contact.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_ResumeContactRecording.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toResumeContactRecording", []))

    @jsii.member(jsii_name="toSearchAvailablePhoneNumbers")
    def to_search_available_phone_numbers(self) -> "Connect":
        '''(experimental) Grants permission to search phone number resources in an Amazon Connect instance or traffic distribution group.

        Access Level: List

        https://docs.aws.amazon.com/connect/latest/APIReference/API_SearchAvailablePhoneNumbers.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toSearchAvailablePhoneNumbers", []))

    @jsii.member(jsii_name="toSearchQueues")
    def to_search_queues(self) -> "Connect":
        '''(experimental) Grants permission to search queue resources in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifInstanceId()
        - .ifSearchTag()

        Dependent actions:

        - connect:DescribeQueue

        https://docs.aws.amazon.com/connect/latest/APIReference/API_SearchQueues.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toSearchQueues", []))

    @jsii.member(jsii_name="toSearchRoutingProfiles")
    def to_search_routing_profiles(self) -> "Connect":
        '''(experimental) Grants permission to search routing profile resources in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifInstanceId()
        - .ifSearchTag()

        Dependent actions:

        - connect:DescribeRoutingProfile

        https://docs.aws.amazon.com/connect/latest/APIReference/API_SearchRoutingProfiles.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toSearchRoutingProfiles", []))

    @jsii.member(jsii_name="toSearchSecurityProfiles")
    def to_search_security_profiles(self) -> "Connect":
        '''(experimental) Grants permission to search security profile resources in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifInstanceId()
        - .ifSearchTag()

        Dependent actions:

        - connect:DescribeSecurityProfile

        https://docs.aws.amazon.com/connect/latest/APIReference/API_SearchSecurityProfiles.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toSearchSecurityProfiles", []))

    @jsii.member(jsii_name="toSearchUsers")
    def to_search_users(self) -> "Connect":
        '''(experimental) Grants permission to search user resources in an Amazon Connect instance.

        Access Level: Read

        Possible conditions:

        - .ifInstanceId()
        - .ifSearchTag()

        Dependent actions:

        - connect:DescribeUser

        https://docs.aws.amazon.com/connect/latest/APIReference/API_SearchUsers.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toSearchUsers", []))

    @jsii.member(jsii_name="toSearchVocabularies")
    def to_search_vocabularies(self) -> "Connect":
        '''(experimental) Grants permission to search vocabularies in a Amazon Connect instance.

        Access Level: List

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_SearchVocabularies.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toSearchVocabularies", []))

    @jsii.member(jsii_name="toStartChatContact")
    def to_start_chat_contact(self) -> "Connect":
        '''(experimental) Grants permission to initiate a chat using the Amazon Connect API.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_StartChatContact.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toStartChatContact", []))

    @jsii.member(jsii_name="toStartContactRecording")
    def to_start_contact_recording(self) -> "Connect":
        '''(experimental) Grants permission to start recording for the specified contact.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_StartContactRecording.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toStartContactRecording", []))

    @jsii.member(jsii_name="toStartContactStreaming")
    def to_start_contact_streaming(self) -> "Connect":
        '''(experimental) Grants permission to start chat streaming using the Amazon Connect API.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_StartContactStreaming.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toStartContactStreaming", []))

    @jsii.member(jsii_name="toStartForecastingPlanningSchedulingIntegration")
    def to_start_forecasting_planning_scheduling_integration(self) -> "Connect":
        '''(experimental) Grants permission to enable forecasting, planning, and scheduling integration on an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/adminguide/optimization-apis.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toStartForecastingPlanningSchedulingIntegration", []))

    @jsii.member(jsii_name="toStartOutboundVoiceContact")
    def to_start_outbound_voice_contact(self) -> "Connect":
        '''(experimental) Grants permission to initiate outbound calls using the Amazon Connect API.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_StartOutboundVoiceContact.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toStartOutboundVoiceContact", []))

    @jsii.member(jsii_name="toStartTaskContact")
    def to_start_task_contact(self) -> "Connect":
        '''(experimental) Grants permission to initiate a task using the Amazon Connect API.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_StartTaskContact.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toStartTaskContact", []))

    @jsii.member(jsii_name="toStopContact")
    def to_stop_contact(self) -> "Connect":
        '''(experimental) Grants permission to stop contacts that were initiated using the Amazon Connect API.

        If you use this operation on an active contact the contact ends, even if the agent is active on a call with a customer

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_StopContact.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toStopContact", []))

    @jsii.member(jsii_name="toStopContactRecording")
    def to_stop_contact_recording(self) -> "Connect":
        '''(experimental) Grants permission to stop recording for the specified contact.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_StopContactRecording.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toStopContactRecording", []))

    @jsii.member(jsii_name="toStopContactStreaming")
    def to_stop_contact_streaming(self) -> "Connect":
        '''(experimental) Grants permission to stop chat streaming using the Amazon Connect API.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_StopContactStreaming.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toStopContactStreaming", []))

    @jsii.member(jsii_name="toStopForecastingPlanningSchedulingIntegration")
    def to_stop_forecasting_planning_scheduling_integration(self) -> "Connect":
        '''(experimental) Grants permission to disable forecasting, planning, and scheduling integration on an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/adminguide/optimization-apis.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toStopForecastingPlanningSchedulingIntegration", []))

    @jsii.member(jsii_name="toSuspendContactRecording")
    def to_suspend_contact_recording(self) -> "Connect":
        '''(experimental) Grants permission to suspend recording for the specified contact.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/APIReference/API_SuspendContactRecording.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toSuspendContactRecording", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Connect":
        '''(experimental) Grants permission to tag an Amazon Connect resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTransferContact")
    def to_transfer_contact(self) -> "Connect":
        '''(experimental) Grants permission to transfer the contact to another queue or agent.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_TransferContact.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toTransferContact", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Connect":
        '''(experimental) Grants permission to untag an Amazon Connect resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAgentStatus")
    def to_update_agent_status(self) -> "Connect":
        '''(experimental) Grants permission to update agent status in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateAgentStatus.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateAgentStatus", []))

    @jsii.member(jsii_name="toUpdateContact")
    def to_update_contact(self) -> "Connect":
        '''(experimental) Grants permission to update a contact in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateContact.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateContact", []))

    @jsii.member(jsii_name="toUpdateContactAttributes")
    def to_update_contact_attributes(self) -> "Connect":
        '''(experimental) Grants permission to create or update the contact attributes associated with the specified contact.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateContactAttributes.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateContactAttributes", []))

    @jsii.member(jsii_name="toUpdateContactFlowContent")
    def to_update_contact_flow_content(self) -> "Connect":
        '''(experimental) Grants permission to update contact flow content in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateContactFlowContent.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateContactFlowContent", []))

    @jsii.member(jsii_name="toUpdateContactFlowMetadata")
    def to_update_contact_flow_metadata(self) -> "Connect":
        '''(experimental) Grants permission to update the metadata of a contact flow in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateContactFlowMetadata.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateContactFlowMetadata", []))

    @jsii.member(jsii_name="toUpdateContactFlowModuleContent")
    def to_update_contact_flow_module_content(self) -> "Connect":
        '''(experimental) Grants permission to update contact flow module content in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateContactFlowModuleContent.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateContactFlowModuleContent", []))

    @jsii.member(jsii_name="toUpdateContactFlowModuleMetadata")
    def to_update_contact_flow_module_metadata(self) -> "Connect":
        '''(experimental) Grants permission to update the metadata of a contact flow module in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateContactFlowModuleMetadata.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateContactFlowModuleMetadata", []))

    @jsii.member(jsii_name="toUpdateContactFlowName")
    def to_update_contact_flow_name(self) -> "Connect":
        '''(experimental) Grants permission to update the name and description of a contact flow in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateContactFlowName.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateContactFlowName", []))

    @jsii.member(jsii_name="toUpdateContactSchedule")
    def to_update_contact_schedule(self) -> "Connect":
        '''(experimental) Grants permission to update the schedule of a contact that is already scheduled in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateContactSchedule.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateContactSchedule", []))

    @jsii.member(jsii_name="toUpdatedescribeContent")
    def to_updatedescribe_content(self) -> "Connect":
        '''(experimental) Grants permission to update contact flow module content in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdatedescribeContent.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdatedescribeContent", []))

    @jsii.member(jsii_name="toUpdateHoursOfOperation")
    def to_update_hours_of_operation(self) -> "Connect":
        '''(experimental) Grants permission to update hours of operation in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateHoursOfOperation.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateHoursOfOperation", []))

    @jsii.member(jsii_name="toUpdateInstanceAttribute")
    def to_update_instance_attribute(self) -> "Connect":
        '''(experimental) Grants permission to update the attribute for an existing Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAttributeType()
        - .ifInstanceId()

        Dependent actions:

        - ds:DescribeDirectories
        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy
        - logs:CreateLogGroup

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateInstanceAttribute", []))

    @jsii.member(jsii_name="toUpdateInstanceStorageConfig")
    def to_update_instance_storage_config(self) -> "Connect":
        '''(experimental) Grants permission to update the storage configuration for an existing Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifStorageResourceType()
        - .ifInstanceId()

        Dependent actions:

        - ds:DescribeDirectories
        - firehose:DescribeDeliveryStream
        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy
        - kinesis:DescribeStream
        - kms:CreateGrant
        - kms:DescribeKey
        - s3:GetBucketAcl
        - s3:GetBucketLocation

        https://docs.aws.amazon.com/console/connect/amazon-connect-console/grant-instance-permissions

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateInstanceStorageConfig", []))

    @jsii.member(jsii_name="toUpdateParticipantRoleConfig")
    def to_update_participant_role_config(self) -> "Connect":
        '''(experimental) Grants permission to update participant role configurations associated with a contact.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateParticipantRoleConfig.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateParticipantRoleConfig", []))

    @jsii.member(jsii_name="toUpdatePhoneNumber")
    def to_update_phone_number(self) -> "Connect":
        '''(experimental) Grants permission to update phone number resources in an Amazon Connect instance or traffic distribution group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdatePhoneNumber.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdatePhoneNumber", []))

    @jsii.member(jsii_name="toUpdateQueueHoursOfOperation")
    def to_update_queue_hours_of_operation(self) -> "Connect":
        '''(experimental) Grants permission to update queue hours of operation in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateQueueHoursOfOperation.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateQueueHoursOfOperation", []))

    @jsii.member(jsii_name="toUpdateQueueMaxContacts")
    def to_update_queue_max_contacts(self) -> "Connect":
        '''(experimental) Grants permission to update queue capacity in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateQueueMaxContacts.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateQueueMaxContacts", []))

    @jsii.member(jsii_name="toUpdateQueueName")
    def to_update_queue_name(self) -> "Connect":
        '''(experimental) Grants permission to update a queue name and description in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateQueueName.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateQueueName", []))

    @jsii.member(jsii_name="toUpdateQueueOutboundCallerConfig")
    def to_update_queue_outbound_caller_config(self) -> "Connect":
        '''(experimental) Grants permission to update queue outbound caller config in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateQueueOutboundCallerConfig.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateQueueOutboundCallerConfig", []))

    @jsii.member(jsii_name="toUpdateQueueStatus")
    def to_update_queue_status(self) -> "Connect":
        '''(experimental) Grants permission to update queue status in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateQueueStatus.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateQueueStatus", []))

    @jsii.member(jsii_name="toUpdateQuickConnectConfig")
    def to_update_quick_connect_config(self) -> "Connect":
        '''(experimental) Grants permission to update the configuration of a quick connect in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateQuickConnectConfig.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateQuickConnectConfig", []))

    @jsii.member(jsii_name="toUpdateQuickConnectName")
    def to_update_quick_connect_name(self) -> "Connect":
        '''(experimental) Grants permission to update a quick connect name and description in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateQuickConnectName.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateQuickConnectName", []))

    @jsii.member(jsii_name="toUpdateRoutingProfileConcurrency")
    def to_update_routing_profile_concurrency(self) -> "Connect":
        '''(experimental) Grants permission to update the concurrency in a routing profile in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateRoutingProfileConcurrency.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateRoutingProfileConcurrency", []))

    @jsii.member(jsii_name="toUpdateRoutingProfileDefaultOutboundQueue")
    def to_update_routing_profile_default_outbound_queue(self) -> "Connect":
        '''(experimental) Grants permission to update the outbound queue in a routing profile in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateRoutingProfileDefaultOutboundQueue.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateRoutingProfileDefaultOutboundQueue", []))

    @jsii.member(jsii_name="toUpdateRoutingProfileName")
    def to_update_routing_profile_name(self) -> "Connect":
        '''(experimental) Grants permission to update a routing profile name and description in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateRoutingProfileName.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateRoutingProfileName", []))

    @jsii.member(jsii_name="toUpdateRoutingProfileQueues")
    def to_update_routing_profile_queues(self) -> "Connect":
        '''(experimental) Grants permission to update the queues in routing profile in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateRoutingProfileQueues.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateRoutingProfileQueues", []))

    @jsii.member(jsii_name="toUpdateRule")
    def to_update_rule(self) -> "Connect":
        '''(experimental) Grants permission to update a rule for an existing Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateRule.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateRule", []))

    @jsii.member(jsii_name="toUpdateSecurityProfile")
    def to_update_security_profile(self) -> "Connect":
        '''(experimental) Grants permission to update a security profile group for a user in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateSecurityProfile.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateSecurityProfile", []))

    @jsii.member(jsii_name="toUpdateTaskTemplate")
    def to_update_task_template(self) -> "Connect":
        '''(experimental) Grants permission to update task template belonging to a Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateTaskTemplate.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateTaskTemplate", []))

    @jsii.member(jsii_name="toUpdateTrafficDistribution")
    def to_update_traffic_distribution(self) -> "Connect":
        '''(experimental) Grants permission to update traffic distribution for a traffic distribution group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateTrafficDistribution.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateTrafficDistribution", []))

    @jsii.member(jsii_name="toUpdateUserHierarchy")
    def to_update_user_hierarchy(self) -> "Connect":
        '''(experimental) Grants permission to update a hierarchy group for a user in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateUserHierarchy.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateUserHierarchy", []))

    @jsii.member(jsii_name="toUpdateUserHierarchyGroupName")
    def to_update_user_hierarchy_group_name(self) -> "Connect":
        '''(experimental) Grants permission to update a user hierarchy group name in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateUserHierarchyGroupName.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateUserHierarchyGroupName", []))

    @jsii.member(jsii_name="toUpdateUserHierarchyStructure")
    def to_update_user_hierarchy_structure(self) -> "Connect":
        '''(experimental) Grants permission to update user hierarchy structure in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateUserHierarchyStructure.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateUserHierarchyStructure", []))

    @jsii.member(jsii_name="toUpdateUserIdentityInfo")
    def to_update_user_identity_info(self) -> "Connect":
        '''(experimental) Grants permission to update identity information for a user in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateUserIdentityInfo.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateUserIdentityInfo", []))

    @jsii.member(jsii_name="toUpdateUserPhoneConfig")
    def to_update_user_phone_config(self) -> "Connect":
        '''(experimental) Grants permission to update phone configuration settings for a user in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateUserPhoneConfig.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateUserPhoneConfig", []))

    @jsii.member(jsii_name="toUpdateUserRoutingProfile")
    def to_update_user_routing_profile(self) -> "Connect":
        '''(experimental) Grants permission to update a routing profile for a user in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateUserRoutingProfile.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateUserRoutingProfile", []))

    @jsii.member(jsii_name="toUpdateUserSecurityProfiles")
    def to_update_user_security_profiles(self) -> "Connect":
        '''(experimental) Grants permission to update security profiles for a user in an Amazon Connect instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifInstanceId()

        https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateUserSecurityProfiles.html

        :stability: experimental
        '''
        return typing.cast("Connect", jsii.invoke(self, "toUpdateUserSecurityProfiles", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3445cc4fb699c1e3539b308e835415346c6d57c084e3332f9c6527c42dbef12e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__666d787f8fa6253ab14ab26bafb0d2fc35cf8f6bc7e8ec6cc57e59a147e5d5db)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class ConnectCampaigns(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ConnectCampaigns",
):
    '''(experimental) Statement provider for service `connect-campaigns <https://docs.aws.amazon.com/service-authorization/latest/reference/list_high-volumeoutboundcommunications.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `connect-campaigns <https://docs.aws.amazon.com/service-authorization/latest/reference/list_high-volumeoutboundcommunications.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8c33a88bc358ce713b33862e55e242767f49a80d862e336432184aef7788ea0b)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onCampaign")
    def on_campaign(
        self,
        campaign_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ConnectCampaigns":
        '''(experimental) Adds a resource of type campaign to the statement.

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :param campaign_id: - Identifier for the campaignId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d35c60891ecfd77852d3fd1b1d6e462d10b77c004ac7149efd7c3de1bb69dedb)
            check_type(argname="argument campaign_id", value=campaign_id, expected_type=type_hints["campaign_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "onCampaign", [campaign_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateCampaign")
    def to_create_campaign(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to create a campaign.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toCreateCampaign", []))

    @jsii.member(jsii_name="toDeleteCampaign")
    def to_delete_campaign(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to delete a campaign.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toDeleteCampaign", []))

    @jsii.member(jsii_name="toDeleteConnectInstanceConfig")
    def to_delete_connect_instance_config(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to remove configuration information for an Amazon Connect instance.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toDeleteConnectInstanceConfig", []))

    @jsii.member(jsii_name="toDeleteInstanceOnboardingJob")
    def to_delete_instance_onboarding_job(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to remove onboarding job for an Amazon Connect instance.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toDeleteInstanceOnboardingJob", []))

    @jsii.member(jsii_name="toDescribeCampaign")
    def to_describe_campaign(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to describe a specific campaign.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toDescribeCampaign", []))

    @jsii.member(jsii_name="toGetCampaignState")
    def to_get_campaign_state(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to get state of a campaign.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toGetCampaignState", []))

    @jsii.member(jsii_name="toGetCampaignStateBatch")
    def to_get_campaign_state_batch(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to get state of campaigns.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toGetCampaignStateBatch", []))

    @jsii.member(jsii_name="toGetConnectInstanceConfig")
    def to_get_connect_instance_config(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to get configuration information for an Amazon Connect instance.

        Access Level: Read

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toGetConnectInstanceConfig", []))

    @jsii.member(jsii_name="toGetInstanceOnboardingJobStatus")
    def to_get_instance_onboarding_job_status(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to get onboarding job status for an Amazon Connect instance.

        Access Level: Read

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toGetInstanceOnboardingJobStatus", []))

    @jsii.member(jsii_name="toListCampaigns")
    def to_list_campaigns(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to provide summary of all campaigns.

        Access Level: List

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toListCampaigns", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPauseCampaign")
    def to_pause_campaign(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to pause a campaign.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toPauseCampaign", []))

    @jsii.member(jsii_name="toPutDialRequestBatch")
    def to_put_dial_request_batch(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to create dial requests for the specified campaign.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toPutDialRequestBatch", []))

    @jsii.member(jsii_name="toResumeCampaign")
    def to_resume_campaign(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to resume a campaign.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toResumeCampaign", []))

    @jsii.member(jsii_name="toStartCampaign")
    def to_start_campaign(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to start a campaign.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toStartCampaign", []))

    @jsii.member(jsii_name="toStartInstanceOnboardingJob")
    def to_start_instance_onboarding_job(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to start onboarding job for an Amazon Connect instance.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toStartInstanceOnboardingJob", []))

    @jsii.member(jsii_name="toStopCampaign")
    def to_stop_campaign(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to stop a campaign.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toStopCampaign", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateCampaignDialerConfig")
    def to_update_campaign_dialer_config(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to update the dialer configuration of a campaign.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toUpdateCampaignDialerConfig", []))

    @jsii.member(jsii_name="toUpdateCampaignName")
    def to_update_campaign_name(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to update the name of a campaign.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toUpdateCampaignName", []))

    @jsii.member(jsii_name="toUpdateCampaignOutboundCallConfig")
    def to_update_campaign_outbound_call_config(self) -> "ConnectCampaigns":
        '''(experimental) Grants permission to update the outbound call configuration of a campaign.

        Access Level: Write

        https://docs.aws.amazon.com/connect/latest/adminguide/enable-high-volume-outbound-communications.html

        :stability: experimental
        '''
        return typing.cast("ConnectCampaigns", jsii.invoke(self, "toUpdateCampaignOutboundCallConfig", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c901b0cfd48aece2ad44a7951edf7178501342babf1250ed1901040c5eee829f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6a6436c6b5c334ce456217d09b03eeb5aa11982850062ff55a67c55cd9527a69)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Consolidatedbilling(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Consolidatedbilling",
):
    '''(experimental) Statement provider for service `consolidatedbilling <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsconsolidatedbilling.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `consolidatedbilling <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsconsolidatedbilling.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0505ed0882f1579f90118afc6d5aead6f1d520261c2f1368a7cce06bb8c66efe)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toGetAccountBillingRole")
    def to_get_account_billing_role(self) -> "Consolidatedbilling":
        '''(experimental) Grants permission to get account role (Payer, Linked, Regular).

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Consolidatedbilling", jsii.invoke(self, "toGetAccountBillingRole", []))

    @jsii.member(jsii_name="toListLinkedAccounts")
    def to_list_linked_accounts(self) -> "Consolidatedbilling":
        '''(experimental) Grants permission to get list of member/linked accounts.

        Access Level: List

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Consolidatedbilling", jsii.invoke(self, "toListLinkedAccounts", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__233d68beb78f583705028963e883f32a4d7b0e53cd3b094abef624cb4b48039b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ec04a48b2831562dc23fc2af867fdf04718ffdbefec25dcda963c7a78b9bd841)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Controltower(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Controltower",
):
    '''(experimental) Statement provider for service `controltower <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscontroltower.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `controltower <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscontroltower.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8a328e51cd1a34c58b00bc13a2cfdfb6923ad5e47b92d68d70679be60d8cae5d)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toCreateManagedAccount")
    def to_create_managed_account(self) -> "Controltower":
        '''(experimental) Grants permission to create an account managed by AWS Control Tower.

        Access Level: Write

        https://docs.aws.amazon.com/controltower/latest/userguide/account-factory.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toCreateManagedAccount", []))

    @jsii.member(jsii_name="toDeleteLandingZone")
    def to_delete_landing_zone(self) -> "Controltower":
        '''(experimental) Grants permission to delete AWS Control Tower landing zone.

        Access Level: Write

        https://docs.aws.amazon.com/controltower/latest/userguide/decommission-landing-zone.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toDeleteLandingZone", []))

    @jsii.member(jsii_name="toDeregisterManagedAccount")
    def to_deregister_managed_account(self) -> "Controltower":
        '''(experimental) Grants permission to deregister an account created through the account factory from AWS Control Tower.

        Access Level: Write

        https://docs.aws.amazon.com/controltower/latest/userguide/account-factory.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toDeregisterManagedAccount", []))

    @jsii.member(jsii_name="toDeregisterOrganizationalUnit")
    def to_deregister_organizational_unit(self) -> "Controltower":
        '''(experimental) Grants permission to deregister an organizational unit from AWS Control Tower management.

        Access Level: Write

        https://docs.aws.amazon.com/controltower/latest/userguide/organizations.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toDeregisterOrganizationalUnit", []))

    @jsii.member(jsii_name="toDescribeAccountFactoryConfig")
    def to_describe_account_factory_config(self) -> "Controltower":
        '''(experimental) Grants permission to describe the current account factory configuration.

        Access Level: Read

        https://docs.aws.amazon.com/controltower/latest/userguide/account-factory.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toDescribeAccountFactoryConfig", []))

    @jsii.member(jsii_name="toDescribeCoreService")
    def to_describe_core_service(self) -> "Controltower":
        '''(experimental) Grants permission to describe resources managed by core accounts in AWS Control Tower.

        Access Level: Read

        https://docs.aws.amazon.com/controltower/latest/userguide/how-control-tower-works.html#what-shared

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toDescribeCoreService", []))

    @jsii.member(jsii_name="toDescribeGuardrail")
    def to_describe_guardrail(self) -> "Controltower":
        '''(experimental) Grants permission to describe a guardrail.

        Access Level: Read

        https://docs.aws.amazon.com/controltower/latest/userguide/controls.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toDescribeGuardrail", []))

    @jsii.member(jsii_name="toDescribeGuardrailForTarget")
    def to_describe_guardrail_for_target(self) -> "Controltower":
        '''(experimental) Grants permission to describe a guardrail for a organizational unit.

        Access Level: Read

        https://docs.aws.amazon.com/controltower/latest/userguide/controls.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toDescribeGuardrailForTarget", []))

    @jsii.member(jsii_name="toDescribeLandingZoneConfiguration")
    def to_describe_landing_zone_configuration(self) -> "Controltower":
        '''(experimental) Grants permission to describe the current Landing Zone configuration.

        Access Level: Read

        https://docs.aws.amazon.com/controltower/latest/userguide/step-two.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toDescribeLandingZoneConfiguration", []))

    @jsii.member(jsii_name="toDescribeManagedAccount")
    def to_describe_managed_account(self) -> "Controltower":
        '''(experimental) Grants permission to describe an account created through account factory.

        Access Level: Read

        https://docs.aws.amazon.com/controltower/latest/userguide/account-factory.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toDescribeManagedAccount", []))

    @jsii.member(jsii_name="toDescribeManagedOrganizationalUnit")
    def to_describe_managed_organizational_unit(self) -> "Controltower":
        '''(experimental) Grants permission to describe an AWS Organizations organizational unit managed by AWS Control Tower.

        Access Level: Read

        https://docs.aws.amazon.com/controltower/latest/userguide/organizations.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toDescribeManagedOrganizationalUnit", []))

    @jsii.member(jsii_name="toDescribeRegisterOrganizationalUnitOperation")
    def to_describe_register_organizational_unit_operation(self) -> "Controltower":
        '''(experimental) Grants permission to describe a Register Organizational Unit Operation.

        Access Level: Read

        https://docs.aws.amazon.com/controltower/latest/userguide/about-extending-governance.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toDescribeRegisterOrganizationalUnitOperation", []))

    @jsii.member(jsii_name="toDescribeSingleSignOn")
    def to_describe_single_sign_on(self) -> "Controltower":
        '''(experimental) Grants permission to describe the current AWS Control Tower SSO configuration.

        Access Level: Read

        https://docs.aws.amazon.com/controltower/latest/userguide/sso.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toDescribeSingleSignOn", []))

    @jsii.member(jsii_name="toDisableControl")
    def to_disable_control(self) -> "Controltower":
        '''(experimental) Grants permission to remove a control from an organizational unit.

        Access Level: Write

        https://docs.aws.amazon.com/controltower/latest/APIReference/API_DisableControl.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toDisableControl", []))

    @jsii.member(jsii_name="toDisableGuardrail")
    def to_disable_guardrail(self) -> "Controltower":
        '''(experimental) Grants permission to disable a guardrail from an organizational unit.

        Access Level: Write

        https://docs.aws.amazon.com/controltower/latest/userguide/enable-controls-on-ou.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toDisableGuardrail", []))

    @jsii.member(jsii_name="toEnableControl")
    def to_enable_control(self) -> "Controltower":
        '''(experimental) Grants permission to activate a control for an organizational unit.

        Access Level: Write

        https://docs.aws.amazon.com/controltower/latest/APIReference/API_EnableControl.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toEnableControl", []))

    @jsii.member(jsii_name="toEnableGuardrail")
    def to_enable_guardrail(self) -> "Controltower":
        '''(experimental) Grants permission to enable a guardrail to an organizational unit.

        Access Level: Write

        https://docs.aws.amazon.com/controltower/latest/userguide/enable-controls-on-ou.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toEnableGuardrail", []))

    @jsii.member(jsii_name="toGetAccountInfo")
    def to_get_account_info(self) -> "Controltower":
        '''(experimental) Grants permission to describe an account email and validate that it exists.

        Access Level: Read

        https://docs.aws.amazon.com/controltower/latest/userguide/accounts.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toGetAccountInfo", []))

    @jsii.member(jsii_name="toGetAvailableUpdates")
    def to_get_available_updates(self) -> "Controltower":
        '''(experimental) Grants permission to list available updates for the current AWS Control Tower deployment.

        Access Level: Read

        https://docs.aws.amazon.com/controltower/latest/userguide/configuration-updates.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toGetAvailableUpdates", []))

    @jsii.member(jsii_name="toGetControlOperation")
    def to_get_control_operation(self) -> "Controltower":
        '''(experimental) Grants permission to get the current status of a particular EnabledControl or DisableControl operation.

        Access Level: Read

        https://docs.aws.amazon.com/controltower/latest/APIReference/API_GetControlOperation.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toGetControlOperation", []))

    @jsii.member(jsii_name="toGetGuardrailComplianceStatus")
    def to_get_guardrail_compliance_status(self) -> "Controltower":
        '''(experimental) Grants permission to get the current compliance status of a guardrail.

        Access Level: Read

        https://docs.aws.amazon.com/controltower/latest/userguide/controls.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toGetGuardrailComplianceStatus", []))

    @jsii.member(jsii_name="toGetHomeRegion")
    def to_get_home_region(self) -> "Controltower":
        '''(experimental) Grants permission to get the home region of the AWS Control Tower setup.

        Access Level: Read

        https://docs.aws.amazon.com/controltower/latest/userguide/how-control-tower-works.html#region-how

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toGetHomeRegion", []))

    @jsii.member(jsii_name="toGetLandingZoneDriftStatus")
    def to_get_landing_zone_drift_status(self) -> "Controltower":
        '''(experimental) Grants permission to get the current landing zone drift status.

        Access Level: Read

        https://docs.aws.amazon.com/controltower/latest/userguide/drift.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toGetLandingZoneDriftStatus", []))

    @jsii.member(jsii_name="toGetLandingZoneStatus")
    def to_get_landing_zone_status(self) -> "Controltower":
        '''(experimental) Grants permission to get the current status of the landing zone setup.

        Access Level: Read

        https://docs.aws.amazon.com/controltower/latest/userguide/getting-started-with-control-tower.html#step-two

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toGetLandingZoneStatus", []))

    @jsii.member(jsii_name="toListDirectoryGroups")
    def to_list_directory_groups(self) -> "Controltower":
        '''(experimental) Grants permission to list the current directory groups available through SSO.

        Access Level: List

        https://docs.aws.amazon.com/controltower/latest/userguide/sso.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toListDirectoryGroups", []))

    @jsii.member(jsii_name="toListDriftDetails")
    def to_list_drift_details(self) -> "Controltower":
        '''(experimental) Grants permission to list occurrences of drift in AWS Control Tower.

        Access Level: Read

        https://docs.aws.amazon.com/controltower/latest/userguide/drift.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toListDriftDetails", []))

    @jsii.member(jsii_name="toListEnabledControls")
    def to_list_enabled_controls(self) -> "Controltower":
        '''(experimental) Grants permission to list all enabled controls in a specified organizational unit.

        Access Level: List

        https://docs.aws.amazon.com/controltower/latest/APIReference/API_ListEnabledControls.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toListEnabledControls", []))

    @jsii.member(jsii_name="toListEnabledGuardrails")
    def to_list_enabled_guardrails(self) -> "Controltower":
        '''(experimental) Grants permission to list currently enabled guardrails.

        Access Level: List

        https://docs.aws.amazon.com/controltower/latest/userguide/controls.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toListEnabledGuardrails", []))

    @jsii.member(jsii_name="toListExtendGovernancePrecheckDetails")
    def to_list_extend_governance_precheck_details(self) -> "Controltower":
        '''(experimental) Grants permission to list Precheck details for an Organizational Unit.

        Access Level: List

        https://docs.aws.amazon.com/controltower/latest/userguide/about-extending-governance.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toListExtendGovernancePrecheckDetails", []))

    @jsii.member(jsii_name="toListExternalConfigRuleCompliance")
    def to_list_external_config_rule_compliance(self) -> "Controltower":
        '''(experimental) Grants permission to list the compliance of external AWS Config rules.

        Access Level: Read

        https://docs.aws.amazon.com/controltower/latest/userguide/review-compliance.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toListExternalConfigRuleCompliance", []))

    @jsii.member(jsii_name="toListGuardrails")
    def to_list_guardrails(self) -> "Controltower":
        '''(experimental) Grants permission to list all available guardrails.

        Access Level: List

        https://docs.aws.amazon.com/controltower/latest/userguide/controls.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toListGuardrails", []))

    @jsii.member(jsii_name="toListGuardrailsForTarget")
    def to_list_guardrails_for_target(self) -> "Controltower":
        '''(experimental) Grants permission to list guardrails and their current state for a organizational unit.

        Access Level: List

        https://docs.aws.amazon.com/controltower/latest/userguide/controls.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toListGuardrailsForTarget", []))

    @jsii.member(jsii_name="toListGuardrailViolations")
    def to_list_guardrail_violations(self) -> "Controltower":
        '''(experimental) Grants permission to list existing guardrail violations.

        Access Level: List

        https://docs.aws.amazon.com/controltower/latest/userguide/controls.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toListGuardrailViolations", []))

    @jsii.member(jsii_name="toListManagedAccounts")
    def to_list_managed_accounts(self) -> "Controltower":
        '''(experimental) Grants permission to list accounts managed through AWS Control Tower.

        Access Level: List

        https://docs.aws.amazon.com/controltower/latest/userguide/account-factory.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toListManagedAccounts", []))

    @jsii.member(jsii_name="toListManagedAccountsForGuardrail")
    def to_list_managed_accounts_for_guardrail(self) -> "Controltower":
        '''(experimental) Grants permission to list managed accounts with a specified guardrail applied.

        Access Level: List

        https://docs.aws.amazon.com/controltower/latest/userguide/account-factory.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toListManagedAccountsForGuardrail", []))

    @jsii.member(jsii_name="toListManagedAccountsForParent")
    def to_list_managed_accounts_for_parent(self) -> "Controltower":
        '''(experimental) Grants permission to list managed accounts under an organizational unit.

        Access Level: List

        https://docs.aws.amazon.com/controltower/latest/userguide/account-factory.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toListManagedAccountsForParent", []))

    @jsii.member(jsii_name="toListManagedOrganizationalUnits")
    def to_list_managed_organizational_units(self) -> "Controltower":
        '''(experimental) Grants permission to list organizational units managed by AWS Control Tower.

        Access Level: List

        https://docs.aws.amazon.com/controltower/latest/userguide/organizations.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toListManagedOrganizationalUnits", []))

    @jsii.member(jsii_name="toListManagedOrganizationalUnitsForGuardrail")
    def to_list_managed_organizational_units_for_guardrail(self) -> "Controltower":
        '''(experimental) Grants permission to list managed organizational units that have a specified guardrail applied.

        Access Level: List

        https://docs.aws.amazon.com/controltower/latest/userguide/organizations.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toListManagedOrganizationalUnitsForGuardrail", []))

    @jsii.member(jsii_name="toManageOrganizationalUnit")
    def to_manage_organizational_unit(self) -> "Controltower":
        '''(experimental) Grants permission to set up an organizational unit to be managed by AWS Control Tower.

        Access Level: Write

        https://docs.aws.amazon.com/controltower/latest/userguide/organizations.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toManageOrganizationalUnit", []))

    @jsii.member(jsii_name="toPerformPreLaunchChecks")
    def to_perform_pre_launch_checks(self) -> "Controltower":
        '''(experimental) Grants permission to perform validations in an account.

        Access Level: Read

        https://docs.aws.amazon.com/controltower/latest/userguide/getting-started-prereqs.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toPerformPreLaunchChecks", []))

    @jsii.member(jsii_name="toSetupLandingZone")
    def to_setup_landing_zone(self) -> "Controltower":
        '''(experimental) Grants permission to set up or update AWS Control Tower landing zone.

        Access Level: Write

        https://docs.aws.amazon.com/controltower/latest/userguide/getting-started-with-control-tower.html#step-two

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toSetupLandingZone", []))

    @jsii.member(jsii_name="toUpdateAccountFactoryConfig")
    def to_update_account_factory_config(self) -> "Controltower":
        '''(experimental) Grants permission to update the account factory configuration.

        Access Level: Write

        https://docs.aws.amazon.com/controltower/latest/userguide/account-factory.html

        :stability: experimental
        '''
        return typing.cast("Controltower", jsii.invoke(self, "toUpdateAccountFactoryConfig", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__66d5f19961d7c2b8c5ec516c776945825c5f5c350dba6e1eb7b46e0c491b7356)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ca7df8e8197c7efed46804d02bf1c8a02de6b65f8c4b2dc685b1f23ff32c763c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Cur(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Cur"):
    '''(experimental) Statement provider for service `cur <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscostandusagereport.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `cur <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscostandusagereport.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__677ee5149a535c4d19d4f7e1a79756f39ba75429c6d6cc4d4222fee4850fd970)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onCur")
    def on_cur(
        self,
        report_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Cur":
        '''(experimental) Adds a resource of type cur to the statement.

        https://docs.aws.amazon.com/cur/latest/userguide/what-is-cur.html

        :param report_name: - Identifier for the reportName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a5a17c18ccfc67481c158d76b19d9dda8dc3ad109dea573e129b68774bc468aa)
            check_type(argname="argument report_name", value=report_name, expected_type=type_hints["report_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Cur", jsii.invoke(self, "onCur", [report_name, account, region, partition]))

    @jsii.member(jsii_name="toDeleteReportDefinition")
    def to_delete_report_definition(self) -> "Cur":
        '''(experimental) Grants permission to delete Cost and Usage Report Definition.

        Access Level: Write

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_cur_DeleteReportDefinition.html

        :stability: experimental
        '''
        return typing.cast("Cur", jsii.invoke(self, "toDeleteReportDefinition", []))

    @jsii.member(jsii_name="toDescribeReportDefinitions")
    def to_describe_report_definitions(self) -> "Cur":
        '''(experimental) Grants permission to get Cost and Usage Report Definitions.

        Access Level: Read

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_cur_DescribeReportDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Cur", jsii.invoke(self, "toDescribeReportDefinitions", []))

    @jsii.member(jsii_name="toGetClassicReport")
    def to_get_classic_report(self) -> "Cur":
        '''(experimental) Grants permission to get Bills CSV report.

        Access Level: Read

        https://docs.aws.amazon.com/cur/latest/userguide/security.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Cur", jsii.invoke(self, "toGetClassicReport", []))

    @jsii.member(jsii_name="toGetClassicReportPreferences")
    def to_get_classic_report_preferences(self) -> "Cur":
        '''(experimental) Grants permission to get the classic report enablement status for Usage Reports.

        Access Level: Read

        https://docs.aws.amazon.com/cur/latest/userguide/security.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Cur", jsii.invoke(self, "toGetClassicReportPreferences", []))

    @jsii.member(jsii_name="toGetUsageReport")
    def to_get_usage_report(self) -> "Cur":
        '''(experimental) Grants permission to get list of AWS services, usage type and operation for the Usage Report workflow.

        Allows or denies download of usage reports too

        Access Level: Read

        https://docs.aws.amazon.com/cur/latest/userguide/security.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Cur", jsii.invoke(self, "toGetUsageReport", []))

    @jsii.member(jsii_name="toModifyReportDefinition")
    def to_modify_report_definition(self) -> "Cur":
        '''(experimental) Grants permission to modify Cost and Usage Report Definition.

        Access Level: Write

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_cur_ModifyReportDefinition.html

        :stability: experimental
        '''
        return typing.cast("Cur", jsii.invoke(self, "toModifyReportDefinition", []))

    @jsii.member(jsii_name="toPutClassicReportPreferences")
    def to_put_classic_report_preferences(self) -> "Cur":
        '''(experimental) Grants permission to enable classic reports.

        Access Level: Write

        https://docs.aws.amazon.com/cur/latest/userguide/security.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Cur", jsii.invoke(self, "toPutClassicReportPreferences", []))

    @jsii.member(jsii_name="toPutReportDefinition")
    def to_put_report_definition(self) -> "Cur":
        '''(experimental) Grants permission to write Cost and Usage Report Definition.

        Access Level: Write

        https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_cur_PutReportDefinition.html

        :stability: experimental
        '''
        return typing.cast("Cur", jsii.invoke(self, "toPutReportDefinition", []))

    @jsii.member(jsii_name="toValidateReportDestination")
    def to_validate_report_destination(self) -> "Cur":
        '''(experimental) Grants permission to validates if the s3 bucket exists with appropriate permissions for CUR delivery.

        Access Level: Read

        https://docs.aws.amazon.com/cur/latest/userguide/security.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Cur", jsii.invoke(self, "toValidateReportDestination", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__08dbe5c6af6162e95481276be632ca74081af0b18ee46c183b5e45d14aafb69e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b5f939e39951e2869ffc581af0e84c32d50057d16d433b414d8e2c2d9f5844db)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Databrew(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Databrew",
):
    '''(experimental) Statement provider for service `databrew <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsgluedatabrew.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `databrew <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsgluedatabrew.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6fac55e1e18eb27b75439c444f00cda7483ebbad7a5007e30ca14b61a5470576)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDataset")
    def on_dataset(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Databrew":
        '''(experimental) Adds a resource of type Dataset to the statement.

        https://docs.aws.amazon.com/databrew/latest/dg/datasets.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__69971928680e711cd83b629cb9129467ab6937368f9bbb82d3df015c685b9570)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Databrew", jsii.invoke(self, "onDataset", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onJob")
    def on_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Databrew":
        '''(experimental) Adds a resource of type Job to the statement.

        https://docs.aws.amazon.com/databrew/latest/dg/jobs.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0c2f366da2850739e6a2cb9c8a275d37a0ee9991bda815d281a9890de1f0dab4)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Databrew", jsii.invoke(self, "onJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Databrew":
        '''(experimental) Adds a resource of type Project to the statement.

        https://docs.aws.amazon.com/databrew/latest/dg/projects.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__787ca2dea43044517a4844f01b3d85a3d1b18df20623df7d407fc40476058491)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Databrew", jsii.invoke(self, "onProject", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onRecipe")
    def on_recipe(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Databrew":
        '''(experimental) Adds a resource of type Recipe to the statement.

        https://docs.aws.amazon.com/databrew/latest/dg/recipes.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fe9c38a5671beba49f4a87e78fd3757e9b2360d0441eb02f872043bb0c916beb)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Databrew", jsii.invoke(self, "onRecipe", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onRuleset")
    def on_ruleset(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Databrew":
        '''(experimental) Adds a resource of type Ruleset to the statement.

        https://docs.aws.amazon.com/databrew/latest/dg/rulesets.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__36b0f9592cd9124449b28545b8e5119be0ab4adddd952c90282e9309238adb9b)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Databrew", jsii.invoke(self, "onRuleset", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onSchedule")
    def on_schedule(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Databrew":
        '''(experimental) Adds a resource of type Schedule to the statement.

        https://docs.aws.amazon.com/databrew/latest/dg/jobs.html#jobs.scheduling

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2e6c1dc5739d603182c874cf141ca0a431e60a0a4338efc972b38bc2e9b82e60)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Databrew", jsii.invoke(self, "onSchedule", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toBatchDeleteRecipeVersion")
    def to_batch_delete_recipe_version(self) -> "Databrew":
        '''(experimental) Grants permission to delete one or more recipe versions.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_BatchDeleteRecipeVersion.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toBatchDeleteRecipeVersion", []))

    @jsii.member(jsii_name="toCreateDataset")
    def to_create_dataset(self) -> "Databrew":
        '''(experimental) Grants permission to create a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/databrew/latest/dg/API_CreateDataset.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toCreateDataset", []))

    @jsii.member(jsii_name="toCreateProfileJob")
    def to_create_profile_job(self) -> "Databrew":
        '''(experimental) Grants permission to create a profile job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/databrew/latest/dg/API_CreateProfileJob.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toCreateProfileJob", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Databrew":
        '''(experimental) Grants permission to create a project.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/databrew/latest/dg/API_CreateProject.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toCreateRecipe")
    def to_create_recipe(self) -> "Databrew":
        '''(experimental) Grants permission to create a recipe.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/databrew/latest/dg/API_CreateRecipe.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toCreateRecipe", []))

    @jsii.member(jsii_name="toCreateRecipeJob")
    def to_create_recipe_job(self) -> "Databrew":
        '''(experimental) Grants permission to create a recipe job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/databrew/latest/dg/API_CreateRecipeJob.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toCreateRecipeJob", []))

    @jsii.member(jsii_name="toCreateRuleset")
    def to_create_ruleset(self) -> "Databrew":
        '''(experimental) Grants permission to create a ruleset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/databrew/latest/dg/API_CreateRuleset.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toCreateRuleset", []))

    @jsii.member(jsii_name="toCreateSchedule")
    def to_create_schedule(self) -> "Databrew":
        '''(experimental) Grants permission to create a schedule.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/databrew/latest/dg/API_CreateSchedule.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toCreateSchedule", []))

    @jsii.member(jsii_name="toDeleteDataset")
    def to_delete_dataset(self) -> "Databrew":
        '''(experimental) Grants permission to delete a dataset.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_DeleteDataset.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDeleteDataset", []))

    @jsii.member(jsii_name="toDeleteJob")
    def to_delete_job(self) -> "Databrew":
        '''(experimental) Grants permission to delete a job.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_DeleteJob.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDeleteJob", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Databrew":
        '''(experimental) Grants permission to delete a project.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_DeleteProject.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDeleteRecipeVersion")
    def to_delete_recipe_version(self) -> "Databrew":
        '''(experimental) Grants permission to delete a recipe version.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_DeleteRecipeVersion.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDeleteRecipeVersion", []))

    @jsii.member(jsii_name="toDeleteRuleset")
    def to_delete_ruleset(self) -> "Databrew":
        '''(experimental) Grants permission to delete a ruleset.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_DeleteRuleset.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDeleteRuleset", []))

    @jsii.member(jsii_name="toDeleteSchedule")
    def to_delete_schedule(self) -> "Databrew":
        '''(experimental) Grants permission to delete a schedule.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_DeleteSchedule.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDeleteSchedule", []))

    @jsii.member(jsii_name="toDescribeDataset")
    def to_describe_dataset(self) -> "Databrew":
        '''(experimental) Grants permission to view details about a dataset.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_DescribeDataset.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDescribeDataset", []))

    @jsii.member(jsii_name="toDescribeJob")
    def to_describe_job(self) -> "Databrew":
        '''(experimental) Grants permission to view details about a job.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_DescribeJob.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDescribeJob", []))

    @jsii.member(jsii_name="toDescribeJobRun")
    def to_describe_job_run(self) -> "Databrew":
        '''(experimental) Grants permission to view details about job run for a given job.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_DescribeJobRun.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDescribeJobRun", []))

    @jsii.member(jsii_name="toDescribeProject")
    def to_describe_project(self) -> "Databrew":
        '''(experimental) Grants permission to view details about a project.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_DescribeProject.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDescribeProject", []))

    @jsii.member(jsii_name="toDescribeRecipe")
    def to_describe_recipe(self) -> "Databrew":
        '''(experimental) Grants permission to view details about a recipe.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_DescribeRecipe.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDescribeRecipe", []))

    @jsii.member(jsii_name="toDescribeRuleset")
    def to_describe_ruleset(self) -> "Databrew":
        '''(experimental) Grants permission to view details about a ruleset.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_DescribeRuleset.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDescribeRuleset", []))

    @jsii.member(jsii_name="toDescribeSchedule")
    def to_describe_schedule(self) -> "Databrew":
        '''(experimental) Grants permission to view details about a schedule.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_DescribeSchedule.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toDescribeSchedule", []))

    @jsii.member(jsii_name="toListDatasets")
    def to_list_datasets(self) -> "Databrew":
        '''(experimental) Grants permission to list datasets in your account.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_ListDatasets.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toListDatasets", []))

    @jsii.member(jsii_name="toListJobRuns")
    def to_list_job_runs(self) -> "Databrew":
        '''(experimental) Grants permission to list job runs for a given job.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_ListJobRuns.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toListJobRuns", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Databrew":
        '''(experimental) Grants permission to list jobs in your account.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_ListJobs.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Databrew":
        '''(experimental) Grants permission to list projects in your account.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_ListProjects.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListRecipes")
    def to_list_recipes(self) -> "Databrew":
        '''(experimental) Grants permission to list recipes in your account.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_ListRecipes.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toListRecipes", []))

    @jsii.member(jsii_name="toListRecipeVersions")
    def to_list_recipe_versions(self) -> "Databrew":
        '''(experimental) Grants permission to list versions in your recipe.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_ListRecipeVersions.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toListRecipeVersions", []))

    @jsii.member(jsii_name="toListRulesets")
    def to_list_rulesets(self) -> "Databrew":
        '''(experimental) Grants permission to list rulesets in your account.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_ListRulesets.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toListRulesets", []))

    @jsii.member(jsii_name="toListSchedules")
    def to_list_schedules(self) -> "Databrew":
        '''(experimental) Grants permission to list schedules in your account.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_ListSchedules.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toListSchedules", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Databrew":
        '''(experimental) Grants permission to retrieve tags associated with a resource.

        Access Level: Read

        https://docs.aws.amazon.com/databrew/latest/dg/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPublishRecipe")
    def to_publish_recipe(self) -> "Databrew":
        '''(experimental) Grants permission to publish a major verison of a recipe.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_PublishRecipe.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toPublishRecipe", []))

    @jsii.member(jsii_name="toSendProjectSessionAction")
    def to_send_project_session_action(self) -> "Databrew":
        '''(experimental) Grants permission to submit an action to the interactive session for a project.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_SendProjectSessionAction.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toSendProjectSessionAction", []))

    @jsii.member(jsii_name="toStartJobRun")
    def to_start_job_run(self) -> "Databrew":
        '''(experimental) Grants permission to start running a job.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_StartJobRun.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toStartJobRun", []))

    @jsii.member(jsii_name="toStartProjectSession")
    def to_start_project_session(self) -> "Databrew":
        '''(experimental) Grants permission to start an interactive session for a project.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_StartProjectSession.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toStartProjectSession", []))

    @jsii.member(jsii_name="toStopJobRun")
    def to_stop_job_run(self) -> "Databrew":
        '''(experimental) Grants permission to stop a job run for a job.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_StopJobRun.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toStopJobRun", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Databrew":
        '''(experimental) Grants permission to add tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/databrew/latest/dg/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Databrew":
        '''(experimental) Grants permission to remove tags associated with a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/databrew/latest/dg/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDataset")
    def to_update_dataset(self) -> "Databrew":
        '''(experimental) Grants permission to modify a dataset.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_UpdateDataset.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toUpdateDataset", []))

    @jsii.member(jsii_name="toUpdateProfileJob")
    def to_update_profile_job(self) -> "Databrew":
        '''(experimental) Grants permission to modify a profile job.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_UpdateProfileJob.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toUpdateProfileJob", []))

    @jsii.member(jsii_name="toUpdateProject")
    def to_update_project(self) -> "Databrew":
        '''(experimental) Grants permission to modify a project.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_UpdateProject.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toUpdateProject", []))

    @jsii.member(jsii_name="toUpdateRecipe")
    def to_update_recipe(self) -> "Databrew":
        '''(experimental) Grants permission to modify a recipe.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_UpdateRecipe.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toUpdateRecipe", []))

    @jsii.member(jsii_name="toUpdateRecipeJob")
    def to_update_recipe_job(self) -> "Databrew":
        '''(experimental) Grants permission to modify a recipe job.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_UpdateRecipeJob.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toUpdateRecipeJob", []))

    @jsii.member(jsii_name="toUpdateRuleset")
    def to_update_ruleset(self) -> "Databrew":
        '''(experimental) Grants permission to modify a ruleset.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_UpdateRuleset.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toUpdateRuleset", []))

    @jsii.member(jsii_name="toUpdateSchedule")
    def to_update_schedule(self) -> "Databrew":
        '''(experimental) Grants permission to modify a schedule.

        Access Level: Write

        https://docs.aws.amazon.com/databrew/latest/dg/API_UpdateSchedule.html

        :stability: experimental
        '''
        return typing.cast("Databrew", jsii.invoke(self, "toUpdateSchedule", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1f32f38ca82d229d2b5cb6e21bd51162a79af40a1fe436ae38cca4b42a91d2fd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__285176a60cb7790a4ceb4bd80a4e7797f863dea6fd304d4ba4f02c3f3eabb8f1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Dataexchange(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Dataexchange",
):
    '''(experimental) Statement provider for service `dataexchange <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdataexchange.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `dataexchange <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdataexchange.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f3dbb035c383b90353d420322f15607c9bf3d723f2650bdc530f7bdcadf17fa8)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifJobType")
    def if_job_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dataexchange":
        '''(experimental) Filters access by the specified job type.

        https://docs.aws.amazon.com/data-exchange/latest/userguide/access-control.html

        Applies to resource types:

        - jobs

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2ed0505fed9353413379e98f429beb73bb9c2e3eacff074e5300a193c387d91c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Dataexchange", jsii.invoke(self, "ifJobType", [value, operator]))

    @jsii.member(jsii_name="onAssets")
    def on_assets(
        self,
        data_set_id: builtins.str,
        revision_id: builtins.str,
        asset_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dataexchange":
        '''(experimental) Adds a resource of type assets to the statement.

        https://docs.aws.amazon.com/data-exchange/latest/userguide/data-sets.html#assets

        :param data_set_id: - Identifier for the dataSetId.
        :param revision_id: - Identifier for the revisionId.
        :param asset_id: - Identifier for the assetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__93052e44fa7209f4bca33fcd5b4d2258a4ac5ce6082f89be727dbf433659fd74)
            check_type(argname="argument data_set_id", value=data_set_id, expected_type=type_hints["data_set_id"])
            check_type(argname="argument revision_id", value=revision_id, expected_type=type_hints["revision_id"])
            check_type(argname="argument asset_id", value=asset_id, expected_type=type_hints["asset_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dataexchange", jsii.invoke(self, "onAssets", [data_set_id, revision_id, asset_id, account, region, partition]))

    @jsii.member(jsii_name="onDataSets")
    def on_data_sets(
        self,
        data_set_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dataexchange":
        '''(experimental) Adds a resource of type data-sets to the statement.

        https://docs.aws.amazon.com/data-exchange/latest/userguide/data-sets.html

        :param data_set_id: - Identifier for the dataSetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b0e7bfb54a596527f0c410eecf47654c2130b6dd8ae453873ca24d0815e3cd0a)
            check_type(argname="argument data_set_id", value=data_set_id, expected_type=type_hints["data_set_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dataexchange", jsii.invoke(self, "onDataSets", [data_set_id, account, region, partition]))

    @jsii.member(jsii_name="onEntitledAssets")
    def on_entitled_assets(
        self,
        data_set_id: builtins.str,
        revision_id: builtins.str,
        asset_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dataexchange":
        '''(experimental) Adds a resource of type entitled-assets to the statement.

        https://docs.aws.amazon.com/data-exchange/latest/userguide/data-sets.html#assets

        :param data_set_id: - Identifier for the dataSetId.
        :param revision_id: - Identifier for the revisionId.
        :param asset_id: - Identifier for the assetId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ce784b2abc1e93e553e3badb3c0b2c56ff2199b428b2479b6c406821944b097c)
            check_type(argname="argument data_set_id", value=data_set_id, expected_type=type_hints["data_set_id"])
            check_type(argname="argument revision_id", value=revision_id, expected_type=type_hints["revision_id"])
            check_type(argname="argument asset_id", value=asset_id, expected_type=type_hints["asset_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dataexchange", jsii.invoke(self, "onEntitledAssets", [data_set_id, revision_id, asset_id, region, partition]))

    @jsii.member(jsii_name="onEntitledDataSets")
    def on_entitled_data_sets(
        self,
        data_set_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dataexchange":
        '''(experimental) Adds a resource of type entitled-data-sets to the statement.

        https://docs.aws.amazon.com/data-exchange/latest/userguide/data-sets.html

        :param data_set_id: - Identifier for the dataSetId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__930594eed8c9f121a64343f66e50712adf4575a05b247aebd30f1463bc08a5c8)
            check_type(argname="argument data_set_id", value=data_set_id, expected_type=type_hints["data_set_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dataexchange", jsii.invoke(self, "onEntitledDataSets", [data_set_id, region, partition]))

    @jsii.member(jsii_name="onEntitledRevisions")
    def on_entitled_revisions(
        self,
        data_set_id: builtins.str,
        revision_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dataexchange":
        '''(experimental) Adds a resource of type entitled-revisions to the statement.

        https://docs.aws.amazon.com/data-exchange/latest/userguide/data-sets.html#revisions

        :param data_set_id: - Identifier for the dataSetId.
        :param revision_id: - Identifier for the revisionId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a8f5d712a5c7463da23f820e424942b734e63dd6dad7674fd21a318fbe88fb8f)
            check_type(argname="argument data_set_id", value=data_set_id, expected_type=type_hints["data_set_id"])
            check_type(argname="argument revision_id", value=revision_id, expected_type=type_hints["revision_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dataexchange", jsii.invoke(self, "onEntitledRevisions", [data_set_id, revision_id, region, partition]))

    @jsii.member(jsii_name="onEventActions")
    def on_event_actions(
        self,
        event_action_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dataexchange":
        '''(experimental) Adds a resource of type event-actions to the statement.

        https://docs.aws.amazon.com/data-exchange/latest/userguide/data-sets.html

        :param event_action_id: - Identifier for the eventActionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7db7837611561b7b3c58357714bb5c88b33a3fe0583e39b49817c6d50a83346d)
            check_type(argname="argument event_action_id", value=event_action_id, expected_type=type_hints["event_action_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dataexchange", jsii.invoke(self, "onEventActions", [event_action_id, account, region, partition]))

    @jsii.member(jsii_name="onJobs")
    def on_jobs(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dataexchange":
        '''(experimental) Adds a resource of type jobs to the statement.

        https://docs.aws.amazon.com/data-exchange/latest/userguide/jobs.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifJobType()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b8b47f8d5ca72699597b8618c317c67f9c2e73a5e4654234ddf66711ca281608)
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dataexchange", jsii.invoke(self, "onJobs", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onRevisions")
    def on_revisions(
        self,
        data_set_id: builtins.str,
        revision_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dataexchange":
        '''(experimental) Adds a resource of type revisions to the statement.

        https://docs.aws.amazon.com/data-exchange/latest/userguide/data-sets.html#revisions

        :param data_set_id: - Identifier for the dataSetId.
        :param revision_id: - Identifier for the revisionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e9e139d7e18d1b18a2f6a8c7093caea9532d3f4e2f9e6b4c5370d980fd3351a5)
            check_type(argname="argument data_set_id", value=data_set_id, expected_type=type_hints["data_set_id"])
            check_type(argname="argument revision_id", value=revision_id, expected_type=type_hints["revision_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dataexchange", jsii.invoke(self, "onRevisions", [data_set_id, revision_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelJob")
    def to_cancel_job(self) -> "Dataexchange":
        '''(experimental) Grants permission to cancel a job.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_CancelJob.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toCancelJob", []))

    @jsii.member(jsii_name="toCreateAsset")
    def to_create_asset(self) -> "Dataexchange":
        '''(experimental) Grants permission to create an asset (for example, in a Job).

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/userguide/api-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toCreateAsset", []))

    @jsii.member(jsii_name="toCreateDataSet")
    def to_create_data_set(self) -> "Dataexchange":
        '''(experimental) Grants permission to create a data set.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_CreateDataSet.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toCreateDataSet", []))

    @jsii.member(jsii_name="toCreateEventAction")
    def to_create_event_action(self) -> "Dataexchange":
        '''(experimental) Grants permission to create an event action.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_CreateEventAction.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toCreateEventAction", []))

    @jsii.member(jsii_name="toCreateJob")
    def to_create_job(self) -> "Dataexchange":
        '''(experimental) Grants permission to create a job to import or export assets.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_CreateJob.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toCreateJob", []))

    @jsii.member(jsii_name="toCreateRevision")
    def to_create_revision(self) -> "Dataexchange":
        '''(experimental) Grants permission to create a revision.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_CreateRevision.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toCreateRevision", []))

    @jsii.member(jsii_name="toDeleteAsset")
    def to_delete_asset(self) -> "Dataexchange":
        '''(experimental) Grants permission to delete an asset.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_DeleteAsset.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toDeleteAsset", []))

    @jsii.member(jsii_name="toDeleteDataSet")
    def to_delete_data_set(self) -> "Dataexchange":
        '''(experimental) Grants permission to delete a data set.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_DeleteDataSet.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toDeleteDataSet", []))

    @jsii.member(jsii_name="toDeleteEventAction")
    def to_delete_event_action(self) -> "Dataexchange":
        '''(experimental) Grants permission to delete an event action.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_DeleteEventAction.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toDeleteEventAction", []))

    @jsii.member(jsii_name="toDeleteRevision")
    def to_delete_revision(self) -> "Dataexchange":
        '''(experimental) Grants permission to delete a revision.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_DeleteRevision.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toDeleteRevision", []))

    @jsii.member(jsii_name="toGetAsset")
    def to_get_asset(self) -> "Dataexchange":
        '''(experimental) Grants permission to get information about an asset and to export it (for example, in a Job).

        Access Level: Read

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_GetAsset.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toGetAsset", []))

    @jsii.member(jsii_name="toGetDataSet")
    def to_get_data_set(self) -> "Dataexchange":
        '''(experimental) Grants permission to get information about a data set.

        Access Level: Read

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_GetDataSet.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toGetDataSet", []))

    @jsii.member(jsii_name="toGetEventAction")
    def to_get_event_action(self) -> "Dataexchange":
        '''(experimental) Grants permission to get an event action.

        Access Level: Read

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_GetEventAction.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toGetEventAction", []))

    @jsii.member(jsii_name="toGetJob")
    def to_get_job(self) -> "Dataexchange":
        '''(experimental) Grants permission to get information about a job.

        Access Level: Read

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_GetJob.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toGetJob", []))

    @jsii.member(jsii_name="toGetRevision")
    def to_get_revision(self) -> "Dataexchange":
        '''(experimental) Grants permission to get information about a revision.

        Access Level: Read

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_GetRevision.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toGetRevision", []))

    @jsii.member(jsii_name="toListDataSetRevisions")
    def to_list_data_set_revisions(self) -> "Dataexchange":
        '''(experimental) Grants permission to list the revisions of a data set.

        Access Level: List

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_ListDataSetRevisions.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toListDataSetRevisions", []))

    @jsii.member(jsii_name="toListDataSets")
    def to_list_data_sets(self) -> "Dataexchange":
        '''(experimental) Grants permission to list data sets for the account.

        Access Level: List

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_ListDataSets.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toListDataSets", []))

    @jsii.member(jsii_name="toListEventActions")
    def to_list_event_actions(self) -> "Dataexchange":
        '''(experimental) Grants permission to list event actions for the account.

        Access Level: List

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_ListEventActions.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toListEventActions", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Dataexchange":
        '''(experimental) Grants permission to list jobs for the account.

        Access Level: List

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_ListJobs.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListRevisionAssets")
    def to_list_revision_assets(self) -> "Dataexchange":
        '''(experimental) Grants permission to get list the assets of a revision.

        Access Level: List

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_ListRevisionAssets.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toListRevisionAssets", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Dataexchange":
        '''(experimental) Grants permission to list the tags that you associated with the specified resource.

        Access Level: List

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPublishDataSet")
    def to_publish_data_set(self) -> "Dataexchange":
        '''(experimental) Grants permission to publish a data set.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/userguide/api-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toPublishDataSet", []))

    @jsii.member(jsii_name="toRevokeRevision")
    def to_revoke_revision(self) -> "Dataexchange":
        '''(experimental) Grants permission to revoke subscriber access to a revision.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_RevokeRevision.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toRevokeRevision", []))

    @jsii.member(jsii_name="toSendApiAsset")
    def to_send_api_asset(self) -> "Dataexchange":
        '''(experimental) Grants permission to send a request to an API asset.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_SendApiAsset.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toSendApiAsset", []))

    @jsii.member(jsii_name="toStartJob")
    def to_start_job(self) -> "Dataexchange":
        '''(experimental) Grants permission to start a job.

        Access Level: Write

        Dependent actions:

        - dataexchange:CreateAsset

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_StartJob.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toStartJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Dataexchange":
        '''(experimental) Grants permission to add one or more tags to a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Dataexchange":
        '''(experimental) Grants permission to remove one or more tags from a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAsset")
    def to_update_asset(self) -> "Dataexchange":
        '''(experimental) Grants permission to get update information about an asset.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_UpdateAsset.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toUpdateAsset", []))

    @jsii.member(jsii_name="toUpdateDataSet")
    def to_update_data_set(self) -> "Dataexchange":
        '''(experimental) Grants permission to update information about a data set.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_UpdateDataSet.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toUpdateDataSet", []))

    @jsii.member(jsii_name="toUpdateEventAction")
    def to_update_event_action(self) -> "Dataexchange":
        '''(experimental) Grants permission to update information for an event action.

        Access Level: Write

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_UpdateEventAction.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toUpdateEventAction", []))

    @jsii.member(jsii_name="toUpdateRevision")
    def to_update_revision(self) -> "Dataexchange":
        '''(experimental) Grants permission to update information about a revision.

        Access Level: Write

        Dependent actions:

        - dataexchange:PublishDataSet

        https://docs.aws.amazon.com/data-exchange/latest/apireference/API_UpdateRevision.html

        :stability: experimental
        '''
        return typing.cast("Dataexchange", jsii.invoke(self, "toUpdateRevision", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1558697df2314e3e71e3e9baa978a9a5825e421b559796e372d45de33699aadf)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__877e693b37dbfe277276ce5c5d478854cba0b35214da86c35456e1dd711ee1fb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Datapipeline(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Datapipeline",
):
    '''(experimental) Statement provider for service `datapipeline <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatapipeline.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `datapipeline <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatapipeline.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a6f14d67ed555c7291b87eddf22846e5ff2282d0cdff77aba66e59820336449f)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifPipelineCreator")
    def if_pipeline_creator(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Datapipeline":
        '''(experimental) Filters access by the IAM user that created the pipeline.

        https://docs.aws.amazon.com/datapipeline/latest/DeveloperGuide/dp-example-tag-policies.html#ex3

        Applies to actions:

        - .toActivatePipeline()
        - .toAddTags()
        - .toDeactivatePipeline()
        - .toDeletePipeline()
        - .toDescribeObjects()
        - .toDescribePipelines()
        - .toEvaluateExpression()
        - .toGetPipelineDefinition()
        - .toPutPipelineDefinition()
        - .toQueryObjects()
        - .toRemoveTags()
        - .toSetStatus()
        - .toValidatePipelineDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c4a154e7d9ffa00a383a2ced9530e6a6d34217317e1472268d4e31b2d59c7a7a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Datapipeline", jsii.invoke(self, "ifPipelineCreator", [value, operator]))

    @jsii.member(jsii_name="ifTag")
    def if_tag(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Datapipeline":
        '''(experimental) Filters access by customer-specified key/value pair that can be attached to a resource.

        https://docs.aws.amazon.com/datapipeline/latest/DeveloperGuide/dp-iam-resourcebased-access.html#dp-control-access-tags

        Applies to actions:

        - .toActivatePipeline()
        - .toAddTags()
        - .toCreatePipeline()
        - .toDeactivatePipeline()
        - .toDeletePipeline()
        - .toDescribeObjects()
        - .toDescribePipelines()
        - .toEvaluateExpression()
        - .toGetPipelineDefinition()
        - .toPutPipelineDefinition()
        - .toQueryObjects()
        - .toRemoveTags()
        - .toSetStatus()
        - .toValidatePipelineDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__de9a1b07071c2a499e0835703f1dc782d61a7093efe60dd2ab3ebea69a557ef1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Datapipeline", jsii.invoke(self, "ifTag", [value, operator]))

    @jsii.member(jsii_name="ifWorkerGroup")
    def if_worker_group(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Datapipeline":
        '''(experimental) Filters access by the name of a worker group for which a Task Runner retrieves work.

        https://docs.aws.amazon.com/datapipeline/latest/DeveloperGuide/dp-iam-resourcebased-access.html#dp-control-access-workergroup

        Applies to actions:

        - .toActivatePipeline()
        - .toDeactivatePipeline()
        - .toGetPipelineDefinition()
        - .toPollForTask()
        - .toPutPipelineDefinition()
        - .toValidatePipelineDefinition()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0fda3a54c21dfee75888316dcebbfc770745aee35635694bbec9e030d05b6073)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Datapipeline", jsii.invoke(self, "ifWorkerGroup", [value, operator]))

    @jsii.member(jsii_name="onPipeline")
    def on_pipeline(
        self,
        pipeline_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Datapipeline":
        '''(experimental) Adds a resource of type pipeline to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatapipeline.html

        :param pipeline_id: - Identifier for the pipelineId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c8ae3e70760e051e30476a0955b4489199590d53efa45fe606aa868637f8718b)
            check_type(argname="argument pipeline_id", value=pipeline_id, expected_type=type_hints["pipeline_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Datapipeline", jsii.invoke(self, "onPipeline", [pipeline_id, account, region, partition]))

    @jsii.member(jsii_name="toActivatePipeline")
    def to_activate_pipeline(self) -> "Datapipeline":
        '''(experimental) Grants permission to validate the specified pipeline and starts processing pipeline tasks.

        If the pipeline does not pass validation, activation fails

        Access Level: Write

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()
        - .ifWorkerGroup()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_ActivatePipeline.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toActivatePipeline", []))

    @jsii.member(jsii_name="toAddTags")
    def to_add_tags(self) -> "Datapipeline":
        '''(experimental) Grants permission to add or modify tags for the specified pipeline.

        Access Level: Tagging

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_AddTags.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toAddTags", []))

    @jsii.member(jsii_name="toCreatePipeline")
    def to_create_pipeline(self) -> "Datapipeline":
        '''(experimental) Grants permission to create a new, empty pipeline.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifTag()

        Dependent actions:

        - datapipeline:AddTags

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_CreatePipeline.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toCreatePipeline", []))

    @jsii.member(jsii_name="toDeactivatePipeline")
    def to_deactivate_pipeline(self) -> "Datapipeline":
        '''(experimental) Grants permission to Deactivate the specified running pipeline.

        Access Level: Write

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()
        - .ifWorkerGroup()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_DeactivatePipeline.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toDeactivatePipeline", []))

    @jsii.member(jsii_name="toDeletePipeline")
    def to_delete_pipeline(self) -> "Datapipeline":
        '''(experimental) Grants permission to delete a pipeline, its pipeline definition, and its run history.

        Access Level: Write

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_DeletePipeline.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toDeletePipeline", []))

    @jsii.member(jsii_name="toDescribeObjects")
    def to_describe_objects(self) -> "Datapipeline":
        '''(experimental) Grants permission to get the object definitions for a set of objects associated with the pipeline.

        Access Level: Read

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_DescribeObjects.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toDescribeObjects", []))

    @jsii.member(jsii_name="toDescribePipelines")
    def to_describe_pipelines(self) -> "Datapipeline":
        '''(experimental) Grants permission to retrieves metadata about one or more pipelines.

        Access Level: Read

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_DescribePipelines.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toDescribePipelines", []))

    @jsii.member(jsii_name="toEvaluateExpression")
    def to_evaluate_expression(self) -> "Datapipeline":
        '''(experimental) Grants permission to task runners to call EvaluateExpression, to evaluate a string in the context of the specified object.

        Access Level: Read

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_EvaluateExpression.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toEvaluateExpression", []))

    @jsii.member(jsii_name="toGetAccountLimits")
    def to_get_account_limits(self) -> "Datapipeline":
        '''(experimental) Grants permission to call GetAccountLimits.

        Access Level: List

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_GetAccountLimits.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toGetAccountLimits", []))

    @jsii.member(jsii_name="toGetPipelineDefinition")
    def to_get_pipeline_definition(self) -> "Datapipeline":
        '''(experimental) Grants permission to gets the definition of the specified pipeline.

        Access Level: Read

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()
        - .ifWorkerGroup()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_GetPipelineDefinition.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toGetPipelineDefinition", []))

    @jsii.member(jsii_name="toListPipelines")
    def to_list_pipelines(self) -> "Datapipeline":
        '''(experimental) Grants permission to list the pipeline identifiers for all active pipelines that you have permission to access.

        Access Level: List

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_ListPipelines.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toListPipelines", []))

    @jsii.member(jsii_name="toPollForTask")
    def to_poll_for_task(self) -> "Datapipeline":
        '''(experimental) Grants permission to task runners to call PollForTask, to receive a task to perform from AWS Data Pipeline.

        Access Level: Write

        Possible conditions:

        - .ifWorkerGroup()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_PollForTask.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toPollForTask", []))

    @jsii.member(jsii_name="toPutAccountLimits")
    def to_put_account_limits(self) -> "Datapipeline":
        '''(experimental) Grants permission to call PutAccountLimits.

        Access Level: Write

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_PutAccountLimits.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toPutAccountLimits", []))

    @jsii.member(jsii_name="toPutPipelineDefinition")
    def to_put_pipeline_definition(self) -> "Datapipeline":
        '''(experimental) Grants permission to add tasks, schedules, and preconditions to the specified pipeline.

        Access Level: Write

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()
        - .ifWorkerGroup()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_PutPipelineDefinition.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toPutPipelineDefinition", []))

    @jsii.member(jsii_name="toQueryObjects")
    def to_query_objects(self) -> "Datapipeline":
        '''(experimental) Grants permission to query the specified pipeline for the names of objects that match the specified set of conditions.

        Access Level: Read

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_QueryObjects.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toQueryObjects", []))

    @jsii.member(jsii_name="toRemoveTags")
    def to_remove_tags(self) -> "Datapipeline":
        '''(experimental) Grants permission to remove existing tags from the specified pipeline.

        Access Level: Tagging

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_RemoveTags.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toRemoveTags", []))

    @jsii.member(jsii_name="toReportTaskProgress")
    def to_report_task_progress(self) -> "Datapipeline":
        '''(experimental) Grants permission to task runners to call ReportTaskProgress, when they are assigned a task to acknowledge that it has the task.

        Access Level: Write

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_ReportTaskProgress.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toReportTaskProgress", []))

    @jsii.member(jsii_name="toReportTaskRunnerHeartbeat")
    def to_report_task_runner_heartbeat(self) -> "Datapipeline":
        '''(experimental) Grants permission to task runners to call ReportTaskRunnerHeartbeat every 15 minutes to indicate that they are operational.

        Access Level: Write

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_ReportTaskRunnerHeartbeat.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toReportTaskRunnerHeartbeat", []))

    @jsii.member(jsii_name="toSetStatus")
    def to_set_status(self) -> "Datapipeline":
        '''(experimental) Grants permission to requests that the status of the specified physical or logical pipeline objects be updated in the specified pipeline.

        Access Level: Write

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_SetStatus.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toSetStatus", []))

    @jsii.member(jsii_name="toSetTaskStatus")
    def to_set_task_status(self) -> "Datapipeline":
        '''(experimental) Grants permission to task runners to call SetTaskStatus to notify AWS Data Pipeline that a task is completed and provide information about the final status.

        Access Level: Write

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_SetTaskStatus.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toSetTaskStatus", []))

    @jsii.member(jsii_name="toValidatePipelineDefinition")
    def to_validate_pipeline_definition(self) -> "Datapipeline":
        '''(experimental) Grants permission to validate the specified pipeline definition to ensure that it is well formed and can be run without error.

        Access Level: Read

        Possible conditions:

        - .ifPipelineCreator()
        - .ifTag()
        - .ifWorkerGroup()

        https://docs.aws.amazon.com/datapipeline/latest/APIReference/API_ValidatePipelineDefinition.html

        :stability: experimental
        '''
        return typing.cast("Datapipeline", jsii.invoke(self, "toValidatePipelineDefinition", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__34fcbb242fcad5bbd4b10429e009e2b8278ecb61e314b6cbd1e82261598452ca)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2d927939287d017a6464122aaeaabfd124ca3192e9eeedde1f3a8da479a9e43e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Datasync(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Datasync",
):
    '''(experimental) Statement provider for service `datasync <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatasync.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `datasync <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatasync.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__885c2d0919ed5e318b4bd42fadc4317848e682a19f44e15b1b8bd2408325fa99)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAgent")
    def on_agent(
        self,
        agent_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Datasync":
        '''(experimental) Adds a resource of type agent to the statement.

        https://docs.aws.amazon.com/datasync/latest/userguide/working-with-agents.html

        :param agent_id: - Identifier for the agentId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1ddfd026200073ccd341a2ca241f9ec81930919d3bbde11ecfcbcb4f6b2b8934)
            check_type(argname="argument agent_id", value=agent_id, expected_type=type_hints["agent_id"])
            check_type(argname="argument account_id", value=account_id, expected_type=type_hints["account_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Datasync", jsii.invoke(self, "onAgent", [agent_id, account_id, region, partition]))

    @jsii.member(jsii_name="onLocation")
    def on_location(
        self,
        location_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Datasync":
        '''(experimental) Adds a resource of type location to the statement.

        https://docs.aws.amazon.com/datasync/latest/userguide/working-with-locations.html

        :param location_id: - Identifier for the locationId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2d611a097443ac811627829246ce57b0b8d7094b76d9974d93d2fdddf1bd14e4)
            check_type(argname="argument location_id", value=location_id, expected_type=type_hints["location_id"])
            check_type(argname="argument account_id", value=account_id, expected_type=type_hints["account_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Datasync", jsii.invoke(self, "onLocation", [location_id, account_id, region, partition]))

    @jsii.member(jsii_name="onTask")
    def on_task(
        self,
        task_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Datasync":
        '''(experimental) Adds a resource of type task to the statement.

        https://docs.aws.amazon.com/datasync/latest/userguide/working-with-tasks.html

        :param task_id: - Identifier for the taskId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5351ff918899ef2497a3d3792b662e162a925d336d8a0d48b85aeec741f28687)
            check_type(argname="argument task_id", value=task_id, expected_type=type_hints["task_id"])
            check_type(argname="argument account_id", value=account_id, expected_type=type_hints["account_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Datasync", jsii.invoke(self, "onTask", [task_id, account_id, region, partition]))

    @jsii.member(jsii_name="onTaskexecution")
    def on_taskexecution(
        self,
        task_id: builtins.str,
        execution_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Datasync":
        '''(experimental) Adds a resource of type taskexecution to the statement.

        https://docs.aws.amazon.com/datasync/latest/userguide/working-with-task-executions.html

        :param task_id: - Identifier for the taskId.
        :param execution_id: - Identifier for the executionId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c92fa68d55599b7a397b98e3a097740050376c1750e98af375e93292f4409377)
            check_type(argname="argument task_id", value=task_id, expected_type=type_hints["task_id"])
            check_type(argname="argument execution_id", value=execution_id, expected_type=type_hints["execution_id"])
            check_type(argname="argument account_id", value=account_id, expected_type=type_hints["account_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Datasync", jsii.invoke(self, "onTaskexecution", [task_id, execution_id, account_id, region, partition]))

    @jsii.member(jsii_name="toCancelTaskExecution")
    def to_cancel_task_execution(self) -> "Datasync":
        '''(experimental) Grants permission to cancel execution of a sync task.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CancelTaskExecution.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCancelTaskExecution", []))

    @jsii.member(jsii_name="toCreateAgent")
    def to_create_agent(self) -> "Datasync":
        '''(experimental) Grants permission to activate an agent that you have deployed on your host.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateAgent.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCreateAgent", []))

    @jsii.member(jsii_name="toCreateLocationEfs")
    def to_create_location_efs(self) -> "Datasync":
        '''(experimental) Grants permission to create an endpoint for an Amazon EFS file system.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateLocationEfs.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCreateLocationEfs", []))

    @jsii.member(jsii_name="toCreateLocationFsxLustre")
    def to_create_location_fsx_lustre(self) -> "Datasync":
        '''(experimental) Grants permission to create an endpoint for an Amazon Fsx Lustre.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateLocationFsxLustre.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCreateLocationFsxLustre", []))

    @jsii.member(jsii_name="toCreateLocationFsxOntap")
    def to_create_location_fsx_ontap(self) -> "Datasync":
        '''(experimental) Grants permission to create an endpoint for Amazon FSx for ONTAP.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateLocationFsxOntap.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCreateLocationFsxOntap", []))

    @jsii.member(jsii_name="toCreateLocationFsxOpenZfs")
    def to_create_location_fsx_open_zfs(self) -> "Datasync":
        '''(experimental) Grants permission to create an endpoint for Amazon FSx for OpenZFS.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateLocationFsxOpenZfs.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCreateLocationFsxOpenZfs", []))

    @jsii.member(jsii_name="toCreateLocationFsxWindows")
    def to_create_location_fsx_windows(self) -> "Datasync":
        '''(experimental) Grants permission to create an endpoint for an Amazon FSx Windows File Server file system.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateLocationFsxWindows.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCreateLocationFsxWindows", []))

    @jsii.member(jsii_name="toCreateLocationHdfs")
    def to_create_location_hdfs(self) -> "Datasync":
        '''(experimental) Grants permission to create an endpoint for an Amazon Hdfs.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateLocationHdfs.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCreateLocationHdfs", []))

    @jsii.member(jsii_name="toCreateLocationNfs")
    def to_create_location_nfs(self) -> "Datasync":
        '''(experimental) Grants permission to create an endpoint for a NFS file system.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateLocationNfs.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCreateLocationNfs", []))

    @jsii.member(jsii_name="toCreateLocationObjectStorage")
    def to_create_location_object_storage(self) -> "Datasync":
        '''(experimental) Grants permission to create an endpoint for a self-managed object storage bucket.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateLocationObjectStorage.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCreateLocationObjectStorage", []))

    @jsii.member(jsii_name="toCreateLocationS3")
    def to_create_location_s3(self) -> "Datasync":
        '''(experimental) Grants permission to create an endpoint for an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateLocationS3.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCreateLocationS3", []))

    @jsii.member(jsii_name="toCreateLocationSmb")
    def to_create_location_smb(self) -> "Datasync":
        '''(experimental) Grants permission to create an endpoint for an SMB file system.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateLocationSmb.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCreateLocationSmb", []))

    @jsii.member(jsii_name="toCreateTask")
    def to_create_task(self) -> "Datasync":
        '''(experimental) Grants permission to create a sync task.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateTask.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toCreateTask", []))

    @jsii.member(jsii_name="toDeleteAgent")
    def to_delete_agent(self) -> "Datasync":
        '''(experimental) Grants permission to delete an agent.

        Access Level: Write

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DeleteAgent.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDeleteAgent", []))

    @jsii.member(jsii_name="toDeleteLocation")
    def to_delete_location(self) -> "Datasync":
        '''(experimental) Grants permission to delete a location used by AWS DataSync.

        Access Level: Write

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DeleteLocation.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDeleteLocation", []))

    @jsii.member(jsii_name="toDeleteTask")
    def to_delete_task(self) -> "Datasync":
        '''(experimental) Grants permission to delete a sync task.

        Access Level: Write

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DeleteTask.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDeleteTask", []))

    @jsii.member(jsii_name="toDescribeAgent")
    def to_describe_agent(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata such as name, network interfaces, and the status (that is, whether the agent is running or not) about a sync agent.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeAgent.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeAgent", []))

    @jsii.member(jsii_name="toDescribeLocationEfs")
    def to_describe_location_efs(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata, such as the path information about an Amazon EFS sync location.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeLocationEfs.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeLocationEfs", []))

    @jsii.member(jsii_name="toDescribeLocationFsxLustre")
    def to_describe_location_fsx_lustre(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata, such as the path information about an Amazon FSx Lustre sync location.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeLocationFsxLustre.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeLocationFsxLustre", []))

    @jsii.member(jsii_name="toDescribeLocationFsxOntap")
    def to_describe_location_fsx_ontap(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata, such as the path information about an Amazon FSx for ONTAP sync location.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeLocationFsxOntap.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeLocationFsxOntap", []))

    @jsii.member(jsii_name="toDescribeLocationFsxOpenZfs")
    def to_describe_location_fsx_open_zfs(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata, such as the path information about an Amazon FSx OpenZFS sync location.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeLocationFsxOpenZfs.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeLocationFsxOpenZfs", []))

    @jsii.member(jsii_name="toDescribeLocationFsxWindows")
    def to_describe_location_fsx_windows(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata, such as the path information about an Amazon FSx Windows sync location.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeLocationFsxWindows.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeLocationFsxWindows", []))

    @jsii.member(jsii_name="toDescribeLocationHdfs")
    def to_describe_location_hdfs(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata, such as the path information about an Amazon HDFS sync location.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeLocationHdfs.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeLocationHdfs", []))

    @jsii.member(jsii_name="toDescribeLocationNfs")
    def to_describe_location_nfs(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata, such as the path information, about a NFS sync location.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeLocationNfs.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeLocationNfs", []))

    @jsii.member(jsii_name="toDescribeLocationObjectStorage")
    def to_describe_location_object_storage(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata about a self-managed object storage server location.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeLocationObjectStorage.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeLocationObjectStorage", []))

    @jsii.member(jsii_name="toDescribeLocationS3")
    def to_describe_location_s3(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata, such as bucket name, about an Amazon S3 bucket sync location.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeLocationS3.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeLocationS3", []))

    @jsii.member(jsii_name="toDescribeLocationSmb")
    def to_describe_location_smb(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata, such as the path information, about an SMB sync location.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeLocationSmb.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeLocationSmb", []))

    @jsii.member(jsii_name="toDescribeTask")
    def to_describe_task(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata about a sync task.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeTask.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeTask", []))

    @jsii.member(jsii_name="toDescribeTaskExecution")
    def to_describe_task_execution(self) -> "Datasync":
        '''(experimental) Grants permission to view metadata about a sync task that is being executed.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_DescribeTaskExecution.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toDescribeTaskExecution", []))

    @jsii.member(jsii_name="toListAgents")
    def to_list_agents(self) -> "Datasync":
        '''(experimental) Grants permission to list agents owned by an AWS account in a region specified in the request.

        Access Level: List

        https://docs.aws.amazon.com/datasync/latest/userguide/API_ListAgents.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toListAgents", []))

    @jsii.member(jsii_name="toListLocations")
    def to_list_locations(self) -> "Datasync":
        '''(experimental) Grants permission to list source and destination sync locations.

        Access Level: List

        https://docs.aws.amazon.com/datasync/latest/userguide/API_ListLocations.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toListLocations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Datasync":
        '''(experimental) Grants permission to list tags that have been added to the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/datasync/latest/userguide/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTaskExecutions")
    def to_list_task_executions(self) -> "Datasync":
        '''(experimental) Grants permission to list executed sync tasks.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_ListTaskExecutions.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toListTaskExecutions", []))

    @jsii.member(jsii_name="toListTasks")
    def to_list_tasks(self) -> "Datasync":
        '''(experimental) Grants permission to list of all the sync tasks.

        Access Level: List

        https://docs.aws.amazon.com/datasync/latest/userguide/API_ListTasks.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toListTasks", []))

    @jsii.member(jsii_name="toStartTaskExecution")
    def to_start_task_execution(self) -> "Datasync":
        '''(experimental) Grants permission to start a specific invocation of a sync task.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_StartTaskExecution.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toStartTaskExecution", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Datasync":
        '''(experimental) Grants permission to apply a key-value pair to an AWS resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Datasync":
        '''(experimental) Grants permission to remove one or more tags from the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAgent")
    def to_update_agent(self) -> "Datasync":
        '''(experimental) Grants permission to update the name of an agent.

        Access Level: Write

        https://docs.aws.amazon.com/datasync/latest/userguide/API_UpdateAgent.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toUpdateAgent", []))

    @jsii.member(jsii_name="toUpdateLocationHdfs")
    def to_update_location_hdfs(self) -> "Datasync":
        '''(experimental) Grants permission to update an HDFS sync Location.

        Access Level: Write

        https://docs.aws.amazon.com/datasync/latest/userguide/API_UpdateLocationHdfs.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toUpdateLocationHdfs", []))

    @jsii.member(jsii_name="toUpdateLocationNfs")
    def to_update_location_nfs(self) -> "Datasync":
        '''(experimental) Grants permission to update an NFS sync Location.

        Access Level: Write

        https://docs.aws.amazon.com/datasync/latest/userguide/API_UpdateLocationNfs.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toUpdateLocationNfs", []))

    @jsii.member(jsii_name="toUpdateLocationObjectStorage")
    def to_update_location_object_storage(self) -> "Datasync":
        '''(experimental) Grants permission to update a self-managed object storage server location.

        Access Level: Write

        https://docs.aws.amazon.com/datasync/latest/userguide/API_UpdateLocationObjectStorage.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toUpdateLocationObjectStorage", []))

    @jsii.member(jsii_name="toUpdateLocationSmb")
    def to_update_location_smb(self) -> "Datasync":
        '''(experimental) Grants permission to update a SMB sync location.

        Access Level: Write

        https://docs.aws.amazon.com/datasync/latest/userguide/API_UpdateLocationSmb.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toUpdateLocationSmb", []))

    @jsii.member(jsii_name="toUpdateTask")
    def to_update_task(self) -> "Datasync":
        '''(experimental) Grants permission to update metadata associated with a sync task.

        Access Level: Write

        https://docs.aws.amazon.com/datasync/latest/userguide/API_UpdateTask.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toUpdateTask", []))

    @jsii.member(jsii_name="toUpdateTaskExecution")
    def to_update_task_execution(self) -> "Datasync":
        '''(experimental) Grants permission to update execution of a sync task.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/datasync/latest/userguide/API_UpdateTaskExecution.html

        :stability: experimental
        '''
        return typing.cast("Datasync", jsii.invoke(self, "toUpdateTaskExecution", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__11edf18e5f39ff8f4f5d713ac1457c9beb476d6ca4838c1e79970ac44aa95286)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6095368760c817dd1fb8a1696e25b3c88a453cb26bbd30efe7fb99c8bdb649d8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Datazone(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Datazone",
):
    '''(experimental) Statement provider for service `datazone <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondatazone.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `datazone <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondatazone.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1ff9f1e271de364f9cc31edf856bc744bb7b95d7a87d0f73eff40d9ae0a128d0)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toGetProject")
    def to_get_project(self) -> "Datazone":
        '''(experimental) Grants permission to retrieve information about an Amazon DataZone project.

        Access Level: Read

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazone", jsii.invoke(self, "toGetProject", []))

    @jsii.member(jsii_name="toGetProjectConfiguration")
    def to_get_project_configuration(self) -> "Datazone":
        '''(experimental) Grants permission to retrieve configuration information for an Amazon DataZone project.

        Access Level: Read

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazone", jsii.invoke(self, "toGetProjectConfiguration", []))

    @jsii.member(jsii_name="toGetProjectCredentials")
    def to_get_project_credentials(self) -> "Datazone":
        '''(experimental) Grants permission to retrieve credentials for an Amazon DataZone project.

        Access Level: Read

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazone", jsii.invoke(self, "toGetProjectCredentials", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Datazone":
        '''(experimental) Grants permission to retrieve all Amazon DataZone projects.

        Access Level: List

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazone", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListUserProjects")
    def to_list_user_projects(self) -> "Datazone":
        '''(experimental) Grants permission to retrieve all Amazon DataZone projects for a user.

        Access Level: List

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazone", jsii.invoke(self, "toListUserProjects", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3130623d19faee1911ba3a032f90124f21c761c385e54846f51b70a887d11b4a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4b62276c8dbd5e60bb56c707a755eb9cdf5e6dab75e7255522dbe9e4fa39723e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Datazonecontrol(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Datazonecontrol",
):
    '''(experimental) Statement provider for service `datazonecontrol <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondatazonecontrol.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `datazonecontrol <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondatazonecontrol.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__386ea3bb66ccfd18e82c0204a0827c06ba8231dd0b9309ed8c22e9911d2eb31a)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDataSource")
    def on_data_source(
        self,
        domain_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Datazonecontrol":
        '''(experimental) Adds a resource of type data-source to the statement.

        https://docs.aws.amazon.com/datazone/latest/userguide/create-glue-data-source.html

        :param domain_id: - Identifier for the domainId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0fcb68009639dca99313bdab6ab7c567832eab6401e253dd1d3933eda446be39)
            check_type(argname="argument domain_id", value=domain_id, expected_type=type_hints["domain_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Datazonecontrol", jsii.invoke(self, "onDataSource", [domain_id, account, region, partition]))

    @jsii.member(jsii_name="onEnvironment")
    def on_environment(
        self,
        domain_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Datazonecontrol":
        '''(experimental) Adds a resource of type environment to the statement.

        https://docs.aws.amazon.com/datazone/latest/userguide/create-root-domain.html

        :param domain_id: - Identifier for the domainId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ee3b1b0b357f10241ddd45db7e1993354180d217eefd661c21453576b9a5df54)
            check_type(argname="argument domain_id", value=domain_id, expected_type=type_hints["domain_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Datazonecontrol", jsii.invoke(self, "onEnvironment", [domain_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateAccountAssociationInvitation")
    def to_create_account_association_invitation(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to request association of an account with a given domain.

        Access Level: Write

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toCreateAccountAssociationInvitation", []))

    @jsii.member(jsii_name="toCreateDataSource")
    def to_create_data_source(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to create Amazon DataZone data sources used for publishing and subscribing to data.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toCreateDataSource", []))

    @jsii.member(jsii_name="toCreateEnvironment")
    def to_create_environment(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to provision a root-domain which is a top level entity that contains other Amazon DataZone resources.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toCreateEnvironment", []))

    @jsii.member(jsii_name="toDeleteDataSource")
    def to_delete_data_source(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to delete a data source.

        Access Level: Write

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toDeleteDataSource", []))

    @jsii.member(jsii_name="toDeleteEnvironment")
    def to_delete_environment(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to delete a provisioned root-domain.

        Access Level: Write

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toDeleteEnvironment", []))

    @jsii.member(jsii_name="toDissociateAccount")
    def to_dissociate_account(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to disassociate an account with a given domain.

        Access Level: Write

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toDissociateAccount", []))

    @jsii.member(jsii_name="toGetAssociatedDomain")
    def to_get_associated_domain(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to retrieve information about any associated domain in the associated account.

        Access Level: Read

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toGetAssociatedDomain", []))

    @jsii.member(jsii_name="toGetDataSourceByEnvironment")
    def to_get_data_source_by_environment(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to retrieve any data source under any domain for a given root-domain.

        Access Level: Read

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toGetDataSourceByEnvironment", []))

    @jsii.member(jsii_name="toGetDomain")
    def to_get_domain(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to retrieve information about any domain in the account.

        Access Level: Read

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toGetDomain", []))

    @jsii.member(jsii_name="toGetEnvironment")
    def to_get_environment(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to retrieve information about a root-domain.

        Access Level: Read

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toGetEnvironment", []))

    @jsii.member(jsii_name="toGetMetadataCollector")
    def to_get_metadata_collector(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to retrieve a publishing job.

        Access Level: Read

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toGetMetadataCollector", []))

    @jsii.member(jsii_name="toGetUserPortalLoginAuthCode")
    def to_get_user_portal_login_auth_code(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to retrieve credentials to log into Amazon DataZone data portal from AWS management console.

        Access Level: Read

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toGetUserPortalLoginAuthCode", []))

    @jsii.member(jsii_name="toListAccountAssociationInvitations")
    def to_list_account_association_invitations(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to retrieve all account-association invitations for a given associated account.

        Access Level: List

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toListAccountAssociationInvitations", []))

    @jsii.member(jsii_name="toListAllAssociatedAccountsForEnvironment")
    def to_list_all_associated_accounts_for_environment(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to list all associated accounts under the given root-domain, including accounts associated to its sub-domains.

        Access Level: List

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toListAllAssociatedAccountsForEnvironment", []))

    @jsii.member(jsii_name="toListAssociatedEnvironments")
    def to_list_associated_environments(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to lists all the associated domains for a given associated account.

        Access Level: List

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toListAssociatedEnvironments", []))

    @jsii.member(jsii_name="toListDataSources")
    def to_list_data_sources(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to retrieve all data sources under any domain in the associated account.

        Access Level: List

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toListDataSources", []))

    @jsii.member(jsii_name="toListDataSourcesByEnvironment")
    def to_list_data_sources_by_environment(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to retrieve all data sources under any domain for a given root-domain.

        Access Level: List

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toListDataSourcesByEnvironment", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to list all the sub-domains for a given domain or a root-domain.

        Access Level: List

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toListEnvironment")
    def to_list_environment(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to retrieve all root-domains.

        Access Level: List

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toListEnvironment", []))

    @jsii.member(jsii_name="toListMetadataCollectorRuns")
    def to_list_metadata_collector_runs(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to list all runs for a given publishing job through Amazon DataZone console for a data source.

        Access Level: List

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toListMetadataCollectorRuns", []))

    @jsii.member(jsii_name="toListMetadataCollectors")
    def to_list_metadata_collectors(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to retrieve all publishing jobs.

        Access Level: List

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toListMetadataCollectors", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to retrieve all Amazon DataZone projects.

        Access Level: List

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to retrieve all tags associated with a resource.

        Access Level: Read

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toReviewAccountAssociationInvitation")
    def to_review_account_association_invitation(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to accept or reject the pending association requests for the given account.

        Access Level: Write

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toReviewAccountAssociationInvitation", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to add or update tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to remove tags associated with a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAccountAssociationDescription")
    def to_update_account_association_description(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to update the description of the account association of the given associated account and given domain.

        Access Level: Write

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toUpdateAccountAssociationDescription", []))

    @jsii.member(jsii_name="toUpdateDataSource")
    def to_update_data_source(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to update a data source.

        Access Level: Write

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toUpdateDataSource", []))

    @jsii.member(jsii_name="toUpdateEnvironment")
    def to_update_environment(self) -> "Datazonecontrol":
        '''(experimental) Grants permission to update information for a root-domain.

        Access Level: Write

        https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html#accessing-datazone

        :stability: experimental
        '''
        return typing.cast("Datazonecontrol", jsii.invoke(self, "toUpdateEnvironment", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2a16ebde54b006e52c0ce437384845876d7ef0f63bf0dd45f3df1dad8667101a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__824e5039c20738e1670352e91459c4c7123f47198c2477a2f07d65d4f42d3065)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Dax(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Dax"):
    '''(experimental) Statement provider for service `dax <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondynamodbacceleratordax.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `dax <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondynamodbacceleratordax.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__88517821d994e32780c13762480fedfd4c681e8ae642b90a349a4b15295a37d1)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifEnclosingOperation")
    def if_enclosing_operation(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dax":
        '''(experimental) Used to block Transactions APIs calls and allow the non-Transaction APIs calls and vice-versa.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAX.access-control.htmlspecifying-conditions.html#FGAC_DDB.ConditionKeys

        Applies to actions:

        - .toDeleteItem()
        - .toGetItem()
        - .toPutItem()
        - .toUpdateItem()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d657d055da3fe3f17dd678215fd9810a7b1f7ed6c15ef4d3287870e7a269b47f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Dax", jsii.invoke(self, "ifEnclosingOperation", [value, operator]))

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        cluster_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dax":
        '''(experimental) Adds a resource of type application to the statement.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAX.access-control.html

        :param cluster_name: - Identifier for the clusterName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2b6062ba873ea2e26bf62f27baf494f2375e690fcc5a9fc7ac82e05b4380e8be)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dax", jsii.invoke(self, "onApplication", [cluster_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchGetItem")
    def to_batch_get_item(self) -> "Dax":
        '''(experimental) Grants permission to return the attributes of one or more items from one or more tables.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_BatchGetItem.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toBatchGetItem", []))

    @jsii.member(jsii_name="toBatchWriteItem")
    def to_batch_write_item(self) -> "Dax":
        '''(experimental) Grants permission to put or delete multiple items in one or more tables.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_BatchWriteItem.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toBatchWriteItem", []))

    @jsii.member(jsii_name="toConditionCheckItem")
    def to_condition_check_item(self) -> "Dax":
        '''(experimental) Grants permission to the ConditionCheckItem operation that checks the existence of a set of attributes for the item with the given primary key.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ConditionCheckItem.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toConditionCheckItem", []))

    @jsii.member(jsii_name="toCreateCluster")
    def to_create_cluster(self) -> "Dax":
        '''(experimental) Grants permission to create a DAX cluster.

        Access Level: Write

        Dependent actions:

        - dax:CreateParameterGroup
        - dax:CreateSubnetGroup
        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs
        - iam:GetRole
        - iam:PassRole

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_CreateCluster.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toCreateCluster", []))

    @jsii.member(jsii_name="toCreateParameterGroup")
    def to_create_parameter_group(self) -> "Dax":
        '''(experimental) Grants permission to create a parameter group.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_CreateParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toCreateParameterGroup", []))

    @jsii.member(jsii_name="toCreateSubnetGroup")
    def to_create_subnet_group(self) -> "Dax":
        '''(experimental) Grants permission to create a subnet group.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_CreateSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toCreateSubnetGroup", []))

    @jsii.member(jsii_name="toDecreaseReplicationFactor")
    def to_decrease_replication_factor(self) -> "Dax":
        '''(experimental) Grants permission to remove one or more nodes from a DAX cluster.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_DecreaseReplicationFactor.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDecreaseReplicationFactor", []))

    @jsii.member(jsii_name="toDeleteCluster")
    def to_delete_cluster(self) -> "Dax":
        '''(experimental) Grants permission to delete a previously provisioned DAX cluster.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_DeleteCluster.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDeleteCluster", []))

    @jsii.member(jsii_name="toDeleteItem")
    def to_delete_item(self) -> "Dax":
        '''(experimental) Grants permission to delete a single item in a table by primary key.

        Access Level: Write

        Possible conditions:

        - .ifEnclosingOperation()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DeleteItem.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDeleteItem", []))

    @jsii.member(jsii_name="toDeleteParameterGroup")
    def to_delete_parameter_group(self) -> "Dax":
        '''(experimental) Grants permission to delete the specified parameter group.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_DeleteParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDeleteParameterGroup", []))

    @jsii.member(jsii_name="toDeleteSubnetGroup")
    def to_delete_subnet_group(self) -> "Dax":
        '''(experimental) Grants permission to delete a subnet group.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_DeleteSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDeleteSubnetGroup", []))

    @jsii.member(jsii_name="toDescribeClusters")
    def to_describe_clusters(self) -> "Dax":
        '''(experimental) Grants permission to return information about all provisioned DAX clusters.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_DescribeClusters.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDescribeClusters", []))

    @jsii.member(jsii_name="toDescribeDefaultParameters")
    def to_describe_default_parameters(self) -> "Dax":
        '''(experimental) Grants permission to return the default system parameter information for DAX.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_DescribeDefaultParameters.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDescribeDefaultParameters", []))

    @jsii.member(jsii_name="toDescribeEvents")
    def to_describe_events(self) -> "Dax":
        '''(experimental) Grants permission to return events related to DAX clusters and parameter groups.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_DescribeEvents.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDescribeEvents", []))

    @jsii.member(jsii_name="toDescribeParameterGroups")
    def to_describe_parameter_groups(self) -> "Dax":
        '''(experimental) Grants permission to return a list of parameter group descriptions.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_DescribeParameterGroups.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDescribeParameterGroups", []))

    @jsii.member(jsii_name="toDescribeParameters")
    def to_describe_parameters(self) -> "Dax":
        '''(experimental) Grants permission to return the detailed parameter list for a particular parameter group.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_DescribeParameters.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDescribeParameters", []))

    @jsii.member(jsii_name="toDescribeSubnetGroups")
    def to_describe_subnet_groups(self) -> "Dax":
        '''(experimental) Grants permission to return a list of subnet group descriptions.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_DescribeSubnetGroups.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toDescribeSubnetGroups", []))

    @jsii.member(jsii_name="toGetItem")
    def to_get_item(self) -> "Dax":
        '''(experimental) Grants permission to the GetItem operation that returns a set of attributes for the item with the given primary key.

        Access Level: Read

        Possible conditions:

        - .ifEnclosingOperation()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_GetItem.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toGetItem", []))

    @jsii.member(jsii_name="toIncreaseReplicationFactor")
    def to_increase_replication_factor(self) -> "Dax":
        '''(experimental) Grants permission to add one or more nodes to a DAX cluster.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_IncreaseReplicationFactor.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toIncreaseReplicationFactor", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Dax":
        '''(experimental) Grants permission to return a list all of the tags for a DAX cluster.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_ListTags.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toPutItem")
    def to_put_item(self) -> "Dax":
        '''(experimental) Grants permission to create a new item, or replace an old item with a new item.

        Access Level: Write

        Possible conditions:

        - .ifEnclosingOperation()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_PutItem.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toPutItem", []))

    @jsii.member(jsii_name="toQuery")
    def to_query(self) -> "Dax":
        '''(experimental) Grants permission to use the primary key of a table or a secondary index to directly access items from that table or index.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Query.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toQuery", []))

    @jsii.member(jsii_name="toRebootNode")
    def to_reboot_node(self) -> "Dax":
        '''(experimental) Grants permission to reboot a single node of a DAX cluster.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_RebootNode.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toRebootNode", []))

    @jsii.member(jsii_name="toScan")
    def to_scan(self) -> "Dax":
        '''(experimental) Grants permission to return one or more items and item attributes by accessing every item in a table or a secondary index.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Scan.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toScan", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Dax":
        '''(experimental) Grants permission to associate a set of tags with a DAX resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Dax":
        '''(experimental) Grants permission to remove the association of tags from a DAX resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateCluster")
    def to_update_cluster(self) -> "Dax":
        '''(experimental) Grants permission to modify the settings for a DAX cluster.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_UpdateCluster.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toUpdateCluster", []))

    @jsii.member(jsii_name="toUpdateItem")
    def to_update_item(self) -> "Dax":
        '''(experimental) Grants permission to edit an existing item's attributes, or adds a new item to the table if it does not already exist.

        Access Level: Write

        Possible conditions:

        - .ifEnclosingOperation()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateItem.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toUpdateItem", []))

    @jsii.member(jsii_name="toUpdateParameterGroup")
    def to_update_parameter_group(self) -> "Dax":
        '''(experimental) Grants permission to modify the parameters of a parameter group.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_UpdateParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toUpdateParameterGroup", []))

    @jsii.member(jsii_name="toUpdateSubnetGroup")
    def to_update_subnet_group(self) -> "Dax":
        '''(experimental) Grants permission to modify an existing subnet group.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_dax_UpdateSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Dax", jsii.invoke(self, "toUpdateSubnetGroup", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__82a4aa6e9d67642fa731f8a8dd072f9d45c40afa8ecaeeac1ae1aa67f0a6f6b9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__85767ab6614a3397f6914b064796e1e2faec57a01cfcd27bc652239a4e9fdcc0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Dbqms(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Dbqms"):
    '''(experimental) Statement provider for service `dbqms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_databasequerymetadataservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `dbqms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_databasequerymetadataservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__26892e3b3e602220509e37150e98faa74ffc05b4d76ba4aa83f9a06770c303f9)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toCreateFavoriteQuery")
    def to_create_favorite_query(self) -> "Dbqms":
        '''(experimental) Grants permission to create a new favorite query.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#CreateFavoriteQuery

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toCreateFavoriteQuery", []))

    @jsii.member(jsii_name="toCreateQueryHistory")
    def to_create_query_history(self) -> "Dbqms":
        '''(experimental) Grants permission to add a query to the history.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toCreateQueryHistory", []))

    @jsii.member(jsii_name="toCreateTab")
    def to_create_tab(self) -> "Dbqms":
        '''(experimental) Grants permission to create a new query tab.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#CreateTab

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toCreateTab", []))

    @jsii.member(jsii_name="toDeleteFavoriteQueries")
    def to_delete_favorite_queries(self) -> "Dbqms":
        '''(experimental) Grants permission to delete saved queries.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#DeleteFavoriteQueries

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toDeleteFavoriteQueries", []))

    @jsii.member(jsii_name="toDeleteQueryHistory")
    def to_delete_query_history(self) -> "Dbqms":
        '''(experimental) Grants permission to delete a historical query.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#DeleteQueryHistory

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toDeleteQueryHistory", []))

    @jsii.member(jsii_name="toDeleteTab")
    def to_delete_tab(self) -> "Dbqms":
        '''(experimental) Grants permission to delete query tab.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#DeleteTab

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toDeleteTab", []))

    @jsii.member(jsii_name="toDescribeFavoriteQueries")
    def to_describe_favorite_queries(self) -> "Dbqms":
        '''(experimental) Grants permission to list saved queries and associated metadata.

        Access Level: List

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#DescribeFavoriteQueries

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toDescribeFavoriteQueries", []))

    @jsii.member(jsii_name="toDescribeQueryHistory")
    def to_describe_query_history(self) -> "Dbqms":
        '''(experimental) Grants permission to list history of queries that were run.

        Access Level: List

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#DescribeQueryHistory

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toDescribeQueryHistory", []))

    @jsii.member(jsii_name="toDescribeTabs")
    def to_describe_tabs(self) -> "Dbqms":
        '''(experimental) Grants permission to list query tabs and associated metadata.

        Access Level: List

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#DescribeTabs

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toDescribeTabs", []))

    @jsii.member(jsii_name="toGetQueryString")
    def to_get_query_string(self) -> "Dbqms":
        '''(experimental) Grants permission to retrieve favorite or history query string by id.

        Access Level: Read

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#GetQueryString

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toGetQueryString", []))

    @jsii.member(jsii_name="toUpdateFavoriteQuery")
    def to_update_favorite_query(self) -> "Dbqms":
        '''(experimental) Grants permission to update saved query and description.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#UpdateFavoriteQuery

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toUpdateFavoriteQuery", []))

    @jsii.member(jsii_name="toUpdateQueryHistory")
    def to_update_query_history(self) -> "Dbqms":
        '''(experimental) Grants permission to update the query history.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#UpdateQueryHistory

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toUpdateQueryHistory", []))

    @jsii.member(jsii_name="toUpdateTab")
    def to_update_tab(self) -> "Dbqms":
        '''(experimental) Grants permission to update query tab.

        Access Level: Write

        https://docs.aws.amazon.com/qldb/latest/developerguide/dbqms-api.html#UpdateTab

        :stability: experimental
        '''
        return typing.cast("Dbqms", jsii.invoke(self, "toUpdateTab", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__caf0a7456cc2cb5be7d8c3e69df4fc3ef672d580d28428506810642de047b566)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bd50339a74aaa105449d14784e53fae676d5e55e26b2df1adbbf57ef076d5d86)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Deepcomposer(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Deepcomposer",
):
    '''(experimental) Statement provider for service `deepcomposer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdeepcomposer.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `deepcomposer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdeepcomposer.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ecaee960f9babc8037d8f5ef0f4b2a34000f99d46bf9b2917bd38034732d4abc)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAudio")
    def on_audio(
        self,
        audio_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deepcomposer":
        '''(experimental) Adds a resource of type audio to the statement.

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/get-started-learn-from-pre-trained-models.html

        :param audio_id: - Identifier for the audioId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9f67b532ec9b05aeb462617a043d94016236564973e752dcadc2c909f266ea31)
            check_type(argname="argument audio_id", value=audio_id, expected_type=type_hints["audio_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Deepcomposer", jsii.invoke(self, "onAudio", [audio_id, account, region, partition]))

    @jsii.member(jsii_name="onComposition")
    def on_composition(
        self,
        composition_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deepcomposer":
        '''(experimental) Adds a resource of type composition to the statement.

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/get-started-learn-from-pre-trained-models.html

        :param composition_id: - Identifier for the compositionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__95d5cdec72aac4ad7d69ae2368ffb29e1f0e876b80006993c0264367b7804c68)
            check_type(argname="argument composition_id", value=composition_id, expected_type=type_hints["composition_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Deepcomposer", jsii.invoke(self, "onComposition", [composition_id, account, region, partition]))

    @jsii.member(jsii_name="onModel")
    def on_model(
        self,
        model_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deepcomposer":
        '''(experimental) Adds a resource of type model to the statement.

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/get-started-custom-model.html

        :param model_id: - Identifier for the modelId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7bbb50fef880d9eb58ab57036633f7a6158775eced74f1de3a80c58cb87f4fa4)
            check_type(argname="argument model_id", value=model_id, expected_type=type_hints["model_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Deepcomposer", jsii.invoke(self, "onModel", [model_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateCoupon")
    def to_associate_coupon(self) -> "Deepcomposer":
        '''(experimental) Grants permission to associate a DeepComposer coupon (or DSN) with the account associated with the sender of the request.

        Access Level: Write

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/what-it-is-keyboard.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toAssociateCoupon", []))

    @jsii.member(jsii_name="toCreateAudio")
    def to_create_audio(self) -> "Deepcomposer":
        '''(experimental) Grants permission to create an audio file by converting the midi composition into a wav or mp3 file.

        Access Level: Write

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/get-started-learn-from-pre-trained-models.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toCreateAudio", []))

    @jsii.member(jsii_name="toCreateComposition")
    def to_create_composition(self) -> "Deepcomposer":
        '''(experimental) Grants permission to create a multi-track midi composition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/get-started-learn-from-pre-trained-models.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toCreateComposition", []))

    @jsii.member(jsii_name="toCreateModel")
    def to_create_model(self) -> "Deepcomposer":
        '''(experimental) Grants permission to start creating/training a generative-model that is able to perform inference against the user-provided piano-melody to create a multi-track midi composition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/get-started-custom-model.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toCreateModel", []))

    @jsii.member(jsii_name="toDeleteComposition")
    def to_delete_composition(self) -> "Deepcomposer":
        '''(experimental) Grants permission to delete the composition.

        Access Level: Write

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/get-started-learn-from-pre-trained-models.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toDeleteComposition", []))

    @jsii.member(jsii_name="toDeleteModel")
    def to_delete_model(self) -> "Deepcomposer":
        '''(experimental) Grants permission to delete the model.

        Access Level: Write

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/get-started-custom-model.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toDeleteModel", []))

    @jsii.member(jsii_name="toGetComposition")
    def to_get_composition(self) -> "Deepcomposer":
        '''(experimental) Grants permission to get information about the composition.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/get-started-learn-from-pre-trained-models.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toGetComposition", []))

    @jsii.member(jsii_name="toGetModel")
    def to_get_model(self) -> "Deepcomposer":
        '''(experimental) Grants permission to get information about the model.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/get-started-custom-model.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toGetModel", []))

    @jsii.member(jsii_name="toGetSampleModel")
    def to_get_sample_model(self) -> "Deepcomposer":
        '''(experimental) Grants permission to get information about the sample/pre-trained DeepComposer model.

        Access Level: Read

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/get-started-learn-from-pre-trained-models.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toGetSampleModel", []))

    @jsii.member(jsii_name="toListCompositions")
    def to_list_compositions(self) -> "Deepcomposer":
        '''(experimental) Grants permission to list all the compositions owned by the sender of the request.

        Access Level: List

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/get-started-learn-from-pre-trained-models.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toListCompositions", []))

    @jsii.member(jsii_name="toListModels")
    def to_list_models(self) -> "Deepcomposer":
        '''(experimental) Grants permission to list all the models owned by the sender of the request.

        Access Level: List

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/get-started-custom-model.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toListModels", []))

    @jsii.member(jsii_name="toListSampleModels")
    def to_list_sample_models(self) -> "Deepcomposer":
        '''(experimental) Grants permission to list all the sample/pre-trained models provided by the DeepComposer service.

        Access Level: List

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/get-started-learn-from-pre-trained-models.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toListSampleModels", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Deepcomposer":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/deepcomposer-tagging.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTrainingTopics")
    def to_list_training_topics(self) -> "Deepcomposer":
        '''(experimental) Grants permission to list all the training options or topic for creating/training a model.

        Access Level: List

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/get-started-custom-model.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toListTrainingTopics", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Deepcomposer":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/deepcomposer-tagging.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Deepcomposer":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/deepcomposer-tagging.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateComposition")
    def to_update_composition(self) -> "Deepcomposer":
        '''(experimental) Grants permission to modify the mutable properties associated with a composition.

        Access Level: Write

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/get-started-learn-from-pre-trained-models.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toUpdateComposition", []))

    @jsii.member(jsii_name="toUpdateModel")
    def to_update_model(self) -> "Deepcomposer":
        '''(experimental) Grants permission to to modify the mutable properties associated with a model.

        Access Level: Write

        https://docs.aws.amazon.com/deepcomposer/latest/devguide/get-started-custom-model.html

        :stability: experimental
        '''
        return typing.cast("Deepcomposer", jsii.invoke(self, "toUpdateModel", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e8d28db5de077fb6fa3255b2988ed4f4063e296aa4e2149fe02107668725eb52)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8c4d63a4f26d0173c0064ab9fff21cc2524dbdcfdc2fff5d6e70b3de0039ba51)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Deeplens(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Deeplens",
):
    '''(experimental) Statement provider for service `deeplens <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdeeplens.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `deeplens <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdeeplens.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1c09c4c3f7fc91dea078ce3d1e071925e70b02dce28629924fbf22759a91dd97)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDevice")
    def on_device(
        self,
        device_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deeplens":
        '''(experimental) Adds a resource of type device to the statement.

        :param device_name: - Identifier for the deviceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d084707981d07cf03ff3e1317037260760013a68ea1b3e84b2f99aa414954cec)
            check_type(argname="argument device_name", value=device_name, expected_type=type_hints["device_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Deeplens", jsii.invoke(self, "onDevice", [device_name, account, region, partition]))

    @jsii.member(jsii_name="onModel")
    def on_model(
        self,
        model_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deeplens":
        '''(experimental) Adds a resource of type model to the statement.

        :param model_name: - Identifier for the modelName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__990bc94f8acfdc8a1e677c12b7351cee0fb940b8c4a01323d1e017fc232b11be)
            check_type(argname="argument model_name", value=model_name, expected_type=type_hints["model_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Deeplens", jsii.invoke(self, "onModel", [model_name, account, region, partition]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deeplens":
        '''(experimental) Adds a resource of type project to the statement.

        :param project_name: - Identifier for the projectName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7fa151bf7ec4d2cc0957bb7d2b3ce652185a63a6f1662fa6cc23409cbab4afd9)
            check_type(argname="argument project_name", value=project_name, expected_type=type_hints["project_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Deeplens", jsii.invoke(self, "onProject", [project_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateServiceRoleToAccount")
    def to_associate_service_role_to_account(self) -> "Deeplens":
        '''(experimental) Associates the user's account with IAM roles controlling various permissions needed by AWS DeepLens for proper functionality.

        Access Level: Permissions management

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toAssociateServiceRoleToAccount", []))

    @jsii.member(jsii_name="toBatchGetDevice")
    def to_batch_get_device(self) -> "Deeplens":
        '''(experimental) Retrieves a list of AWS DeepLens devices.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toBatchGetDevice", []))

    @jsii.member(jsii_name="toBatchGetModel")
    def to_batch_get_model(self) -> "Deeplens":
        '''(experimental) Retrieves a list of AWS DeepLens Models.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toBatchGetModel", []))

    @jsii.member(jsii_name="toBatchGetProject")
    def to_batch_get_project(self) -> "Deeplens":
        '''(experimental) Retrieves a list of AWS DeepLens Projects.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toBatchGetProject", []))

    @jsii.member(jsii_name="toCreateDeviceCertificates")
    def to_create_device_certificates(self) -> "Deeplens":
        '''(experimental) Creates a certificate package that is used to successfully authenticate and Register an AWS DeepLens device.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toCreateDeviceCertificates", []))

    @jsii.member(jsii_name="toCreateModel")
    def to_create_model(self) -> "Deeplens":
        '''(experimental) Creates a new AWS DeepLens Model.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toCreateModel", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Deeplens":
        '''(experimental) Creates a new AWS DeepLens Project.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toDeleteModel")
    def to_delete_model(self) -> "Deeplens":
        '''(experimental) Deletes an AWS DeepLens Model.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toDeleteModel", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Deeplens":
        '''(experimental) Deletes an AWS DeepLens Project.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDeployProject")
    def to_deploy_project(self) -> "Deeplens":
        '''(experimental) Deploys an AWS DeepLens project to a registered AWS DeepLens device.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toDeployProject", []))

    @jsii.member(jsii_name="toDeregisterDevice")
    def to_deregister_device(self) -> "Deeplens":
        '''(experimental) Begins a device de-registration workflow for a registered AWS DeepLens device.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toDeregisterDevice", []))

    @jsii.member(jsii_name="toGetAssociatedResources")
    def to_get_associated_resources(self) -> "Deeplens":
        '''(experimental) Retrieves the account level resources associated with the user's account.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toGetAssociatedResources", []))

    @jsii.member(jsii_name="toGetDeploymentStatus")
    def to_get_deployment_status(self) -> "Deeplens":
        '''(experimental) Retrieves the the deployment status of a particular AWS DeepLens device, along with any associated metadata.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toGetDeploymentStatus", []))

    @jsii.member(jsii_name="toGetDevice")
    def to_get_device(self) -> "Deeplens":
        '''(experimental) Retrieves information about an AWS DeepLens device.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toGetDevice", []))

    @jsii.member(jsii_name="toGetModel")
    def to_get_model(self) -> "Deeplens":
        '''(experimental) Retrieves an AWS DeepLens Model.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toGetModel", []))

    @jsii.member(jsii_name="toGetProject")
    def to_get_project(self) -> "Deeplens":
        '''(experimental) Retrieves an AWS DeepLens Project.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toGetProject", []))

    @jsii.member(jsii_name="toImportProjectFromTemplate")
    def to_import_project_from_template(self) -> "Deeplens":
        '''(experimental) Creates a new AWS DeepLens project from a sample project template.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toImportProjectFromTemplate", []))

    @jsii.member(jsii_name="toListDeployments")
    def to_list_deployments(self) -> "Deeplens":
        '''(experimental) Retrieves a list of AWS DeepLens Deployment identifiers.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toListDeployments", []))

    @jsii.member(jsii_name="toListDevices")
    def to_list_devices(self) -> "Deeplens":
        '''(experimental) Retrieves a list of AWS DeepLens device identifiers.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toListDevices", []))

    @jsii.member(jsii_name="toListModels")
    def to_list_models(self) -> "Deeplens":
        '''(experimental) Retrieves a list of AWS DeepLens Model identifiers.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toListModels", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Deeplens":
        '''(experimental) Retrieves a list of AWS DeepLens Project identifiers.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toRegisterDevice")
    def to_register_device(self) -> "Deeplens":
        '''(experimental) Begins a device registration workflow for an AWS DeepLens device.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toRegisterDevice", []))

    @jsii.member(jsii_name="toRemoveProject")
    def to_remove_project(self) -> "Deeplens":
        '''(experimental) Removes a deployed AWS DeepLens project from an AWS DeepLens device.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toRemoveProject", []))

    @jsii.member(jsii_name="toUpdateProject")
    def to_update_project(self) -> "Deeplens":
        '''(experimental) Updates an existing AWS DeepLens Project.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Deeplens", jsii.invoke(self, "toUpdateProject", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6a9eba68b311c5d440ce91b82141dd2d629beebd4cd761fd7878686f2ec3ba22)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__005f124ec50841da0b92fd250d3b10085856ed4e70c358fece2a733ddd514f5a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Deepracer(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Deepracer",
):
    '''(experimental) Statement provider for service `deepracer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdeepracer.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `deepracer <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdeepracer.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__78e55aeb0c9c280d65f66e2b75a9b302f7de722c46dc58bcc514c7673623f6dc)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifMultiUser")
    def if_multi_user(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Deepracer":
        '''(experimental) Filters access by multiuser flag.

        https://docs.aws.amazon.com/deepracer/latest/developerguide/reference_policies_iam-condition-keys.html#condition-keys-multiuser

        Applies to actions:

        - .toAddLeaderboardAccessPermission()
        - .toCloneReinforcementLearningModel()
        - .toCreateCar()
        - .toCreateLeaderboard()
        - .toCreateLeaderboardAccessToken()
        - .toCreateLeaderboardSubmission()
        - .toCreateReinforcementLearningModel()
        - .toDeleteLeaderboard()
        - .toDeleteModel()
        - .toEditLeaderboard()
        - .toGetAccountConfig()
        - .toGetAlias()
        - .toGetAssetUrl()
        - .toGetCar()
        - .toGetCars()
        - .toGetEvaluation()
        - .toGetLatestUserSubmission()
        - .toGetLeaderboard()
        - .toGetModel()
        - .toGetPrivateLeaderboard()
        - .toGetRankedUserSubmission()
        - .toGetTrainingJob()
        - .toImportModel()
        - .toListEvaluations()
        - .toListLeaderboardSubmissions()
        - .toListLeaderboards()
        - .toListModels()
        - .toListPrivateLeaderboardParticipants()
        - .toListPrivateLeaderboards()
        - .toListSubscribedPrivateLeaderboards()
        - .toListTagsForResource()
        - .toListTrainingJobs()
        - .toPerformLeaderboardOperation()
        - .toRemoveLeaderboardAccessPermission()
        - .toSetAlias()
        - .toStartEvaluation()
        - .toStopEvaluation()
        - .toStopTrainingReinforcementLearningModel()
        - .toTagResource()
        - .toUntagResource()
        - .toUpdateCar()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e49ca20bd32e15a3be9b507d4e5f4b89b9637195636913175b12321f595d633c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Deepracer", jsii.invoke(self, "ifMultiUser", [value]))

    @jsii.member(jsii_name="ifUserToken")
    def if_user_token(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Deepracer":
        '''(experimental) Filters access by user token in the request.

        https://docs.aws.amazon.com/deepracer/latest/developerguide/reference_policies_iam-condition-keys.html#condition-keys-usertoken

        Applies to actions:

        - .toAddLeaderboardAccessPermission()
        - .toCloneReinforcementLearningModel()
        - .toCreateCar()
        - .toCreateLeaderboard()
        - .toCreateLeaderboardAccessToken()
        - .toCreateLeaderboardSubmission()
        - .toCreateReinforcementLearningModel()
        - .toDeleteLeaderboard()
        - .toDeleteModel()
        - .toEditLeaderboard()
        - .toGetAccountConfig()
        - .toGetAlias()
        - .toGetAssetUrl()
        - .toGetCar()
        - .toGetCars()
        - .toGetEvaluation()
        - .toGetLatestUserSubmission()
        - .toGetLeaderboard()
        - .toGetModel()
        - .toGetPrivateLeaderboard()
        - .toGetRankedUserSubmission()
        - .toGetTrainingJob()
        - .toImportModel()
        - .toListEvaluations()
        - .toListLeaderboardSubmissions()
        - .toListLeaderboards()
        - .toListModels()
        - .toListPrivateLeaderboardParticipants()
        - .toListPrivateLeaderboards()
        - .toListSubscribedPrivateLeaderboards()
        - .toListTagsForResource()
        - .toListTrainingJobs()
        - .toPerformLeaderboardOperation()
        - .toRemoveLeaderboardAccessPermission()
        - .toSetAlias()
        - .toStartEvaluation()
        - .toStopEvaluation()
        - .toStopTrainingReinforcementLearningModel()
        - .toTagResource()
        - .toUntagResource()
        - .toUpdateCar()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__000a975ad9f883fd1168e4eeb91c25c2c55979cfa9555a24bcaaa39a4acc2c14)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Deepracer", jsii.invoke(self, "ifUserToken", [value, operator]))

    @jsii.member(jsii_name="onCar")
    def on_car(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deepracer":
        '''(experimental) Adds a resource of type car to the statement.

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-choose-race-type.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1ad656e390ebadb4893f7da3233e9a6dfe389e34f1c8c520d6d726b0530e907c)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Deepracer", jsii.invoke(self, "onCar", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onEvaluationJob")
    def on_evaluation_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deepracer":
        '''(experimental) Adds a resource of type evaluation_job to the statement.

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-test-in-simulator.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__99388e7c0b2f2bf060cb8a1a31c72829a0c6a31113daa9d6cfceb66e92ea73e0)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Deepracer", jsii.invoke(self, "onEvaluationJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onLeaderboard")
    def on_leaderboard(
        self,
        resource_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deepracer":
        '''(experimental) Adds a resource of type leaderboard to the statement.

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-submit-model-to-leaderboard.html

        :param resource_id: - Identifier for the resourceId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a0e8500485a68af0f8f8944fc15b24ab4526ec61ae308dc7d71d919d2b4160c8)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Deepracer", jsii.invoke(self, "onLeaderboard", [resource_id, region, partition]))

    @jsii.member(jsii_name="onLeaderboardEvaluationJob")
    def on_leaderboard_evaluation_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deepracer":
        '''(experimental) Adds a resource of type leaderboard_evaluation_job to the statement.

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-submit-model-to-leaderboard.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4bb06a078d669de65bfe727f86a88e4f753ed09c9a4aacacfd6591469bc003b7)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Deepracer", jsii.invoke(self, "onLeaderboardEvaluationJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onReinforcementLearningModel")
    def on_reinforcement_learning_model(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deepracer":
        '''(experimental) Adds a resource of type reinforcement_learning_model to the statement.

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c95fd9849db3df2ce12d3f701c77c48ac92ac1aa250b3101feadcc89132fc993)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Deepracer", jsii.invoke(self, "onReinforcementLearningModel", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onTrack")
    def on_track(
        self,
        resource_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deepracer":
        '''(experimental) Adds a resource of type track to the statement.

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-console-train-evaluate-models.html

        :param resource_id: - Identifier for the resourceId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__24e94cb43c2bf6fe5b6ba640b7f9cca28a67181a5f6082271cab2ffb7d367cf4)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Deepracer", jsii.invoke(self, "onTrack", [resource_id, region, partition]))

    @jsii.member(jsii_name="onTrainingJob")
    def on_training_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Deepracer":
        '''(experimental) Adds a resource of type training_job to the statement.

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6e623603e6850967f21ded139d19a5caee6adff8505e11bb0620eba9e885fc1c)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Deepracer", jsii.invoke(self, "onTrainingJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toAddLeaderboardAccessPermission")
    def to_add_leaderboard_access_permission(self) -> "Deepracer":
        '''(experimental) Grants permission to add access for a private leaderboard.

        Access Level: Write

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-manage-community-races.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toAddLeaderboardAccessPermission", []))

    @jsii.member(jsii_name="toAdminGetAccountConfig")
    def to_admin_get_account_config(self) -> "Deepracer":
        '''(experimental) Grants permission to get current admin multiuser configuration for this account.

        Access Level: Read

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-admin-set-account-config.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toAdminGetAccountConfig", []))

    @jsii.member(jsii_name="toAdminListAssociatedResources")
    def to_admin_list_associated_resources(self) -> "Deepracer":
        '''(experimental) Grants permission to list all deepracer users with their associated resources created under this account.

        Access Level: Read

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-admin-list-associated-resources.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toAdminListAssociatedResources", []))

    @jsii.member(jsii_name="toAdminListAssociatedUsers")
    def to_admin_list_associated_users(self) -> "Deepracer":
        '''(experimental) Grants permission to list user data for all users associated with this account.

        Access Level: Read

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-admin-list-associated-users.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toAdminListAssociatedUsers", []))

    @jsii.member(jsii_name="toAdminManageUser")
    def to_admin_manage_user(self) -> "Deepracer":
        '''(experimental) Grants permission to manage a user associated with this account.

        Access Level: Write

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-admin-manage-user.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toAdminManageUser", []))

    @jsii.member(jsii_name="toAdminSetAccountConfig")
    def to_admin_set_account_config(self) -> "Deepracer":
        '''(experimental) Grants permission to set configuration options for this account.

        Access Level: Write

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-admin-set-account-config.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toAdminSetAccountConfig", []))

    @jsii.member(jsii_name="toCloneReinforcementLearningModel")
    def to_clone_reinforcement_learning_model(self) -> "Deepracer":
        '''(experimental) Grants permission to clone an existing DeepRacer model.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-console-train-evaluate-models.html#deepracer-clone-trained-model

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toCloneReinforcementLearningModel", []))

    @jsii.member(jsii_name="toCreateCar")
    def to_create_car(self) -> "Deepracer":
        '''(experimental) Grants permission to create a DeepRacer car in your garage.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-choose-race-type.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toCreateCar", []))

    @jsii.member(jsii_name="toCreateLeaderboard")
    def to_create_leaderboard(self) -> "Deepracer":
        '''(experimental) Grants permission to create a leaderboard.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-create-community-race.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toCreateLeaderboard", []))

    @jsii.member(jsii_name="toCreateLeaderboardAccessToken")
    def to_create_leaderboard_access_token(self) -> "Deepracer":
        '''(experimental) Grants permission to create an access token for a private leaderboard.

        Access Level: Write

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-manage-community-races.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toCreateLeaderboardAccessToken", []))

    @jsii.member(jsii_name="toCreateLeaderboardSubmission")
    def to_create_leaderboard_submission(self) -> "Deepracer":
        '''(experimental) Grants permission to submit a DeepRacer model to be evaluated for leaderboards.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-submit-model-to-leaderboard.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toCreateLeaderboardSubmission", []))

    @jsii.member(jsii_name="toCreateReinforcementLearningModel")
    def to_create_reinforcement_learning_model(self) -> "Deepracer":
        '''(experimental) Grants permission to create ra einforcement learning model for DeepRacer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toCreateReinforcementLearningModel", []))

    @jsii.member(jsii_name="toDeleteLeaderboard")
    def to_delete_leaderboard(self) -> "Deepracer":
        '''(experimental) Grants permission to delete a leaderboard.

        Access Level: Write

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-manage-community-races.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toDeleteLeaderboard", []))

    @jsii.member(jsii_name="toDeleteModel")
    def to_delete_model(self) -> "Deepracer":
        '''(experimental) Grants permission to delete a DeepRacer model.

        Access Level: Write

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toDeleteModel", []))

    @jsii.member(jsii_name="toEditLeaderboard")
    def to_edit_leaderboard(self) -> "Deepracer":
        '''(experimental) Grants permission to edit a leaderboard.

        Access Level: Write

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-manage-community-races.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toEditLeaderboard", []))

    @jsii.member(jsii_name="toGetAccountConfig")
    def to_get_account_config(self) -> "Deepracer":
        '''(experimental) Grants permission to get current multiuser configuration for this account.

        Access Level: Read

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-admin-set-account-config.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetAccountConfig", []))

    @jsii.member(jsii_name="toGetAlias")
    def to_get_alias(self) -> "Deepracer":
        '''(experimental) Grants permission to retrieve the user's alias for submitting a DeepRacer model to leaderboards.

        Access Level: Read

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-submit-model-to-leaderboard.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetAlias", []))

    @jsii.member(jsii_name="toGetAssetUrl")
    def to_get_asset_url(self) -> "Deepracer":
        '''(experimental) Grants permission to download artifacts for an existing DeepRacer model.

        Access Level: Read

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-console-train-evaluate-models.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetAssetUrl", []))

    @jsii.member(jsii_name="toGetCar")
    def to_get_car(self) -> "Deepracer":
        '''(experimental) Grants permission to retrieve a specific DeepRacer car from your garage.

        Access Level: Read

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-choose-race-type.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetCar", []))

    @jsii.member(jsii_name="toGetCars")
    def to_get_cars(self) -> "Deepracer":
        '''(experimental) Grants permission to view all the DeepRacer cars in your garage.

        Access Level: Read

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-choose-race-type.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetCars", []))

    @jsii.member(jsii_name="toGetEvaluation")
    def to_get_evaluation(self) -> "Deepracer":
        '''(experimental) Grants permission to retrieve information about an existing DeepRacer model's evaluation jobs.

        Access Level: Read

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-test-in-simulator.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetEvaluation", []))

    @jsii.member(jsii_name="toGetLatestUserSubmission")
    def to_get_latest_user_submission(self) -> "Deepracer":
        '''(experimental) Grants permission to retrieve information about how the latest submitted DeepRacer model for a user performed on a leaderboard.

        Access Level: Read

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-submit-model-to-leaderboard.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetLatestUserSubmission", []))

    @jsii.member(jsii_name="toGetLeaderboard")
    def to_get_leaderboard(self) -> "Deepracer":
        '''(experimental) Grants permission to retrieve information about leaderboards.

        Access Level: Read

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-submit-model-to-leaderboard.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetLeaderboard", []))

    @jsii.member(jsii_name="toGetModel")
    def to_get_model(self) -> "Deepracer":
        '''(experimental) Grants permission to retrieve information about an existing DeepRacer model.

        Access Level: Read

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetModel", []))

    @jsii.member(jsii_name="toGetPrivateLeaderboard")
    def to_get_private_leaderboard(self) -> "Deepracer":
        '''(experimental) Grants permission to retrieve information about private leaderboards.

        Access Level: Read

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-join-community-race.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetPrivateLeaderboard", []))

    @jsii.member(jsii_name="toGetRankedUserSubmission")
    def to_get_ranked_user_submission(self) -> "Deepracer":
        '''(experimental) Grants permission to retrieve information about the performance of a user's DeepRacer model that got placed on a leaderboard.

        Access Level: Read

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-submit-model-to-leaderboard.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetRankedUserSubmission", []))

    @jsii.member(jsii_name="toGetTrack")
    def to_get_track(self) -> "Deepracer":
        '''(experimental) Grants permission to retrieve information about DeepRacer tracks.

        Access Level: Read

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-console-train-evaluate-models.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetTrack", []))

    @jsii.member(jsii_name="toGetTrainingJob")
    def to_get_training_job(self) -> "Deepracer":
        '''(experimental) Grants permission to retrieve information about an existing DeepRacer model's training job.

        Access Level: Read

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toGetTrainingJob", []))

    @jsii.member(jsii_name="toImportModel")
    def to_import_model(self) -> "Deepracer":
        '''(experimental) Grants permission to import a reinforcement learning model for DeepRacer.

        Access Level: Write

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-troubleshooting-service-migration-errors.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toImportModel", []))

    @jsii.member(jsii_name="toListEvaluations")
    def to_list_evaluations(self) -> "Deepracer":
        '''(experimental) Grants permission to list a DeepRacer model's evaluation jobs.

        Access Level: Read

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-test-in-simulator.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toListEvaluations", []))

    @jsii.member(jsii_name="toListLeaderboards")
    def to_list_leaderboards(self) -> "Deepracer":
        '''(experimental) Grants permission to list all the available leaderboards.

        Access Level: Read

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-submit-model-to-leaderboard.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toListLeaderboards", []))

    @jsii.member(jsii_name="toListLeaderboardSubmissions")
    def to_list_leaderboard_submissions(self) -> "Deepracer":
        '''(experimental) Grants permission to list all the DeepRacer model submissions of a user on a leaderboard.

        Access Level: Read

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-submit-model-to-leaderboard.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toListLeaderboardSubmissions", []))

    @jsii.member(jsii_name="toListModels")
    def to_list_models(self) -> "Deepracer":
        '''(experimental) Grants permission to list all existing DeepRacer models.

        Access Level: Read

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toListModels", []))

    @jsii.member(jsii_name="toListPrivateLeaderboardParticipants")
    def to_list_private_leaderboard_participants(self) -> "Deepracer":
        '''(experimental) Grants permission to retrieve participant information about private leaderboards.

        Access Level: Read

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-join-community-race.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toListPrivateLeaderboardParticipants", []))

    @jsii.member(jsii_name="toListPrivateLeaderboards")
    def to_list_private_leaderboards(self) -> "Deepracer":
        '''(experimental) Grants permission to list all the available private leaderboards.

        Access Level: Read

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-join-community-race.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toListPrivateLeaderboards", []))

    @jsii.member(jsii_name="toListSubscribedPrivateLeaderboards")
    def to_list_subscribed_private_leaderboards(self) -> "Deepracer":
        '''(experimental) Grants permission to list all the subscribed private leaderboards.

        Access Level: Read

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-join-community-race.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toListSubscribedPrivateLeaderboards", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Deepracer":
        '''(experimental) Grants permission to lists tag for a resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-tagging.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTracks")
    def to_list_tracks(self) -> "Deepracer":
        '''(experimental) Grants permission to list all DeepRacer tracks.

        Access Level: Read

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-console-train-evaluate-models.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toListTracks", []))

    @jsii.member(jsii_name="toListTrainingJobs")
    def to_list_training_jobs(self) -> "Deepracer":
        '''(experimental) Grants permission to list a DeepRacer model's training jobs.

        Access Level: Read

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toListTrainingJobs", []))

    @jsii.member(jsii_name="toMigrateModels")
    def to_migrate_models(self) -> "Deepracer":
        '''(experimental) Grants permission to migrate previous reinforcement learning models for DeepRacer.

        Access Level: Write

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-troubleshooting-service-migration-errors.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toMigrateModels", []))

    @jsii.member(jsii_name="toPerformLeaderboardOperation")
    def to_perform_leaderboard_operation(self) -> "Deepracer":
        '''(experimental) Grants permission to performs the leaderboard operation mentioned in the operation attribute.

        Access Level: Write

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-perform-leaderboard-operation.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toPerformLeaderboardOperation", []))

    @jsii.member(jsii_name="toRemoveLeaderboardAccessPermission")
    def to_remove_leaderboard_access_permission(self) -> "Deepracer":
        '''(experimental) Grants permission to remove access for a private leaderboard.

        Access Level: Write

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-manage-community-races.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toRemoveLeaderboardAccessPermission", []))

    @jsii.member(jsii_name="toSetAlias")
    def to_set_alias(self) -> "Deepracer":
        '''(experimental) Grants permission to set the user's alias for submitting a DeepRacer model to leaderboards.

        Access Level: Write

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-submit-model-to-leaderboard.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toSetAlias", []))

    @jsii.member(jsii_name="toStartEvaluation")
    def to_start_evaluation(self) -> "Deepracer":
        '''(experimental) Grants permission to evaluate a DeepRacer model in a simulated environment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-test-in-simulator.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toStartEvaluation", []))

    @jsii.member(jsii_name="toStopEvaluation")
    def to_stop_evaluation(self) -> "Deepracer":
        '''(experimental) Grants permission to stop DeepRacer model evaluations.

        Access Level: Write

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-test-in-simulator.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toStopEvaluation", []))

    @jsii.member(jsii_name="toStopTrainingReinforcementLearningModel")
    def to_stop_training_reinforcement_learning_model(self) -> "Deepracer":
        '''(experimental) Grants permission to stop training a DeepRacer model.

        Access Level: Write

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-get-started-training-model.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toStopTrainingReinforcementLearningModel", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Deepracer":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()
        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-tagging.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestRewardFunction")
    def to_test_reward_function(self) -> "Deepracer":
        '''(experimental) Grants permission to test reward functions for correctness.

        Access Level: Write

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-console-train-evaluate-models.html#deepracer-train-models-define-reward-function

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toTestRewardFunction", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Deepracer":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()
        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-tagging.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateCar")
    def to_update_car(self) -> "Deepracer":
        '''(experimental) Grants permission to update a DeepRacer car in your garage.

        Access Level: Write

        Possible conditions:

        - .ifUserToken()
        - .ifMultiUser()

        https://docs.aws.amazon.com/deepracer/latest/developerguide/deepracer-choose-race-type.html

        :stability: experimental
        '''
        return typing.cast("Deepracer", jsii.invoke(self, "toUpdateCar", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3501091fadca8c56adb52dcb274365a8a01afefb70efd8a01009ba569e6952da)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2064d750c5b18ab89f09499796fad9b37e14b70053186eeb7801bd8a29ca5bdd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Detective(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Detective",
):
    '''(experimental) Statement provider for service `detective <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondetective.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `detective <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondetective.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__06a87854c2199787db1f74138285e4688238151bc1eca77435be963aded4342b)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onGraph")
    def on_graph(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Detective":
        '''(experimental) Adds a resource of type Graph to the statement.

        https://docs.aws.amazon.com/detective/latest/adminguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-resources

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__94ad1f03d57e17000252f070c5a37194759ee64a36b881623f2bdf025057325d)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Detective", jsii.invoke(self, "onGraph", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptInvitation")
    def to_accept_invitation(self) -> "Detective":
        '''(experimental) Grants permission to accept an invitation to become a member of a behavior graph.

        Access Level: Write

        https://docs.aws.amazon.com/detective/latest/APIReference/API_AcceptInvitation.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toAcceptInvitation", []))

    @jsii.member(jsii_name="toBatchGetGraphMemberDatasources")
    def to_batch_get_graph_member_datasources(self) -> "Detective":
        '''(experimental) Grants permission to retrieve the datasource package history for the specified member accounts in a behavior graph managed by this account.

        Access Level: Read

        https://docs.aws.amazon.com/detective/latest/APIReference/API_BatchGetGraphMemberDatasources.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toBatchGetGraphMemberDatasources", []))

    @jsii.member(jsii_name="toBatchGetMembershipDatasources")
    def to_batch_get_membership_datasources(self) -> "Detective":
        '''(experimental) Grants permission to retrieve the datasource package history of the caller account for the specified graphs.

        Access Level: Read

        https://docs.aws.amazon.com/detective/latest/APIReference/API_BatchGetMembershipDatasources.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toBatchGetMembershipDatasources", []))

    @jsii.member(jsii_name="toCreateGraph")
    def to_create_graph(self) -> "Detective":
        '''(experimental) Grants permission to create a behavior graph and begin to aggregate security information.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/detective/latest/APIReference/API_CreateGraph.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toCreateGraph", []))

    @jsii.member(jsii_name="toCreateMembers")
    def to_create_members(self) -> "Detective":
        '''(experimental) Grants permission to request the membership of one or more accounts in a behavior graph managed by this account.

        Access Level: Write

        https://docs.aws.amazon.com/detective/latest/APIReference/API_CreateMembers.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toCreateMembers", []))

    @jsii.member(jsii_name="toDeleteGraph")
    def to_delete_graph(self) -> "Detective":
        '''(experimental) Grants permission to delete a behavior graph and stop aggregating security information.

        Access Level: Write

        https://docs.aws.amazon.com/detective/latest/APIReference/API_DeleteGraph.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toDeleteGraph", []))

    @jsii.member(jsii_name="toDeleteMembers")
    def to_delete_members(self) -> "Detective":
        '''(experimental) Grants permission to remove member accounts from a behavior graph managed by this account.

        Access Level: Write

        https://docs.aws.amazon.com/detective/latest/APIReference/API_DeleteMembers.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toDeleteMembers", []))

    @jsii.member(jsii_name="toDescribeOrganizationConfiguration")
    def to_describe_organization_configuration(self) -> "Detective":
        '''(experimental) Grants permission to view the current configuration related to the Amazon Detective integration with AWS Organizations.

        Access Level: Read

        Dependent actions:

        - organizations:DescribeOrganization

        https://docs.aws.amazon.com/detective/latest/APIReference/API_DescribeOrganizationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toDescribeOrganizationConfiguration", []))

    @jsii.member(jsii_name="toDisableOrganizationAdminAccount")
    def to_disable_organization_admin_account(self) -> "Detective":
        '''(experimental) Grants permission to remove the Amazon Detective delegated administrator account for an organization.

        Access Level: Write

        Dependent actions:

        - organizations:DescribeOrganization

        https://docs.aws.amazon.com/detective/latest/APIReference/API_DisableOrganizationAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toDisableOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toDisassociateMembership")
    def to_disassociate_membership(self) -> "Detective":
        '''(experimental) Grants permission to remove the association of this account with a behavior graph.

        Access Level: Write

        https://docs.aws.amazon.com/detective/latest/APIReference/API_DisassociateMembership.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toDisassociateMembership", []))

    @jsii.member(jsii_name="toEnableOrganizationAdminAccount")
    def to_enable_organization_admin_account(self) -> "Detective":
        '''(experimental) Grants permission to designate the Amazon Detective delegated administrator account for an organization.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - organizations:DescribeOrganization
        - organizations:EnableAWSServiceAccess
        - organizations:RegisterDelegatedAdministrator

        https://docs.aws.amazon.com/detective/latest/APIReference/API_EnableOrganizationAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toEnableOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toGetFreeTrialEligibility")
    def to_get_free_trial_eligibility(self) -> "Detective":
        '''(experimental) Grants permission to retrieve a behavior graph's eligibility for a free trial period.

        Access Level: Read

        https://docs.aws.amazon.com/detective/latest/adminguide/free-trial-overview.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toGetFreeTrialEligibility", []))

    @jsii.member(jsii_name="toGetGraphIngestState")
    def to_get_graph_ingest_state(self) -> "Detective":
        '''(experimental) Grants permission to retrieve the data ingestion state of a behavior graph.

        Access Level: Read

        https://docs.aws.amazon.com/detective/latest/adminguide/detective-source-data-about.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toGetGraphIngestState", []))

    @jsii.member(jsii_name="toGetMembers")
    def to_get_members(self) -> "Detective":
        '''(experimental) Grants permission to retrieve details on specified members of a behavior graph.

        Access Level: Read

        https://docs.aws.amazon.com/detective/latest/APIReference/API_GetMembers.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toGetMembers", []))

    @jsii.member(jsii_name="toGetPricingInformation")
    def to_get_pricing_information(self) -> "Detective":
        '''(experimental) Grants permission to retrieve information about Amazon Detective's pricing.

        Access Level: Read

        https://docs.aws.amazon.com/detective/latest/adminguide/usage-projected-cost-calculation.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toGetPricingInformation", []))

    @jsii.member(jsii_name="toGetUsageInformation")
    def to_get_usage_information(self) -> "Detective":
        '''(experimental) Grants permission to list usage information of a behavior graph.

        Access Level: Read

        https://docs.aws.amazon.com/detective/latest/adminguide/tracking-usage-logging.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toGetUsageInformation", []))

    @jsii.member(jsii_name="toListDatasourcePackages")
    def to_list_datasource_packages(self) -> "Detective":
        '''(experimental) Grants permission to list a graph's datasource package ingest states and timestamps for the most recent state changes in a behavior graph managed by this account.

        Access Level: List

        https://docs.aws.amazon.com/detective/latest/APIReference/API_ListDatasourcePackages.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toListDatasourcePackages", []))

    @jsii.member(jsii_name="toListGraphs")
    def to_list_graphs(self) -> "Detective":
        '''(experimental) Grants permission to list behavior graphs managed by this account.

        Access Level: List

        https://docs.aws.amazon.com/detective/latest/APIReference/API_ListGraphs.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toListGraphs", []))

    @jsii.member(jsii_name="toListHighDegreeEntities")
    def to_list_high_degree_entities(self) -> "Detective":
        '''(experimental) Grants permission to retrieve high volume entities whose relationships cannot be stored by Detective.

        Access Level: List

        https://docs.aws.amazon.com/detective/latest/userguide/high-volume-entities.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toListHighDegreeEntities", []))

    @jsii.member(jsii_name="toListInvitations")
    def to_list_invitations(self) -> "Detective":
        '''(experimental) Grants permission to retrieve details on the behavior graphs to which this account has been invited to join.

        Access Level: List

        https://docs.aws.amazon.com/detective/latest/APIReference/API_ListInvitations.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toListInvitations", []))

    @jsii.member(jsii_name="toListMembers")
    def to_list_members(self) -> "Detective":
        '''(experimental) Grants permission to retrieve details on all members of a behavior graph.

        Access Level: List

        https://docs.aws.amazon.com/detective/latest/APIReference/API_ListMembers.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toListMembers", []))

    @jsii.member(jsii_name="toListOrganizationAdminAccount")
    def to_list_organization_admin_account(self) -> "Detective":
        '''(experimental) Grants permission to view the current Amazon Detective delegated administrator account for an organization.

        Access Level: List

        Dependent actions:

        - organizations:DescribeOrganization

        https://docs.aws.amazon.com/detective/latest/APIReference/API_ListOrganizationAdminAccounts.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toListOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Detective":
        '''(experimental) Grants permission to list the tag values that are assigned to a behavior graph.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/detective/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRejectInvitation")
    def to_reject_invitation(self) -> "Detective":
        '''(experimental) Grants permission to reject an invitation to become a member of a behavior graph.

        Access Level: Write

        https://docs.aws.amazon.com/detective/latest/APIReference/API_RejectInvitation.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toRejectInvitation", []))

    @jsii.member(jsii_name="toSearchGraph")
    def to_search_graph(self) -> "Detective":
        '''(experimental) Grants permission to search the data stored in a behavior graph.

        Access Level: Read

        https://docs.aws.amazon.com/detective/latest/userguide/detective-search.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toSearchGraph", []))

    @jsii.member(jsii_name="toStartMonitoringMember")
    def to_start_monitoring_member(self) -> "Detective":
        '''(experimental) Grants permission to start data ingest for a member account that has a status of ACCEPTED_BUT_DISABLED.

        Access Level: Write

        https://docs.aws.amazon.com/detective/latest/APIReference/API_StartMonitoringMember.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toStartMonitoringMember", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Detective":
        '''(experimental) Grants permission to assign tag values to a behavior graph.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/detective/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Detective":
        '''(experimental) Grants permission to remove tag values from a behavior graph.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/detective/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDatasourcePackages")
    def to_update_datasource_packages(self) -> "Detective":
        '''(experimental) Grants permission to enable or disable datasource package(s) in a behavior graph managed by this account.

        Access Level: Write

        https://docs.aws.amazon.com/detective/latest/APIReference/API_UpdateDatasourcePackages.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toUpdateDatasourcePackages", []))

    @jsii.member(jsii_name="toUpdateOrganizationConfiguration")
    def to_update_organization_configuration(self) -> "Detective":
        '''(experimental) Grants permission to update the current configuration related to the Amazon Detective integration with AWS Organizations.

        Access Level: Write

        Dependent actions:

        - organizations:DescribeOrganization

        https://docs.aws.amazon.com/detective/latest/APIReference/API_UpdateOrganizationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Detective", jsii.invoke(self, "toUpdateOrganizationConfiguration", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1c15614b18e421fd9b93ceb483ad3d438f750155e5476cfbd202850bbccc4ad7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__525991265bd9643465279c1fbafa862a29eb781401e5966cab39a7b691e57818)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Devicefarm(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Devicefarm",
):
    '''(experimental) Statement provider for service `devicefarm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdevicefarm.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `devicefarm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdevicefarm.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3674f04a03c687985ae607f8e1ce5350e41cb621326a56527372213c33e01bbe)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onArtifact")
    def on_artifact(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type artifact to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_Artifact.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f22e20997f5e8cce908b8e77eccbab092d40abbf4ba6ca4127b282f1df2769a4)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Devicefarm", jsii.invoke(self, "onArtifact", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onDevice")
    def on_device(
        self,
        resource_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type device to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_Device.html

        :param resource_id: - Identifier for the resourceId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dc64758bc9e05150342b368a18379630c49f5384e2dba5d8c3bb0b56ca272496)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Devicefarm", jsii.invoke(self, "onDevice", [resource_id, region, partition]))

    @jsii.member(jsii_name="onDeviceinstance")
    def on_deviceinstance(
        self,
        resource_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type deviceinstance to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_DeviceInstance.html

        :param resource_id: - Identifier for the resourceId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dd7e044744b6d4a373f3e6b6ca91ae45da09db50d17f874fb84f3467b33b1ee3)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Devicefarm", jsii.invoke(self, "onDeviceinstance", [resource_id, region, partition]))

    @jsii.member(jsii_name="onDevicepool")
    def on_devicepool(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type devicepool to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_DevicePool.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ec13df283ea6e71f61cdfe7317d80a6c2b04d167b75381a08efc8dc6c48dd01e)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Devicefarm", jsii.invoke(self, "onDevicepool", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onInstanceprofile")
    def on_instanceprofile(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type instanceprofile to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_InstanceProfile.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0259f0841fa3d44403b1cf5531aac700565e906e4ab72027bebaee6205b3768a)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Devicefarm", jsii.invoke(self, "onInstanceprofile", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onJob")
    def on_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type job to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_Job.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__aa64d25e97826d7f7210dbf1a0b20043f5438dbf577772e4f2c8aa99fce5dba0)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Devicefarm", jsii.invoke(self, "onJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onNetworkprofile")
    def on_networkprofile(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type networkprofile to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_NetworkProfile.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__959c1babd51a57831b7cf74a5d4633f52a48ea2108f2ba7821dcec3ac354c5bb)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Devicefarm", jsii.invoke(self, "onNetworkprofile", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type project to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_Project.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0e1be89e9b0552e1c3e58bc0a9e47611039fd0865978eb2c1fcf0af97b9523f6)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Devicefarm", jsii.invoke(self, "onProject", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onRun")
    def on_run(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type run to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_Run.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__921ea83ac2fd332245754e5683378c40001c0f8ab6cc88c58a3b696490e9cc66)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Devicefarm", jsii.invoke(self, "onRun", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onSample")
    def on_sample(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type sample to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_Sample.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9c831facecac675d3dfe8194b8914ea3d3cec42efacaa2b67edeaf2c81d613b8)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Devicefarm", jsii.invoke(self, "onSample", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onSession")
    def on_session(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type session to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_RemoteAccessSession.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__046c4fb4a66a366508c97735a58d0eb97fe8287afa745c2ce4f02be1577e6074)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Devicefarm", jsii.invoke(self, "onSession", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onSuite")
    def on_suite(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type suite to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_Suite.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f4604bba7986652886b07e6e01b297f8d29f25169e4b2e1643fea880c783ed34)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Devicefarm", jsii.invoke(self, "onSuite", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onTest")
    def on_test(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type test to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_Test.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__09a27416c1e8fcd246785cd5c13acdf2d0a54a5ad085082a625312f19155fe0b)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Devicefarm", jsii.invoke(self, "onTest", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onTestgridProject")
    def on_testgrid_project(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type testgrid-project to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_TestGridProject.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b34da811b3546d0e6342e27ab3674f691f133a04039371bf586bf731f699c8a2)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Devicefarm", jsii.invoke(self, "onTestgridProject", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onTestgridSession")
    def on_testgrid_session(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type testgrid-session to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_TestGridSession.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6824233d141684231a036e81aec4e6ae84828ac36caa9f0bdeeb4317d151a633)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Devicefarm", jsii.invoke(self, "onTestgridSession", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onUpload")
    def on_upload(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type upload to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_Upload.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e3bb353581b28a907584e266cb5f1f02fce0d5959869db71a348e4260b2ea886)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Devicefarm", jsii.invoke(self, "onUpload", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onVpceconfiguration")
    def on_vpceconfiguration(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Devicefarm":
        '''(experimental) Adds a resource of type vpceconfiguration to the statement.

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_VPCEConfiguration.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ce8534fafcd0b1f0506164c3c173d11ef8e0b8839d497934407d2760adee64ad)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Devicefarm", jsii.invoke(self, "onVpceconfiguration", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateDevicePool")
    def to_create_device_pool(self) -> "Devicefarm":
        '''(experimental) Grants permission to create a device pool within a project.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateDevicePool.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toCreateDevicePool", []))

    @jsii.member(jsii_name="toCreateInstanceProfile")
    def to_create_instance_profile(self) -> "Devicefarm":
        '''(experimental) Grants permission to create a device instance profile.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toCreateInstanceProfile", []))

    @jsii.member(jsii_name="toCreateNetworkProfile")
    def to_create_network_profile(self) -> "Devicefarm":
        '''(experimental) Grants permission to create a network profile within a project.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateNetworkProfile.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toCreateNetworkProfile", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Devicefarm":
        '''(experimental) Grants permission to create a project for mobile testing.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs
        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateProject.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toCreateRemoteAccessSession")
    def to_create_remote_access_session(self) -> "Devicefarm":
        '''(experimental) Grants permission to start a remote access session to a device instance.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateRemoteAccessSession.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toCreateRemoteAccessSession", []))

    @jsii.member(jsii_name="toCreateTestGridProject")
    def to_create_test_grid_project(self) -> "Devicefarm":
        '''(experimental) Grants permission to create a project for desktop testing.

        Access Level: Write

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs
        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateTestGridProject.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toCreateTestGridProject", []))

    @jsii.member(jsii_name="toCreateTestGridUrl")
    def to_create_test_grid_url(self) -> "Devicefarm":
        '''(experimental) Grants permission to generate a new pre-signed url used to access our test grid service.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateTestGridUrl.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toCreateTestGridUrl", []))

    @jsii.member(jsii_name="toCreateUpload")
    def to_create_upload(self) -> "Devicefarm":
        '''(experimental) Grants permission to upload a new file or app within a project.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateUpload.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toCreateUpload", []))

    @jsii.member(jsii_name="toCreateVPCEConfiguration")
    def to_create_vpce_configuration(self) -> "Devicefarm":
        '''(experimental) Grants permission to create an Amazon Virtual Private Cloud (VPC) endpoint configuration.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_CreateVPCEConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toCreateVPCEConfiguration", []))

    @jsii.member(jsii_name="toDeleteDevicePool")
    def to_delete_device_pool(self) -> "Devicefarm":
        '''(experimental) Grants permission to delete a user-generated device pool.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_DeleteDevicePool.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toDeleteDevicePool", []))

    @jsii.member(jsii_name="toDeleteInstanceProfile")
    def to_delete_instance_profile(self) -> "Devicefarm":
        '''(experimental) Grants permission to delete a user-generated instance profile.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_DeleteInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toDeleteInstanceProfile", []))

    @jsii.member(jsii_name="toDeleteNetworkProfile")
    def to_delete_network_profile(self) -> "Devicefarm":
        '''(experimental) Grants permission to delete a user-generated network profile.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/DeleteNetworkProfile.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toDeleteNetworkProfile", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Devicefarm":
        '''(experimental) Grants permission to delete a mobile testing project.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_DeleteProject.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDeleteRemoteAccessSession")
    def to_delete_remote_access_session(self) -> "Devicefarm":
        '''(experimental) Grants permission to delete a completed remote access session and its results.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_DeleteRemoteAccessSession.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toDeleteRemoteAccessSession", []))

    @jsii.member(jsii_name="toDeleteRun")
    def to_delete_run(self) -> "Devicefarm":
        '''(experimental) Grants permission to delete a run.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_DeleteRun.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toDeleteRun", []))

    @jsii.member(jsii_name="toDeleteTestGridProject")
    def to_delete_test_grid_project(self) -> "Devicefarm":
        '''(experimental) Grants permission to delete a desktop testing project.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_DeleteTestGridProject.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toDeleteTestGridProject", []))

    @jsii.member(jsii_name="toDeleteUpload")
    def to_delete_upload(self) -> "Devicefarm":
        '''(experimental) Grants permission to delete a user-uploaded file.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_DeleteUpload.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toDeleteUpload", []))

    @jsii.member(jsii_name="toDeleteVPCEConfiguration")
    def to_delete_vpce_configuration(self) -> "Devicefarm":
        '''(experimental) Grants permission to delete an Amazon Virtual Private Cloud (VPC) endpoint configuration.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_DeleteVPCEConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toDeleteVPCEConfiguration", []))

    @jsii.member(jsii_name="toGetAccountSettings")
    def to_get_account_settings(self) -> "Devicefarm":
        '''(experimental) Grants permission to retrieve the number of unmetered iOS and/or unmetered Android devices purchased by the account.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetAccountSettings.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetAccountSettings", []))

    @jsii.member(jsii_name="toGetDevice")
    def to_get_device(self) -> "Devicefarm":
        '''(experimental) Grants permission to retrieve the information of a unique device type.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetDevice.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetDevice", []))

    @jsii.member(jsii_name="toGetDeviceInstance")
    def to_get_device_instance(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of a device instance.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetDeviceInstance.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetDeviceInstance", []))

    @jsii.member(jsii_name="toGetDevicePool")
    def to_get_device_pool(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of a device pool.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetDevicePool.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetDevicePool", []))

    @jsii.member(jsii_name="toGetDevicePoolCompatibility")
    def to_get_device_pool_compatibility(self) -> "Devicefarm":
        '''(experimental) Grants permission to retrieve information about the compatibility of a test and/or app with a device pool.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetDevicePoolCompatibility.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetDevicePoolCompatibility", []))

    @jsii.member(jsii_name="toGetInstanceProfile")
    def to_get_instance_profile(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of an instance profile.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetInstanceProfile", []))

    @jsii.member(jsii_name="toGetJob")
    def to_get_job(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of a job.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetJob.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetJob", []))

    @jsii.member(jsii_name="toGetNetworkProfile")
    def to_get_network_profile(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of a network profile.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetNetworkProfile.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetNetworkProfile", []))

    @jsii.member(jsii_name="toGetOfferingStatus")
    def to_get_offering_status(self) -> "Devicefarm":
        '''(experimental) Grants permission to retrieve the current status and future status of all offerings purchased by an AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetOfferingStatus.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetOfferingStatus", []))

    @jsii.member(jsii_name="toGetProject")
    def to_get_project(self) -> "Devicefarm":
        '''(experimental) Grants permission to retrieve information about a mobile testing project.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetProject.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetProject", []))

    @jsii.member(jsii_name="toGetRemoteAccessSession")
    def to_get_remote_access_session(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the link to a currently running remote access session.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetRemoteAccessSession.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetRemoteAccessSession", []))

    @jsii.member(jsii_name="toGetRun")
    def to_get_run(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of a run.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetRun.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetRun", []))

    @jsii.member(jsii_name="toGetSuite")
    def to_get_suite(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of a testing suite.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetSuite.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetSuite", []))

    @jsii.member(jsii_name="toGetTest")
    def to_get_test(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of a test case.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetTest.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetTest", []))

    @jsii.member(jsii_name="toGetTestGridProject")
    def to_get_test_grid_project(self) -> "Devicefarm":
        '''(experimental) Grants permission to retrieve information about a desktop testing project.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetTestGridProject.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetTestGridProject", []))

    @jsii.member(jsii_name="toGetTestGridSession")
    def to_get_test_grid_session(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of a test grid session.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetTestGridSession.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetTestGridSession", []))

    @jsii.member(jsii_name="toGetUpload")
    def to_get_upload(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of an uploaded file.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetUpload.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetUpload", []))

    @jsii.member(jsii_name="toGetVPCEConfiguration")
    def to_get_vpce_configuration(self) -> "Devicefarm":
        '''(experimental) Grants permission to retireve the information of an Amazon Virtual Private Cloud (VPC) endpoint configuration.

        Access Level: Read

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_GetVPCEConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toGetVPCEConfiguration", []))

    @jsii.member(jsii_name="toInstallToRemoteAccessSession")
    def to_install_to_remote_access_session(self) -> "Devicefarm":
        '''(experimental) Grants permission to install an application to a device in a remote access session.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_InstallToRemoteAccessSession.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toInstallToRemoteAccessSession", []))

    @jsii.member(jsii_name="toListArtifacts")
    def to_list_artifacts(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the artifacts in a project.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListArtifacts.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListArtifacts", []))

    @jsii.member(jsii_name="toListDeviceInstances")
    def to_list_device_instances(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of device instances.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListDeviceInstances.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListDeviceInstances", []))

    @jsii.member(jsii_name="toListDevicePools")
    def to_list_device_pools(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of device pools.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListDevicePools.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListDevicePools", []))

    @jsii.member(jsii_name="toListDevices")
    def to_list_devices(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of unique device types.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListDevices.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListDevices", []))

    @jsii.member(jsii_name="toListInstanceProfiles")
    def to_list_instance_profiles(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of device instance profiles.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListInstanceProfiles.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListInstanceProfiles", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of jobs within a run.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListJobs.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListNetworkProfiles")
    def to_list_network_profiles(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of network profiles within a project.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListNetworkProfiles.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListNetworkProfiles", []))

    @jsii.member(jsii_name="toListOfferingPromotions")
    def to_list_offering_promotions(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the offering promotions.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListOfferingPromotions.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListOfferingPromotions", []))

    @jsii.member(jsii_name="toListOfferings")
    def to_list_offerings(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the products or offerings that the user can manage through the API.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListOfferings.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListOfferings", []))

    @jsii.member(jsii_name="toListOfferingTransactions")
    def to_list_offering_transactions(self) -> "Devicefarm":
        '''(experimental) Grants permission to list all of the historical purchases, renewals, and system renewal transactions for an AWS account.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListOfferingTransactions.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListOfferingTransactions", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of mobile testing projects for an AWS account.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListProjects.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListRemoteAccessSessions")
    def to_list_remote_access_sessions(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of currently running remote access sessions.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListRemoteAccessSessions.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListRemoteAccessSessions", []))

    @jsii.member(jsii_name="toListRuns")
    def to_list_runs(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of runs within a project.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListRuns.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListRuns", []))

    @jsii.member(jsii_name="toListSamples")
    def to_list_samples(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of samples within a project.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListSamples.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListSamples", []))

    @jsii.member(jsii_name="toListSuites")
    def to_list_suites(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of testing suites within a job.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListSuites.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListSuites", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the tags of a resource.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTestGridProjects")
    def to_list_test_grid_projects(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of desktop testing projects for an AWS account.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListTestGridProjects.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListTestGridProjects", []))

    @jsii.member(jsii_name="toListTestGridSessionActions")
    def to_list_test_grid_session_actions(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the session actions performed during a test grid session.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListTestGridSessionActions.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListTestGridSessionActions", []))

    @jsii.member(jsii_name="toListTestGridSessionArtifacts")
    def to_list_test_grid_session_artifacts(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the artifacts generated by a test grid session.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListTestGridSessionArtifacts.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListTestGridSessionArtifacts", []))

    @jsii.member(jsii_name="toListTestGridSessions")
    def to_list_test_grid_sessions(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the sessions within a test grid project.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListTestGridSessions.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListTestGridSessions", []))

    @jsii.member(jsii_name="toListTests")
    def to_list_tests(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of tests within a testing suite.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListTests.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListTests", []))

    @jsii.member(jsii_name="toListUniqueProblems")
    def to_list_unique_problems(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of unique problems within a run.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListUniqueProblems.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListUniqueProblems", []))

    @jsii.member(jsii_name="toListUploads")
    def to_list_uploads(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of uploads within a project.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListUploads.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListUploads", []))

    @jsii.member(jsii_name="toListVPCEConfigurations")
    def to_list_vpce_configurations(self) -> "Devicefarm":
        '''(experimental) Grants permission to list the information of Amazon Virtual Private Cloud (VPC) endpoint configurations.

        Access Level: List

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ListVPCEConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toListVPCEConfigurations", []))

    @jsii.member(jsii_name="toPurchaseOffering")
    def to_purchase_offering(self) -> "Devicefarm":
        '''(experimental) Grants permission to purchase offerings for an AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_PurchaseOffering.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toPurchaseOffering", []))

    @jsii.member(jsii_name="toRenewOffering")
    def to_renew_offering(self) -> "Devicefarm":
        '''(experimental) Grants permission to set the quantity of devices to renew for an offering.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_RenewOffering.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toRenewOffering", []))

    @jsii.member(jsii_name="toScheduleRun")
    def to_schedule_run(self) -> "Devicefarm":
        '''(experimental) Grants permission to schedule a run.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_ScheduleRun.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toScheduleRun", []))

    @jsii.member(jsii_name="toStopJob")
    def to_stop_job(self) -> "Devicefarm":
        '''(experimental) Grants permission to terminate a running job.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_StopJob.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toStopJob", []))

    @jsii.member(jsii_name="toStopRemoteAccessSession")
    def to_stop_remote_access_session(self) -> "Devicefarm":
        '''(experimental) Grants permission to terminate a running remote access session.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_StopRemoteAccessSession.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toStopRemoteAccessSession", []))

    @jsii.member(jsii_name="toStopRun")
    def to_stop_run(self) -> "Devicefarm":
        '''(experimental) Grants permission to terminate a running test run.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_StopRun.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toStopRun", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Devicefarm":
        '''(experimental) Grants permission to add tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Devicefarm":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDeviceInstance")
    def to_update_device_instance(self) -> "Devicefarm":
        '''(experimental) Grants permission to modify an existing device instance.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_UpdateDeviceInstance.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toUpdateDeviceInstance", []))

    @jsii.member(jsii_name="toUpdateDevicePool")
    def to_update_device_pool(self) -> "Devicefarm":
        '''(experimental) Grants permission to modify an existing device pool.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_UpdateDevicePool.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toUpdateDevicePool", []))

    @jsii.member(jsii_name="toUpdateInstanceProfile")
    def to_update_instance_profile(self) -> "Devicefarm":
        '''(experimental) Grants permission to modify an existing instance profile.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_UpdateInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toUpdateInstanceProfile", []))

    @jsii.member(jsii_name="toUpdateNetworkProfile")
    def to_update_network_profile(self) -> "Devicefarm":
        '''(experimental) Grants permission to modify an existing network profile.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_UpdateNetworkProfile.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toUpdateNetworkProfile", []))

    @jsii.member(jsii_name="toUpdateProject")
    def to_update_project(self) -> "Devicefarm":
        '''(experimental) Grants permission to modify an existing mobile testing project.

        Access Level: Write

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs
        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_UpdateProject.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toUpdateProject", []))

    @jsii.member(jsii_name="toUpdateTestGridProject")
    def to_update_test_grid_project(self) -> "Devicefarm":
        '''(experimental) Grants permission to modify an existing desktop testing project.

        Access Level: Write

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs
        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_UpdateTestGridProject.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toUpdateTestGridProject", []))

    @jsii.member(jsii_name="toUpdateUpload")
    def to_update_upload(self) -> "Devicefarm":
        '''(experimental) Grants permission to modify an existing upload.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_UpdateUpload.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toUpdateUpload", []))

    @jsii.member(jsii_name="toUpdateVPCEConfiguration")
    def to_update_vpce_configuration(self) -> "Devicefarm":
        '''(experimental) Grants permission to modify an existing Amazon Virtual Private Cloud (VPC) endpoint configuration.

        Access Level: Write

        https://docs.aws.amazon.com/devicefarm/latest/APIReference/API_UpdateVPCEConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Devicefarm", jsii.invoke(self, "toUpdateVPCEConfiguration", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6e50725543612e43308ec965f3fba3e4cbe3963fd657f3da52383215d2db1699)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ad8acbf77ff52796453ade9690a4c39dabff67dc769cb8cef26ae0ec7f03173f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class DevopsGuru(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.DevopsGuru",
):
    '''(experimental) Statement provider for service `devops-guru <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondevopsguru.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `devops-guru <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondevopsguru.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8a72cc78e5058ec1c5d76e9e631ab667805bd66a5cba458c0aba0cb495e3e322)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifServiceNames")
    def if_service_names(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "DevopsGuru":
        '''(experimental) Filters access by API to restrict access to given AWS service names.

        https://docs.aws.amazon.com/devops-guru/latest/userguide/API_ServiceCollection.html

        Applies to actions:

        - .toListAnomaliesForInsight()
        - .toSearchInsights()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fd23488436108cd216968b6a4691a6e17f546a9ad50877019d1410ac060c9936)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("DevopsGuru", jsii.invoke(self, "ifServiceNames", [value, operator]))

    @jsii.member(jsii_name="onTopic")
    def on_topic(
        self,
        topic_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "DevopsGuru":
        '''(experimental) Adds a resource of type topic to the statement.

        https://docs.aws.amazon.com/devops-guru/latest/userguide/setting-up.html#setting-up-notifications

        :param topic_name: - Identifier for the topicName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fe55873207da25a589a2ff5f1864bfebb4db604e261d6ce3b73645a9e8c78d3a)
            check_type(argname="argument topic_name", value=topic_name, expected_type=type_hints["topic_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("DevopsGuru", jsii.invoke(self, "onTopic", [topic_name, account, region, partition]))

    @jsii.member(jsii_name="toAddNotificationChannel")
    def to_add_notification_channel(self) -> "DevopsGuru":
        '''(experimental) Grants permission to add a notification channel to DevOps Guru.

        Access Level: Write

        Dependent actions:

        - sns:GetTopicAttributes
        - sns:SetTopicAttributes

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_AddNotificationChannel.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toAddNotificationChannel", []))

    @jsii.member(jsii_name="toDeleteInsight")
    def to_delete_insight(self) -> "DevopsGuru":
        '''(experimental) Grants permission to delete specified insight in your account.

        Access Level: Write

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_DeleteInsight.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toDeleteInsight", []))

    @jsii.member(jsii_name="toDescribeAccountHealth")
    def to_describe_account_health(self) -> "DevopsGuru":
        '''(experimental) Grants permission to view the health of operations in your AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_DescribeAccountHealth.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toDescribeAccountHealth", []))

    @jsii.member(jsii_name="toDescribeAccountOverview")
    def to_describe_account_overview(self) -> "DevopsGuru":
        '''(experimental) Grants permission to view the health of operations within a time range in your AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_DescribeAccountOverview.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toDescribeAccountOverview", []))

    @jsii.member(jsii_name="toDescribeAnomaly")
    def to_describe_anomaly(self) -> "DevopsGuru":
        '''(experimental) Grants permission to list the details of a specified anomaly.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_DescribeAnomaly.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toDescribeAnomaly", []))

    @jsii.member(jsii_name="toDescribeEventSourcesConfig")
    def to_describe_event_sources_config(self) -> "DevopsGuru":
        '''(experimental) Grants permission to retrieve details about event sources for DevOps Guru.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_DescribeEventSourcesConfig.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toDescribeEventSourcesConfig", []))

    @jsii.member(jsii_name="toDescribeFeedback")
    def to_describe_feedback(self) -> "DevopsGuru":
        '''(experimental) Grants permission to view the feedback details of a specified insight.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_DescribeFeedback.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toDescribeFeedback", []))

    @jsii.member(jsii_name="toDescribeInsight")
    def to_describe_insight(self) -> "DevopsGuru":
        '''(experimental) Grants permission to list the details of a specified insight.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_DescribeInsight.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toDescribeInsight", []))

    @jsii.member(jsii_name="toDescribeOrganizationHealth")
    def to_describe_organization_health(self) -> "DevopsGuru":
        '''(experimental) Grants permission to view the health of operations in your organization.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_DescribeOrganizationHealth.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toDescribeOrganizationHealth", []))

    @jsii.member(jsii_name="toDescribeOrganizationOverview")
    def to_describe_organization_overview(self) -> "DevopsGuru":
        '''(experimental) Grants permission to view the health of operations within a time range in your organization.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_DescribeOrganizationOverview.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toDescribeOrganizationOverview", []))

    @jsii.member(jsii_name="toDescribeOrganizationResourceCollectionHealth")
    def to_describe_organization_resource_collection_health(self) -> "DevopsGuru":
        '''(experimental) Grants permission to view the health of operations for each AWS CloudFormation stack or AWS Services or accounts specified in DevOps Guru in your organization.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_DescribeOrganizationResourceCollectionHealth.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toDescribeOrganizationResourceCollectionHealth", []))

    @jsii.member(jsii_name="toDescribeResourceCollectionHealth")
    def to_describe_resource_collection_health(self) -> "DevopsGuru":
        '''(experimental) Grants permission to view the health of operations for each AWS CloudFormation stack specified in DevOps Guru.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_DescribeResourceCollectionHealth.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toDescribeResourceCollectionHealth", []))

    @jsii.member(jsii_name="toDescribeServiceIntegration")
    def to_describe_service_integration(self) -> "DevopsGuru":
        '''(experimental) Grants permission to view the integration status of services that can be integrated with DevOps Guru.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_DescribeServiceIntegration.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toDescribeServiceIntegration", []))

    @jsii.member(jsii_name="toGetCostEstimation")
    def to_get_cost_estimation(self) -> "DevopsGuru":
        '''(experimental) Grants permission to list service resource cost estimates.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_GetCostEstimation.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toGetCostEstimation", []))

    @jsii.member(jsii_name="toGetResourceCollection")
    def to_get_resource_collection(self) -> "DevopsGuru":
        '''(experimental) Grants permission to list AWS CloudFormation stacks that DevOps Guru is configured to use.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_GetResourceCollection.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toGetResourceCollection", []))

    @jsii.member(jsii_name="toListAnomaliesForInsight")
    def to_list_anomalies_for_insight(self) -> "DevopsGuru":
        '''(experimental) Grants permission to list anomalies of a given insight in your account.

        Access Level: List

        Possible conditions:

        - .ifServiceNames()

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_ListAnomaliesForInsight.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toListAnomaliesForInsight", []))

    @jsii.member(jsii_name="toListAnomalousLogGroups")
    def to_list_anomalous_log_groups(self) -> "DevopsGuru":
        '''(experimental) Grants permission to list log anomalies of a given insight in your account.

        Access Level: List

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_ListAnomalousLogGroups.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toListAnomalousLogGroups", []))

    @jsii.member(jsii_name="toListEvents")
    def to_list_events(self) -> "DevopsGuru":
        '''(experimental) Grants permission to list resource events that are evaluated by DevOps Guru.

        Access Level: List

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_ListEvents.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toListEvents", []))

    @jsii.member(jsii_name="toListInsights")
    def to_list_insights(self) -> "DevopsGuru":
        '''(experimental) Grants permission to list insights in your account.

        Access Level: List

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_ListInsights.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toListInsights", []))

    @jsii.member(jsii_name="toListMonitoredResources")
    def to_list_monitored_resources(self) -> "DevopsGuru":
        '''(experimental) Grants permission to list resource monitored by DevOps Guru in your account.

        Access Level: List

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_ListMonitoredResources.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toListMonitoredResources", []))

    @jsii.member(jsii_name="toListNotificationChannels")
    def to_list_notification_channels(self) -> "DevopsGuru":
        '''(experimental) Grants permission to list notification channels configured for DevOps Guru in your account.

        Access Level: List

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_ListNotificationChannels.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toListNotificationChannels", []))

    @jsii.member(jsii_name="toListOrganizationInsights")
    def to_list_organization_insights(self) -> "DevopsGuru":
        '''(experimental) Grants permission to list insights in your organization.

        Access Level: List

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_ListOrganizationInsights.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toListOrganizationInsights", []))

    @jsii.member(jsii_name="toListRecommendations")
    def to_list_recommendations(self) -> "DevopsGuru":
        '''(experimental) Grants permission to list a specified insight's recommendations.

        Access Level: List

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_ListRecommendations.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toListRecommendations", []))

    @jsii.member(jsii_name="toPutFeedback")
    def to_put_feedback(self) -> "DevopsGuru":
        '''(experimental) Grants permission to submit a feedback to DevOps Guru.

        Access Level: Write

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_PutFeedback.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toPutFeedback", []))

    @jsii.member(jsii_name="toRemoveNotificationChannel")
    def to_remove_notification_channel(self) -> "DevopsGuru":
        '''(experimental) Grants permission to remove a notification channel from DevOps Guru.

        Access Level: Write

        Dependent actions:

        - sns:GetTopicAttributes
        - sns:SetTopicAttributes

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_RemoveNotificationChannel.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toRemoveNotificationChannel", []))

    @jsii.member(jsii_name="toSearchInsights")
    def to_search_insights(self) -> "DevopsGuru":
        '''(experimental) Grants permission to search insights in your account.

        Access Level: List

        Possible conditions:

        - .ifServiceNames()

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_SearchInsights.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toSearchInsights", []))

    @jsii.member(jsii_name="toSearchOrganizationInsights")
    def to_search_organization_insights(self) -> "DevopsGuru":
        '''(experimental) Grants permission to search insights in your organization.

        Access Level: List

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_SearchOrganizationInsights.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toSearchOrganizationInsights", []))

    @jsii.member(jsii_name="toStartCostEstimation")
    def to_start_cost_estimation(self) -> "DevopsGuru":
        '''(experimental) Grants permission to start the creation of an estimate of the monthly cost.

        Access Level: Read

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_StartCostEstimation.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toStartCostEstimation", []))

    @jsii.member(jsii_name="toUpdateEventSourcesConfig")
    def to_update_event_sources_config(self) -> "DevopsGuru":
        '''(experimental) Grants permission to update an event source for DevOps Guru.

        Access Level: Write

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_UpdateEventSourcesConfig.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toUpdateEventSourcesConfig", []))

    @jsii.member(jsii_name="toUpdateResourceCollection")
    def to_update_resource_collection(self) -> "DevopsGuru":
        '''(experimental) Grants permission to update the list of AWS CloudFormation stacks that are used to specify which AWS resources in your account are analyzed by DevOps Guru.

        Access Level: Write

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_UpdateResourceCollection.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toUpdateResourceCollection", []))

    @jsii.member(jsii_name="toUpdateServiceIntegration")
    def to_update_service_integration(self) -> "DevopsGuru":
        '''(experimental) Grants permission to enable or disable a service that integrates with DevOps Guru.

        Access Level: Write

        https://docs.aws.amazon.com/devops-guru/latest/APIReference/API_UpdateServiceIntegration.html

        :stability: experimental
        '''
        return typing.cast("DevopsGuru", jsii.invoke(self, "toUpdateServiceIntegration", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4671d64c9818ab6336b48b5eeb088df2bc14f31d3e1f43f3a370439d13bd7cb4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__213c3daa28ac988eb5da7c13119067f4e27928c1184e3f95b45a30857f39acdc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Directconnect(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Directconnect",
):
    '''(experimental) Statement provider for service `directconnect <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdirectconnect.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `directconnect <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdirectconnect.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__529120211b32d419f5102037084fcfe34aa7b1ab91974c32779bdc425f9b8579)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDxcon")
    def on_dxcon(
        self,
        connection_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Directconnect":
        '''(experimental) Adds a resource of type dxcon to the statement.

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_Connection.html

        :param connection_id: - Identifier for the connectionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f691b9047205ca972851ec4c99feef92199912eda57a8036d7dc352954638f14)
            check_type(argname="argument connection_id", value=connection_id, expected_type=type_hints["connection_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Directconnect", jsii.invoke(self, "onDxcon", [connection_id, account, region, partition]))

    @jsii.member(jsii_name="onDxGateway")
    def on_dx_gateway(
        self,
        direct_connect_gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Directconnect":
        '''(experimental) Adds a resource of type dx-gateway to the statement.

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DirectConnectGateway.html

        :param direct_connect_gateway_id: - Identifier for the directConnectGatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__68130bbbd34c019af170be070722c765f2a2bc506d036283c1faa0683b51ca13)
            check_type(argname="argument direct_connect_gateway_id", value=direct_connect_gateway_id, expected_type=type_hints["direct_connect_gateway_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Directconnect", jsii.invoke(self, "onDxGateway", [direct_connect_gateway_id, account, partition]))

    @jsii.member(jsii_name="onDxlag")
    def on_dxlag(
        self,
        lag_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Directconnect":
        '''(experimental) Adds a resource of type dxlag to the statement.

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_Lag.html

        :param lag_id: - Identifier for the lagId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d72411b62131f3b802058f37bac6864ddc29dc21b5102d81c25c2d44d7dbd2ff)
            check_type(argname="argument lag_id", value=lag_id, expected_type=type_hints["lag_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Directconnect", jsii.invoke(self, "onDxlag", [lag_id, account, region, partition]))

    @jsii.member(jsii_name="onDxvif")
    def on_dxvif(
        self,
        virtual_interface_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Directconnect":
        '''(experimental) Adds a resource of type dxvif to the statement.

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_VirtualInterface.html

        :param virtual_interface_id: - Identifier for the virtualInterfaceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1b5ceeaa5abe6ed08deb13859b3a320196e897989a34958e81871fc0214a3303)
            check_type(argname="argument virtual_interface_id", value=virtual_interface_id, expected_type=type_hints["virtual_interface_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Directconnect", jsii.invoke(self, "onDxvif", [virtual_interface_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptDirectConnectGatewayAssociationProposal")
    def to_accept_direct_connect_gateway_association_proposal(self) -> "Directconnect":
        '''(experimental) Grants permission to accept a proposal request to attach a virtual private gateway to a Direct Connect gateway.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AcceptDirectConnectGatewayAssociationProposal.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toAcceptDirectConnectGatewayAssociationProposal", []))

    @jsii.member(jsii_name="toAllocateConnectionOnInterconnect")
    def to_allocate_connection_on_interconnect(self) -> "Directconnect":
        '''(experimental) Grants permission to create a hosted connection on an interconnect.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AllocateConnectionOnInterconnect.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toAllocateConnectionOnInterconnect", []))

    @jsii.member(jsii_name="toAllocateHostedConnection")
    def to_allocate_hosted_connection(self) -> "Directconnect":
        '''(experimental) Grants permission to create a new hosted connection between a AWS Direct Connect partner's network and a specific AWS Direct Connect location.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AllocateHostedConnection.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toAllocateHostedConnection", []))

    @jsii.member(jsii_name="toAllocatePrivateVirtualInterface")
    def to_allocate_private_virtual_interface(self) -> "Directconnect":
        '''(experimental) Grants permission to provision a private virtual interface to be owned by a different customer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AllocatePrivateVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toAllocatePrivateVirtualInterface", []))

    @jsii.member(jsii_name="toAllocatePublicVirtualInterface")
    def to_allocate_public_virtual_interface(self) -> "Directconnect":
        '''(experimental) Grants permission to provision a public virtual interface to be owned by a different customer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AllocatePublicVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toAllocatePublicVirtualInterface", []))

    @jsii.member(jsii_name="toAllocateTransitVirtualInterface")
    def to_allocate_transit_virtual_interface(self) -> "Directconnect":
        '''(experimental) Grants permission to provision a transit virtual interface to be owned by a different customer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AllocateTransitVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toAllocateTransitVirtualInterface", []))

    @jsii.member(jsii_name="toAssociateConnectionWithLag")
    def to_associate_connection_with_lag(self) -> "Directconnect":
        '''(experimental) Grants permission to associate a connection with a LAG.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AssociateConnectionWithLag.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toAssociateConnectionWithLag", []))

    @jsii.member(jsii_name="toAssociateHostedConnection")
    def to_associate_hosted_connection(self) -> "Directconnect":
        '''(experimental) Grants permission to associate a hosted connection and its virtual interfaces with a link aggregation group (LAG) or interconnect.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AssociateHostedConnection.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toAssociateHostedConnection", []))

    @jsii.member(jsii_name="toAssociateMacSecKey")
    def to_associate_mac_sec_key(self) -> "Directconnect":
        '''(experimental) Grants permission to associate a MAC Security (MACsec) Connection Key Name (CKN)/ Connectivity Association Key (CAK) pair with an AWS Direct Connect dedicated connection.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AssociateMacSecKey.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toAssociateMacSecKey", []))

    @jsii.member(jsii_name="toAssociateVirtualInterface")
    def to_associate_virtual_interface(self) -> "Directconnect":
        '''(experimental) Grants permission to associate a virtual interface with a specified link aggregation group (LAG) or connection.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_AssociateVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toAssociateVirtualInterface", []))

    @jsii.member(jsii_name="toConfirmConnection")
    def to_confirm_connection(self) -> "Directconnect":
        '''(experimental) Grants permission to confirm the creation of a hosted connection on an interconnect.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_ConfirmConnection.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toConfirmConnection", []))

    @jsii.member(jsii_name="toConfirmCustomerAgreement")
    def to_confirm_customer_agreement(self) -> "Directconnect":
        '''(experimental) Grants permission to confirm the the terms of agreement when creating the connection or link aggregation group (LAG).

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_ConfirmCustomerAgreement.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toConfirmCustomerAgreement", []))

    @jsii.member(jsii_name="toConfirmPrivateVirtualInterface")
    def to_confirm_private_virtual_interface(self) -> "Directconnect":
        '''(experimental) Grants permission to accept ownership of a private virtual interface created by another customer.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_ConfirmPrivateVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toConfirmPrivateVirtualInterface", []))

    @jsii.member(jsii_name="toConfirmPublicVirtualInterface")
    def to_confirm_public_virtual_interface(self) -> "Directconnect":
        '''(experimental) Grants permission to accept ownership of a public virtual interface created by another customer.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_ConfirmPublicVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toConfirmPublicVirtualInterface", []))

    @jsii.member(jsii_name="toConfirmTransitVirtualInterface")
    def to_confirm_transit_virtual_interface(self) -> "Directconnect":
        '''(experimental) Grants permission to accept ownership of a transit virtual interface created by another customer.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_ConfirmTransitVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toConfirmTransitVirtualInterface", []))

    @jsii.member(jsii_name="toCreateBGPPeer")
    def to_create_bgp_peer(self) -> "Directconnect":
        '''(experimental) Grants permission to create a BGP peer on the specified virtual interface.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateBGPPeer.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toCreateBGPPeer", []))

    @jsii.member(jsii_name="toCreateConnection")
    def to_create_connection(self) -> "Directconnect":
        '''(experimental) Grants permission to create a new connection between the customer network and a specific AWS Direct Connect location.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateConnection.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toCreateConnection", []))

    @jsii.member(jsii_name="toCreateDirectConnectGateway")
    def to_create_direct_connect_gateway(self) -> "Directconnect":
        '''(experimental) Grants permission to create a Direct Connect gateway, which is an intermediate object that enables you to connect a set of virtual interfaces and virtual private gateways.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateDirectConnectGateway.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toCreateDirectConnectGateway", []))

    @jsii.member(jsii_name="toCreateDirectConnectGatewayAssociation")
    def to_create_direct_connect_gateway_association(self) -> "Directconnect":
        '''(experimental) Grants permission to create an association between a Direct Connect gateway and a virtual private gateway.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateDirectConnectGatewayAssociation.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toCreateDirectConnectGatewayAssociation", []))

    @jsii.member(jsii_name="toCreateDirectConnectGatewayAssociationProposal")
    def to_create_direct_connect_gateway_association_proposal(self) -> "Directconnect":
        '''(experimental) Grants permission to create a proposal to associate the specified virtual private gateway with the specified Direct Connect gateway.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateDirectConnectGatewayAssociationProposal.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toCreateDirectConnectGatewayAssociationProposal", []))

    @jsii.member(jsii_name="toCreateInterconnect")
    def to_create_interconnect(self) -> "Directconnect":
        '''(experimental) Grants permission to create a new interconnect between a AWS Direct Connect partner's network and a specific AWS Direct Connect location.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateInterconnect.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toCreateInterconnect", []))

    @jsii.member(jsii_name="toCreateLag")
    def to_create_lag(self) -> "Directconnect":
        '''(experimental) Grants permission to create a link aggregation group (LAG) with the specified number of bundled physical connections between the customer network and a specific AWS Direct Connect location.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateLag.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toCreateLag", []))

    @jsii.member(jsii_name="toCreatePrivateVirtualInterface")
    def to_create_private_virtual_interface(self) -> "Directconnect":
        '''(experimental) Grants permission to create a new private virtual interface.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreatePrivateVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toCreatePrivateVirtualInterface", []))

    @jsii.member(jsii_name="toCreatePublicVirtualInterface")
    def to_create_public_virtual_interface(self) -> "Directconnect":
        '''(experimental) Grants permission to create a new public virtual interface.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreatePublicVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toCreatePublicVirtualInterface", []))

    @jsii.member(jsii_name="toCreateTransitVirtualInterface")
    def to_create_transit_virtual_interface(self) -> "Directconnect":
        '''(experimental) Grants permission to create a new transit virtual interface.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_CreateTransitVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toCreateTransitVirtualInterface", []))

    @jsii.member(jsii_name="toDeleteBGPPeer")
    def to_delete_bgp_peer(self) -> "Directconnect":
        '''(experimental) Grants permission to delete the specified BGP peer on the specified virtual interface with the specified customer address and ASN.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteBGPPeer.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDeleteBGPPeer", []))

    @jsii.member(jsii_name="toDeleteConnection")
    def to_delete_connection(self) -> "Directconnect":
        '''(experimental) Grants permission to delete the connection.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteConnection.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDeleteConnection", []))

    @jsii.member(jsii_name="toDeleteDirectConnectGateway")
    def to_delete_direct_connect_gateway(self) -> "Directconnect":
        '''(experimental) Grants permission to delete the specified Direct Connect gateway.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteDirectConnectGateway.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDeleteDirectConnectGateway", []))

    @jsii.member(jsii_name="toDeleteDirectConnectGatewayAssociation")
    def to_delete_direct_connect_gateway_association(self) -> "Directconnect":
        '''(experimental) Grants permission to delete the association between the specified Direct Connect gateway and virtual private gateway.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteDirectConnectGatewayAssociation.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDeleteDirectConnectGatewayAssociation", []))

    @jsii.member(jsii_name="toDeleteDirectConnectGatewayAssociationProposal")
    def to_delete_direct_connect_gateway_association_proposal(self) -> "Directconnect":
        '''(experimental) Grants permission to delete the association proposal request between the specified Direct Connect gateway and virtual private gateway.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteDirectConnectGatewayAssociationProposal.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDeleteDirectConnectGatewayAssociationProposal", []))

    @jsii.member(jsii_name="toDeleteInterconnect")
    def to_delete_interconnect(self) -> "Directconnect":
        '''(experimental) Grants permission to delete the specified interconnect.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteInterconnect.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDeleteInterconnect", []))

    @jsii.member(jsii_name="toDeleteLag")
    def to_delete_lag(self) -> "Directconnect":
        '''(experimental) Grants permission to delete the specified link aggregation group (LAG).

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteLag.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDeleteLag", []))

    @jsii.member(jsii_name="toDeleteVirtualInterface")
    def to_delete_virtual_interface(self) -> "Directconnect":
        '''(experimental) Grants permission to delete a virtual interface.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DeleteVirtualInterface.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDeleteVirtualInterface", []))

    @jsii.member(jsii_name="toDescribeConnectionLoa")
    def to_describe_connection_loa(self) -> "Directconnect":
        '''(experimental) Grants permission to describe the LOA-CFA for a Connection.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeConnectionLoa.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeConnectionLoa", []))

    @jsii.member(jsii_name="toDescribeConnections")
    def to_describe_connections(self) -> "Directconnect":
        '''(experimental) Grants permission to describe all connections in this region.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeConnections.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeConnections", []))

    @jsii.member(jsii_name="toDescribeConnectionsOnInterconnect")
    def to_describe_connections_on_interconnect(self) -> "Directconnect":
        '''(experimental) Grants permission to describe a list of connections that have been provisioned on the given interconnect.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeConnectionsOnInterconnect.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeConnectionsOnInterconnect", []))

    @jsii.member(jsii_name="toDescribeCustomerMetadata")
    def to_describe_customer_metadata(self) -> "Directconnect":
        '''(experimental) Grants permission to view a list of customer agreements, along with their signed status and whether the customer is an NNIPartner, NNIPartnerV2, or a nonPartner.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeCustomerMetadata.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeCustomerMetadata", []))

    @jsii.member(jsii_name="toDescribeDirectConnectGatewayAssociationProposals")
    def to_describe_direct_connect_gateway_association_proposals(
        self,
    ) -> "Directconnect":
        '''(experimental) Grants permission to describe one or more association proposals for connection between a virtual private gateway and a Direct Connect gateway.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeDirectConnectGatewayAssociationProposals.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeDirectConnectGatewayAssociationProposals", []))

    @jsii.member(jsii_name="toDescribeDirectConnectGatewayAssociations")
    def to_describe_direct_connect_gateway_associations(self) -> "Directconnect":
        '''(experimental) Grants permission to describe the associations between your Direct Connect gateways and virtual private gateways.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeDirectConnectGatewayAssociations.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeDirectConnectGatewayAssociations", []))

    @jsii.member(jsii_name="toDescribeDirectConnectGatewayAttachments")
    def to_describe_direct_connect_gateway_attachments(self) -> "Directconnect":
        '''(experimental) Grants permission to describe the attachments between your Direct Connect gateways and virtual interfaces.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeDirectConnectGatewayAttachments.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeDirectConnectGatewayAttachments", []))

    @jsii.member(jsii_name="toDescribeDirectConnectGateways")
    def to_describe_direct_connect_gateways(self) -> "Directconnect":
        '''(experimental) Grants permission to describe all your Direct Connect gateways or only the specified Direct Connect gateway.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeDirectConnectGateways.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeDirectConnectGateways", []))

    @jsii.member(jsii_name="toDescribeHostedConnections")
    def to_describe_hosted_connections(self) -> "Directconnect":
        '''(experimental) Grants permission to describe the hosted connections that have been provisioned on the specified interconnect or link aggregation group (LAG).

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeHostedConnections.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeHostedConnections", []))

    @jsii.member(jsii_name="toDescribeInterconnectLoa")
    def to_describe_interconnect_loa(self) -> "Directconnect":
        '''(experimental) Grants permission to describe the LOA-CFA for an Interconnect.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeInterconnectLoa.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeInterconnectLoa", []))

    @jsii.member(jsii_name="toDescribeInterconnects")
    def to_describe_interconnects(self) -> "Directconnect":
        '''(experimental) Grants permission to describe a list of interconnects owned by the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeInterconnects.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeInterconnects", []))

    @jsii.member(jsii_name="toDescribeLags")
    def to_describe_lags(self) -> "Directconnect":
        '''(experimental) Grants permission to describe all your link aggregation groups (LAG) or the specified LAG.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeLags.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeLags", []))

    @jsii.member(jsii_name="toDescribeLoa")
    def to_describe_loa(self) -> "Directconnect":
        '''(experimental) Grants permission to describe the LOA-CFA for a connection, interconnect, or link aggregation group (LAG).

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeLoa.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeLoa", []))

    @jsii.member(jsii_name="toDescribeLocations")
    def to_describe_locations(self) -> "Directconnect":
        '''(experimental) Grants permission to describe the list of AWS Direct Connect locations in the current AWS region.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeLocations.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeLocations", []))

    @jsii.member(jsii_name="toDescribeRouterConfiguration")
    def to_describe_router_configuration(self) -> "Directconnect":
        '''(experimental) Grants permission to describe Details about the router for a virtual interface.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeRouterConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeRouterConfiguration", []))

    @jsii.member(jsii_name="toDescribeTags")
    def to_describe_tags(self) -> "Directconnect":
        '''(experimental) Grants permission to describe the tags associated with the specified AWS Direct Connect resources.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeTags.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeTags", []))

    @jsii.member(jsii_name="toDescribeVirtualGateways")
    def to_describe_virtual_gateways(self) -> "Directconnect":
        '''(experimental) Grants permission to describe a list of virtual private gateways owned by the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeVirtualGateways.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeVirtualGateways", []))

    @jsii.member(jsii_name="toDescribeVirtualInterfaces")
    def to_describe_virtual_interfaces(self) -> "Directconnect":
        '''(experimental) Grants permission to describe all virtual interfaces for an AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DescribeVirtualInterfaces.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDescribeVirtualInterfaces", []))

    @jsii.member(jsii_name="toDisassociateConnectionFromLag")
    def to_disassociate_connection_from_lag(self) -> "Directconnect":
        '''(experimental) Grants permission to disassociate a connection from a link aggregation group (LAG).

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DisassociateConnectionFromLag.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDisassociateConnectionFromLag", []))

    @jsii.member(jsii_name="toDisassociateMacSecKey")
    def to_disassociate_mac_sec_key(self) -> "Directconnect":
        '''(experimental) Grants permission to remove the association between a MAC Security (MACsec) security key and an AWS Direct Connect dedicated connection.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_DisassociateMacSecKey.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toDisassociateMacSecKey", []))

    @jsii.member(jsii_name="toListVirtualInterfaceTestHistory")
    def to_list_virtual_interface_test_history(self) -> "Directconnect":
        '''(experimental) Grants permission to list the virtual interface failover test history.

        Access Level: List

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_ListVirtualInterfaceTestHistory.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toListVirtualInterfaceTestHistory", []))

    @jsii.member(jsii_name="toStartBgpFailoverTest")
    def to_start_bgp_failover_test(self) -> "Directconnect":
        '''(experimental) Grants permission to start the virtual interface failover test that verifies your configuration meets your resiliency requirements by placing the BGP peering session in the DOWN state.

        You can then send traffic to verify that there are no outages

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_StartBgpFailoverTest.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toStartBgpFailoverTest", []))

    @jsii.member(jsii_name="toStopBgpFailoverTest")
    def to_stop_bgp_failover_test(self) -> "Directconnect":
        '''(experimental) Grants permission to stop the virtual interface failover test.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_StopBgpFailoverTest.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toStopBgpFailoverTest", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Directconnect":
        '''(experimental) Grants permission to add the specified tags to the specified AWS Direct Connect resource.

        Each resource can have a maximum of 50 tags

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Directconnect":
        '''(experimental) Grants permission to remove one or more tags from the specified AWS Direct Connect resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateConnection")
    def to_update_connection(self) -> "Directconnect":
        '''(experimental) Grants permission to update the AWS Direct Connect dedicated connection configuration.

        You can update the following parameters for a connection: The connection name or The connection's MAC Security (MACsec) encryption mode

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_UpdateConnection.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toUpdateConnection", []))

    @jsii.member(jsii_name="toUpdateDirectConnectGateway")
    def to_update_direct_connect_gateway(self) -> "Directconnect":
        '''(experimental) Grants permission to update the name of a Direct Connect gateway.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_UpdateDirectConnectGateway.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toUpdateDirectConnectGateway", []))

    @jsii.member(jsii_name="toUpdateDirectConnectGatewayAssociation")
    def to_update_direct_connect_gateway_association(self) -> "Directconnect":
        '''(experimental) Grants permission to update the specified attributes of the Direct Connect gateway association.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_UpdateDirectConnectGatewayAssociation.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toUpdateDirectConnectGatewayAssociation", []))

    @jsii.member(jsii_name="toUpdateLag")
    def to_update_lag(self) -> "Directconnect":
        '''(experimental) Grants permission to update the attributes of the specified link aggregation group (LAG).

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_UpdateLag.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toUpdateLag", []))

    @jsii.member(jsii_name="toUpdateVirtualInterfaceAttributes")
    def to_update_virtual_interface_attributes(self) -> "Directconnect":
        '''(experimental) Grants permission to update the specified attributes of the specified virtual private interface.

        Access Level: Write

        https://docs.aws.amazon.com/directconnect/latest/APIReference/API_UpdateVirtualInterfaceAttributes.html

        :stability: experimental
        '''
        return typing.cast("Directconnect", jsii.invoke(self, "toUpdateVirtualInterfaceAttributes", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__da32bad7317c2c09a0e9246f1bfa40efb16949b0c7ac1643839552a6362b517a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5bce97d9e63587f317b1470e68fafd26163e4a7ef56dd9ee3946b4b2b8c23a1f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Discovery(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Discovery",
):
    '''(experimental) Statement provider for service `discovery <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsapplicationdiscoveryservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `discovery <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsapplicationdiscoveryservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__20a6bff56ac27c531db030923654ee47536d9940ac9c74819d394ae4eb687b92)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toAssociateConfigurationItemsToApplication")
    def to_associate_configuration_items_to_application(self) -> "Discovery":
        '''(experimental) Grants permission to AssociateConfigurationItemsToApplication API. AssociateConfigurationItemsToApplication associates one or more configuration items with an application.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_AssociateConfigurationItemsToApplication.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toAssociateConfigurationItemsToApplication", []))

    @jsii.member(jsii_name="toBatchDeleteImportData")
    def to_batch_delete_import_data(self) -> "Discovery":
        '''(experimental) Grants permission to BatchDeleteImportData API.

        BatchDeleteImportData deletes one or more Migration Hub import tasks, each identified by their import ID. Each import task has a number of records, which can identify servers or applications

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_BatchDeleteImportData.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toBatchDeleteImportData", []))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "Discovery":
        '''(experimental) Grants permission to CreateApplication API. CreateApplication creates an application with the given name and description.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toCreateTags")
    def to_create_tags(self) -> "Discovery":
        '''(experimental) Grants permission to CreateTags API.

        CreateTags creates one or more tags for configuration items. Tags are metadata that help you categorize IT assets. This API accepts a list of multiple configuration items

        Access Level: Tagging

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_CreateTags.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toCreateTags", []))

    @jsii.member(jsii_name="toDeleteApplications")
    def to_delete_applications(self) -> "Discovery":
        '''(experimental) Grants permission to DeleteApplications API. DeleteApplications deletes a list of applications and their associations with configuration items.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DeleteApplications.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toDeleteApplications", []))

    @jsii.member(jsii_name="toDeleteTags")
    def to_delete_tags(self) -> "Discovery":
        '''(experimental) Grants permission to DeleteTags API.

        DeleteTags deletes the association between configuration items and one or more tags. This API accepts a list of multiple configuration items

        Access Level: Tagging

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DeleteTags.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toDeleteTags", []))

    @jsii.member(jsii_name="toDescribeAgents")
    def to_describe_agents(self) -> "Discovery":
        '''(experimental) Grants permission to DescribeAgents API.

        DescribeAgents lists agents or the Connector by ID or lists all agents/Connectors associated with your user account if you did not specify an ID

        Access Level: Read

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DescribeAgents.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toDescribeAgents", []))

    @jsii.member(jsii_name="toDescribeConfigurations")
    def to_describe_configurations(self) -> "Discovery":
        '''(experimental) Grants permission to DescribeConfigurations API.

        DescribeConfigurations retrieves attributes for a list of configuration item IDs. All of the supplied IDs must be for the same asset type (server, application, process, or connection). Output fields are specific to the asset type selected. For example, the output for a server configuration item includes a list of attributes about the server, such as host name, operating system, and number of network cards

        Access Level: Read

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DescribeConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toDescribeConfigurations", []))

    @jsii.member(jsii_name="toDescribeContinuousExports")
    def to_describe_continuous_exports(self) -> "Discovery":
        '''(experimental) Grants permission to DescribeContinuousExports API.

        DescribeContinuousExports lists exports as specified by ID. All continuous exports associated with your user account can be listed if you call DescribeContinuousExports as is without passing any parameters

        Access Level: Read

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DescribeContinuousExports.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toDescribeContinuousExports", []))

    @jsii.member(jsii_name="toDescribeExportConfigurations")
    def to_describe_export_configurations(self) -> "Discovery":
        '''(experimental) Grants permission to DescribeExportConfigurations API.

        DescribeExportConfigurations retrieves the status of a given export process. You can retrieve status from a maximum of 100 processes

        Access Level: Read

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DescribeExportConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toDescribeExportConfigurations", []))

    @jsii.member(jsii_name="toDescribeExportTasks")
    def to_describe_export_tasks(self) -> "Discovery":
        '''(experimental) Grants permission to DescribeExportTasks API.

        DescribeExportTasks retrieve status of one or more export tasks. You can retrieve the status of up to 100 export tasks

        Access Level: Read

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DescribeExportTasks.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toDescribeExportTasks", []))

    @jsii.member(jsii_name="toDescribeImportTasks")
    def to_describe_import_tasks(self) -> "Discovery":
        '''(experimental) Grants permission to DescribeImportTasks API.

        DescribeImportTasks returns an array of import tasks for your account, including status information, times, IDs, the Amazon S3 Object URL for the import file, and more

        Access Level: List

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DescribeImportTasks.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toDescribeImportTasks", []))

    @jsii.member(jsii_name="toDescribeTags")
    def to_describe_tags(self) -> "Discovery":
        '''(experimental) Grants permission to DescribeTags API.

        DescribeTags retrieves a list of configuration items that are tagged with a specific tag. Or retrieves a list of all tags assigned to a specific configuration item

        Access Level: Read

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DescribeTags.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toDescribeTags", []))

    @jsii.member(jsii_name="toDisassociateConfigurationItemsFromApplication")
    def to_disassociate_configuration_items_from_application(self) -> "Discovery":
        '''(experimental) Grants permission to DisassociateConfigurationItemsFromApplication API. DisassociateConfigurationItemsFromApplication disassociates one or more configuration items from an application.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_DisassociateConfigurationItemsFromApplication.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toDisassociateConfigurationItemsFromApplication", []))

    @jsii.member(jsii_name="toExportConfigurations")
    def to_export_configurations(self) -> "Discovery":
        '''(experimental) Grants permission to ExportConfigurations API.

        ExportConfigurations exports all discovered configuration data to an Amazon S3 bucket or an application that enables you to view and evaluate the data. Data includes tags and tag associations, processes, connections, servers, and system performance

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_ExportConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toExportConfigurations", []))

    @jsii.member(jsii_name="toGetDiscoverySummary")
    def to_get_discovery_summary(self) -> "Discovery":
        '''(experimental) Grants permission to GetDiscoverySummary API. GetDiscoverySummary retrieves a short summary of discovered assets.

        Access Level: Read

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_GetDiscoverySummary.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toGetDiscoverySummary", []))

    @jsii.member(jsii_name="toGetNetworkConnectionGraph")
    def to_get_network_connection_graph(self) -> "Discovery":
        '''(experimental) Grants permission to GetNetworkConnectionGraph API.

        GetNetworkConnectionGraph accepts input list of one of - Ip Addresses, server ids or node ids. Returns a list of nodes and edges which help customer visualize network connection graph. This API is used for visualize network graph functionality in MigrationHub console

        Access Level: Read

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_GetNetworkConnectionGraph.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toGetNetworkConnectionGraph", []))

    @jsii.member(jsii_name="toListConfigurations")
    def to_list_configurations(self) -> "Discovery":
        '''(experimental) Grants permission to ListConfigurations API.

        ListConfigurations retrieves a list of configuration items according to criteria you specify in a filter. The filter criteria identify relationship requirements

        Access Level: List

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_ListConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toListConfigurations", []))

    @jsii.member(jsii_name="toListServerNeighbors")
    def to_list_server_neighbors(self) -> "Discovery":
        '''(experimental) Grants permission to ListServerNeighbors API.

        ListServerNeighbors retrieves a list of servers which are one network hop away from a specified server

        Access Level: List

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_ListServerNeighbors.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toListServerNeighbors", []))

    @jsii.member(jsii_name="toStartContinuousExport")
    def to_start_continuous_export(self) -> "Discovery":
        '''(experimental) Grants permission to StartContinuousExport API. StartContinuousExport start the continuous flow of agent's discovered data into Amazon Athena.

        Access Level: Write

        Dependent actions:

        - iam:AttachRolePolicy
        - iam:CreatePolicy
        - iam:CreateRole
        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_StartContinuousExport.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toStartContinuousExport", []))

    @jsii.member(jsii_name="toStartDataCollectionByAgentIds")
    def to_start_data_collection_by_agent_ids(self) -> "Discovery":
        '''(experimental) Grants permission to StartDataCollectionByAgentIds API. StartDataCollectionByAgentIds instructs the specified agents or Connectors to start collecting data.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_StartDataCollectionByAgentIds.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toStartDataCollectionByAgentIds", []))

    @jsii.member(jsii_name="toStartExportTask")
    def to_start_export_task(self) -> "Discovery":
        '''(experimental) Grants permission to StartExportTask API.

        StartExportTask export the configuration data about discovered configuration items and relationships to an S3 bucket in a specified format

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_StartExportTask.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toStartExportTask", []))

    @jsii.member(jsii_name="toStartImportTask")
    def to_start_import_task(self) -> "Discovery":
        '''(experimental) Grants permission to StartImportTask API.

        StartImportTask starts an import task. The Migration Hub import feature allows you to import details of your on-premises environment directly into AWS without having to use the Application Discovery Service (ADS) tools such as the Discovery Connector or Discovery Agent. This gives you the option to perform migration assessment and planning directly from your imported data including the ability to group your devices as applications and track their migration status

        Access Level: Write

        Dependent actions:

        - discovery:AssociateConfigurationItemsToApplication
        - discovery:CreateApplication
        - discovery:CreateTags
        - discovery:ListConfigurations

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_StartImportTask.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toStartImportTask", []))

    @jsii.member(jsii_name="toStopContinuousExport")
    def to_stop_continuous_export(self) -> "Discovery":
        '''(experimental) Grants permission to StopContinuousExport API. StopContinuousExport stops the continuous flow of agent's discovered data into Amazon Athena.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_StopContinuousExport.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toStopContinuousExport", []))

    @jsii.member(jsii_name="toStopDataCollectionByAgentIds")
    def to_stop_data_collection_by_agent_ids(self) -> "Discovery":
        '''(experimental) Grants permission to StopDataCollectionByAgentIds API. StopDataCollectionByAgentIds instructs the specified agents or Connectors to stop collecting data.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_StopDataCollectionByAgentIds.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toStopDataCollectionByAgentIds", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "Discovery":
        '''(experimental) Grants permission to UpdateApplication API. UpdateApplication updates metadata about an application.

        Access Level: Write

        https://docs.aws.amazon.com/application-discovery/latest/APIReference/API_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("Discovery", jsii.invoke(self, "toUpdateApplication", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b947cb6dad11e51ce6db7983eff48bd65c59d7034990507e700d746fe5685ecc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c4dc3d6e5f548a5b7841120bcac36d8c710820f09988e9bfd4bfaa1985620a14)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Dlm(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Dlm"):
    '''(experimental) Statement provider for service `dlm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondatalifecyclemanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `dlm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondatalifecyclemanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__73ebe5b1cf1bfd5309dd5fb2ac80cbded57b1bcf734d517e11ab653a001016c7)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onPolicy")
    def on_policy(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dlm":
        '''(experimental) Adds a resource of type policy to the statement.

        https://docs.aws.amazon.com/dlm/latest/APIReference/API_LifecyclePolicy.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1bf7b82be83e60ae987b2e01338d9882f9b78349805a5cb6fb1d4e4b83777df4)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dlm", jsii.invoke(self, "onPolicy", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateLifecyclePolicy")
    def to_create_lifecycle_policy(self) -> "Dlm":
        '''(experimental) Grants permission to create a data lifecycle policy to manage the scheduled creation and retention of Amazon EBS snapshots.

        You may have up to 100 policies

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/dlm/latest/APIReference/API_CreateLifecyclePolicy.html

        :stability: experimental
        '''
        return typing.cast("Dlm", jsii.invoke(self, "toCreateLifecyclePolicy", []))

    @jsii.member(jsii_name="toDeleteLifecyclePolicy")
    def to_delete_lifecycle_policy(self) -> "Dlm":
        '''(experimental) Grants permission to delete an existing data lifecycle policy.

        In addition, this action halts the creation and deletion of snapshots that the policy specified. Existing snapshots are not affected

        Access Level: Write

        https://docs.aws.amazon.com/dlm/latest/APIReference/API_DeleteLifecyclePolicy.html

        :stability: experimental
        '''
        return typing.cast("Dlm", jsii.invoke(self, "toDeleteLifecyclePolicy", []))

    @jsii.member(jsii_name="toGetLifecyclePolicies")
    def to_get_lifecycle_policies(self) -> "Dlm":
        '''(experimental) Grants permission to returns a list of summary descriptions of data lifecycle policies.

        Access Level: List

        https://docs.aws.amazon.com/dlm/latest/APIReference/API_GetLifecyclePolicies.html

        :stability: experimental
        '''
        return typing.cast("Dlm", jsii.invoke(self, "toGetLifecyclePolicies", []))

    @jsii.member(jsii_name="toGetLifecyclePolicy")
    def to_get_lifecycle_policy(self) -> "Dlm":
        '''(experimental) Grants permission to return a complete description of a single data lifecycle policy.

        Access Level: Read

        https://docs.aws.amazon.com/dlm/latest/APIReference/API_GetLifecyclePolicy.html

        :stability: experimental
        '''
        return typing.cast("Dlm", jsii.invoke(self, "toGetLifecyclePolicy", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Dlm":
        '''(experimental) Grants permission to list the tags associated with a resource.

        Access Level: Read

        https://docs.aws.amazon.com/dlm/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Dlm", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Dlm":
        '''(experimental) Grants permission to add or update tags of a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/dlm/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Dlm", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Dlm":
        '''(experimental) Grants permission to remove tags associated with a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/dlm/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Dlm", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateLifecyclePolicy")
    def to_update_lifecycle_policy(self) -> "Dlm":
        '''(experimental) Grants permission to update an existing data lifecycle policy.

        Access Level: Write

        https://docs.aws.amazon.com/dlm/latest/APIReference/API_UpdateLifecyclePolicy.html

        :stability: experimental
        '''
        return typing.cast("Dlm", jsii.invoke(self, "toUpdateLifecyclePolicy", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__34465b5527e61c2661c269488e1996c118e9c6d867cbf049a065e688e13c3365)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d1b3210d561a9f39c939c06784a235afcd5758e71efb648e3b2fef097fb645f9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Dms(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Dms"):
    '''(experimental) Statement provider for service `dms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatabasemigrationservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `dms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatabasemigrationservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3bf3d272c38629bdbb5bfc07138aef77d2f25c19d8ff0620edd8e6f179a56827)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifCertTag")
    def if_cert_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dms":
        '''(experimental) Filters access by the presence of tag key-value pairs in the request for Certificate.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatabasemigrationservice.html#awsdatabasemigrationservice--dms_cert-tag___TagKey_

        Applies to resource types:

        - Certificate

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__50b916eb5ed1e21603764d0fb511a3cddddfa8f5a30629e6b29ceb14ee67e847)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Dms", jsii.invoke(self, "ifCertTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifDpTag")
    def if_dp_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dms":
        '''(experimental) Filters access by the presence of tag key-value pairs in the request for DataProvider.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatabasemigrationservice.html#awsdatabasemigrationservice--dms_dp-tag___TagKey_

        Applies to resource types:

        - DataProvider

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6be78f467c3d66f498dfac0694075f148fe2e728424a38d3e0410abca9b6130a)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Dms", jsii.invoke(self, "ifDpTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifEndpointTag")
    def if_endpoint_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dms":
        '''(experimental) Filters access by the presence of tag key-value pairs in the request for Endpoint.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatabasemigrationservice.html#awsdatabasemigrationservice-dms_endpoint-tag___TagKey_

        Applies to resource types:

        - Endpoint

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d4d3d77b2e78f2281b4884f80c07dacdd8a943300a2f44a3f7c42e389e188eba)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Dms", jsii.invoke(self, "ifEndpointTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifEsTag")
    def if_es_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dms":
        '''(experimental) Filters access by the presence of tag key-value pairs in the request for EventSubscription.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatabasemigrationservice.html#awsdatabasemigrationservice-dms_es-tag___TagKey_

        Applies to resource types:

        - EventSubscription

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9c2a832a5a6dc0f300b60bee95160c4c6d18bad3c02debcebd748088840254e6)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Dms", jsii.invoke(self, "ifEsTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifIpTag")
    def if_ip_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dms":
        '''(experimental) Filters access by the presence of tag key-value pairs in the request for InstanceProfile.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatabasemigrationservice.html#awsdatabasemigrationservice--dms_ip-tag___TagKey_

        Applies to resource types:

        - InstanceProfile

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8ac1b62af425892de46179a319e86a495558d2561577d40203a696acb4f58174)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Dms", jsii.invoke(self, "ifIpTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifMpTag")
    def if_mp_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dms":
        '''(experimental) Filters access by the presence of tag key-value pairs in the request for MigrationProject.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatabasemigrationservice.html#awsdatabasemigrationservice--dms_mp-tag___TagKey_

        Applies to resource types:

        - MigrationProject

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__079f2c88ee4815e50ba22e13bdd7342369fb1f94e7ef290de579b6e393c77099)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Dms", jsii.invoke(self, "ifMpTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifRepTag")
    def if_rep_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dms":
        '''(experimental) Filters access by the presence of tag key-value pairs in the request for ReplicationInstance.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatabasemigrationservice.html#awsdatabasemigrationservice-dms_rep-tag___TagKey_

        Applies to resource types:

        - ReplicationInstance

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__08e583036864201b47757715dcafa7baeea569da8cbc919de8537dd8bdba9f22)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Dms", jsii.invoke(self, "ifRepTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifReqTag")
    def if_req_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dms":
        '''(experimental) Filters access by the presence of tag key-value pairs in the given request.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatabasemigrationservice.html#awsdatabasemigrationservice-dms_req-tag___TagKey_

        Applies to actions:

        - .toAddTagsToResource()
        - .toCreateDataProvider()
        - .toCreateEndpoint()
        - .toCreateEventSubscription()
        - .toCreateInstanceProfile()
        - .toCreateMigrationProject()
        - .toCreateReplicationInstance()
        - .toCreateReplicationSubnetGroup()
        - .toCreateReplicationTask()

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__52f7e8b2c0824328949bf5298f2eb91c317e0ed3605bca26542ec5e6df65d8d7)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Dms", jsii.invoke(self, "ifReqTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifSubgrpTag")
    def if_subgrp_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dms":
        '''(experimental) Filters access by the presence of tag key-value pairs in the request for ReplicationSubnetGroup.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatabasemigrationservice.html#awsdatabasemigrationservice-dms_subgrp-tag___TagKey_

        Applies to resource types:

        - ReplicationSubnetGroup

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__76ba8bdd921aa1c51fd079b61f1b672908c9140a07cb4e26e882b6fee23628dd)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Dms", jsii.invoke(self, "ifSubgrpTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifTaskTag")
    def if_task_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dms":
        '''(experimental) Filters access by the presence of tag key-value pairs in the request for ReplicationTask.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdatabasemigrationservice.html#awsdatabasemigrationservice-dms_task-tag___TagKey_

        Applies to resource types:

        - ReplicationTask

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b171d3cdcf2f335f6e14d36ebec956bd605115c42e94884c4dcf44aea54ab3d5)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Dms", jsii.invoke(self, "ifTaskTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onCertificate")
    def on_certificate(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dms":
        '''(experimental) Adds a resource of type Certificate to the statement.

        https://docs.aws.amazon.com/dms/latest/APIReference/API_Certificate.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifCertTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__69a3b0149379728d4fd89dbbde346d58e1f9f81f68ad9161b9888ba736f8071f)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dms", jsii.invoke(self, "onCertificate", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onDataProvider")
    def on_data_provider(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dms":
        '''(experimental) Adds a resource of type DataProvider to the statement.

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifDpTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a7db434efcb75454051444eabe96e9de7794d6993a7812b1912245f10aa51b8b)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dms", jsii.invoke(self, "onDataProvider", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onEndpoint")
    def on_endpoint(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dms":
        '''(experimental) Adds a resource of type Endpoint to the statement.

        https://docs.aws.amazon.com/dms/latest/APIReference/API_Endpoint.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifEndpointTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__10502493bafa359f69977a5a146de7400b7efd353d92f081d09ddd8f7b98ecde)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dms", jsii.invoke(self, "onEndpoint", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onEventSubscription")
    def on_event_subscription(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dms":
        '''(experimental) Adds a resource of type EventSubscription to the statement.

        https://docs.aws.amazon.com/dms/latest/APIReference/API_EventSubscription.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifEsTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dc222a2e3547a403776fc00f8dd8f25a2544fc6f60acd79483e1965a98f75405)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dms", jsii.invoke(self, "onEventSubscription", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onInstanceProfile")
    def on_instance_profile(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dms":
        '''(experimental) Adds a resource of type InstanceProfile to the statement.

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifIpTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1953e96bf730a3c8378c4c242b78990e86d8151771a3b42ae927604785c85d28)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dms", jsii.invoke(self, "onInstanceProfile", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onMigrationProject")
    def on_migration_project(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dms":
        '''(experimental) Adds a resource of type MigrationProject to the statement.

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifMpTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__44a6db330647c22d252a6a1113b74e80b75ea7bc58c95d714791633cec6240b8)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dms", jsii.invoke(self, "onMigrationProject", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onReplicationInstance")
    def on_replication_instance(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dms":
        '''(experimental) Adds a resource of type ReplicationInstance to the statement.

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ReplicationInstance.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifRepTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6f8d74ebed91b4e2012ac0314045ea039673c441a44c00487537928612688e72)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dms", jsii.invoke(self, "onReplicationInstance", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onReplicationSubnetGroup")
    def on_replication_subnet_group(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dms":
        '''(experimental) Adds a resource of type ReplicationSubnetGroup to the statement.

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ReplicationSubnetGroup.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifSubgrpTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__41bb5545729c62335ffef5eeaee04afdc0a0f38ef40c8f9099ab0ebac12c1460)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dms", jsii.invoke(self, "onReplicationSubnetGroup", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onReplicationTask")
    def on_replication_task(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dms":
        '''(experimental) Adds a resource of type ReplicationTask to the statement.

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ReplicationTask.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifTaskTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1e52a84ee9f7a40b2426a09fc7aaa6b795321c3af8213a67efc43d96b36c8cd4)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dms", jsii.invoke(self, "onReplicationTask", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onReplicationTaskAssessmentRun")
    def on_replication_task_assessment_run(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dms":
        '''(experimental) Adds a resource of type ReplicationTaskAssessmentRun to the statement.

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ReplicationTaskAssessmentRun.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5efd068ca140dee1d47f3196b68fc165d7a17f7acc9e9f1ca30f4a468454f3f0)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dms", jsii.invoke(self, "onReplicationTaskAssessmentRun", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="onReplicationTaskIndividualAssessment")
    def on_replication_task_individual_assessment(
        self,
        resource_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dms":
        '''(experimental) Adds a resource of type ReplicationTaskIndividualAssessment to the statement.

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ReplicationTaskIndividualAssessment.html

        :param resource_name: - Identifier for the resourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__88aee3fd000cccba33cfb482d7672718f9d03b39a4528bc55e007d44907bf82c)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dms", jsii.invoke(self, "onReplicationTaskIndividualAssessment", [resource_name, account, region, partition]))

    @jsii.member(jsii_name="toAddTagsToResource")
    def to_add_tags_to_resource(self) -> "Dms":
        '''(experimental) Grants permission to add metadata tags to DMS resources, including replication instances, endpoints, security groups, and migration tasks.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        https://docs.aws.amazon.com/dms/latest/APIReference/API_AddTagsToResource.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toAddTagsToResource", []))

    @jsii.member(jsii_name="toApplyPendingMaintenanceAction")
    def to_apply_pending_maintenance_action(self) -> "Dms":
        '''(experimental) Grants permission to apply a pending maintenance action to a resource (for example, to a replication instance).

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ApplyPendingMaintenanceAction.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toApplyPendingMaintenanceAction", []))

    @jsii.member(jsii_name="toAssociateExtensionPack")
    def to_associate_extension_pack(self) -> "Dms":
        '''(experimental) Grants permission to associate a extension pack.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toAssociateExtensionPack", []))

    @jsii.member(jsii_name="toBatchStartRecommendations")
    def to_batch_start_recommendations(self) -> "Dms":
        '''(experimental) Grants permission to start the analysis of up to 20 source databases to recommend target engines for each source database.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_BatchStartRecommendations.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toBatchStartRecommendations", []))

    @jsii.member(jsii_name="toCancelMetadataModelAssessment")
    def to_cancel_metadata_model_assessment(self) -> "Dms":
        '''(experimental) Grants permission to cancel a single metadata model assessment run.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toCancelMetadataModelAssessment", []))

    @jsii.member(jsii_name="toCancelMetadataModelConversion")
    def to_cancel_metadata_model_conversion(self) -> "Dms":
        '''(experimental) Grants permission to cancel a single metadata model conversion run.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toCancelMetadataModelConversion", []))

    @jsii.member(jsii_name="toCancelMetadataModelExport")
    def to_cancel_metadata_model_export(self) -> "Dms":
        '''(experimental) Grants permission to cancel a single metadata model export run.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toCancelMetadataModelExport", []))

    @jsii.member(jsii_name="toCancelReplicationTaskAssessmentRun")
    def to_cancel_replication_task_assessment_run(self) -> "Dms":
        '''(experimental) Grants permission to cancel a single premigration assessment run.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_CancelReplicationTaskAssessmentRun.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toCancelReplicationTaskAssessmentRun", []))

    @jsii.member(jsii_name="toCreateDataProvider")
    def to_create_data_provider(self) -> "Dms":
        '''(experimental) Grants permission to create an data provider using the provided settings.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toCreateDataProvider", []))

    @jsii.member(jsii_name="toCreateEndpoint")
    def to_create_endpoint(self) -> "Dms":
        '''(experimental) Grants permission to create an endpoint using the provided settings.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        https://docs.aws.amazon.com/dms/latest/APIReference/API_CreateEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toCreateEndpoint", []))

    @jsii.member(jsii_name="toCreateEventSubscription")
    def to_create_event_subscription(self) -> "Dms":
        '''(experimental) Grants permission to create an AWS DMS event notification subscription.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        https://docs.aws.amazon.com/dms/latest/APIReference/API_CreateEventSubscription.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toCreateEventSubscription", []))

    @jsii.member(jsii_name="toCreateFleetAdvisorCollector")
    def to_create_fleet_advisor_collector(self) -> "Dms":
        '''(experimental) Grants permission to create a Fleet Advisor collector using the specified parameters.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_CreateFleetAdvisorCollector.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toCreateFleetAdvisorCollector", []))

    @jsii.member(jsii_name="toCreateInstanceProfile")
    def to_create_instance_profile(self) -> "Dms":
        '''(experimental) Grants permission to create an instance profile using the provided settings.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toCreateInstanceProfile", []))

    @jsii.member(jsii_name="toCreateMigrationProject")
    def to_create_migration_project(self) -> "Dms":
        '''(experimental) Grants permission to create an migration project using the provided settings.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toCreateMigrationProject", []))

    @jsii.member(jsii_name="toCreateReplicationInstance")
    def to_create_replication_instance(self) -> "Dms":
        '''(experimental) Grants permission to create a replication instance using the specified parameters.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        https://docs.aws.amazon.com/dms/latest/APIReference/API_CreateReplicationInstance.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toCreateReplicationInstance", []))

    @jsii.member(jsii_name="toCreateReplicationSubnetGroup")
    def to_create_replication_subnet_group(self) -> "Dms":
        '''(experimental) Grants permission to create a replication subnet group given a list of the subnet IDs in a VPC.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        https://docs.aws.amazon.com/dms/latest/APIReference/API_CreateReplicationSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toCreateReplicationSubnetGroup", []))

    @jsii.member(jsii_name="toCreateReplicationTask")
    def to_create_replication_task(self) -> "Dms":
        '''(experimental) Grants permission to create a replication task using the specified parameters.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifReqTag()

        https://docs.aws.amazon.com/dms/latest/APIReference/API_CreateReplicationTask.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toCreateReplicationTask", []))

    @jsii.member(jsii_name="toDeleteCertificate")
    def to_delete_certificate(self) -> "Dms":
        '''(experimental) Grants permission to delete the specified certificate.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DeleteCertificate.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDeleteCertificate", []))

    @jsii.member(jsii_name="toDeleteConnection")
    def to_delete_connection(self) -> "Dms":
        '''(experimental) Grants permission to delete the specified connection between a replication instance and an endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DeleteConnection.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDeleteConnection", []))

    @jsii.member(jsii_name="toDeleteDataProvider")
    def to_delete_data_provider(self) -> "Dms":
        '''(experimental) Grants permission to delete the specified data provider.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDeleteDataProvider", []))

    @jsii.member(jsii_name="toDeleteEndpoint")
    def to_delete_endpoint(self) -> "Dms":
        '''(experimental) Grants permission to delete the specified endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DeleteEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDeleteEndpoint", []))

    @jsii.member(jsii_name="toDeleteEventSubscription")
    def to_delete_event_subscription(self) -> "Dms":
        '''(experimental) Grants permission to delete an AWS DMS event subscription.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DeleteEventSubscription.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDeleteEventSubscription", []))

    @jsii.member(jsii_name="toDeleteFleetAdvisorCollector")
    def to_delete_fleet_advisor_collector(self) -> "Dms":
        '''(experimental) Grants permission to delete the specified Fleet Advisor collector.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DeleteFleetAdvisorCollector.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDeleteFleetAdvisorCollector", []))

    @jsii.member(jsii_name="toDeleteFleetAdvisorDatabases")
    def to_delete_fleet_advisor_databases(self) -> "Dms":
        '''(experimental) Grants permission to delete the specified Fleet Advisor databases.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DeleteFleetAdvisorDatabases.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDeleteFleetAdvisorDatabases", []))

    @jsii.member(jsii_name="toDeleteInstanceProfile")
    def to_delete_instance_profile(self) -> "Dms":
        '''(experimental) Grants permission to delete the specified instance profile.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDeleteInstanceProfile", []))

    @jsii.member(jsii_name="toDeleteMigrationProject")
    def to_delete_migration_project(self) -> "Dms":
        '''(experimental) Grants permission to delete the specified migration project.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDeleteMigrationProject", []))

    @jsii.member(jsii_name="toDeleteReplicationInstance")
    def to_delete_replication_instance(self) -> "Dms":
        '''(experimental) Grants permission to delete the specified replication instance.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DeleteReplicationInstance.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDeleteReplicationInstance", []))

    @jsii.member(jsii_name="toDeleteReplicationSubnetGroup")
    def to_delete_replication_subnet_group(self) -> "Dms":
        '''(experimental) Grants permission to deletes a subnet group.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DeleteReplicationSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDeleteReplicationSubnetGroup", []))

    @jsii.member(jsii_name="toDeleteReplicationTask")
    def to_delete_replication_task(self) -> "Dms":
        '''(experimental) Grants permission to delete the specified replication task.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DeleteReplicationTask.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDeleteReplicationTask", []))

    @jsii.member(jsii_name="toDeleteReplicationTaskAssessmentRun")
    def to_delete_replication_task_assessment_run(self) -> "Dms":
        '''(experimental) Grants permission to delete the record of a single premigration assessment run.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DeleteReplicationTaskAssessmentRun.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDeleteReplicationTaskAssessmentRun", []))

    @jsii.member(jsii_name="toDescribeAccountAttributes")
    def to_describe_account_attributes(self) -> "Dms":
        '''(experimental) Grants permission to list all of the AWS DMS attributes for a customer account.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeAccountAttributes.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeAccountAttributes", []))

    @jsii.member(jsii_name="toDescribeApplicableIndividualAssessments")
    def to_describe_applicable_individual_assessments(self) -> "Dms":
        '''(experimental) Grants permission to list individual assessments that you can specify for a new premigration assessment run.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeApplicableIndividualAssessments.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeApplicableIndividualAssessments", []))

    @jsii.member(jsii_name="toDescribeCertificates")
    def to_describe_certificates(self) -> "Dms":
        '''(experimental) Grants permission to provide a description of the certificate.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeCertificates.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeCertificates", []))

    @jsii.member(jsii_name="toDescribeConnections")
    def to_describe_connections(self) -> "Dms":
        '''(experimental) Grants permission to describe the status of the connections that have been made between the replication instance and an endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeConnections.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeConnections", []))

    @jsii.member(jsii_name="toDescribeEndpoints")
    def to_describe_endpoints(self) -> "Dms":
        '''(experimental) Grants permission to return information about the endpoints for your account in the current region.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeEndpoints", []))

    @jsii.member(jsii_name="toDescribeEndpointSettings")
    def to_describe_endpoint_settings(self) -> "Dms":
        '''(experimental) Grants permission to return the possible endpoint settings available when you create an endpoint for a specific database engine.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeEndpointSettings.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeEndpointSettings", []))

    @jsii.member(jsii_name="toDescribeEndpointTypes")
    def to_describe_endpoint_types(self) -> "Dms":
        '''(experimental) Grants permission to return information about the type of endpoints available.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeEndpointTypes.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeEndpointTypes", []))

    @jsii.member(jsii_name="toDescribeEventCategories")
    def to_describe_event_categories(self) -> "Dms":
        '''(experimental) Grants permission to list categories for all event source types, or, if specified, for a specified source type.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeEventCategories.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeEventCategories", []))

    @jsii.member(jsii_name="toDescribeEvents")
    def to_describe_events(self) -> "Dms":
        '''(experimental) Grants permission to list events for a given source identifier and source type.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeEvents.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeEvents", []))

    @jsii.member(jsii_name="toDescribeEventSubscriptions")
    def to_describe_event_subscriptions(self) -> "Dms":
        '''(experimental) Grants permission to list all the event subscriptions for a customer account.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeEventSubscriptions.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeEventSubscriptions", []))

    @jsii.member(jsii_name="toDescribeFleetAdvisorCollectors")
    def to_describe_fleet_advisor_collectors(self) -> "Dms":
        '''(experimental) Grants permission to return a paginated list of Fleet Advisor collectors in your account based on filter settings.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeFleetAdvisorCollectors.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeFleetAdvisorCollectors", []))

    @jsii.member(jsii_name="toDescribeFleetAdvisorDatabases")
    def to_describe_fleet_advisor_databases(self) -> "Dms":
        '''(experimental) Grants permission to return a paginated list of Fleet Advisor databases in your account based on filter settings.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeFleetAdvisorDatabases.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeFleetAdvisorDatabases", []))

    @jsii.member(jsii_name="toDescribeFleetAdvisorLsaAnalysis")
    def to_describe_fleet_advisor_lsa_analysis(self) -> "Dms":
        '''(experimental) Grants permission to return a paginated list of descriptions of large-scale assessment (LSA) analyses produced by your Fleet Advisor collectors.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeFleetAdvisorLsaAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeFleetAdvisorLsaAnalysis", []))

    @jsii.member(jsii_name="toDescribeFleetAdvisorSchemaObjectSummary")
    def to_describe_fleet_advisor_schema_object_summary(self) -> "Dms":
        '''(experimental) Grants permission to return a paginated list of descriptions of schemas discovered by your Fleet Advisor collectors based on filter settings.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeFleetAdvisorSchemaObjectSummary.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeFleetAdvisorSchemaObjectSummary", []))

    @jsii.member(jsii_name="toDescribeFleetAdvisorSchemas")
    def to_describe_fleet_advisor_schemas(self) -> "Dms":
        '''(experimental) Grants permission to return a paginated list of schemas discovered by your Fleet Advisor collectors based on filter settings.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeFleetAdvisorSchemas.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeFleetAdvisorSchemas", []))

    @jsii.member(jsii_name="toDescribeOrderableReplicationInstances")
    def to_describe_orderable_replication_instances(self) -> "Dms":
        '''(experimental) Grants permission to return information about the replication instance types that can be created in the specified region.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeOrderableReplicationInstances.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeOrderableReplicationInstances", []))

    @jsii.member(jsii_name="toDescribePendingMaintenanceActions")
    def to_describe_pending_maintenance_actions(self) -> "Dms":
        '''(experimental) Grants permission to return information about pending maintenance actions.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribePendingMaintenanceActions.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribePendingMaintenanceActions", []))

    @jsii.member(jsii_name="toDescribeRecommendationLimitations")
    def to_describe_recommendation_limitations(self) -> "Dms":
        '''(experimental) Grants permission to return a paginated list of descriptions of limitations for recommendations of target AWS engines.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeFleetAdvisorLsaAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeRecommendationLimitations", []))

    @jsii.member(jsii_name="toDescribeRecommendations")
    def to_describe_recommendations(self) -> "Dms":
        '''(experimental) Grants permission to return a paginated list of descriptions of target engine recommendations for your source databases.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeRecommendations.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeRecommendations", []))

    @jsii.member(jsii_name="toDescribeRefreshSchemasStatus")
    def to_describe_refresh_schemas_status(self) -> "Dms":
        '''(experimental) Grants permission to returns the status of the RefreshSchemas operation.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeRefreshSchemasStatus.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeRefreshSchemasStatus", []))

    @jsii.member(jsii_name="toDescribeReplicationInstances")
    def to_describe_replication_instances(self) -> "Dms":
        '''(experimental) Grants permission to return information about replication instances for your account in the current region.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeReplicationInstances.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeReplicationInstances", []))

    @jsii.member(jsii_name="toDescribeReplicationInstanceTaskLogs")
    def to_describe_replication_instance_task_logs(self) -> "Dms":
        '''(experimental) Grants permission to return information about the task logs for the specified task.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeReplicationInstanceTaskLogs.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeReplicationInstanceTaskLogs", []))

    @jsii.member(jsii_name="toDescribeReplicationSubnetGroups")
    def to_describe_replication_subnet_groups(self) -> "Dms":
        '''(experimental) Grants permission to return information about the replication subnet groups.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeReplicationSubnetGroups.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeReplicationSubnetGroups", []))

    @jsii.member(jsii_name="toDescribeReplicationTaskAssessmentResults")
    def to_describe_replication_task_assessment_results(self) -> "Dms":
        '''(experimental) Grants permission to return the latest task assessment results from Amazon S3.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeReplicationTaskAssessmentResults.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeReplicationTaskAssessmentResults", []))

    @jsii.member(jsii_name="toDescribeReplicationTaskAssessmentRuns")
    def to_describe_replication_task_assessment_runs(self) -> "Dms":
        '''(experimental) Grants permission to return a paginated list of premigration assessment runs based on filter settings.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeReplicationTaskAssessmentRuns.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeReplicationTaskAssessmentRuns", []))

    @jsii.member(jsii_name="toDescribeReplicationTaskIndividualAssessments")
    def to_describe_replication_task_individual_assessments(self) -> "Dms":
        '''(experimental) Grants permission to return a paginated list of individual assessments based on filter settings.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeReplicationTaskIndividualAssessments.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeReplicationTaskIndividualAssessments", []))

    @jsii.member(jsii_name="toDescribeReplicationTasks")
    def to_describe_replication_tasks(self) -> "Dms":
        '''(experimental) Grants permission to return information about replication tasks for your account in the current region.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeReplicationTasks.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeReplicationTasks", []))

    @jsii.member(jsii_name="toDescribeSchemas")
    def to_describe_schemas(self) -> "Dms":
        '''(experimental) Grants permission to return information about the schema for the specified endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeSchemas.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeSchemas", []))

    @jsii.member(jsii_name="toDescribeTableStatistics")
    def to_describe_table_statistics(self) -> "Dms":
        '''(experimental) Grants permission to return table statistics on the database migration task, including table name, rows inserted, rows updated, and rows deleted.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_DescribeTableStatistics.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDescribeTableStatistics", []))

    @jsii.member(jsii_name="toDisassociateExtensionPack")
    def to_disassociate_extension_pack(self) -> "Dms":
        '''(experimental) Grants permission to disassociate a extension pack.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toDisassociateExtensionPack", []))

    @jsii.member(jsii_name="toExportMetadataModelAssessment")
    def to_export_metadata_model_assessment(self) -> "Dms":
        '''(experimental) Grants permission to export the specified metadata model assessment.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toExportMetadataModelAssessment", []))

    @jsii.member(jsii_name="toGetMetadataModel")
    def to_get_metadata_model(self) -> "Dms":
        '''(experimental) Grants permission to list all of the AWS DMS attributes for a metadata model.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toGetMetadataModel", []))

    @jsii.member(jsii_name="toImportCertificate")
    def to_import_certificate(self) -> "Dms":
        '''(experimental) Grants permission to upload the specified certificate.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ImportCertificate.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toImportCertificate", []))

    @jsii.member(jsii_name="toListDataProviders")
    def to_list_data_providers(self) -> "Dms":
        '''(experimental) Grants permission to list the AWS DMS attributes for a data providers.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toListDataProviders", []))

    @jsii.member(jsii_name="toListExtensionPacks")
    def to_list_extension_packs(self) -> "Dms":
        '''(experimental) Grants permission to list the AWS DMS attributes for a extension packs.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toListExtensionPacks", []))

    @jsii.member(jsii_name="toListInstanceProfiles")
    def to_list_instance_profiles(self) -> "Dms":
        '''(experimental) Grants permission to list the AWS DMS attributes for a instance profiles.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toListInstanceProfiles", []))

    @jsii.member(jsii_name="toListMetadataModelAssessmentActionItems")
    def to_list_metadata_model_assessment_action_items(self) -> "Dms":
        '''(experimental) Grants permission to list the AWS DMS attributes for a metadata model assessment action items.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toListMetadataModelAssessmentActionItems", []))

    @jsii.member(jsii_name="toListMetadataModelAssessments")
    def to_list_metadata_model_assessments(self) -> "Dms":
        '''(experimental) Grants permission to list the AWS DMS attributes for a metadata model assessments.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toListMetadataModelAssessments", []))

    @jsii.member(jsii_name="toListMetadataModelConversions")
    def to_list_metadata_model_conversions(self) -> "Dms":
        '''(experimental) Grants permission to list the AWS DMS attributes for a metadata model conversions.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toListMetadataModelConversions", []))

    @jsii.member(jsii_name="toListMetadataModelExports")
    def to_list_metadata_model_exports(self) -> "Dms":
        '''(experimental) Grants permission to list the AWS DMS attributes for a metadata model exports.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toListMetadataModelExports", []))

    @jsii.member(jsii_name="toListMigrationProjects")
    def to_list_migration_projects(self) -> "Dms":
        '''(experimental) Grants permission to list the AWS DMS attributes for a migration projects.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toListMigrationProjects", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Dms":
        '''(experimental) Grants permission to list all tags for an AWS DMS resource.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toModifyEndpoint")
    def to_modify_endpoint(self) -> "Dms":
        '''(experimental) Grants permission to modify the specified endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ModifyEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toModifyEndpoint", []))

    @jsii.member(jsii_name="toModifyEventSubscription")
    def to_modify_event_subscription(self) -> "Dms":
        '''(experimental) Grants permission to modify an existing AWS DMS event notification subscription.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ModifyEventSubscription.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toModifyEventSubscription", []))

    @jsii.member(jsii_name="toModifyFleetAdvisorCollector")
    def to_modify_fleet_advisor_collector(self) -> "Dms":
        '''(experimental) Grants permission to modify the name and description of the specified Fleet Advisor collector.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toModifyFleetAdvisorCollector", []))

    @jsii.member(jsii_name="toModifyFleetAdvisorCollectorStatuses")
    def to_modify_fleet_advisor_collector_statuses(self) -> "Dms":
        '''(experimental) Grants permission to modify the status of the specified Fleet Advisor collector.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toModifyFleetAdvisorCollectorStatuses", []))

    @jsii.member(jsii_name="toModifyReplicationInstance")
    def to_modify_replication_instance(self) -> "Dms":
        '''(experimental) Grants permission to modify the replication instance to apply new settings.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ModifyReplicationInstance.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toModifyReplicationInstance", []))

    @jsii.member(jsii_name="toModifyReplicationSubnetGroup")
    def to_modify_replication_subnet_group(self) -> "Dms":
        '''(experimental) Grants permission to modify the settings for the specified replication subnet group.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ModifyReplicationSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toModifyReplicationSubnetGroup", []))

    @jsii.member(jsii_name="toModifyReplicationTask")
    def to_modify_replication_task(self) -> "Dms":
        '''(experimental) Grants permission to modify the specified replication task.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ModifyReplicationTask.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toModifyReplicationTask", []))

    @jsii.member(jsii_name="toMoveReplicationTask")
    def to_move_replication_task(self) -> "Dms":
        '''(experimental) Grants permission to move the specified replication task to a different replication instance.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_MoveReplicationTask.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toMoveReplicationTask", []))

    @jsii.member(jsii_name="toRebootReplicationInstance")
    def to_reboot_replication_instance(self) -> "Dms":
        '''(experimental) Grants permission to reboot a replication instance.

        Rebooting results in a momentary outage, until the replication instance becomes available again

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_RebootReplicationInstance.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toRebootReplicationInstance", []))

    @jsii.member(jsii_name="toRefreshSchemas")
    def to_refresh_schemas(self) -> "Dms":
        '''(experimental) Grants permission to populate the schema for the specified endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_RefreshSchemas.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toRefreshSchemas", []))

    @jsii.member(jsii_name="toReloadTables")
    def to_reload_tables(self) -> "Dms":
        '''(experimental) Grants permission to reload the target database table with the source data.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_ReloadTables.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toReloadTables", []))

    @jsii.member(jsii_name="toRemoveTagsFromResource")
    def to_remove_tags_from_resource(self) -> "Dms":
        '''(experimental) Grants permission to remove metadata tags from a DMS resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/dms/latest/APIReference/API_RemoveTagsFromResource.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toRemoveTagsFromResource", []))

    @jsii.member(jsii_name="toRunFleetAdvisorLsaAnalysis")
    def to_run_fleet_advisor_lsa_analysis(self) -> "Dms":
        '''(experimental) Grants permission to run a large-scale assessment (LSA) analysis on every Fleet Advisor collector in your account.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_RunFleetAdvisorLsaAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toRunFleetAdvisorLsaAnalysis", []))

    @jsii.member(jsii_name="toStartMetadataModelAssessment")
    def to_start_metadata_model_assessment(self) -> "Dms":
        '''(experimental) Grants permission to start a new assessment of metadata model.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toStartMetadataModelAssessment", []))

    @jsii.member(jsii_name="toStartMetadataModelConversion")
    def to_start_metadata_model_conversion(self) -> "Dms":
        '''(experimental) Grants permission to start a new conversion of metadata model.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toStartMetadataModelConversion", []))

    @jsii.member(jsii_name="toStartMetadataModelExportAsScripts")
    def to_start_metadata_model_export_as_scripts(self) -> "Dms":
        '''(experimental) Grants permission to start a new export of metadata model as script.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toStartMetadataModelExportAsScripts", []))

    @jsii.member(jsii_name="toStartMetadataModelExportToTarget")
    def to_start_metadata_model_export_to_target(self) -> "Dms":
        '''(experimental) Grants permission to start a new export of metadata model to target.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toStartMetadataModelExportToTarget", []))

    @jsii.member(jsii_name="toStartMetadataModelImport")
    def to_start_metadata_model_import(self) -> "Dms":
        '''(experimental) Grants permission to start a new import of metadata model.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toStartMetadataModelImport", []))

    @jsii.member(jsii_name="toStartRecommendations")
    def to_start_recommendations(self) -> "Dms":
        '''(experimental) Grants permission to start the analysis of your source database to provide recommendations of target engines.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_StartRecommendations.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toStartRecommendations", []))

    @jsii.member(jsii_name="toStartReplicationTask")
    def to_start_replication_task(self) -> "Dms":
        '''(experimental) Grants permission to start the replication task.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_StartReplicationTask.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toStartReplicationTask", []))

    @jsii.member(jsii_name="toStartReplicationTaskAssessment")
    def to_start_replication_task_assessment(self) -> "Dms":
        '''(experimental) Grants permission to start the replication task assessment for unsupported data types in the source database.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_StartReplicationTaskAssessment.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toStartReplicationTaskAssessment", []))

    @jsii.member(jsii_name="toStartReplicationTaskAssessmentRun")
    def to_start_replication_task_assessment_run(self) -> "Dms":
        '''(experimental) Grants permission to start a new premigration assessment run for one or more individual assessments of a migration task.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_StartReplicationTaskAssessmentRun.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toStartReplicationTaskAssessmentRun", []))

    @jsii.member(jsii_name="toStopReplicationTask")
    def to_stop_replication_task(self) -> "Dms":
        '''(experimental) Grants permission to stop the replication task.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_StopReplicationTask.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toStopReplicationTask", []))

    @jsii.member(jsii_name="toTestConnection")
    def to_test_connection(self) -> "Dms":
        '''(experimental) Grants permission to test the connection between the replication instance and the endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/dms/latest/APIReference/API_TestConnection.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toTestConnection", []))

    @jsii.member(jsii_name="toUpdateConversionConfiguration")
    def to_update_conversion_configuration(self) -> "Dms":
        '''(experimental) Grants permission to update a conversion configuration.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toUpdateConversionConfiguration", []))

    @jsii.member(jsii_name="toUpdateDataProvider")
    def to_update_data_provider(self) -> "Dms":
        '''(experimental) Grants permission to update the specified data provider.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toUpdateDataProvider", []))

    @jsii.member(jsii_name="toUpdateInstanceProfile")
    def to_update_instance_profile(self) -> "Dms":
        '''(experimental) Grants permission to update the specified instance profile.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toUpdateInstanceProfile", []))

    @jsii.member(jsii_name="toUpdateMigrationProject")
    def to_update_migration_project(self) -> "Dms":
        '''(experimental) Grants permission to update the specified migration project.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toUpdateMigrationProject", []))

    @jsii.member(jsii_name="toUpdateSubscriptionsToEventBridge")
    def to_update_subscriptions_to_event_bridge(self) -> "Dms":
        '''(experimental) Grants permission to migrate DMS subcriptions to Eventbridge.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/API_UpdateSubscriptionsToEventBridge.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toUpdateSubscriptionsToEventBridge", []))

    @jsii.member(jsii_name="toUploadFileMetadataList")
    def to_upload_file_metadata_list(self) -> "Dms":
        '''(experimental) Grants permission to upload files to your Amazon S3 bucket.

        Access Level: Write

        https://docs.aws.amazon.com/dms/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Dms", jsii.invoke(self, "toUploadFileMetadataList", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7c674e62fdc8ded7290fef216efbdd8298bd0e40870cc1d2b7bea392cba23b93)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ee07690f1135d8169152108c39c4a0578243f3894944438cf652b400adc1ee2b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class DocdbElastic(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.DocdbElastic",
):
    '''(experimental) Statement provider for service `docdb-elastic <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondocumentdbelasticclusters.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `docdb-elastic <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondocumentdbelasticclusters.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__771637d30fc844c4e5619e5d447f7aaa60e281d8afc625511ccf0fa769fdd400)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "DocdbElastic":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/documentdb/latest/developerguide/elastic-managing.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__11663c235960f713384b886ab3c7c523f41d44a868fad36be931a6380bdefb02)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("DocdbElastic", jsii.invoke(self, "onCluster", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onClusterSnapshot")
    def on_cluster_snapshot(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "DocdbElastic":
        '''(experimental) Adds a resource of type cluster-snapshot to the statement.

        https://docs.aws.amazon.com/documentdb/latest/developerguide/elastic-managing.html#elastic-manage-snapshots

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9f90a27c642e3b22301ddfc5cb613566ebd4fde85850eb8a192f8d95a2a277f5)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("DocdbElastic", jsii.invoke(self, "onClusterSnapshot", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateCluster")
    def to_create_cluster(self) -> "DocdbElastic":
        '''(experimental) Grants permission to create a new Amazon DocDB-Elastic cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:CreateVpcEndpoint
        - ec2:DeleteVpcEndpoints
        - ec2:DescribeAvailabilityZones
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:DescribeVpcAttribute
        - ec2:DescribeVpcEndpoints
        - ec2:DescribeVpcs
        - ec2:ModifyVpcEndpoint
        - iam:CreateServiceLinkedRole
        - kms:CreateGrant
        - kms:Decrypt
        - kms:DescribeKey
        - kms:GenerateDataKey
        - secretsmanager:DescribeSecret
        - secretsmanager:GetResourcePolicy
        - secretsmanager:GetSecretValue
        - secretsmanager:ListSecretVersionIds
        - secretsmanager:ListSecrets

        https://docs.aws.amazon.com/documentdb/latest/developerguide/API_elastic_CreateCluster.html

        :stability: experimental
        '''
        return typing.cast("DocdbElastic", jsii.invoke(self, "toCreateCluster", []))

    @jsii.member(jsii_name="toCreateClusterSnapshot")
    def to_create_cluster_snapshot(self) -> "DocdbElastic":
        '''(experimental) Grants permission to create a new Amazon DocDB-Elastic cluster snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:CreateVpcEndpoint
        - ec2:DeleteVpcEndpoints
        - ec2:DescribeAvailabilityZones
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:DescribeVpcAttribute
        - ec2:DescribeVpcEndpoints
        - ec2:DescribeVpcs
        - ec2:ModifyVpcEndpoint
        - iam:CreateServiceLinkedRole
        - kms:CreateGrant
        - kms:Decrypt
        - kms:DescribeKey
        - kms:GenerateDataKey
        - secretsmanager:DescribeSecret
        - secretsmanager:GetResourcePolicy
        - secretsmanager:GetSecretValue
        - secretsmanager:ListSecretVersionIds
        - secretsmanager:ListSecrets

        https://docs.aws.amazon.com/documentdb/latest/developerguide/API_elastic_CreateClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("DocdbElastic", jsii.invoke(self, "toCreateClusterSnapshot", []))

    @jsii.member(jsii_name="toDeleteCluster")
    def to_delete_cluster(self) -> "DocdbElastic":
        '''(experimental) Grants permission to delete a cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:DeleteVpcEndpoints
        - ec2:DescribeAvailabilityZones
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:DescribeVpcAttribute
        - ec2:DescribeVpcEndpoints
        - ec2:DescribeVpcs
        - ec2:ModifyVpcEndpoint

        https://docs.aws.amazon.com/documentdb/latest/developerguide/API_elastic_DeleteCluster.html

        :stability: experimental
        '''
        return typing.cast("DocdbElastic", jsii.invoke(self, "toDeleteCluster", []))

    @jsii.member(jsii_name="toDeleteClusterSnapshot")
    def to_delete_cluster_snapshot(self) -> "DocdbElastic":
        '''(experimental) Grants permission to delete a cluster snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:DeleteVpcEndpoints
        - ec2:DescribeAvailabilityZones
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:DescribeVpcAttribute
        - ec2:DescribeVpcEndpoints
        - ec2:DescribeVpcs
        - ec2:ModifyVpcEndpoint

        https://docs.aws.amazon.com/documentdb/latest/developerguide/API_elastic_DeleteClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("DocdbElastic", jsii.invoke(self, "toDeleteClusterSnapshot", []))

    @jsii.member(jsii_name="toGetCluster")
    def to_get_cluster(self) -> "DocdbElastic":
        '''(experimental) Grants permission to view details about a cluster.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/documentdb/latest/developerguide/API_elastic_GetCluster.html

        :stability: experimental
        '''
        return typing.cast("DocdbElastic", jsii.invoke(self, "toGetCluster", []))

    @jsii.member(jsii_name="toGetClusterSnapshot")
    def to_get_cluster_snapshot(self) -> "DocdbElastic":
        '''(experimental) Grants permission to view details about a cluster snapshot.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/documentdb/latest/developerguide/API_elastic_GetClusterSnapshot.html

        :stability: experimental
        '''
        return typing.cast("DocdbElastic", jsii.invoke(self, "toGetClusterSnapshot", []))

    @jsii.member(jsii_name="toListClusters")
    def to_list_clusters(self) -> "DocdbElastic":
        '''(experimental) Grants permission to list the clusters in your account.

        Access Level: List

        https://docs.aws.amazon.com/documentdb/latest/developerguide/API_elastic_ListClusters.html

        :stability: experimental
        '''
        return typing.cast("DocdbElastic", jsii.invoke(self, "toListClusters", []))

    @jsii.member(jsii_name="toListClusterSnapshots")
    def to_list_cluster_snapshots(self) -> "DocdbElastic":
        '''(experimental) Grants permission to list the cluster snapshots in your account.

        Access Level: List

        https://docs.aws.amazon.com/documentdb/latest/developerguide/API_elastic_ListClusterSnapshots.html

        :stability: experimental
        '''
        return typing.cast("DocdbElastic", jsii.invoke(self, "toListClusterSnapshots", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "DocdbElastic":
        '''(experimental) Grants permission to lists tag for an DocumentDB Elastic resource.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/documentdb/latest/developerguide/API_elastic_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("DocdbElastic", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRestoreClusterFromSnapshot")
    def to_restore_cluster_from_snapshot(self) -> "DocdbElastic":
        '''(experimental) Grants permission to restore cluster from a Amazon DocDB-Elastic cluster snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:CreateVpcEndpoint
        - ec2:DeleteVpcEndpoints
        - ec2:DescribeAvailabilityZones
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:DescribeVpcAttribute
        - ec2:DescribeVpcEndpoints
        - ec2:DescribeVpcs
        - ec2:ModifyVpcEndpoint
        - iam:CreateServiceLinkedRole
        - kms:CreateGrant
        - kms:Decrypt
        - kms:DescribeKey
        - kms:GenerateDataKey
        - secretsmanager:DescribeSecret
        - secretsmanager:GetResourcePolicy
        - secretsmanager:GetSecretValue
        - secretsmanager:ListSecretVersionIds
        - secretsmanager:ListSecrets

        https://docs.aws.amazon.com/documentdb/latest/developerguide/API_elastic_RestoreClusterFromSnapshot.html

        :stability: experimental
        '''
        return typing.cast("DocdbElastic", jsii.invoke(self, "toRestoreClusterFromSnapshot", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "DocdbElastic":
        '''(experimental) Grants permission to tag an DocumentDB Elastic resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/documentdb/latest/developerguide/API_elastic_TagResource.html

        :stability: experimental
        '''
        return typing.cast("DocdbElastic", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "DocdbElastic":
        '''(experimental) Grants permission to untag a DocumentDB Elastic resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/documentdb/latest/developerguide/API_elastic_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("DocdbElastic", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateCluster")
    def to_update_cluster(self) -> "DocdbElastic":
        '''(experimental) Grants permission to modify a cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:CreateVpcEndpoint
        - ec2:DeleteVpcEndpoints
        - ec2:DescribeAvailabilityZones
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:DescribeVpcAttribute
        - ec2:DescribeVpcEndpoints
        - ec2:DescribeVpcs
        - ec2:ModifyVpcEndpoint
        - kms:CreateGrant
        - kms:Decrypt
        - kms:DescribeKey
        - kms:GenerateDataKey
        - secretsmanager:DescribeSecret
        - secretsmanager:GetResourcePolicy
        - secretsmanager:GetSecretValue
        - secretsmanager:ListSecretVersionIds
        - secretsmanager:ListSecrets

        https://docs.aws.amazon.com/documentdb/latest/developerguide/API_elastic_UpdateCluster.html

        :stability: experimental
        '''
        return typing.cast("DocdbElastic", jsii.invoke(self, "toUpdateCluster", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5186b436d4f4005f3ba4bdfcc5ba1323d22bfe95b5212db45c3600404f28ad38)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7d94a4e5314dc7b3db6f85223bf64ed29a4267d6fc1a4df8cbeb6b02a40952ee)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Drs(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Drs"):
    '''(experimental) Statement provider for service `drs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticdisasterrecovery.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `drs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticdisasterrecovery.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__25ef9e5a882c0a4ed53abdb0f886085cf2ab1ea529616797ba7ad4039f76f510)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifCreateAction")
    def if_create_action(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Drs":
        '''(experimental) Filters access by the name of a resource-creating API action.

        https://docs.aws.amazon.com/drs/latest/userguide/supported-iam-actions-tagging.html

        Applies to actions:

        - .toTagResource()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b2a5aa4f0999d137c8a20903f8f0806d14db14eecc6eeb01b5c9f2e9b1e1ac6b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Drs", jsii.invoke(self, "ifCreateAction", [value, operator]))

    @jsii.member(jsii_name="ifEC2InstanceARN")
    def if_ec2_instance_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Drs":
        '''(experimental) Filters access by the EC2 instance the request originated from.

        https://docs.aws.amazon.com/drs/latest/userguide/security_iam_authentication.html

        Applies to resource types:

        - RecoveryInstanceResource

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e11a3675320a299247730371d164644de9d316fb1c45424e53a4b046d00844ba)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Drs", jsii.invoke(self, "ifEC2InstanceARN", [value, operator]))

    @jsii.member(jsii_name="onJobResource")
    def on_job_resource(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Drs":
        '''(experimental) Adds a resource of type JobResource to the statement.

        https://docs.aws.amazon.com/drs/latest/userguide/failback-overview.html

        :param job_id: - Identifier for the jobID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dff93b035fe826be523719bdba0fcaea7b3b6d97885be67892609d9e2169fc5f)
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Drs", jsii.invoke(self, "onJobResource", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onRecoveryInstanceResource")
    def on_recovery_instance_resource(
        self,
        recovery_instance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Drs":
        '''(experimental) Adds a resource of type RecoveryInstanceResource to the statement.

        https://docs.aws.amazon.com/drs/latest/userguide/recovery-instances.html

        :param recovery_instance_id: - Identifier for the recoveryInstanceID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifEC2InstanceARN()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dc60adc7337ead6cf1bb0e40a5d60d0ba3e78123d2000940f7333da01388a66b)
            check_type(argname="argument recovery_instance_id", value=recovery_instance_id, expected_type=type_hints["recovery_instance_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Drs", jsii.invoke(self, "onRecoveryInstanceResource", [recovery_instance_id, account, region, partition]))

    @jsii.member(jsii_name="onReplicationConfigurationTemplateResource")
    def on_replication_configuration_template_resource(
        self,
        replication_configuration_template_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Drs":
        '''(experimental) Adds a resource of type ReplicationConfigurationTemplateResource to the statement.

        https://docs.aws.amazon.com/drs/latest/userguide/replication-settings-template.html

        :param replication_configuration_template_id: - Identifier for the replicationConfigurationTemplateID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__820805f3edc94020315d722e05e36f1240aa6f8a37e62bee0bfbda74351807fc)
            check_type(argname="argument replication_configuration_template_id", value=replication_configuration_template_id, expected_type=type_hints["replication_configuration_template_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Drs", jsii.invoke(self, "onReplicationConfigurationTemplateResource", [replication_configuration_template_id, account, region, partition]))

    @jsii.member(jsii_name="onSourceServerResource")
    def on_source_server_resource(
        self,
        source_server_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Drs":
        '''(experimental) Adds a resource of type SourceServerResource to the statement.

        https://docs.aws.amazon.com/drs/latest/userguide/source-servers.html

        :param source_server_id: - Identifier for the sourceServerID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a2887f536e44f6804cfc70feb8cafd0f76e62ff818382c52b9bebcf1536f72f3)
            check_type(argname="argument source_server_id", value=source_server_id, expected_type=type_hints["source_server_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Drs", jsii.invoke(self, "onSourceServerResource", [source_server_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateFailbackClientToRecoveryInstanceForDrs")
    def to_associate_failback_client_to_recovery_instance_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to get associate failback client to recovery instance.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toAssociateFailbackClientToRecoveryInstanceForDrs", []))

    @jsii.member(jsii_name="toBatchCreateVolumeSnapshotGroupForDrs")
    def to_batch_create_volume_snapshot_group_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to batch create volume snapshot group.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toBatchCreateVolumeSnapshotGroupForDrs", []))

    @jsii.member(jsii_name="toBatchDeleteSnapshotRequestForDrs")
    def to_batch_delete_snapshot_request_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to batch delete snapshot request.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toBatchDeleteSnapshotRequestForDrs", []))

    @jsii.member(jsii_name="toCreateConvertedSnapshotForDrs")
    def to_create_converted_snapshot_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to create converted snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toCreateConvertedSnapshotForDrs", []))

    @jsii.member(jsii_name="toCreateExtendedSourceServer")
    def to_create_extended_source_server(self) -> "Drs":
        '''(experimental) Grants permission to extend a source server.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - drs:DescribeSourceServers
        - drs:GetReplicationConfiguration

        https://docs.aws.amazon.com/drs/latest/APIReference/API_CreateExtendedSourceServer.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toCreateExtendedSourceServer", []))

    @jsii.member(jsii_name="toCreateRecoveryInstanceForDrs")
    def to_create_recovery_instance_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to create recovery instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toCreateRecoveryInstanceForDrs", []))

    @jsii.member(jsii_name="toCreateReplicationConfigurationTemplate")
    def to_create_replication_configuration_template(self) -> "Drs":
        '''(experimental) Grants permission to create replication configuration template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:CreateSecurityGroup
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:GetEbsDefaultKmsKeyId
        - ec2:GetEbsEncryptionByDefault
        - kms:CreateGrant
        - kms:DescribeKey

        https://docs.aws.amazon.com/drs/latest/APIReference/API_CreateReplicationConfigurationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toCreateReplicationConfigurationTemplate", []))

    @jsii.member(jsii_name="toCreateSourceServerForDrs")
    def to_create_source_server_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to create a source server.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toCreateSourceServerForDrs", []))

    @jsii.member(jsii_name="toDeleteJob")
    def to_delete_job(self) -> "Drs":
        '''(experimental) Grants permission to delete a job.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/APIReference/API_DeleteJob.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toDeleteJob", []))

    @jsii.member(jsii_name="toDeleteRecoveryInstance")
    def to_delete_recovery_instance(self) -> "Drs":
        '''(experimental) Grants permission to delete recovery instance.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/APIReference/API_DeleteRecoveryInstance.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toDeleteRecoveryInstance", []))

    @jsii.member(jsii_name="toDeleteReplicationConfigurationTemplate")
    def to_delete_replication_configuration_template(self) -> "Drs":
        '''(experimental) Grants permission to delete replication configuration template.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/APIReference/API_DeleteReplicationConfigurationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toDeleteReplicationConfigurationTemplate", []))

    @jsii.member(jsii_name="toDeleteSourceServer")
    def to_delete_source_server(self) -> "Drs":
        '''(experimental) Grants permission to delete source server.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/APIReference/API_DeleteSourceServer.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toDeleteSourceServer", []))

    @jsii.member(jsii_name="toDescribeJobLogItems")
    def to_describe_job_log_items(self) -> "Drs":
        '''(experimental) Grants permission to describe job log items.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/APIReference/API_DescribeJobLogItems.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toDescribeJobLogItems", []))

    @jsii.member(jsii_name="toDescribeJobs")
    def to_describe_jobs(self) -> "Drs":
        '''(experimental) Grants permission to describe jobs.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/APIReference/API_DescribeJobs.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toDescribeJobs", []))

    @jsii.member(jsii_name="toDescribeRecoveryInstances")
    def to_describe_recovery_instances(self) -> "Drs":
        '''(experimental) Grants permission to describe recovery instances.

        Access Level: Read

        Dependent actions:

        - drs:DescribeSourceServers
        - ec2:DescribeInstances

        https://docs.aws.amazon.com/drs/latest/APIReference/API_DescribeRecoveryInstances.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toDescribeRecoveryInstances", []))

    @jsii.member(jsii_name="toDescribeRecoverySnapshots")
    def to_describe_recovery_snapshots(self) -> "Drs":
        '''(experimental) Grants permission to describe recovery snapshots.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/APIReference/API_DescribeRecoverySnapshots.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toDescribeRecoverySnapshots", []))

    @jsii.member(jsii_name="toDescribeReplicationConfigurationTemplates")
    def to_describe_replication_configuration_templates(self) -> "Drs":
        '''(experimental) Grants permission to describe replication configuration template.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/APIReference/API_DescribeReplicationConfigurationTemplates.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toDescribeReplicationConfigurationTemplates", []))

    @jsii.member(jsii_name="toDescribeReplicationServerAssociationsForDrs")
    def to_describe_replication_server_associations_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to describe replication server associations.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toDescribeReplicationServerAssociationsForDrs", []))

    @jsii.member(jsii_name="toDescribeSnapshotRequestsForDrs")
    def to_describe_snapshot_requests_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to describe snapshot requests.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toDescribeSnapshotRequestsForDrs", []))

    @jsii.member(jsii_name="toDescribeSourceServers")
    def to_describe_source_servers(self) -> "Drs":
        '''(experimental) Grants permission to describe source servers.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/APIReference/API_DescribeSourceServers.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toDescribeSourceServers", []))

    @jsii.member(jsii_name="toDisconnectRecoveryInstance")
    def to_disconnect_recovery_instance(self) -> "Drs":
        '''(experimental) Grants permission to disconnect recovery instance.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/APIReference/API_DisconnectRecoveryInstance.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toDisconnectRecoveryInstance", []))

    @jsii.member(jsii_name="toDisconnectSourceServer")
    def to_disconnect_source_server(self) -> "Drs":
        '''(experimental) Grants permission to disconnect source server.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/APIReference/API_DisconnectSourceServer.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toDisconnectSourceServer", []))

    @jsii.member(jsii_name="toGetAgentCommandForDrs")
    def to_get_agent_command_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to get agent command.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toGetAgentCommandForDrs", []))

    @jsii.member(jsii_name="toGetAgentConfirmedResumeInfoForDrs")
    def to_get_agent_confirmed_resume_info_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to get agent confirmed resume info.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toGetAgentConfirmedResumeInfoForDrs", []))

    @jsii.member(jsii_name="toGetAgentInstallationAssetsForDrs")
    def to_get_agent_installation_assets_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to get agent installation assets.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toGetAgentInstallationAssetsForDrs", []))

    @jsii.member(jsii_name="toGetAgentReplicationInfoForDrs")
    def to_get_agent_replication_info_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to get agent replication info.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toGetAgentReplicationInfoForDrs", []))

    @jsii.member(jsii_name="toGetAgentRuntimeConfigurationForDrs")
    def to_get_agent_runtime_configuration_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to get agent runtime configuration.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toGetAgentRuntimeConfigurationForDrs", []))

    @jsii.member(jsii_name="toGetAgentSnapshotCreditsForDrs")
    def to_get_agent_snapshot_credits_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to get agent snapshot credits.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toGetAgentSnapshotCreditsForDrs", []))

    @jsii.member(jsii_name="toGetChannelCommandsForDrs")
    def to_get_channel_commands_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to get channel commands.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toGetChannelCommandsForDrs", []))

    @jsii.member(jsii_name="toGetFailbackCommandForDrs")
    def to_get_failback_command_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to get failback command.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toGetFailbackCommandForDrs", []))

    @jsii.member(jsii_name="toGetFailbackLaunchRequestedForDrs")
    def to_get_failback_launch_requested_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to get failback launch requested.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toGetFailbackLaunchRequestedForDrs", []))

    @jsii.member(jsii_name="toGetFailbackReplicationConfiguration")
    def to_get_failback_replication_configuration(self) -> "Drs":
        '''(experimental) Grants permission to get failback replication configuration.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/APIReference/API_GetFailbackReplicationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toGetFailbackReplicationConfiguration", []))

    @jsii.member(jsii_name="toGetLaunchConfiguration")
    def to_get_launch_configuration(self) -> "Drs":
        '''(experimental) Grants permission to get launch configuration.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/APIReference/API_GetLaunchConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toGetLaunchConfiguration", []))

    @jsii.member(jsii_name="toGetReplicationConfiguration")
    def to_get_replication_configuration(self) -> "Drs":
        '''(experimental) Grants permission to get replication configuration.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/APIReference/API_GetReplicationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toGetReplicationConfiguration", []))

    @jsii.member(jsii_name="toGetSuggestedFailbackClientDeviceMappingForDrs")
    def to_get_suggested_failback_client_device_mapping_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to get suggested failback client device mapping.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toGetSuggestedFailbackClientDeviceMappingForDrs", []))

    @jsii.member(jsii_name="toInitializeService")
    def to_initialize_service(self) -> "Drs":
        '''(experimental) Grants permission to initialize service.

        Access Level: Write

        Dependent actions:

        - iam:AddRoleToInstanceProfile
        - iam:CreateInstanceProfile
        - iam:CreateServiceLinkedRole
        - iam:GetInstanceProfile

        https://docs.aws.amazon.com/drs/latest/APIReference/API_InitializeService.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toInitializeService", []))

    @jsii.member(jsii_name="toIssueAgentCertificateForDrs")
    def to_issue_agent_certificate_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to issue an agent certificate.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toIssueAgentCertificateForDrs", []))

    @jsii.member(jsii_name="toListExtensibleSourceServers")
    def to_list_extensible_source_servers(self) -> "Drs":
        '''(experimental) Grants permission to list extensible source servers.

        Access Level: Read

        Dependent actions:

        - drs:DescribeSourceServers

        https://docs.aws.amazon.com/drs/latest/APIReference/API_ListExtensibleSourceServers.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toListExtensibleSourceServers", []))

    @jsii.member(jsii_name="toListStagingAccounts")
    def to_list_staging_accounts(self) -> "Drs":
        '''(experimental) Grants permission to list staging accounts.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/APIReference/API_ListStagingAccounts.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toListStagingAccounts", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Drs":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/drs/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toNotifyAgentAuthenticationForDrs")
    def to_notify_agent_authentication_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to notify agent authentication.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toNotifyAgentAuthenticationForDrs", []))

    @jsii.member(jsii_name="toNotifyAgentConnectedForDrs")
    def to_notify_agent_connected_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to notify agent is connected.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toNotifyAgentConnectedForDrs", []))

    @jsii.member(jsii_name="toNotifyAgentDisconnectedForDrs")
    def to_notify_agent_disconnected_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to notify agent is disconnected.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toNotifyAgentDisconnectedForDrs", []))

    @jsii.member(jsii_name="toNotifyAgentReplicationProgressForDrs")
    def to_notify_agent_replication_progress_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to notify agent replication progress.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toNotifyAgentReplicationProgressForDrs", []))

    @jsii.member(jsii_name="toNotifyConsistencyAttainedForDrs")
    def to_notify_consistency_attained_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to notify consistency attained.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toNotifyConsistencyAttainedForDrs", []))

    @jsii.member(jsii_name="toNotifyReplicationServerAuthenticationForDrs")
    def to_notify_replication_server_authentication_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to notify replication server authentication.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toNotifyReplicationServerAuthenticationForDrs", []))

    @jsii.member(jsii_name="toNotifyVolumeEventForDrs")
    def to_notify_volume_event_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to notify replicator volume events.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toNotifyVolumeEventForDrs", []))

    @jsii.member(jsii_name="toRetryDataReplication")
    def to_retry_data_replication(self) -> "Drs":
        '''(experimental) Grants permission to retry data replication.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/APIReference/API_RetryDataReplication.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toRetryDataReplication", []))

    @jsii.member(jsii_name="toReverseReplication")
    def to_reverse_replication(self) -> "Drs":
        '''(experimental) Grants permission to reverse replication.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - drs:DescribeReplicationConfigurationTemplates
        - drs:DescribeSourceServers
        - ec2:DescribeInstances

        https://docs.aws.amazon.com/drs/latest/APIReference/API_ReverseReplication.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toReverseReplication", []))

    @jsii.member(jsii_name="toSendAgentLogsForDrs")
    def to_send_agent_logs_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to send agent logs.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toSendAgentLogsForDrs", []))

    @jsii.member(jsii_name="toSendAgentMetricsForDrs")
    def to_send_agent_metrics_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to send agent metrics.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toSendAgentMetricsForDrs", []))

    @jsii.member(jsii_name="toSendChannelCommandResultForDrs")
    def to_send_channel_command_result_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to send channel command result.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toSendChannelCommandResultForDrs", []))

    @jsii.member(jsii_name="toSendClientLogsForDrs")
    def to_send_client_logs_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to send client logs.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toSendClientLogsForDrs", []))

    @jsii.member(jsii_name="toSendClientMetricsForDrs")
    def to_send_client_metrics_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to send client metrics.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toSendClientMetricsForDrs", []))

    @jsii.member(jsii_name="toSendVolumeStatsForDrs")
    def to_send_volume_stats_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to send volume throughput statistics.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toSendVolumeStatsForDrs", []))

    @jsii.member(jsii_name="toStartFailbackLaunch")
    def to_start_failback_launch(self) -> "Drs":
        '''(experimental) Grants permission to start failback launch.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/drs/latest/APIReference/API_StartFailbackLaunch.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toStartFailbackLaunch", []))

    @jsii.member(jsii_name="toStartRecovery")
    def to_start_recovery(self) -> "Drs":
        '''(experimental) Grants permission to start recovery.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - drs:CreateRecoveryInstanceForDrs
        - drs:ListTagsForResource
        - ec2:AttachVolume
        - ec2:AuthorizeSecurityGroupEgress
        - ec2:AuthorizeSecurityGroupIngress
        - ec2:CreateLaunchTemplate
        - ec2:CreateLaunchTemplateVersion
        - ec2:CreateSnapshot
        - ec2:CreateTags
        - ec2:CreateVolume
        - ec2:DeleteLaunchTemplateVersions
        - ec2:DeleteSnapshot
        - ec2:DeleteVolume
        - ec2:DescribeAccountAttributes
        - ec2:DescribeAvailabilityZones
        - ec2:DescribeImages
        - ec2:DescribeInstanceAttribute
        - ec2:DescribeInstanceStatus
        - ec2:DescribeInstanceTypes
        - ec2:DescribeInstances
        - ec2:DescribeLaunchTemplateVersions
        - ec2:DescribeLaunchTemplates
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSnapshots
        - ec2:DescribeSubnets
        - ec2:DescribeVolumes
        - ec2:DetachVolume
        - ec2:ModifyInstanceAttribute
        - ec2:ModifyLaunchTemplate
        - ec2:RevokeSecurityGroupEgress
        - ec2:RunInstances
        - ec2:StartInstances
        - ec2:StopInstances
        - ec2:TerminateInstances
        - iam:PassRole

        https://docs.aws.amazon.com/drs/latest/APIReference/API_StartRecovery.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toStartRecovery", []))

    @jsii.member(jsii_name="toStartReplication")
    def to_start_replication(self) -> "Drs":
        '''(experimental) Grants permission to start replication.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/APIReference/API_StartReplication.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toStartReplication", []))

    @jsii.member(jsii_name="toStopFailback")
    def to_stop_failback(self) -> "Drs":
        '''(experimental) Grants permission to stop failback.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/APIReference/API_StopFailback.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toStopFailback", []))

    @jsii.member(jsii_name="toStopReplication")
    def to_stop_replication(self) -> "Drs":
        '''(experimental) Grants permission to stop replication.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/APIReference/API_StopReplication.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toStopReplication", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Drs":
        '''(experimental) Grants permission to assign a resource tag.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifCreateAction()

        https://docs.aws.amazon.com/drs/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTerminateRecoveryInstances")
    def to_terminate_recovery_instances(self) -> "Drs":
        '''(experimental) Grants permission to terminate recovery instances.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - drs:DescribeSourceServers
        - ec2:DeleteVolume
        - ec2:DescribeInstances
        - ec2:DescribeVolumes
        - ec2:TerminateInstances

        https://docs.aws.amazon.com/drs/latest/APIReference/API_TerminateRecoveryInstances.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toTerminateRecoveryInstances", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Drs":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/drs/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAgentBacklogForDrs")
    def to_update_agent_backlog_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to update agent backlog.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toUpdateAgentBacklogForDrs", []))

    @jsii.member(jsii_name="toUpdateAgentConversionInfoForDrs")
    def to_update_agent_conversion_info_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to update agent conversion info.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toUpdateAgentConversionInfoForDrs", []))

    @jsii.member(jsii_name="toUpdateAgentReplicationInfoForDrs")
    def to_update_agent_replication_info_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to update agent replication info.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toUpdateAgentReplicationInfoForDrs", []))

    @jsii.member(jsii_name="toUpdateAgentReplicationProcessStateForDrs")
    def to_update_agent_replication_process_state_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to update agent replication process state.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toUpdateAgentReplicationProcessStateForDrs", []))

    @jsii.member(jsii_name="toUpdateAgentSourcePropertiesForDrs")
    def to_update_agent_source_properties_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to update agent source properties.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toUpdateAgentSourcePropertiesForDrs", []))

    @jsii.member(jsii_name="toUpdateFailbackClientDeviceMappingForDrs")
    def to_update_failback_client_device_mapping_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to update failback client device mapping.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toUpdateFailbackClientDeviceMappingForDrs", []))

    @jsii.member(jsii_name="toUpdateFailbackClientLastSeenForDrs")
    def to_update_failback_client_last_seen_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to update failback client last seen.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toUpdateFailbackClientLastSeenForDrs", []))

    @jsii.member(jsii_name="toUpdateFailbackReplicationConfiguration")
    def to_update_failback_replication_configuration(self) -> "Drs":
        '''(experimental) Grants permission to update failback replication configuration.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/APIReference/API_UpdateFailbackReplicationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toUpdateFailbackReplicationConfiguration", []))

    @jsii.member(jsii_name="toUpdateLaunchConfiguration")
    def to_update_launch_configuration(self) -> "Drs":
        '''(experimental) Grants permission to update launch configuration.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/APIReference/API_UpdateLaunchConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toUpdateLaunchConfiguration", []))

    @jsii.member(jsii_name="toUpdateReplicationCertificateForDrs")
    def to_update_replication_certificate_for_drs(self) -> "Drs":
        '''(experimental) Grants permission to update a replication certificate.

        Access Level: Write

        https://docs.aws.amazon.com/drs/latest/userguide/drs-apis.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toUpdateReplicationCertificateForDrs", []))

    @jsii.member(jsii_name="toUpdateReplicationConfiguration")
    def to_update_replication_configuration(self) -> "Drs":
        '''(experimental) Grants permission to update replication configuration.

        Access Level: Write

        Dependent actions:

        - ec2:CreateSecurityGroup
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:GetEbsDefaultKmsKeyId
        - ec2:GetEbsEncryptionByDefault
        - kms:CreateGrant
        - kms:DescribeKey

        https://docs.aws.amazon.com/drs/latest/APIReference/API_UpdateReplicationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toUpdateReplicationConfiguration", []))

    @jsii.member(jsii_name="toUpdateReplicationConfigurationTemplate")
    def to_update_replication_configuration_template(self) -> "Drs":
        '''(experimental) Grants permission to update replication configuration template.

        Access Level: Write

        Dependent actions:

        - ec2:CreateSecurityGroup
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:GetEbsDefaultKmsKeyId
        - ec2:GetEbsEncryptionByDefault
        - kms:CreateGrant
        - kms:DescribeKey

        https://docs.aws.amazon.com/drs/latest/APIReference/API_UpdateReplicationConfigurationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Drs", jsii.invoke(self, "toUpdateReplicationConfigurationTemplate", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0d1564faf309866bdc116c51591b29ebd855787bf10edb217d8ab231ee511887)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__129ac000fac8268cdbf2967f4288dda0735b00a478c9486f6ab12cb26fcbcd88)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Ds(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ds"):
    '''(experimental) Statement provider for service `ds <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdirectoryservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ds <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsdirectoryservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6de901c6fbde63a6f2dce1fd8b2d7db443515a7c9b4e0acc2838c09e377152be)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDirectory")
    def on_directory(
        self,
        directory_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ds":
        '''(experimental) Adds a resource of type directory to the statement.

        https://docs.aws.amazon.com/directoryservice/latest/devguide/welcome.html

        :param directory_id: - Identifier for the directoryId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f111983e10aab40f194c008e490b9619abc9278d6b0db6373b79986d98571d87)
            check_type(argname="argument directory_id", value=directory_id, expected_type=type_hints["directory_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ds", jsii.invoke(self, "onDirectory", [directory_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptSharedDirectory")
    def to_accept_shared_directory(self) -> "Ds":
        '''(experimental) Grants permission to accept a directory sharing request that was sent from the directory owner account.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_AcceptSharedDirectory.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toAcceptSharedDirectory", []))

    @jsii.member(jsii_name="toAddIpRoutes")
    def to_add_ip_routes(self) -> "Ds":
        '''(experimental) Grants permission to add a CIDR address block to correctly route traffic to and from your Microsoft AD on Amazon Web Services.

        Access Level: Write

        Dependent actions:

        - ec2:AuthorizeSecurityGroupEgress
        - ec2:AuthorizeSecurityGroupIngress
        - ec2:DescribeSecurityGroups

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_AddIpRoutes.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toAddIpRoutes", []))

    @jsii.member(jsii_name="toAddRegion")
    def to_add_region(self) -> "Ds":
        '''(experimental) Grants permission to add two domain controllers in the specified Region for the specified directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_AddRegion.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toAddRegion", []))

    @jsii.member(jsii_name="toAddTagsToResource")
    def to_add_tags_to_resource(self) -> "Ds":
        '''(experimental) Grants permission to add or overwrite one or more tags for the specified Amazon Directory Services directory.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_AddTagsToResource.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toAddTagsToResource", []))

    @jsii.member(jsii_name="toAuthorizeApplication")
    def to_authorize_application(self) -> "Ds":
        '''(experimental) Grants permission to authorize an application for your AWS Directory.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toAuthorizeApplication", []))

    @jsii.member(jsii_name="toCancelSchemaExtension")
    def to_cancel_schema_extension(self) -> "Ds":
        '''(experimental) Grants permission to cancel an in-progress schema extension to a Microsoft AD directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CancelSchemaExtension.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCancelSchemaExtension", []))

    @jsii.member(jsii_name="toCheckAlias")
    def to_check_alias(self) -> "Ds":
        '''(experimental) Grants permission to verify that the alias is available for use.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCheckAlias", []))

    @jsii.member(jsii_name="toConnectDirectory")
    def to_connect_directory(self) -> "Ds":
        '''(experimental) Grants permission to create an AD Connector to connect to an on-premises directory.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:AuthorizeSecurityGroupEgress
        - ec2:AuthorizeSecurityGroupIngress
        - ec2:CreateNetworkInterface
        - ec2:CreateSecurityGroup
        - ec2:CreateTags
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ConnectDirectory.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toConnectDirectory", []))

    @jsii.member(jsii_name="toCreateAlias")
    def to_create_alias(self) -> "Ds":
        '''(experimental) Grants permission to create an alias for a directory and assigns the alias to the directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateAlias.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCreateAlias", []))

    @jsii.member(jsii_name="toCreateComputer")
    def to_create_computer(self) -> "Ds":
        '''(experimental) Grants permission to create a computer account in the specified directory, and joins the computer to the directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateComputer.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCreateComputer", []))

    @jsii.member(jsii_name="toCreateConditionalForwarder")
    def to_create_conditional_forwarder(self) -> "Ds":
        '''(experimental) Grants permission to create a conditional forwarder associated with your AWS directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateConditionalForwarder.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCreateConditionalForwarder", []))

    @jsii.member(jsii_name="toCreateDirectory")
    def to_create_directory(self) -> "Ds":
        '''(experimental) Grants permission to create a Simple AD directory.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:AuthorizeSecurityGroupEgress
        - ec2:AuthorizeSecurityGroupIngress
        - ec2:CreateNetworkInterface
        - ec2:CreateSecurityGroup
        - ec2:CreateTags
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateDirectory.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCreateDirectory", []))

    @jsii.member(jsii_name="toCreateIdentityPoolDirectory")
    def to_create_identity_pool_directory(self) -> "Ds":
        '''(experimental) Grants permission to create an IdentityPool Directory in the AWS cloud.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCreateIdentityPoolDirectory", []))

    @jsii.member(jsii_name="toCreateLogSubscription")
    def to_create_log_subscription(self) -> "Ds":
        '''(experimental) Grants permission to create a subscription to forward real time Directory Service domain controller security logs to the specified CloudWatch log group in your AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateLogSubscription.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCreateLogSubscription", []))

    @jsii.member(jsii_name="toCreateMicrosoftAD")
    def to_create_microsoft_ad(self) -> "Ds":
        '''(experimental) Grants permission to create a Microsoft AD in the AWS cloud.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:AuthorizeSecurityGroupEgress
        - ec2:AuthorizeSecurityGroupIngress
        - ec2:CreateNetworkInterface
        - ec2:CreateSecurityGroup
        - ec2:CreateTags
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateMicrosoftAD.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCreateMicrosoftAD", []))

    @jsii.member(jsii_name="toCreateSnapshot")
    def to_create_snapshot(self) -> "Ds":
        '''(experimental) Grants permission to create a snapshot of a Simple AD or Microsoft AD directory in the AWS cloud.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCreateSnapshot", []))

    @jsii.member(jsii_name="toCreateTrust")
    def to_create_trust(self) -> "Ds":
        '''(experimental) Grants permission to initiate the creation of the AWS side of a trust relationship between a Microsoft AD in the AWS cloud and an external domain.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateTrust.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toCreateTrust", []))

    @jsii.member(jsii_name="toDeleteConditionalForwarder")
    def to_delete_conditional_forwarder(self) -> "Ds":
        '''(experimental) Grants permission to delete a conditional forwarder that has been set up for your AWS directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeleteConditionalForwarder.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDeleteConditionalForwarder", []))

    @jsii.member(jsii_name="toDeleteDirectory")
    def to_delete_directory(self) -> "Ds":
        '''(experimental) Grants permission to delete an AWS Directory Service directory.

        Access Level: Write

        Dependent actions:

        - ec2:DeleteNetworkInterface
        - ec2:DeleteSecurityGroup
        - ec2:DescribeNetworkInterfaces
        - ec2:RevokeSecurityGroupEgress
        - ec2:RevokeSecurityGroupIngress

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeleteDirectory.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDeleteDirectory", []))

    @jsii.member(jsii_name="toDeleteLogSubscription")
    def to_delete_log_subscription(self) -> "Ds":
        '''(experimental) Grants permission to delete the specified log subscription.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeleteLogSubscription.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDeleteLogSubscription", []))

    @jsii.member(jsii_name="toDeleteSnapshot")
    def to_delete_snapshot(self) -> "Ds":
        '''(experimental) Grants permission to delete a directory snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeleteSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDeleteSnapshot", []))

    @jsii.member(jsii_name="toDeleteTrust")
    def to_delete_trust(self) -> "Ds":
        '''(experimental) Grants permission to delete an existing trust relationship between your Microsoft AD in the AWS cloud and an external domain.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/DeleteTrust.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDeleteTrust", []))

    @jsii.member(jsii_name="toDeregisterCertificate")
    def to_deregister_certificate(self) -> "Ds":
        '''(experimental) Grants permission to delete from the system the certificate that was registered for a secured LDAP connection.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeregisterCertificate.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDeregisterCertificate", []))

    @jsii.member(jsii_name="toDeregisterEventTopic")
    def to_deregister_event_topic(self) -> "Ds":
        '''(experimental) Grants permission to remove the specified directory as a publisher to the specified SNS topic.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeregisterEventTopic.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDeregisterEventTopic", []))

    @jsii.member(jsii_name="toDescribeCertificate")
    def to_describe_certificate(self) -> "Ds":
        '''(experimental) Grants permission to display information about the certificate registered for a secured LDAP connection.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeCertificate.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeCertificate", []))

    @jsii.member(jsii_name="toDescribeClientAuthenticationSettings")
    def to_describe_client_authentication_settings(self) -> "Ds":
        '''(experimental) Grants permission to retrieve information about the type of client authentication for the specified directory, if the type is specified.

        If no type is specified, information about all client authentication types that are supported for the specified directory is retrieved. Currently, only SmartCard is supported

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeClientAuthenticationSettings.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeClientAuthenticationSettings", []))

    @jsii.member(jsii_name="toDescribeConditionalForwarders")
    def to_describe_conditional_forwarders(self) -> "Ds":
        '''(experimental) Grants permission to obtain information about the conditional forwarders for this account.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeConditionalForwarders.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeConditionalForwarders", []))

    @jsii.member(jsii_name="toDescribeDirectories")
    def to_describe_directories(self) -> "Ds":
        '''(experimental) Grants permission to obtain information about the directories that belong to this account.

        Access Level: List

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeDirectories.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeDirectories", []))

    @jsii.member(jsii_name="toDescribeDomainControllers")
    def to_describe_domain_controllers(self) -> "Ds":
        '''(experimental) Grants permission to provide information about any domain controllers in your directory.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeDomainControllers.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeDomainControllers", []))

    @jsii.member(jsii_name="toDescribeEventTopics")
    def to_describe_event_topics(self) -> "Ds":
        '''(experimental) Grants permission to obtain information about which SNS topics receive status messages from the specified directory.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeEventTopics.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeEventTopics", []))

    @jsii.member(jsii_name="toDescribeLDAPSSettings")
    def to_describe_ldaps_settings(self) -> "Ds":
        '''(experimental) Grants permission to describe the status of LDAP security for the specified directory.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeLDAPSSettings.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeLDAPSSettings", []))

    @jsii.member(jsii_name="toDescribeRegions")
    def to_describe_regions(self) -> "Ds":
        '''(experimental) Grants permission to provide information about the Regions that are configured for multi-Region replication.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeRegions.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeRegions", []))

    @jsii.member(jsii_name="toDescribeSettings")
    def to_describe_settings(self) -> "Ds":
        '''(experimental) Grants permission to retrieve information about the configurable settings for the specified directory.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeSettings.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeSettings", []))

    @jsii.member(jsii_name="toDescribeSharedDirectories")
    def to_describe_shared_directories(self) -> "Ds":
        '''(experimental) Grants permission to return the shared directories in your account.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeSharedDirectories.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeSharedDirectories", []))

    @jsii.member(jsii_name="toDescribeSnapshots")
    def to_describe_snapshots(self) -> "Ds":
        '''(experimental) Grants permission to obtain information about the directory snapshots that belong to this account.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeSnapshots", []))

    @jsii.member(jsii_name="toDescribeTrusts")
    def to_describe_trusts(self) -> "Ds":
        '''(experimental) Grants permission to obtain information about the trust relationships for this account.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeTrusts.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeTrusts", []))

    @jsii.member(jsii_name="toDescribeUpdateDirectory")
    def to_describe_update_directory(self) -> "Ds":
        '''(experimental) Grants permission to describe the updates of a directory for a particular update type.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeUpdateDirectory.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDescribeUpdateDirectory", []))

    @jsii.member(jsii_name="toDisableClientAuthentication")
    def to_disable_client_authentication(self) -> "Ds":
        '''(experimental) Grants permission to disable alternative client authentication methods for the specified directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DisableClientAuthentication.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDisableClientAuthentication", []))

    @jsii.member(jsii_name="toDisableLDAPS")
    def to_disable_ldaps(self) -> "Ds":
        '''(experimental) Grants permission to deactivate LDAP secure calls for the specified directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DisableLDAPS.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDisableLDAPS", []))

    @jsii.member(jsii_name="toDisableRadius")
    def to_disable_radius(self) -> "Ds":
        '''(experimental) Grants permission to disable multi-factor authentication (MFA) with the Remote Authentication Dial In User Service (RADIUS) server for an AD Connector directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DisableRadius.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDisableRadius", []))

    @jsii.member(jsii_name="toDisableSso")
    def to_disable_sso(self) -> "Ds":
        '''(experimental) Grants permission to disable single-sign on for a directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DisableSso.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toDisableSso", []))

    @jsii.member(jsii_name="toEnableClientAuthentication")
    def to_enable_client_authentication(self) -> "Ds":
        '''(experimental) Grants permission to enable alternative client authentication methods for the specified directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_EnableClientAuthentication.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toEnableClientAuthentication", []))

    @jsii.member(jsii_name="toEnableLDAPS")
    def to_enable_ldaps(self) -> "Ds":
        '''(experimental) Grants permission to activate the switch for the specific directory to always use LDAP secure calls.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_EnableLDAPS.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toEnableLDAPS", []))

    @jsii.member(jsii_name="toEnableRadius")
    def to_enable_radius(self) -> "Ds":
        '''(experimental) Grants permission to enable multi-factor authentication (MFA) with the Remote Authentication Dial In User Service (RADIUS) server for an AD Connector directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_EnableRadius.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toEnableRadius", []))

    @jsii.member(jsii_name="toEnableSso")
    def to_enable_sso(self) -> "Ds":
        '''(experimental) Grants permission to enable single-sign on for a directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_EnableSso.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toEnableSso", []))

    @jsii.member(jsii_name="toGetAuthorizedApplicationDetails")
    def to_get_authorized_application_details(self) -> "Ds":
        '''(experimental) Grants permission to retrieve the details of the authorized applications on a directory.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_GetAuthorizedApplicationDetails.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toGetAuthorizedApplicationDetails", []))

    @jsii.member(jsii_name="toGetDirectoryLimits")
    def to_get_directory_limits(self) -> "Ds":
        '''(experimental) Grants permission to obtain directory limit information for the current region.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_GetDirectoryLimits.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toGetDirectoryLimits", []))

    @jsii.member(jsii_name="toGetSnapshotLimits")
    def to_get_snapshot_limits(self) -> "Ds":
        '''(experimental) Grants permission to obtain the manual snapshot limits for a directory.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_GetSnapshotLimits.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toGetSnapshotLimits", []))

    @jsii.member(jsii_name="toListAuthorizedApplications")
    def to_list_authorized_applications(self) -> "Ds":
        '''(experimental) Grants permission to obtain the AWS applications authorized for a directory.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toListAuthorizedApplications", []))

    @jsii.member(jsii_name="toListCertificates")
    def to_list_certificates(self) -> "Ds":
        '''(experimental) Grants permission to list all the certificates registered for a secured LDAP connection, for the specified directory.

        Access Level: List

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ListCertificates.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toListCertificates", []))

    @jsii.member(jsii_name="toListIpRoutes")
    def to_list_ip_routes(self) -> "Ds":
        '''(experimental) Grants permission to list the address blocks that you have added to a directory.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ListIpRoutes.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toListIpRoutes", []))

    @jsii.member(jsii_name="toListLogSubscriptions")
    def to_list_log_subscriptions(self) -> "Ds":
        '''(experimental) Grants permission to list the active log subscriptions for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ListLogSubscriptions.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toListLogSubscriptions", []))

    @jsii.member(jsii_name="toListSchemaExtensions")
    def to_list_schema_extensions(self) -> "Ds":
        '''(experimental) Grants permission to list all schema extensions applied to a Microsoft AD Directory.

        Access Level: List

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ListSchemaExtensions.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toListSchemaExtensions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Ds":
        '''(experimental) Grants permission to list all tags on an Amazon Directory Services directory.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRegisterCertificate")
    def to_register_certificate(self) -> "Ds":
        '''(experimental) Grants permission to register a certificate for secured LDAP connection.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RegisterCertificate.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toRegisterCertificate", []))

    @jsii.member(jsii_name="toRegisterEventTopic")
    def to_register_event_topic(self) -> "Ds":
        '''(experimental) Grants permission to associate a directory with an SNS topic.

        Access Level: Write

        Dependent actions:

        - sns:GetTopicAttributes

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RegisterEventTopic.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toRegisterEventTopic", []))

    @jsii.member(jsii_name="toRejectSharedDirectory")
    def to_reject_shared_directory(self) -> "Ds":
        '''(experimental) Grants permission to reject a directory sharing request that was sent from the directory owner account.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RejectSharedDirectory.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toRejectSharedDirectory", []))

    @jsii.member(jsii_name="toRemoveIpRoutes")
    def to_remove_ip_routes(self) -> "Ds":
        '''(experimental) Grants permission to remove IP address blocks from a directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RemoveIpRoutes.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toRemoveIpRoutes", []))

    @jsii.member(jsii_name="toRemoveRegion")
    def to_remove_region(self) -> "Ds":
        '''(experimental) Grants permission to stop all replication and removes the domain controllers from the specified Region.

        You cannot remove the primary Region with this operation

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RemoveRegion.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toRemoveRegion", []))

    @jsii.member(jsii_name="toRemoveTagsFromResource")
    def to_remove_tags_from_resource(self) -> "Ds":
        '''(experimental) Grants permission to remove tags from an Amazon Directory Services directory.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:DeleteTags

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RemoveTagsFromResource.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toRemoveTagsFromResource", []))

    @jsii.member(jsii_name="toResetUserPassword")
    def to_reset_user_password(self) -> "Ds":
        '''(experimental) Grants permission to reset the password for any user in your AWS Managed Microsoft AD or Simple AD directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ResetUserPassword.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toResetUserPassword", []))

    @jsii.member(jsii_name="toRestoreFromSnapshot")
    def to_restore_from_snapshot(self) -> "Ds":
        '''(experimental) Grants permission to restore a directory using an existing directory snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RestoreFromSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toRestoreFromSnapshot", []))

    @jsii.member(jsii_name="toShareDirectory")
    def to_share_directory(self) -> "Ds":
        '''(experimental) Grants permission to share a specified directory in your AWS account (directory owner) with another AWS account (directory consumer).

        With this operation you can use your directory from any AWS account and from any Amazon VPC within an AWS Region

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ShareDirectory.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toShareDirectory", []))

    @jsii.member(jsii_name="toStartSchemaExtension")
    def to_start_schema_extension(self) -> "Ds":
        '''(experimental) Grants permission to apply a schema extension to a Microsoft AD directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_StartSchemaExtension.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toStartSchemaExtension", []))

    @jsii.member(jsii_name="toUnauthorizeApplication")
    def to_unauthorize_application(self) -> "Ds":
        '''(experimental) Grants permission to unauthorize an application from your AWS Directory.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toUnauthorizeApplication", []))

    @jsii.member(jsii_name="toUnshareDirectory")
    def to_unshare_directory(self) -> "Ds":
        '''(experimental) Grants permission to stop the directory sharing between the directory owner and consumer accounts.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UnshareDirectory.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toUnshareDirectory", []))

    @jsii.member(jsii_name="toUpdateConditionalForwarder")
    def to_update_conditional_forwarder(self) -> "Ds":
        '''(experimental) Grants permission to update a conditional forwarder that has been set up for your AWS directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UpdateConditionalForwarder.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toUpdateConditionalForwarder", []))

    @jsii.member(jsii_name="toUpdateDirectorySetup")
    def to_update_directory_setup(self) -> "Ds":
        '''(experimental) Grants permission to update the directory for a particular update type.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UpdateDirectorySetup.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toUpdateDirectorySetup", []))

    @jsii.member(jsii_name="toUpdateNumberOfDomainControllers")
    def to_update_number_of_domain_controllers(self) -> "Ds":
        '''(experimental) Grants permission to add or remove domain controllers to or from the directory.

        Based on the difference between current value and new value (provided through this API call), domain controllers will be added or removed. It may take up to 45 minutes for any new domain controllers to become fully active once the requested number of domain controllers is updated. During this time, you cannot make another update request

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UpdateNumberOfDomainControllers.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toUpdateNumberOfDomainControllers", []))

    @jsii.member(jsii_name="toUpdateRadius")
    def to_update_radius(self) -> "Ds":
        '''(experimental) Grants permission to update the Remote Authentication Dial In User Service (RADIUS) server information for an AD Connector directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UpdateRadius.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toUpdateRadius", []))

    @jsii.member(jsii_name="toUpdateSettings")
    def to_update_settings(self) -> "Ds":
        '''(experimental) Grants permission to update the configurable settings for the specified directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UpdateSettings.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toUpdateSettings", []))

    @jsii.member(jsii_name="toUpdateTrust")
    def to_update_trust(self) -> "Ds":
        '''(experimental) Grants permission to update the trust that has been set up between your AWS Managed Microsoft AD directory and an on-premises Active Directory.

        Access Level: Write

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UpdateTrust.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toUpdateTrust", []))

    @jsii.member(jsii_name="toVerifyTrust")
    def to_verify_trust(self) -> "Ds":
        '''(experimental) Grants permission to verify a trust relationship between your Microsoft AD in the AWS cloud and an external domain.

        Access Level: Read

        https://docs.aws.amazon.com/directoryservice/latest/devguide/API_VerifyTrust.html

        :stability: experimental
        '''
        return typing.cast("Ds", jsii.invoke(self, "toVerifyTrust", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7efd15a8c6850a4127d84d8a9fad2280e13b1a58c58dc9fcfb306d264edc61d6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5b954f787409468ee328eaa8a2b46097bf738e5b31fc4af8de1b55053ae70556)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Dynamodb(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Dynamodb",
):
    '''(experimental) Statement provider for service `dynamodb <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondynamodb.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `dynamodb <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondynamodb.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e2d7c27fba4decd9872b7d3464b7f066edb6cec61a66235a38a02dffbf878463)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAttributes")
    def if_attributes(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dynamodb":
        '''(experimental) Filters access by attribute (field or column) names of the table.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/specifying-conditions.html#FGAC_DDB.ConditionKeys

        Applies to actions:

        - .toBatchGetItem()
        - .toBatchWriteItem()
        - .toConditionCheckItem()
        - .toDeleteItem()
        - .toGetItem()
        - .toPartiQLDelete()
        - .toPartiQLInsert()
        - .toPartiQLSelect()
        - .toPartiQLUpdate()
        - .toPutItem()
        - .toQuery()
        - .toScan()
        - .toUpdateItem()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__12b1af39939a22dde596c99123e8f4755a5fce9c4599eebd980f09db6803907d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Dynamodb", jsii.invoke(self, "ifAttributes", [value, operator]))

    @jsii.member(jsii_name="ifEnclosingOperation")
    def if_enclosing_operation(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dynamodb":
        '''(experimental) Filters access by blocking Transactions APIs calls and allow the non-Transaction APIs calls and vice-versa.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/specifying-conditions.html#FGAC_DDB.ConditionKeys

        Applies to actions:

        - .toDeleteItem()
        - .toGetItem()
        - .toPartiQLDelete()
        - .toPartiQLInsert()
        - .toPartiQLSelect()
        - .toPartiQLUpdate()
        - .toPutItem()
        - .toUpdateItem()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b25399900396d06d68cac8e5e00589175d93657c3c43805652ad4504edd1fb15)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Dynamodb", jsii.invoke(self, "ifEnclosingOperation", [value, operator]))

    @jsii.member(jsii_name="ifFullTableScan")
    def if_full_table_scan(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Dynamodb":
        '''(experimental) Filters access by blocking full table scan.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/ql-iam.html

        Applies to actions:

        - .toPartiQLSelect()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f53cbea8b7c9d40991d2bb9f7e8c019e477e5a1ffbe6d6ea9a4d20f9c999d27c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Dynamodb", jsii.invoke(self, "ifFullTableScan", [value]))

    @jsii.member(jsii_name="ifLeadingKeys")
    def if_leading_keys(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dynamodb":
        '''(experimental) Filters access by the partition key of the table.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/specifying-conditions.html#FGAC_DDB.ConditionKeys

        Applies to actions:

        - .toBatchGetItem()
        - .toBatchWriteItem()
        - .toConditionCheckItem()
        - .toDeleteItem()
        - .toGetItem()
        - .toPartiQLDelete()
        - .toPartiQLInsert()
        - .toPartiQLSelect()
        - .toPartiQLUpdate()
        - .toPutItem()
        - .toQuery()
        - .toUpdateItem()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__566286a5856a48db5c60def00a2830ee6973f3bb0cbacb0331b88a654a4c18f2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Dynamodb", jsii.invoke(self, "ifLeadingKeys", [value, operator]))

    @jsii.member(jsii_name="ifReturnConsumedCapacity")
    def if_return_consumed_capacity(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dynamodb":
        '''(experimental) Filters access by the ReturnConsumedCapacity parameter of a request. Contains either "TOTAL" or "NONE".

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/specifying-conditions.html#FGAC_DDB.ConditionKeys

        Applies to actions:

        - .toBatchGetItem()
        - .toBatchWriteItem()
        - .toConditionCheckItem()
        - .toDeleteItem()
        - .toGetItem()
        - .toPutItem()
        - .toQuery()
        - .toScan()
        - .toUpdateItem()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f94a3cf85aa1c0a0c4cedbf509c6d6b2660167ad2fcd069cb5ecdeb3d23dbd22)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Dynamodb", jsii.invoke(self, "ifReturnConsumedCapacity", [value, operator]))

    @jsii.member(jsii_name="ifReturnValues")
    def if_return_values(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dynamodb":
        '''(experimental) Filters access by the ReturnValues parameter of request. Contains one of the following: "ALL_OLD", "UPDATED_OLD","ALL_NEW","UPDATED_NEW", or "NONE".

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/specifying-conditions.html#FGAC_DDB.ConditionKeys

        Applies to actions:

        - .toConditionCheckItem()
        - .toDeleteItem()
        - .toPartiQLDelete()
        - .toPartiQLUpdate()
        - .toPutItem()
        - .toQuery()
        - .toScan()
        - .toUpdateItem()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c967779ede5e0cf85d53aca3e974ca5f2d6fcdad9f7a960e29844036080ac035)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Dynamodb", jsii.invoke(self, "ifReturnValues", [value, operator]))

    @jsii.member(jsii_name="ifSelect")
    def if_select(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Dynamodb":
        '''(experimental) Filters access by the Select parameter of a Query or Scan request.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/specifying-conditions.html#FGAC_DDB.ConditionKeys

        Applies to actions:

        - .toBatchGetItem()
        - .toGetItem()
        - .toPartiQLSelect()
        - .toQuery()
        - .toScan()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9428c8daefb37e787aed6e5c64e6aef760f071c44cf71b5e34d70a9ff6e577c8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Dynamodb", jsii.invoke(self, "ifSelect", [value, operator]))

    @jsii.member(jsii_name="onBackup")
    def on_backup(
        self,
        table_name: builtins.str,
        backup_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dynamodb":
        '''(experimental) Adds a resource of type backup to the statement.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/backuprestore_HowItWorks.html

        :param table_name: - Identifier for the tableName.
        :param backup_name: - Identifier for the backupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0850a3e2ea4c29a06639cb07336d242ba4910fcf5c831fdaba7eb94c2d385eda)
            check_type(argname="argument table_name", value=table_name, expected_type=type_hints["table_name"])
            check_type(argname="argument backup_name", value=backup_name, expected_type=type_hints["backup_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dynamodb", jsii.invoke(self, "onBackup", [table_name, backup_name, account, region, partition]))

    @jsii.member(jsii_name="onExport")
    def on_export(
        self,
        table_name: builtins.str,
        export_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dynamodb":
        '''(experimental) Adds a resource of type export to the statement.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/S3DataExport.HowItWorks.html

        :param table_name: - Identifier for the tableName.
        :param export_name: - Identifier for the exportName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9fbbd2029e42277a27355d518d1b3c7cb43700cf020b4d826ca8be6e350935e0)
            check_type(argname="argument table_name", value=table_name, expected_type=type_hints["table_name"])
            check_type(argname="argument export_name", value=export_name, expected_type=type_hints["export_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dynamodb", jsii.invoke(self, "onExport", [table_name, export_name, account, region, partition]))

    @jsii.member(jsii_name="onGlobalTable")
    def on_global_table(
        self,
        global_table_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dynamodb":
        '''(experimental) Adds a resource of type global-table to the statement.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables_HowItWorks.html

        :param global_table_name: - Identifier for the globalTableName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4261bd528439929fd93d0429f5aaa1adb0c640ec1658e4240928b0a53f1b96a1)
            check_type(argname="argument global_table_name", value=global_table_name, expected_type=type_hints["global_table_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dynamodb", jsii.invoke(self, "onGlobalTable", [global_table_name, account, partition]))

    @jsii.member(jsii_name="onImport")
    def on_import(
        self,
        table_name: builtins.str,
        import_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dynamodb":
        '''(experimental) Adds a resource of type import to the statement.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/S3DataImport.HowItWorks.html

        :param table_name: - Identifier for the tableName.
        :param import_name: - Identifier for the importName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5945c4165006374dada84b50358314f0b54ecfb7083c1d343df40dbbb350c7c7)
            check_type(argname="argument table_name", value=table_name, expected_type=type_hints["table_name"])
            check_type(argname="argument import_name", value=import_name, expected_type=type_hints["import_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dynamodb", jsii.invoke(self, "onImport", [table_name, import_name, account, region, partition]))

    @jsii.member(jsii_name="onIndex")
    def on_index(
        self,
        table_name: builtins.str,
        index_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dynamodb":
        '''(experimental) Adds a resource of type index to the statement.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.CoreComponents.html#HowItWorks.CoreComponents.PrimaryKey

        :param table_name: - Identifier for the tableName.
        :param index_name: - Identifier for the indexName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__449fec7a104dee5dc407090b74bcd5cb43a4122210260f7159c64209aba274de)
            check_type(argname="argument table_name", value=table_name, expected_type=type_hints["table_name"])
            check_type(argname="argument index_name", value=index_name, expected_type=type_hints["index_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dynamodb", jsii.invoke(self, "onIndex", [table_name, index_name, account, region, partition]))

    @jsii.member(jsii_name="onStream")
    def on_stream(
        self,
        table_name: builtins.str,
        stream_label: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dynamodb":
        '''(experimental) Adds a resource of type stream to the statement.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.CoreComponents.html#HowItWorks.CoreComponents.Streams

        :param table_name: - Identifier for the tableName.
        :param stream_label: - Identifier for the streamLabel.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__05c7d7bdce673b29219ad158068020fd54171c714a5f0c29e2a764fa80eac982)
            check_type(argname="argument table_name", value=table_name, expected_type=type_hints["table_name"])
            check_type(argname="argument stream_label", value=stream_label, expected_type=type_hints["stream_label"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dynamodb", jsii.invoke(self, "onStream", [table_name, stream_label, account, region, partition]))

    @jsii.member(jsii_name="onTable")
    def on_table(
        self,
        table_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Dynamodb":
        '''(experimental) Adds a resource of type table to the statement.

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.CoreComponents.html#HowItWorks.CoreComponents.TablesItemsAttributes

        :param table_name: - Identifier for the tableName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__22ce66cf3f285bab5cf62bcfd963b66151dd6d2f0f3eb66fbde101c7002d7cd5)
            check_type(argname="argument table_name", value=table_name, expected_type=type_hints["table_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Dynamodb", jsii.invoke(self, "onTable", [table_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchGetItem")
    def to_batch_get_item(self) -> "Dynamodb":
        '''(experimental) Grants permission to return the attributes of one or more items from one or more tables.

        Access Level: Read

        Possible conditions:

        - .ifAttributes()
        - .ifLeadingKeys()
        - .ifReturnConsumedCapacity()
        - .ifSelect()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_BatchGetItem.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toBatchGetItem", []))

    @jsii.member(jsii_name="toBatchWriteItem")
    def to_batch_write_item(self) -> "Dynamodb":
        '''(experimental) Grants permission to put or delete multiple items in one or more tables.

        Access Level: Write

        Possible conditions:

        - .ifAttributes()
        - .ifLeadingKeys()
        - .ifReturnConsumedCapacity()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_BatchWriteItem.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toBatchWriteItem", []))

    @jsii.member(jsii_name="toConditionCheckItem")
    def to_condition_check_item(self) -> "Dynamodb":
        '''(experimental) Grants permission to the ConditionCheckItem operation checks the existence of a set of attributes for the item with the given primary key.

        Access Level: Read

        Possible conditions:

        - .ifAttributes()
        - .ifLeadingKeys()
        - .ifReturnConsumedCapacity()
        - .ifReturnValues()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ConditionCheck.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toConditionCheckItem", []))

    @jsii.member(jsii_name="toCreateBackup")
    def to_create_backup(self) -> "Dynamodb":
        '''(experimental) Grants permission to create a backup for an existing table.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_CreateBackup.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toCreateBackup", []))

    @jsii.member(jsii_name="toCreateGlobalTable")
    def to_create_global_table(self) -> "Dynamodb":
        '''(experimental) Grants permission to create a global table from an existing table.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_CreateGlobalTable.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toCreateGlobalTable", []))

    @jsii.member(jsii_name="toCreateTable")
    def to_create_table(self) -> "Dynamodb":
        '''(experimental) Grants permission to the CreateTable operation adds a new table to your account.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_CreateTable.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toCreateTable", []))

    @jsii.member(jsii_name="toCreateTableReplica")
    def to_create_table_replica(self) -> "Dynamodb":
        '''(experimental) Grants permission to add a new replica table.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/V2gt_IAM.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toCreateTableReplica", []))

    @jsii.member(jsii_name="toDeleteBackup")
    def to_delete_backup(self) -> "Dynamodb":
        '''(experimental) Grants permission to delete an existing backup of a table.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DeleteBackup.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDeleteBackup", []))

    @jsii.member(jsii_name="toDeleteItem")
    def to_delete_item(self) -> "Dynamodb":
        '''(experimental) Grants permission to deletes a single item in a table by primary key.

        Access Level: Write

        Possible conditions:

        - .ifAttributes()
        - .ifEnclosingOperation()
        - .ifLeadingKeys()
        - .ifReturnConsumedCapacity()
        - .ifReturnValues()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DeleteItem.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDeleteItem", []))

    @jsii.member(jsii_name="toDeleteTable")
    def to_delete_table(self) -> "Dynamodb":
        '''(experimental) Grants permission to the DeleteTable operation which deletes a table and all of its items.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DeleteTable.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDeleteTable", []))

    @jsii.member(jsii_name="toDeleteTableReplica")
    def to_delete_table_replica(self) -> "Dynamodb":
        '''(experimental) Grants permission to delete a replica table and all of its items.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/V2gt_IAM.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDeleteTableReplica", []))

    @jsii.member(jsii_name="toDescribeBackup")
    def to_describe_backup(self) -> "Dynamodb":
        '''(experimental) Grants permission to describe an existing backup of a table.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeBackup.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeBackup", []))

    @jsii.member(jsii_name="toDescribeContinuousBackups")
    def to_describe_continuous_backups(self) -> "Dynamodb":
        '''(experimental) Grants permission to check the status of the backup restore settings on the specified table.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeContinuousBackups.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeContinuousBackups", []))

    @jsii.member(jsii_name="toDescribeContributorInsights")
    def to_describe_contributor_insights(self) -> "Dynamodb":
        '''(experimental) Grants permission to describe the contributor insights status and related details for a given table or global secondary index.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeContributorInsights.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeContributorInsights", []))

    @jsii.member(jsii_name="toDescribeEndpoints")
    def to_describe_endpoints(self) -> "Dynamodb":
        '''(experimental) Grants permission to return the regional endpoint information.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeEndpoints", []))

    @jsii.member(jsii_name="toDescribeExport")
    def to_describe_export(self) -> "Dynamodb":
        '''(experimental) Grants permission to describe an existing Export of a table.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeExport.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeExport", []))

    @jsii.member(jsii_name="toDescribeGlobalTable")
    def to_describe_global_table(self) -> "Dynamodb":
        '''(experimental) Grants permission to return information about the specified global table.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeGlobalTable.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeGlobalTable", []))

    @jsii.member(jsii_name="toDescribeGlobalTableSettings")
    def to_describe_global_table_settings(self) -> "Dynamodb":
        '''(experimental) Grants permission to return settings information about the specified global table.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeGlobalTableSettings.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeGlobalTableSettings", []))

    @jsii.member(jsii_name="toDescribeImport")
    def to_describe_import(self) -> "Dynamodb":
        '''(experimental) Grants permission to describe an existing import.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeImport.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeImport", []))

    @jsii.member(jsii_name="toDescribeKinesisStreamingDestination")
    def to_describe_kinesis_streaming_destination(self) -> "Dynamodb":
        '''(experimental) Grants permission to grant permission to describe the status of Kinesis streaming and related details for a given table.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeKinesisStreamingDestination.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeKinesisStreamingDestination", []))

    @jsii.member(jsii_name="toDescribeLimits")
    def to_describe_limits(self) -> "Dynamodb":
        '''(experimental) Grants permission to return the current provisioned-capacity limits for your AWS account in a region, both for the region as a whole and for any one DynamoDB table that you create there.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeLimits.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeLimits", []))

    @jsii.member(jsii_name="toDescribeReservedCapacity")
    def to_describe_reserved_capacity(self) -> "Dynamodb":
        '''(experimental) Grants permission to describe one or more of the Reserved Capacity purchased.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/iam-policy-prevent-purchase-reserved-capacity.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeReservedCapacity", []))

    @jsii.member(jsii_name="toDescribeReservedCapacityOfferings")
    def to_describe_reserved_capacity_offerings(self) -> "Dynamodb":
        '''(experimental) Grants permission to describe Reserved Capacity offerings that are available for purchase.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/iam-policy-prevent-purchase-reserved-capacity.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeReservedCapacityOfferings", []))

    @jsii.member(jsii_name="toDescribeStream")
    def to_describe_stream(self) -> "Dynamodb":
        '''(experimental) Grants permission to return information about a stream, including the current status of the stream, its Amazon Resource Name (ARN), the composition of its shards, and its corresponding DynamoDB table.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_streams_DescribeStream.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeStream", []))

    @jsii.member(jsii_name="toDescribeTable")
    def to_describe_table(self) -> "Dynamodb":
        '''(experimental) Grants permission to return information about the table.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeTable.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeTable", []))

    @jsii.member(jsii_name="toDescribeTableReplicaAutoScaling")
    def to_describe_table_replica_auto_scaling(self) -> "Dynamodb":
        '''(experimental) Grants permission to describe the auto scaling settings across all replicas of the global table.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeTableReplicaAutoScaling.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeTableReplicaAutoScaling", []))

    @jsii.member(jsii_name="toDescribeTimeToLive")
    def to_describe_time_to_live(self) -> "Dynamodb":
        '''(experimental) Grants permission to give a description of the Time to Live (TTL) status on the specified table.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeTimeToLive.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDescribeTimeToLive", []))

    @jsii.member(jsii_name="toDisableKinesisStreamingDestination")
    def to_disable_kinesis_streaming_destination(self) -> "Dynamodb":
        '''(experimental) Grants permission to grant permission to stop replication from the DynamoDB table to the Kinesis data stream.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DisableKinesisStreamingDestination.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toDisableKinesisStreamingDestination", []))

    @jsii.member(jsii_name="toEnableKinesisStreamingDestination")
    def to_enable_kinesis_streaming_destination(self) -> "Dynamodb":
        '''(experimental) Grants permission to grant permission to start table data replication to the specified Kinesis data stream at a timestamp chosen during the enable workflow.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_EnableKinesisStreamingDestination.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toEnableKinesisStreamingDestination", []))

    @jsii.member(jsii_name="toExportTableToPointInTime")
    def to_export_table_to_point_in_time(self) -> "Dynamodb":
        '''(experimental) Grants permission to initiate an Export of a DynamoDB table to S3.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ExportTableToPointInTime.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toExportTableToPointInTime", []))

    @jsii.member(jsii_name="toGetItem")
    def to_get_item(self) -> "Dynamodb":
        '''(experimental) Grants permission to the GetItem operation that returns a set of attributes for the item with the given primary key.

        Access Level: Read

        Possible conditions:

        - .ifAttributes()
        - .ifEnclosingOperation()
        - .ifLeadingKeys()
        - .ifReturnConsumedCapacity()
        - .ifSelect()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_GetItem.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toGetItem", []))

    @jsii.member(jsii_name="toGetRecords")
    def to_get_records(self) -> "Dynamodb":
        '''(experimental) Grants permission to retrieve the stream records from a given shard.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_streams_GetRecords.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toGetRecords", []))

    @jsii.member(jsii_name="toGetShardIterator")
    def to_get_shard_iterator(self) -> "Dynamodb":
        '''(experimental) Grants permission to return a shard iterator.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_streams_GetShardIterator.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toGetShardIterator", []))

    @jsii.member(jsii_name="toImportTable")
    def to_import_table(self) -> "Dynamodb":
        '''(experimental) Grants permission to initiate an import from S3 to a DynamoDB table.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ImportTable.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toImportTable", []))

    @jsii.member(jsii_name="toListBackups")
    def to_list_backups(self) -> "Dynamodb":
        '''(experimental) Grants permission to list backups associated with the account and endpoint.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListBackups.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toListBackups", []))

    @jsii.member(jsii_name="toListContributorInsights")
    def to_list_contributor_insights(self) -> "Dynamodb":
        '''(experimental) Grants permission to list the ContributorInsightsSummary for all tables and global secondary indexes associated with the current account and endpoint.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListContributorInsights.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toListContributorInsights", []))

    @jsii.member(jsii_name="toListExports")
    def to_list_exports(self) -> "Dynamodb":
        '''(experimental) Grants permission to list exports associated with the account and endpoint.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListExports.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toListExports", []))

    @jsii.member(jsii_name="toListGlobalTables")
    def to_list_global_tables(self) -> "Dynamodb":
        '''(experimental) Grants permission to list all global tables that have a replica in the specified region.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListGlobalTables.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toListGlobalTables", []))

    @jsii.member(jsii_name="toListImports")
    def to_list_imports(self) -> "Dynamodb":
        '''(experimental) Grants permission to list imports associated with the account and endpoint.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListImports.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toListImports", []))

    @jsii.member(jsii_name="toListStreams")
    def to_list_streams(self) -> "Dynamodb":
        '''(experimental) Grants permission to return an array of stream ARNs associated with the current account and endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_streams_ListStreams.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toListStreams", []))

    @jsii.member(jsii_name="toListTables")
    def to_list_tables(self) -> "Dynamodb":
        '''(experimental) Grants permission to return an array of table names associated with the current account and endpoint.

        Access Level: List

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListTables.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toListTables", []))

    @jsii.member(jsii_name="toListTagsOfResource")
    def to_list_tags_of_resource(self) -> "Dynamodb":
        '''(experimental) Grants permission to list all tags on an Amazon DynamoDB resource.

        Access Level: Read

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListTagsOfResource.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toListTagsOfResource", []))

    @jsii.member(jsii_name="toPartiQLDelete")
    def to_parti_ql_delete(self) -> "Dynamodb":
        '''(experimental) Grants permission to delete a single item in a table by primary key.

        Access Level: Write

        Possible conditions:

        - .ifAttributes()
        - .ifEnclosingOperation()
        - .ifLeadingKeys()
        - .ifReturnValues()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ExecuteStatement.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toPartiQLDelete", []))

    @jsii.member(jsii_name="toPartiQLInsert")
    def to_parti_ql_insert(self) -> "Dynamodb":
        '''(experimental) Grants permission to create a new item, if an item with same primary key does not exist in the table.

        Access Level: Write

        Possible conditions:

        - .ifAttributes()
        - .ifEnclosingOperation()
        - .ifLeadingKeys()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ExecuteStatement.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toPartiQLInsert", []))

    @jsii.member(jsii_name="toPartiQLSelect")
    def to_parti_ql_select(self) -> "Dynamodb":
        '''(experimental) Grants permission to read a set of attributes for items from a table or index.

        Access Level: Read

        Possible conditions:

        - .ifAttributes()
        - .ifEnclosingOperation()
        - .ifFullTableScan()
        - .ifLeadingKeys()
        - .ifSelect()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ExecuteStatement.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toPartiQLSelect", []))

    @jsii.member(jsii_name="toPartiQLUpdate")
    def to_parti_ql_update(self) -> "Dynamodb":
        '''(experimental) Grants permission to edit an existing item's attributes.

        Access Level: Write

        Possible conditions:

        - .ifAttributes()
        - .ifEnclosingOperation()
        - .ifLeadingKeys()
        - .ifReturnValues()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ExecuteStatement.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toPartiQLUpdate", []))

    @jsii.member(jsii_name="toPurchaseReservedCapacityOfferings")
    def to_purchase_reserved_capacity_offerings(self) -> "Dynamodb":
        '''(experimental) Grants permission to purchases reserved capacity for use with your account.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/iam-policy-prevent-purchase-reserved-capacity.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toPurchaseReservedCapacityOfferings", []))

    @jsii.member(jsii_name="toPutItem")
    def to_put_item(self) -> "Dynamodb":
        '''(experimental) Grants permission to create a new item, or replace an old item with a new item.

        Access Level: Write

        Possible conditions:

        - .ifAttributes()
        - .ifEnclosingOperation()
        - .ifLeadingKeys()
        - .ifReturnConsumedCapacity()
        - .ifReturnValues()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_PutItem.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toPutItem", []))

    @jsii.member(jsii_name="toQuery")
    def to_query(self) -> "Dynamodb":
        '''(experimental) Grants permission to use the primary key of a table or a secondary index to directly access items from that table or index.

        Access Level: Read

        Possible conditions:

        - .ifAttributes()
        - .ifLeadingKeys()
        - .ifReturnConsumedCapacity()
        - .ifReturnValues()
        - .ifSelect()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Query.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toQuery", []))

    @jsii.member(jsii_name="toRestoreTableFromAwsBackup")
    def to_restore_table_from_aws_backup(self) -> "Dynamodb":
        '''(experimental) Grants permission to create a new table from recovery point on AWS Backup.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/UsageNotesAWS.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toRestoreTableFromAwsBackup", []))

    @jsii.member(jsii_name="toRestoreTableFromBackup")
    def to_restore_table_from_backup(self) -> "Dynamodb":
        '''(experimental) Grants permission to create a new table from an existing backup.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_RestoreTableFromBackup.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toRestoreTableFromBackup", []))

    @jsii.member(jsii_name="toRestoreTableToPointInTime")
    def to_restore_table_to_point_in_time(self) -> "Dynamodb":
        '''(experimental) Grants permission to restore a table to a point in time.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_RestoreTableToPointInTime.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toRestoreTableToPointInTime", []))

    @jsii.member(jsii_name="toScan")
    def to_scan(self) -> "Dynamodb":
        '''(experimental) Grants permission to return one or more items and item attributes by accessing every item in a table or a secondary index.

        Access Level: Read

        Possible conditions:

        - .ifAttributes()
        - .ifReturnConsumedCapacity()
        - .ifReturnValues()
        - .ifSelect()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_Scan.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toScan", []))

    @jsii.member(jsii_name="toStartAwsBackupJob")
    def to_start_aws_backup_job(self) -> "Dynamodb":
        '''(experimental) Grants permission to create a backup on AWS Backup with advanced features enabled.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/UsageNotesAWS.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toStartAwsBackupJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Dynamodb":
        '''(experimental) Grants permission to associate a set of tags with an Amazon DynamoDB resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Dynamodb":
        '''(experimental) Grants permission to remove the association of tags from an Amazon DynamoDB resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateContinuousBackups")
    def to_update_continuous_backups(self) -> "Dynamodb":
        '''(experimental) Grants permission to enable or disable continuous backups.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateContinuousBackups.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toUpdateContinuousBackups", []))

    @jsii.member(jsii_name="toUpdateContributorInsights")
    def to_update_contributor_insights(self) -> "Dynamodb":
        '''(experimental) Grants permission to update the status for contributor insights for a specific table or global secondary index.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateContributorInsights.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toUpdateContributorInsights", []))

    @jsii.member(jsii_name="toUpdateGlobalTable")
    def to_update_global_table(self) -> "Dynamodb":
        '''(experimental) Grants permission to add or remove replicas in the specified global table.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateGlobalTable.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toUpdateGlobalTable", []))

    @jsii.member(jsii_name="toUpdateGlobalTableSettings")
    def to_update_global_table_settings(self) -> "Dynamodb":
        '''(experimental) Grants permission to update settings of the specified global table.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateGlobalTableSettings.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toUpdateGlobalTableSettings", []))

    @jsii.member(jsii_name="toUpdateGlobalTableVersion")
    def to_update_global_table_version(self) -> "Dynamodb":
        '''(experimental) Grants permission to update version of the specified global table.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/V2globaltables_upgrade.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toUpdateGlobalTableVersion", []))

    @jsii.member(jsii_name="toUpdateItem")
    def to_update_item(self) -> "Dynamodb":
        '''(experimental) Grants permission to edit an existing item's attributes, or adds a new item to the table if it does not already exist.

        Access Level: Write

        Possible conditions:

        - .ifAttributes()
        - .ifEnclosingOperation()
        - .ifLeadingKeys()
        - .ifReturnConsumedCapacity()
        - .ifReturnValues()

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateItem.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toUpdateItem", []))

    @jsii.member(jsii_name="toUpdateTable")
    def to_update_table(self) -> "Dynamodb":
        '''(experimental) Grants permission to modify the provisioned throughput settings, global secondary indexes, or DynamoDB Streams settings for a given table.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateTable.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toUpdateTable", []))

    @jsii.member(jsii_name="toUpdateTableReplicaAutoScaling")
    def to_update_table_replica_auto_scaling(self) -> "Dynamodb":
        '''(experimental) Grants permission to update auto scaling settings on your replica table.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateTableReplicaAutoScaling.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toUpdateTableReplicaAutoScaling", []))

    @jsii.member(jsii_name="toUpdateTimeToLive")
    def to_update_time_to_live(self) -> "Dynamodb":
        '''(experimental) Grants permission to enable or disable TTL for the specified table.

        Access Level: Write

        https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateTimeToLive.html

        :stability: experimental
        '''
        return typing.cast("Dynamodb", jsii.invoke(self, "toUpdateTimeToLive", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fbf9805c3ea2f2d70d91670a480ae001e200e3bcd557a6ff9ca509a628d69994)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__81646ac29ff92089cf684dde47a6addc85563aeeff41e3f849fabe1f6f855c7b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Ebs(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ebs"):
    '''(experimental) Statement provider for service `ebs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticblockstore.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ebs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticblockstore.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f2b445b9aae32c5d9dc57ed38022613e70bad3970ce5ea9a05c83c8f0d439ce7)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifDescription")
    def if_description(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ebs":
        '''(experimental) Filters access by the description of the snapshot being created.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonelasticblockstore.html#amazonelasticblockstore-policy-keys

        Applies to actions:

        - .toStartSnapshot()

        Applies to resource types:

        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5dd7e0b0582b0b68d54f3f4efb88752a90141399681835df6cc13acd258bc5f9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ebs", jsii.invoke(self, "ifDescription", [value, operator]))

    @jsii.member(jsii_name="ifParentSnapshot")
    def if_parent_snapshot(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ebs":
        '''(experimental) Filters access by the ID of the parent snapshot.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonelasticblockstore.html#amazonelasticblockstore-policy-keys

        Applies to actions:

        - .toStartSnapshot()

        Applies to resource types:

        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6fdd214ab1a9619c2ee73db68df642bf2143e1a3ac601b71d18594e8e0836d3d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ebs", jsii.invoke(self, "ifParentSnapshot", [value, operator]))

    @jsii.member(jsii_name="ifVolumeSize")
    def if_volume_size(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ebs":
        '''(experimental) Filters access by the size of the volume for the snapshot being created, in GiB.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonelasticblockstore.html#amazonelasticblockstore-policy-keys

        Applies to actions:

        - .toStartSnapshot()

        Applies to resource types:

        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d4af6b0b23af04fbf3ff66230f9da64e318ed374b779405c632f952aea60f263)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ebs", jsii.invoke(self, "ifVolumeSize", [value, operator]))

    @jsii.member(jsii_name="onSnapshot")
    def on_snapshot(
        self,
        snapshot_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ebs":
        '''(experimental) Adds a resource of type snapshot to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSSnapshots.html

        :param snapshot_id: - Identifier for the snapshotId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifDescription() - .ifParentSnapshot() - .ifVolumeSize()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c572344ad8357863d61fca8ad10af9d2b740d19d7b0d29703f3b8f4dedb5bef2)
            check_type(argname="argument snapshot_id", value=snapshot_id, expected_type=type_hints["snapshot_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ebs", jsii.invoke(self, "onSnapshot", [snapshot_id, region, partition]))

    @jsii.member(jsii_name="toCompleteSnapshot")
    def to_complete_snapshot(self) -> "Ebs":
        '''(experimental) Grants permission to seal and complete the snapshot after all of the required blocks of data have been written to it.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ebs/latest/APIReference/API_CompleteSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Ebs", jsii.invoke(self, "toCompleteSnapshot", []))

    @jsii.member(jsii_name="toGetSnapshotBlock")
    def to_get_snapshot_block(self) -> "Ebs":
        '''(experimental) Grants permission to return the data of a block in an Amazon Elastic Block Store (EBS) snapshot.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ebs/latest/APIReference/API_GetSnapshotBlock.html

        :stability: experimental
        '''
        return typing.cast("Ebs", jsii.invoke(self, "toGetSnapshotBlock", []))

    @jsii.member(jsii_name="toListChangedBlocks")
    def to_list_changed_blocks(self) -> "Ebs":
        '''(experimental) Grants permission to list the blocks that are different between two Amazon Elastic Block Store (EBS) snapshots of the same volume/snapshot lineage.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ebs/latest/APIReference/API_ListChangedBlocks.html

        :stability: experimental
        '''
        return typing.cast("Ebs", jsii.invoke(self, "toListChangedBlocks", []))

    @jsii.member(jsii_name="toListSnapshotBlocks")
    def to_list_snapshot_blocks(self) -> "Ebs":
        '''(experimental) Grants permission to list the blocks in an Amazon Elastic Block Store (EBS) snapshot.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ebs/latest/APIReference/API_ListSnapshotBlocks.html

        :stability: experimental
        '''
        return typing.cast("Ebs", jsii.invoke(self, "toListSnapshotBlocks", []))

    @jsii.member(jsii_name="toPutSnapshotBlock")
    def to_put_snapshot_block(self) -> "Ebs":
        '''(experimental) Grants permission to write a block of data to a snapshot created by the StartSnapshot operation.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/ebs/latest/APIReference/API_PutSnapshotBlock.html

        :stability: experimental
        '''
        return typing.cast("Ebs", jsii.invoke(self, "toPutSnapshotBlock", []))

    @jsii.member(jsii_name="toStartSnapshot")
    def to_start_snapshot(self) -> "Ebs":
        '''(experimental) Grants permission to create a new EBS snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsResourceTag()
        - .ifAwsTagKeys()
        - .ifDescription()
        - .ifParentSnapshot()
        - .ifVolumeSize()

        https://docs.aws.amazon.com/ebs/latest/APIReference/API_StartSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Ebs", jsii.invoke(self, "toStartSnapshot", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__37e9c3a4453cb3c021601834a3720f1f2aa6fc59846022acdc2f6a3b1058861c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b9b417f0ec8ca2c7e7d2534864b2d100d736f2bc78795947f042a368013b9df1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Ec2(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ec2"):
    '''(experimental) Statement provider for service `ec2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ec2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__42ce36e1c60f40990ee20b9062ce5b1b091e54da4a2d29e66aa9562577ea1a13)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAccepterVpc")
    def if_accepter_vpc(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of an accepter VPC in a VPC peering connection.

        https://docs.aws.amazon.com/vpc/latest/peering/security-iam.html

        Applies to actions:

        - .toAcceptVpcPeeringConnection()
        - .toCreateNetworkInsightsPath()
        - .toCreateTags()
        - .toCreateVpcPeeringConnection()
        - .toDeleteVpcPeeringConnection()
        - .toModifyVpcPeeringConnectionOptions()
        - .toRejectVpcPeeringConnection()

        Applies to resource types:

        - vpc-peering-connection

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__75b32321b6d48f065de8866d1082053b335404d59da73db675e55cafaca1702f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifAccepterVpc", [value, operator]))

    @jsii.member(jsii_name="ifAddGroup")
    def if_add_group(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the group being added to a snapshot.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toModifySnapshotAttribute()

        Applies to resource types:

        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5213e454e140e3e3ade2ad4766ea94a461d74a8a265b88445d5e6d8c3f9c7d2f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifAddGroup", [value, operator]))

    @jsii.member(jsii_name="ifAddUserId")
    def if_add_user_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the account id being added to a snapshot.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toModifySnapshotAttribute()

        Applies to resource types:

        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2ffe592f3331ae9dd87d04b2f592e1a9396d111d0f94beb2297668d2ce91d45f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifAddUserId", [value, operator]))

    @jsii.member(jsii_name="ifAllocationId")
    def if_allocation_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the allocation ID of the Elastic IP address.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAcceptAddressTransfer()
        - .toAssociateAddress()
        - .toAssociateNatGatewayAddress()
        - .toCreateNatGateway()
        - .toCreateTags()
        - .toDescribeAddressesAttribute()
        - .toDisableAddressTransfer()
        - .toDisassociateAddress()
        - .toDisassociateNatGatewayAddress()
        - .toEnableAddressTransfer()
        - .toModifyAddressAttribute()
        - .toReleaseAddress()
        - .toResetAddressAttribute()

        Applies to resource types:

        - elastic-ip

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__86d699f99b946009ac8bae24f768a3ef450a918982671ddfdf895204cafccba3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifAllocationId", [value, operator]))

    @jsii.member(jsii_name="ifAssociatePublicIpAddress")
    def if_associate_public_ip_address(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by whether the user wants to associate a public IP address with the instance.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateFleet()
        - .toCreateNetworkInsightsPath()
        - .toCreateTags()
        - .toCreateVerifiedAccessEndpoint()
        - .toDeleteNetworkInterfacePermission()
        - .toDisassociateNatGatewayAddress()
        - .toModifyFleet()
        - .toModifyLocalGatewayRoute()
        - .toRequestSpotInstances()
        - .toRunInstances()

        Applies to resource types:

        - network-interface

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__40ca388cb60a5e8253b0808cad0f6d9d3df2a51ab9a3f56a9d4731d0a4720536)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Ec2", jsii.invoke(self, "ifAssociatePublicIpAddress", [value]))

    @jsii.member(jsii_name="ifAttribute")
    def if_attribute(
        self,
        attribute_name: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by an attribute being set on a resource.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toModifyAddressAttribute()
        - .toModifyCapacityReservation()
        - .toModifyCapacityReservationFleet()
        - .toModifyClientVpnEndpoint()
        - .toModifyFleet()
        - .toModifyFpgaImageAttribute()
        - .toModifyHosts()
        - .toModifyImageAttribute()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceEventStartTime()
        - .toModifyInstanceMaintenanceOptions()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyIpam()
        - .toModifyIpamPool()
        - .toModifyIpamResourceCidr()
        - .toModifyIpamScope()
        - .toModifyLaunchTemplate()
        - .toModifyManagedPrefixList()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyPrivateDnsNameOptions()
        - .toModifyReservedInstances()
        - .toModifySecurityGroupRules()
        - .toModifySnapshotAttribute()
        - .toModifySnapshotTier()
        - .toModifySpotFleetRequest()
        - .toModifySubnetAttribute()
        - .toModifyTrafficMirrorFilterNetworkServices()
        - .toModifyTrafficMirrorFilterRule()
        - .toModifyTrafficMirrorSession()
        - .toModifyTransitGateway()
        - .toModifyTransitGatewayPrefixListReference()
        - .toModifyTransitGatewayVpcAttachment()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toModifyVpcAttribute()
        - .toModifyVpcEndpoint()
        - .toModifyVpcEndpointServiceConfiguration()
        - .toModifyVpcEndpointServicePayerResponsibility()
        - .toModifyVpcEndpointServicePermissions()
        - .toModifyVpcPeeringConnectionOptions()
        - .toModifyVpcTenancy()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toResetAddressAttribute()
        - .toResetFpgaImageAttribute()
        - .toResetImageAttribute()
        - .toResetSnapshotAttribute()

        Applies to resource types:

        - elastic-ip
        - capacity-reservation-fleet
        - capacity-reservation
        - client-vpn-endpoint
        - dedicated-host
        - fleet
        - fpga-image
        - image
        - instance
        - ipam
        - ipam-pool
        - ipam-scope
        - launch-template
        - network-interface
        - prefix-list
        - reserved-instances
        - security-group
        - snapshot
        - spot-fleet-request
        - subnet
        - traffic-mirror-filter
        - traffic-mirror-filter-rule
        - traffic-mirror-session
        - transit-gateway-attachment
        - transit-gateway
        - transit-gateway-route-table
        - volume
        - vpc-endpoint
        - vpc-endpoint-service
        - vpc
        - vpc-peering-connection
        - vpn-connection

        :param attribute_name: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4688166aeb848a0ecfad72a8a51524bf785b4f18861d1a847d6c208d7dd0ff14)
            check_type(argname="argument attribute_name", value=attribute_name, expected_type=type_hints["attribute_name"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifAttribute", [attribute_name, value, operator]))

    @jsii.member(jsii_name="ifAttributeExists")
    def if_attribute_exists(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by an attribute of a resource.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toModifyAddressAttribute()
        - .toModifyCapacityReservation()
        - .toModifyCapacityReservationFleet()
        - .toModifyClientVpnEndpoint()
        - .toModifyFleet()
        - .toModifyFpgaImageAttribute()
        - .toModifyHosts()
        - .toModifyImageAttribute()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceMaintenanceOptions()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyIpam()
        - .toModifyIpamPool()
        - .toModifyIpamResourceCidr()
        - .toModifyIpamScope()
        - .toModifyLaunchTemplate()
        - .toModifyManagedPrefixList()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyPrivateDnsNameOptions()
        - .toModifyReservedInstances()
        - .toModifySecurityGroupRules()
        - .toModifySnapshotAttribute()
        - .toModifySnapshotTier()
        - .toModifySpotFleetRequest()
        - .toModifySubnetAttribute()
        - .toModifyTrafficMirrorFilterNetworkServices()
        - .toModifyTrafficMirrorFilterRule()
        - .toModifyTrafficMirrorSession()
        - .toModifyTransitGateway()
        - .toModifyTransitGatewayPrefixListReference()
        - .toModifyTransitGatewayVpcAttachment()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toModifyVpcAttribute()
        - .toModifyVpcEndpoint()
        - .toModifyVpcEndpointServiceConfiguration()
        - .toModifyVpcEndpointServicePayerResponsibility()
        - .toModifyVpcEndpointServicePermissions()
        - .toModifyVpcPeeringConnectionOptions()
        - .toModifyVpcTenancy()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toResetAddressAttribute()
        - .toResetFpgaImageAttribute()
        - .toResetImageAttribute()
        - .toResetSnapshotAttribute()

        Applies to resource types:

        - elastic-ip
        - capacity-reservation-fleet
        - capacity-reservation
        - client-vpn-endpoint
        - dedicated-host
        - fleet
        - fpga-image
        - image
        - instance
        - ipam
        - ipam-pool
        - ipam-scope
        - launch-template
        - network-interface
        - prefix-list
        - reserved-instances
        - security-group
        - snapshot
        - spot-fleet-request
        - subnet
        - traffic-mirror-filter
        - traffic-mirror-filter-rule
        - traffic-mirror-session
        - transit-gateway-attachment
        - transit-gateway
        - transit-gateway-route-table
        - volume
        - vpc-endpoint
        - vpc-endpoint-service
        - vpc
        - vpc-peering-connection
        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__39cc007c9c259e6c8bc79f831495bb673fa6aa432712adc714074863fb642fe5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifAttributeExists", [value, operator]))

    @jsii.member(jsii_name="ifAuthenticationType")
    def if_authentication_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the authentication type for the VPN tunnel endpoints.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toModifyVpnConnection()
        - .toModifyVpnTunnelOptions()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c530904fe904e35df031f04883066b69b4a40ac2f1f876f987ed8f34b9a81db4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifAuthenticationType", [value, operator]))

    @jsii.member(jsii_name="ifAuthorizedService")
    def if_authorized_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the AWS service that has permission to use a resource.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateFleet()
        - .toCreateNetworkInsightsPath()
        - .toCreateNetworkInterfacePermission()
        - .toCreateTags()
        - .toCreateVerifiedAccessEndpoint()
        - .toDeleteNetworkInterfacePermission()
        - .toDisassociateNatGatewayAddress()
        - .toModifyFleet()
        - .toModifyLocalGatewayRoute()
        - .toRequestSpotInstances()
        - .toRunInstances()

        Applies to resource types:

        - network-interface

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1a11ee82c8e079a6878c854b445dd9bbb8d8b102177a1875cedfe8b0cbf19af3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifAuthorizedService", [value, operator]))

    @jsii.member(jsii_name="ifAuthorizedUser")
    def if_authorized_user(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by an IAM principal that has permission to use a resource.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateNetworkInterfacePermission()
        - .toCreateTags()
        - .toCreateVerifiedAccessEndpoint()
        - .toDisassociateNatGatewayAddress()
        - .toModifyLocalGatewayRoute()
        - .toRequestSpotInstances()

        Applies to resource types:

        - network-interface

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__195cdf4b7934972e325597a59a97851790d088a86bb049a6e2f8917fe563b29f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifAuthorizedUser", [value, operator]))

    @jsii.member(jsii_name="ifAutoPlacement")
    def if_auto_placement(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the Auto Placement properties of a Dedicated Host.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAllocateHosts()
        - .toCreateTags()

        Applies to resource types:

        - dedicated-host

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a26c18b190a3a40c21ae9bb5a57efb9bcbaaab1bb51983fdc50290b2fb3ff70a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifAutoPlacement", [value, operator]))

    @jsii.member(jsii_name="ifAvailabilityZone")
    def if_availability_zone(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the name of an Availability Zone in an AWS Region.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAllocateHosts()
        - .toAssignIpv6Addresses()
        - .toAssignPrivateIpAddresses()
        - .toAssociateAddress()
        - .toAssociateIamInstanceProfile()
        - .toAssociateRouteTable()
        - .toAssociateSubnetCidrBlock()
        - .toAssociateTransitGatewayMulticastDomain()
        - .toAttachClassicLinkVpc()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toCreateFleet()
        - .toCreateFlowLogs()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateLocalGatewayRoute()
        - .toCreateNatGateway()
        - .toCreateNetworkInsightsPath()
        - .toCreateNetworkInterface()
        - .toCreateNetworkInterfacePermission()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toCreateTransitGatewayVpcAttachment()
        - .toCreateVerifiedAccessEndpoint()
        - .toCreateVolume()
        - .toDeleteClientVpnRoute()
        - .toDeleteNetworkInterface()
        - .toDeleteNetworkInterfacePermission()
        - .toDeleteSubnet()
        - .toDeleteVolume()
        - .toDeregisterTransitGatewayMulticastGroupMembers()
        - .toDeregisterTransitGatewayMulticastGroupSources()
        - .toDescribeInstanceAttribute()
        - .toDescribeSnapshotAttribute()
        - .toDescribeVolumeAttribute()
        - .toDetachClassicLinkVpc()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDisableFastSnapshotRestores()
        - .toDisassociateAddress()
        - .toDisassociateIamInstanceProfile()
        - .toDisassociateNatGatewayAddress()
        - .toDisassociateRouteTable()
        - .toDisassociateSubnetCidrBlock()
        - .toDisassociateTransitGatewayMulticastDomain()
        - .toEnableFastSnapshotRestores()
        - .toEnableVolumeIO()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetInstanceUefiData()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toImportInstance()
        - .toImportVolume()
        - .toListSnapshotsInRecycleBin()
        - .toModifyFleet()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceMaintenanceOptions()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyLocalGatewayRoute()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyPrivateDnsNameOptions()
        - .toModifyReservedInstances()
        - .toModifySnapshotTier()
        - .toModifySpotFleetRequest()
        - .toModifySubnetAttribute()
        - .toModifyVerifiedAccessEndpoint()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toMonitorInstances()
        - .toPauseVolumeIO()
        - .toRebootInstances()
        - .toRegisterTransitGatewayMulticastGroupMembers()
        - .toRegisterTransitGatewayMulticastGroupSources()
        - .toReplaceIamInstanceProfileAssociation()
        - .toReplaceNetworkAclAssociation()
        - .toReplaceRouteTableAssociation()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toResetInstanceAttribute()
        - .toResetNetworkInterfaceAttribute()
        - .toRestoreSnapshotFromRecycleBin()
        - .toRestoreSnapshotTier()
        - .toRunInstances()
        - .toSendDiagnosticInterrupt()
        - .toSendSpotInstanceInterruptions()
        - .toStartInstances()
        - .toStopInstances()
        - .toTerminateInstances()
        - .toUnassignIpv6Addresses()
        - .toUnassignPrivateIpAddresses()
        - .toUnmonitorInstances()

        Applies to resource types:

        - dedicated-host
        - instance
        - network-interface
        - reserved-instances
        - snapshot
        - subnet
        - volume

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9ae9d7c595c1a674ee13b61363f5fd19512f1a8310f7360eef8bb01c7c7e71a2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifAvailabilityZone", [value, operator]))

    @jsii.member(jsii_name="ifCapacityReservationFleet")
    def if_capacity_reservation_fleet(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the Capacity Reservation Fleet.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCancelCapacityReservation()
        - .toCreateCapacityReservation()
        - .toGetCapacityReservationUsage()
        - .toGetGroupsForCapacityReservation()
        - .toModifyCapacityReservation()

        Applies to resource types:

        - capacity-reservation

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2840f81337b628c88a0f1e9189e2b13167d69340ddbabed426d87ad8f94bf939)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifCapacityReservationFleet", [value, operator]))

    @jsii.member(jsii_name="ifClientRootCertificateChainArn")
    def if_client_root_certificate_chain_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the client root certificate chain.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toApplySecurityGroupsToClientVpnTargetNetwork()
        - .toAssociateClientVpnTargetNetwork()
        - .toAuthorizeClientVpnIngress()
        - .toCreateClientVpnEndpoint()
        - .toCreateClientVpnRoute()
        - .toCreateTags()
        - .toDeleteClientVpnEndpoint()
        - .toDeleteClientVpnRoute()
        - .toDescribeClientVpnConnections()
        - .toDescribeClientVpnEndpoints()
        - .toDescribeClientVpnRoutes()
        - .toDescribeClientVpnTargetNetworks()
        - .toDisassociateClientVpnTargetNetwork()
        - .toExportClientVpnClientCertificateRevocationList()
        - .toExportClientVpnClientConfiguration()
        - .toImportClientVpnClientCertificateRevocationList()
        - .toModifyClientVpnEndpoint()
        - .toRevokeClientVpnIngress()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - client-vpn-endpoint

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cf3fffca6b5988b05cfb9c8ebb37a8cc42cdd8e6373fb0eff527394a28c8abdc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifClientRootCertificateChainArn", [value, operator]))

    @jsii.member(jsii_name="ifCloudwatchLogGroupArn")
    def if_cloudwatch_log_group_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the CloudWatch Logs log group.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toApplySecurityGroupsToClientVpnTargetNetwork()
        - .toAssociateClientVpnTargetNetwork()
        - .toAuthorizeClientVpnIngress()
        - .toCreateClientVpnEndpoint()
        - .toCreateClientVpnRoute()
        - .toCreateTags()
        - .toDeleteClientVpnEndpoint()
        - .toDeleteClientVpnRoute()
        - .toDescribeClientVpnConnections()
        - .toDescribeClientVpnEndpoints()
        - .toDescribeClientVpnRoutes()
        - .toDescribeClientVpnTargetNetworks()
        - .toDisassociateClientVpnTargetNetwork()
        - .toExportClientVpnClientCertificateRevocationList()
        - .toExportClientVpnClientConfiguration()
        - .toImportClientVpnClientCertificateRevocationList()
        - .toModifyClientVpnEndpoint()
        - .toRevokeClientVpnIngress()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - client-vpn-endpoint

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__84a93aab320a3f26fa79230a2110aee59ecb17cd928793f584afb41aca44599d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifCloudwatchLogGroupArn", [value, operator]))

    @jsii.member(jsii_name="ifCloudwatchLogStreamArn")
    def if_cloudwatch_log_stream_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the CloudWatch Logs log stream.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toApplySecurityGroupsToClientVpnTargetNetwork()
        - .toAssociateClientVpnTargetNetwork()
        - .toAuthorizeClientVpnIngress()
        - .toCreateClientVpnEndpoint()
        - .toCreateClientVpnRoute()
        - .toCreateTags()
        - .toDeleteClientVpnEndpoint()
        - .toDeleteClientVpnRoute()
        - .toDescribeClientVpnConnections()
        - .toDescribeClientVpnEndpoints()
        - .toDescribeClientVpnRoutes()
        - .toDescribeClientVpnTargetNetworks()
        - .toDisassociateClientVpnTargetNetwork()
        - .toExportClientVpnClientCertificateRevocationList()
        - .toExportClientVpnClientConfiguration()
        - .toImportClientVpnClientCertificateRevocationList()
        - .toModifyClientVpnEndpoint()
        - .toRevokeClientVpnIngress()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - client-vpn-endpoint

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d70a57842be5aec760b5d129810804bc82f677bd04ed16256d9b769518842765)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifCloudwatchLogStreamArn", [value, operator]))

    @jsii.member(jsii_name="ifCreateAction")
    def if_create_action(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the name of a resource-creating API action.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/supported-iam-actions-tagging.html

        Applies to actions:

        - .toCreateTags()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4b53219d1ae601ee31dc0aeac999625a1c5e96d075046a0be8fa5244c78484bf)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifCreateAction", [value, operator]))

    @jsii.member(jsii_name="ifDhcpOptionsID")
    def if_dhcp_options_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ID of a dynamic host configuration protocol (DHCP) options set.

        Applies to actions:

        - .toAssociateDhcpOptions()
        - .toCreateDhcpOptions()
        - .toCreateTags()
        - .toDeleteDhcpOptions()

        Applies to resource types:

        - dhcp-options

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d0f94f74a726c90698b28640d2437944508bc3aca1b63c4f6f6800ff7c99928b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifDhcpOptionsID", [value, operator]))

    @jsii.member(jsii_name="ifDirectoryArn")
    def if_directory_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the directory.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toApplySecurityGroupsToClientVpnTargetNetwork()
        - .toAssociateClientVpnTargetNetwork()
        - .toAuthorizeClientVpnIngress()
        - .toCreateClientVpnEndpoint()
        - .toCreateClientVpnRoute()
        - .toCreateTags()
        - .toDeleteClientVpnEndpoint()
        - .toDeleteClientVpnRoute()
        - .toDescribeClientVpnConnections()
        - .toDescribeClientVpnEndpoints()
        - .toDescribeClientVpnRoutes()
        - .toDescribeClientVpnTargetNetworks()
        - .toDisassociateClientVpnTargetNetwork()
        - .toExportClientVpnClientCertificateRevocationList()
        - .toExportClientVpnClientConfiguration()
        - .toImportClientVpnClientCertificateRevocationList()
        - .toModifyClientVpnEndpoint()
        - .toRevokeClientVpnIngress()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - client-vpn-endpoint

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a83fe8636a3f6b12a66f6ac6acb41f5c0cd40981ed6d1dfe3f69752b63d26683)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifDirectoryArn", [value, operator]))

    @jsii.member(jsii_name="ifDomain")
    def if_domain(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the domain of the Elastic IP address.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAcceptAddressTransfer()
        - .toAssociateAddress()
        - .toAssociateNatGatewayAddress()
        - .toCreateNatGateway()
        - .toCreateTags()
        - .toDescribeAddressesAttribute()
        - .toDisableAddressTransfer()
        - .toDisassociateAddress()
        - .toDisassociateNatGatewayAddress()
        - .toEnableAddressTransfer()
        - .toModifyAddressAttribute()
        - .toReleaseAddress()
        - .toResetAddressAttribute()

        Applies to resource types:

        - elastic-ip

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__334a9ac3ecd6564007ffbb505249a03d609bfa49c478ecd92560135c16f6e0cb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifDomain", [value, operator]))

    @jsii.member(jsii_name="ifDomainCertificateArn")
    def if_domain_certificate_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of an Amazon Certificate Manager certificate.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateTags()
        - .toCreateVerifiedAccessEndpoint()
        - .toDeleteVerifiedAccessEndpoint()
        - .toGetVerifiedAccessEndpointPolicy()
        - .toModifyVerifiedAccessEndpoint()
        - .toModifyVerifiedAccessEndpointPolicy()

        Applies to resource types:

        - verified-access-endpoint

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__37c02bfcc718176f5c9723a871bc94bb501dc7c4cda1fb23189ad0aba27f9b24)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifDomainCertificateArn", [value, operator]))

    @jsii.member(jsii_name="ifDPDTimeoutSeconds")
    def if_dpd_timeout_seconds(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the duration after which DPD timeout occurs on a VPN tunnel.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toModifyVpnConnection()
        - .toModifyVpnTunnelOptions()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4ef817e26a268f6aca627a2d7f0f8e1f2a9102bb3fbb673b98ff69967e94c25e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifDPDTimeoutSeconds", [value, operator]))

    @jsii.member(jsii_name="ifEbsOptimized")
    def if_ebs_optimized(self, value: typing.Optional[builtins.bool] = None) -> "Ec2":
        '''(experimental) Filters access by whether the instance is enabled for EBS optimization.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssociateAddress()
        - .toAssociateIamInstanceProfile()
        - .toAttachClassicLinkVpc()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toCreateFleet()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateNetworkInsightsPath()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toDescribeInstanceAttribute()
        - .toDetachClassicLinkVpc()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDisassociateIamInstanceProfile()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetInstanceUefiData()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceMaintenanceOptions()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyPrivateDnsNameOptions()
        - .toMonitorInstances()
        - .toPauseVolumeIO()
        - .toRebootInstances()
        - .toReplaceIamInstanceProfileAssociation()
        - .toResetInstanceAttribute()
        - .toRunInstances()
        - .toSendDiagnosticInterrupt()
        - .toSendSpotInstanceInterruptions()
        - .toStartInstances()
        - .toStopInstances()
        - .toTerminateInstances()
        - .toUnmonitorInstances()

        Applies to resource types:

        - instance

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eb6f43d51f6c0008d65d7ef3fb0353c747cbe7701e196c81f7da46f073d95a57)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Ec2", jsii.invoke(self, "ifEbsOptimized", [value]))

    @jsii.member(jsii_name="ifElasticGpuType")
    def if_elastic_gpu_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the type of Elastic Graphics accelerator.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateTags()
        - .toRunInstances()

        Applies to resource types:

        - elastic-gpu

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e7b36d5baea6c0494404dbb33dc0f8027aa0282498c11a3c6a2d314be1f6079a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifElasticGpuType", [value, operator]))

    @jsii.member(jsii_name="ifEncrypted")
    def if_encrypted(self, value: typing.Optional[builtins.bool] = None) -> "Ec2":
        '''(experimental) Filters access by whether the EBS volume is encrypted.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAttachVolume()
        - .toCreateFleet()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toCreateVolume()
        - .toDeleteVolume()
        - .toDescribeSnapshotAttribute()
        - .toDescribeVolumeAttribute()
        - .toDetachVolume()
        - .toDisableFastSnapshotRestores()
        - .toEnableFastSnapshotRestores()
        - .toEnableVolumeIO()
        - .toImportInstance()
        - .toImportVolume()
        - .toListSnapshotsInRecycleBin()
        - .toModifyInstanceAttribute()
        - .toModifySnapshotTier()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toPauseVolumeIO()
        - .toRestoreSnapshotFromRecycleBin()
        - .toRestoreSnapshotTier()
        - .toRunInstances()

        Applies to resource types:

        - snapshot
        - volume

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fac32ffc3ea307805b018b0e5ee5e1a7f14b0ceb3bd616b6e35e7133e60469e7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Ec2", jsii.invoke(self, "ifEncrypted", [value]))

    @jsii.member(jsii_name="ifGatewayType")
    def if_gateway_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the gateway type for a VPN endpoint on the AWS side of a VPN connection.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toModifyVpnConnection()
        - .toModifyVpnTunnelOptions()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b856b90fb512a51624f0cb793a9bcad91bc6d17d0d572196929980cac1b9289f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifGatewayType", [value, operator]))

    @jsii.member(jsii_name="ifHostRecovery")
    def if_host_recovery(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by whether host recovery is enabled for a Dedicated Host.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAllocateHosts()
        - .toCreateTags()

        Applies to resource types:

        - dedicated-host

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f7aaaeb75f1ec9d2f6e99d457b8200cf09bb1f950ed244adb0c95a5314ceca92)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifHostRecovery", [value, operator]))

    @jsii.member(jsii_name="ifIKEVersions")
    def if_ike_versions(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the internet key exchange (IKE) versions that are permitted for a VPN tunnel.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toModifyVpnConnection()
        - .toModifyVpnTunnelOptions()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c719a52aea95a71fde31fb33862f252476b5c273b55a69c97570b9d4def9bee6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifIKEVersions", [value, operator]))

    @jsii.member(jsii_name="ifImageID")
    def if_image_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ID of an image.

        Applies to actions:

        - .toCancelImageLaunchPermission()
        - .toCopyImage()
        - .toCreateFleet()
        - .toCreateImage()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateRestoreImageTask()
        - .toCreateStoreImageTask()
        - .toCreateTags()
        - .toDeregisterImage()
        - .toDescribeFastLaunchImages()
        - .toDescribeImageAttribute()
        - .toDisableFastLaunch()
        - .toDisableImageDeprecation()
        - .toEnableFastLaunch()
        - .toEnableImageDeprecation()
        - .toExportImage()
        - .toImportImage()
        - .toListImagesInRecycleBin()
        - .toModifyFleet()
        - .toModifyImageAttribute()
        - .toRegisterImage()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toResetImageAttribute()
        - .toRestoreImageFromRecycleBin()
        - .toRunInstances()

        Applies to resource types:

        - image

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8a61cb9fa6ede1a4b00404e9d12fd6eb7e80db4a7b591cd7af43e608d6a39ed8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifImageID", [value, operator]))

    @jsii.member(jsii_name="ifImageType")
    def if_image_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the type of image (machine, aki, or ari).

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCancelImageLaunchPermission()
        - .toCreateFleet()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateStoreImageTask()
        - .toCreateTags()
        - .toDeregisterImage()
        - .toDescribeFastLaunchImages()
        - .toDescribeImageAttribute()
        - .toDisableFastLaunch()
        - .toDisableImageDeprecation()
        - .toEnableFastLaunch()
        - .toEnableImageDeprecation()
        - .toExportImage()
        - .toImportImage()
        - .toListImagesInRecycleBin()
        - .toModifyFleet()
        - .toModifyImageAttribute()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toResetImageAttribute()
        - .toRestoreImageFromRecycleBin()
        - .toRunInstances()

        Applies to resource types:

        - image

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__604cd0627ae2970a4f904bda8ea2dc4040dc923569e60fa8bffa19b7256b8b55)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifImageType", [value, operator]))

    @jsii.member(jsii_name="ifInsideTunnelCidr")
    def if_inside_tunnel_cidr(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the range of inside IP addresses for a VPN tunnel.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toModifyVpnConnection()
        - .toModifyVpnTunnelOptions()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0570ff3142b64a309d3bd93a0f287b415074d0f3ed35588a7bb72e14613d3f98)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifInsideTunnelCidr", [value, operator]))

    @jsii.member(jsii_name="ifInsideTunnelIpv6Cidr")
    def if_inside_tunnel_ipv6_cidr(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by a range of inside IPv6 addresses for a VPN tunnel.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toModifyVpnConnection()
        - .toModifyVpnTunnelOptions()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__27de948bc207bd7d646c5308a5d2cb49622bdb4cf6dc625d35d02f79633df16c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifInsideTunnelIpv6Cidr", [value, operator]))

    @jsii.member(jsii_name="ifInstanceAutoRecovery")
    def if_instance_auto_recovery(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by whether the instance type supports auto recovery.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssociateAddress()
        - .toAssociateIamInstanceProfile()
        - .toAttachNetworkInterface()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateTags()
        - .toDescribeInstanceAttribute()
        - .toDetachNetworkInterface()
        - .toDisassociateIamInstanceProfile()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetInstanceUefiData()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceMaintenanceOptions()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyPrivateDnsNameOptions()
        - .toMonitorInstances()
        - .toPauseVolumeIO()
        - .toRebootInstances()
        - .toReplaceIamInstanceProfileAssociation()
        - .toRunInstances()
        - .toSendDiagnosticInterrupt()
        - .toSendSpotInstanceInterruptions()
        - .toUnmonitorInstances()

        Applies to resource types:

        - instance

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1682c0dc71e29ba4bc94ab7e6c399f8950bde28f7fffc73cc4fdcba43515c1ea)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifInstanceAutoRecovery", [value, operator]))

    @jsii.member(jsii_name="ifInstanceID")
    def if_instance_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ID of an instance.

        Applies to actions:

        - .toAssociateAddress()
        - .toAssociateIamInstanceProfile()
        - .toAttachClassicLinkVpc()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toCreateFleet()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateNetworkInsightsPath()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toDescribeInstanceAttribute()
        - .toDetachClassicLinkVpc()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDisassociateIamInstanceProfile()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetInstanceUefiData()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toImportInstance()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceEventStartTime()
        - .toModifyInstanceMaintenanceOptions()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyPrivateDnsNameOptions()
        - .toMonitorInstances()
        - .toPauseVolumeIO()
        - .toRebootInstances()
        - .toReplaceIamInstanceProfileAssociation()
        - .toResetInstanceAttribute()
        - .toRunInstances()
        - .toSendDiagnosticInterrupt()
        - .toSendSpotInstanceInterruptions()
        - .toStartInstances()
        - .toStopInstances()
        - .toTerminateInstances()
        - .toUnmonitorInstances()

        Applies to resource types:

        - instance

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3556a2bddcd8e722b26db61ad71306be1236bd7e53df1fb6ac8ed9307aed944f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifInstanceID", [value, operator]))

    @jsii.member(jsii_name="ifInstanceMarketType")
    def if_instance_market_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the market or purchasing option of an instance (on-demand or spot).

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssociateAddress()
        - .toAssociateIamInstanceProfile()
        - .toAttachClassicLinkVpc()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateTags()
        - .toDescribeInstanceAttribute()
        - .toDetachClassicLinkVpc()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDisassociateIamInstanceProfile()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetInstanceUefiData()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceMaintenanceOptions()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyPrivateDnsNameOptions()
        - .toMonitorInstances()
        - .toPauseVolumeIO()
        - .toRebootInstances()
        - .toReplaceIamInstanceProfileAssociation()
        - .toResetInstanceAttribute()
        - .toRunInstances()
        - .toSendDiagnosticInterrupt()
        - .toSendSpotInstanceInterruptions()
        - .toStartInstances()
        - .toStopInstances()
        - .toTerminateInstances()
        - .toUnmonitorInstances()

        Applies to resource types:

        - instance

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0933fb2d02137e00e1b456e585388ad71886226ee1ce9089db1b95bba7f02998)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifInstanceMarketType", [value, operator]))

    @jsii.member(jsii_name="ifInstanceMetadataTags")
    def if_instance_metadata_tags(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by whether the instance allows access to instance tags from the instance metadata.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssociateAddress()
        - .toAssociateIamInstanceProfile()
        - .toAttachNetworkInterface()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateTags()
        - .toDescribeInstanceAttribute()
        - .toDetachNetworkInterface()
        - .toDisassociateIamInstanceProfile()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetInstanceUefiData()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceMaintenanceOptions()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyPrivateDnsNameOptions()
        - .toMonitorInstances()
        - .toPauseVolumeIO()
        - .toRebootInstances()
        - .toReplaceIamInstanceProfileAssociation()
        - .toRunInstances()
        - .toSendDiagnosticInterrupt()
        - .toSendSpotInstanceInterruptions()
        - .toUnmonitorInstances()

        Applies to resource types:

        - instance

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c207b62d1e107053bbfbc60cc734176a5b0e3c730d825d691c429f8960ef0e4a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifInstanceMetadataTags", [value, operator]))

    @jsii.member(jsii_name="ifInstanceProfile")
    def if_instance_profile(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of an instance profile.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssociateAddress()
        - .toAssociateIamInstanceProfile()
        - .toAttachClassicLinkVpc()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toCreateFleet()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateNetworkInsightsPath()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toDescribeInstanceAttribute()
        - .toDetachClassicLinkVpc()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDisassociateIamInstanceProfile()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetInstanceUefiData()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceMaintenanceOptions()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyPrivateDnsNameOptions()
        - .toMonitorInstances()
        - .toPauseVolumeIO()
        - .toRebootInstances()
        - .toReplaceIamInstanceProfileAssociation()
        - .toResetInstanceAttribute()
        - .toRunInstances()
        - .toSendDiagnosticInterrupt()
        - .toSendSpotInstanceInterruptions()
        - .toStartInstances()
        - .toStopInstances()
        - .toTerminateInstances()
        - .toUnmonitorInstances()

        Applies to resource types:

        - instance

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3783bb22e4263f6e77907fe74d4a2dbfae08bace89c237169d5fca978869ef1f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifInstanceProfile", [value, operator]))

    @jsii.member(jsii_name="ifInstanceType")
    def if_instance_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the type of instance.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAllocateHosts()
        - .toAssociateAddress()
        - .toAssociateIamInstanceProfile()
        - .toAttachClassicLinkVpc()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toCreateFleet()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateNetworkInsightsPath()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toDescribeInstanceAttribute()
        - .toDetachClassicLinkVpc()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDisassociateIamInstanceProfile()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetInstanceUefiData()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceMaintenanceOptions()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyPrivateDnsNameOptions()
        - .toModifyReservedInstances()
        - .toMonitorInstances()
        - .toPauseVolumeIO()
        - .toRebootInstances()
        - .toReplaceIamInstanceProfileAssociation()
        - .toResetInstanceAttribute()
        - .toRunInstances()
        - .toSendDiagnosticInterrupt()
        - .toSendSpotInstanceInterruptions()
        - .toStartInstances()
        - .toStopInstances()
        - .toTerminateInstances()
        - .toUnmonitorInstances()

        Applies to resource types:

        - dedicated-host
        - instance
        - reserved-instances

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__74d111d5b3a3b188287a5a9a2a82c70705f7546889764e446625b54cf0e45288)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifInstanceType", [value, operator]))

    @jsii.member(jsii_name="ifInternetGatewayID")
    def if_internet_gateway_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ID of an internet gateway.

        Applies to actions:

        - .toAssociateRouteTable()
        - .toAttachInternetGateway()
        - .toCreateInternetGateway()
        - .toCreateNetworkInsightsPath()
        - .toCreateTags()
        - .toDeleteInternetGateway()
        - .toDetachInternetGateway()
        - .toDisassociateRouteTable()

        Applies to resource types:

        - internet-gateway

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__52851c17a6cdb84e1ed106f44a5cc7b9686b51514f865b508cb81a25b0eedb40)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifInternetGatewayID", [value, operator]))

    @jsii.member(jsii_name="ifIpv4IpamPoolId")
    def if_ipv4_ipam_pool_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ID of an IPAM pool provided for IPv4 CIDR block allocation.

        Applies to actions:

        - .toAssociateVpcCidrBlock()
        - .toCreateVpc()

        Applies to resource types:

        - vpc

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__63dbe79c0fc928f3a8380808dfca8eebe9b5e8a14c270fba60d50c4115e1c1b4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifIpv4IpamPoolId", [value, operator]))

    @jsii.member(jsii_name="ifIpv6IpamPoolId")
    def if_ipv6_ipam_pool_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ID of an IPAM pool provided for IPv6 CIDR block allocation.

        Applies to actions:

        - .toAssociateVpcCidrBlock()
        - .toCreateVpc()

        Applies to resource types:

        - vpc

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5c4528f3b35122ea6b7e2f5f43bcd1070e0e7f05f55daab51dd88e4c1d923991)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifIpv6IpamPoolId", [value, operator]))

    @jsii.member(jsii_name="ifIsLaunchTemplateResource")
    def if_is_launch_template_resource(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by whether users are able to override resources that are specified in the launch template.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toRunInstances()

        Applies to resource types:

        - capacity-reservation
        - dedicated-host
        - elastic-gpu
        - image
        - instance
        - key-pair
        - launch-template
        - network-interface
        - placement-group
        - security-group
        - snapshot
        - subnet
        - volume

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5b9c6eb072672ad10e3710c529ca654135cc74bfaf99d4e790c6cf1d0d0feec3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Ec2", jsii.invoke(self, "ifIsLaunchTemplateResource", [value]))

    @jsii.member(jsii_name="ifKeyPairName")
    def if_key_pair_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the name of a key pair.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateFleet()
        - .toCreateTags()
        - .toDeleteKeyPair()
        - .toModifyFleet()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toRunInstances()

        Applies to resource types:

        - key-pair

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f89b316661966a632efa35a63bfb75d35de271ed445a5b8a35b60d0dc95bd5d8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifKeyPairName", [value, operator]))

    @jsii.member(jsii_name="ifKeyPairType")
    def if_key_pair_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the type of a key pair.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateFleet()
        - .toCreateKeyPair()
        - .toCreateTags()
        - .toDeleteKeyPair()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toRunInstances()

        Applies to resource types:

        - key-pair

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d22b193095c429a724951c0757dfb0daf0aa47d16b4b61c72be71a4bda7a8d8c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifKeyPairType", [value, operator]))

    @jsii.member(jsii_name="ifKmsKeyId")
    def if_kms_key_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ID of an AWS KMS key.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateFleet()
        - .toCreateVolume()

        Applies to resource types:

        - volume

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__28f6e0e791102192c1bd4a218a62e890974be87108c7435ab6b62f5db0912734)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifKmsKeyId", [value, operator]))

    @jsii.member(jsii_name="ifLaunchTemplate")
    def if_launch_template(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of a launch template.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toRunInstances()

        Applies to resource types:

        - capacity-reservation
        - dedicated-host
        - elastic-gpu
        - image
        - instance
        - key-pair
        - launch-template
        - network-interface
        - placement-group
        - security-group
        - snapshot
        - subnet
        - volume

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e78c31b8acc8d6b294184ccc96ddfd91ae993a60b706ea5405204f717f05cfcc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifLaunchTemplate", [value, operator]))

    @jsii.member(jsii_name="ifLoadBalancerArn")
    def if_load_balancer_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of an Elastic Load Balancer.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateTags()
        - .toCreateVerifiedAccessEndpoint()
        - .toDeleteVerifiedAccessEndpoint()
        - .toGetVerifiedAccessEndpointPolicy()
        - .toModifyVerifiedAccessEndpoint()
        - .toModifyVerifiedAccessEndpointPolicy()

        Applies to resource types:

        - verified-access-endpoint

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a93a55fa8d8f255ba3f2cfef4cd22025564d6bc4387537cacff4f72be95b6b3c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifLoadBalancerArn", [value, operator]))

    @jsii.member(jsii_name="ifMetadataHttpEndpoint")
    def if_metadata_http_endpoint(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by whether the HTTP endpoint is enabled for the instance metadata service.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssociateAddress()
        - .toAssociateIamInstanceProfile()
        - .toAttachClassicLinkVpc()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateTags()
        - .toDescribeInstanceAttribute()
        - .toDetachClassicLinkVpc()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDisassociateIamInstanceProfile()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetInstanceUefiData()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceMaintenanceOptions()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyPrivateDnsNameOptions()
        - .toMonitorInstances()
        - .toPauseVolumeIO()
        - .toRebootInstances()
        - .toReplaceIamInstanceProfileAssociation()
        - .toResetInstanceAttribute()
        - .toRunInstances()
        - .toSendDiagnosticInterrupt()
        - .toSendSpotInstanceInterruptions()
        - .toTerminateInstances()
        - .toUnmonitorInstances()

        Applies to resource types:

        - instance

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__badbe60c579f14d2a97933e50bc0f51c251d766e7528a618867076ee093e3fcd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifMetadataHttpEndpoint", [value, operator]))

    @jsii.member(jsii_name="ifMetadataHttpPutResponseHopLimit")
    def if_metadata_http_put_response_hop_limit(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the allowed number of hops when calling the instance metadata service.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssociateAddress()
        - .toAssociateIamInstanceProfile()
        - .toAttachClassicLinkVpc()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateTags()
        - .toDescribeInstanceAttribute()
        - .toDetachClassicLinkVpc()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDisassociateIamInstanceProfile()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetInstanceUefiData()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceMaintenanceOptions()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyPrivateDnsNameOptions()
        - .toMonitorInstances()
        - .toPauseVolumeIO()
        - .toRebootInstances()
        - .toReplaceIamInstanceProfileAssociation()
        - .toResetInstanceAttribute()
        - .toRunInstances()
        - .toSendDiagnosticInterrupt()
        - .toSendSpotInstanceInterruptions()
        - .toTerminateInstances()
        - .toUnmonitorInstances()

        Applies to resource types:

        - instance

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__86eb822544d20164a98c6a8d69699e797211d9a4b186fcfd340067767b060056)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifMetadataHttpPutResponseHopLimit", [value, operator]))

    @jsii.member(jsii_name="ifMetadataHttpTokens")
    def if_metadata_http_tokens(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by whether tokens are required when calling the instance metadata service (optional or required).

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssociateAddress()
        - .toAssociateIamInstanceProfile()
        - .toAttachClassicLinkVpc()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateTags()
        - .toDescribeInstanceAttribute()
        - .toDetachClassicLinkVpc()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDisassociateIamInstanceProfile()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetInstanceUefiData()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceMaintenanceOptions()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyPrivateDnsNameOptions()
        - .toMonitorInstances()
        - .toPauseVolumeIO()
        - .toRebootInstances()
        - .toReplaceIamInstanceProfileAssociation()
        - .toResetInstanceAttribute()
        - .toRunInstances()
        - .toSendDiagnosticInterrupt()
        - .toSendSpotInstanceInterruptions()
        - .toTerminateInstances()
        - .toUnmonitorInstances()

        Applies to resource types:

        - instance

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__98aae2ecd2dbe9653eac20810e6a75bd0ae46ce43fd510e4e67cc3e48ae9ee27)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifMetadataHttpTokens", [value, operator]))

    @jsii.member(jsii_name="ifNetworkAclID")
    def if_network_acl_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ID of a network access control list (ACL).

        Applies to actions:

        - .toCreateNetworkAcl()
        - .toCreateNetworkAclEntry()
        - .toCreateTags()
        - .toDeleteNetworkAcl()
        - .toDeleteNetworkAclEntry()
        - .toReplaceNetworkAclAssociation()
        - .toReplaceNetworkAclEntry()

        Applies to resource types:

        - network-acl

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2abbc5a0627ed9a6c1e6dc73a9a1f4d45b62dd62f56d65ed9ecdf70d308b45bd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifNetworkAclID", [value, operator]))

    @jsii.member(jsii_name="ifNetworkInterfaceID")
    def if_network_interface_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ID of an elastic network interface.

        Applies to actions:

        - .toAssignIpv6Addresses()
        - .toAssignPrivateIpAddresses()
        - .toAssociateAddress()
        - .toAttachNetworkInterface()
        - .toCreateFleet()
        - .toCreateFlowLogs()
        - .toCreateLocalGatewayRoute()
        - .toCreateNetworkInsightsPath()
        - .toCreateNetworkInterface()
        - .toCreateNetworkInterfacePermission()
        - .toCreateTags()
        - .toCreateTrafficMirrorSession()
        - .toCreateTrafficMirrorTarget()
        - .toCreateVerifiedAccessEndpoint()
        - .toDeleteNetworkInterface()
        - .toDeleteNetworkInterfacePermission()
        - .toDeregisterTransitGatewayMulticastGroupMembers()
        - .toDeregisterTransitGatewayMulticastGroupSources()
        - .toDetachNetworkInterface()
        - .toDisassociateAddress()
        - .toDisassociateNatGatewayAddress()
        - .toModifyFleet()
        - .toModifyLocalGatewayRoute()
        - .toModifyNetworkInterfaceAttribute()
        - .toRegisterTransitGatewayMulticastGroupMembers()
        - .toRegisterTransitGatewayMulticastGroupSources()
        - .toRequestSpotInstances()
        - .toResetNetworkInterfaceAttribute()
        - .toRunInstances()
        - .toUnassignIpv6Addresses()
        - .toUnassignPrivateIpAddresses()

        Applies to resource types:

        - network-interface

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f345a952fa1e2f8931ba587aa56a7b5c9d1c5e41ed59dea76dc48d625feadd95)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifNetworkInterfaceID", [value, operator]))

    @jsii.member(jsii_name="ifNewInstanceProfile")
    def if_new_instance_profile(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the instance profile being attached.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssociateIamInstanceProfile()
        - .toGetConsoleScreenshot()
        - .toGetInstanceUefiData()
        - .toModifyPrivateDnsNameOptions()
        - .toReplaceIamInstanceProfileAssociation()

        Applies to resource types:

        - instance

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__251527bec98ea00a70f9f5a9234efedf0dbbff6f5d99a30d2ccb2f99468b8bd2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifNewInstanceProfile", [value, operator]))

    @jsii.member(jsii_name="ifOutpostArn")
    def if_outpost_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the Outpost.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCopySnapshot()
        - .toCreateImage()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toDeleteSnapshot()
        - .toDescribeSnapshotAttribute()
        - .toRegisterImage()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()

        Applies to resource types:

        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__02ef64318331cdeb9d2130a2531a101f5e419bba4a699c0f4a9e19248d3ae9bb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifOutpostArn", [value, operator]))

    @jsii.member(jsii_name="ifOwner")
    def if_owner(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the owner of the resource (amazon, aws-marketplace, or an AWS account ID).

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCancelImageLaunchPermission()
        - .toCopyFpgaImage()
        - .toCopyImage()
        - .toCreateFleet()
        - .toCreateFpgaImage()
        - .toCreateImage()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateRestoreImageTask()
        - .toCreateStoreImageTask()
        - .toCreateTags()
        - .toDeleteFpgaImage()
        - .toDeleteSnapshot()
        - .toDeregisterImage()
        - .toDescribeFastLaunchImages()
        - .toDescribeFpgaImageAttribute()
        - .toDescribeImageAttribute()
        - .toDescribeSnapshotAttribute()
        - .toDisableFastLaunch()
        - .toDisableFastSnapshotRestores()
        - .toDisableImageDeprecation()
        - .toEnableFastLaunch()
        - .toEnableFastSnapshotRestores()
        - .toEnableImageDeprecation()
        - .toExportImage()
        - .toImportImage()
        - .toImportSnapshot()
        - .toListImagesInRecycleBin()
        - .toListSnapshotsInRecycleBin()
        - .toModifyFleet()
        - .toModifyFpgaImageAttribute()
        - .toModifyImageAttribute()
        - .toModifySnapshotAttribute()
        - .toModifySnapshotTier()
        - .toRegisterImage()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toResetFpgaImageAttribute()
        - .toResetImageAttribute()
        - .toResetSnapshotAttribute()
        - .toRestoreImageFromRecycleBin()
        - .toRestoreSnapshotFromRecycleBin()
        - .toRestoreSnapshotTier()
        - .toRunInstances()

        Applies to resource types:

        - fpga-image
        - image
        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5048a69d581ae29ff14234679798366300e8b7d221fae833c0791c25d14af6a7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifOwner", [value, operator]))

    @jsii.member(jsii_name="ifParentSnapshot")
    def if_parent_snapshot(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the parent snapshot.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAttachVolume()
        - .toCreateFleet()
        - .toCreateTags()
        - .toCreateVolume()
        - .toDeleteVolume()
        - .toDescribeVolumeAttribute()
        - .toDetachVolume()
        - .toEnableVolumeIO()
        - .toImportInstance()
        - .toImportVolume()
        - .toModifyInstanceAttribute()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toPauseVolumeIO()
        - .toRunInstances()

        Applies to resource types:

        - volume

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__136e0ff904648b9f02997025ef3d88cd856524de3a972ebb906be7dc035e2e6d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifParentSnapshot", [value, operator]))

    @jsii.member(jsii_name="ifParentVolume")
    def if_parent_volume(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the parent volume from which the snapshot was created.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateFleet()
        - .toCreateImage()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toDeleteSnapshot()
        - .toDescribeSnapshotAttribute()
        - .toDisableFastSnapshotRestores()
        - .toEnableFastSnapshotRestores()
        - .toImportImage()
        - .toImportSnapshot()
        - .toListSnapshotsInRecycleBin()
        - .toModifyFleet()
        - .toModifySnapshotAttribute()
        - .toModifySnapshotTier()
        - .toRegisterImage()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toResetSnapshotAttribute()
        - .toRestoreSnapshotFromRecycleBin()
        - .toRestoreSnapshotTier()
        - .toRunInstances()

        Applies to resource types:

        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bc294072bd32c3b51fa64cfe953c54bd76564744f7b360ee7340b69b9618c01b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifParentVolume", [value, operator]))

    @jsii.member(jsii_name="ifPermission")
    def if_permission(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the type of permission for a resource (INSTANCE-ATTACH or EIP-ASSOCIATE).

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateNetworkInterfacePermission()
        - .toCreateTags()
        - .toCreateVerifiedAccessEndpoint()
        - .toDisassociateNatGatewayAddress()
        - .toModifyLocalGatewayRoute()
        - .toRequestSpotInstances()

        Applies to resource types:

        - network-interface

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a402b6e143571b75c04fd5b94e1583a6760c387b61d1c9bf08ad6bd2aa6fabce)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifPermission", [value, operator]))

    @jsii.member(jsii_name="ifPhase1DHGroup")
    def if_phase1_dh_group(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the Diffie-Hellman group numbers that are permitted for a VPN tunnel for the phase 1 IKE negotiations.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toModifyVpnConnection()
        - .toModifyVpnTunnelOptions()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a17da715f4ec312de94b4eebeb3dcda0907f1c8cba8d504d17dfdf2db436a8e6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifPhase1DHGroup", [value, operator]))

    @jsii.member(jsii_name="ifPhase1EncryptionAlgorithms")
    def if_phase1_encryption_algorithms(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the encryption algorithms that are permitted for a VPN tunnel for the phase 1 IKE negotiations.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toModifyVpnConnection()
        - .toModifyVpnTunnelOptions()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__27bc7f199f347a580e72463418c66090b13cadcde36f402eedabd44bc1b12444)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifPhase1EncryptionAlgorithms", [value, operator]))

    @jsii.member(jsii_name="ifPhase1IntegrityAlgorithms")
    def if_phase1_integrity_algorithms(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the integrity algorithms that are permitted for a VPN tunnel for the phase 1 IKE negotiations.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toModifyVpnConnection()
        - .toModifyVpnTunnelOptions()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b56bbd6633366d277e9a158bd6a1be6480ff024bf68a713853c6d1ff130422f6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifPhase1IntegrityAlgorithms", [value, operator]))

    @jsii.member(jsii_name="ifPhase1LifetimeSeconds")
    def if_phase1_lifetime_seconds(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the lifetime in seconds for phase 1 of the IKE negotiations for a VPN tunnel.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toModifyVpnConnection()
        - .toModifyVpnTunnelOptions()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__31994e975b73372a21067e2f14fd40ef916ed0c503226cafac8b684a06c20d2b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifPhase1LifetimeSeconds", [value, operator]))

    @jsii.member(jsii_name="ifPhase2DHGroup")
    def if_phase2_dh_group(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the Diffie-Hellman group numbers that are permitted for a VPN tunnel for the phase 2 IKE negotiations.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toModifyVpnConnection()
        - .toModifyVpnTunnelOptions()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__52ae950cf6f0b760bf317c01237fca97d12dcd44624095c819a7177fdf5b1e78)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifPhase2DHGroup", [value, operator]))

    @jsii.member(jsii_name="ifPhase2EncryptionAlgorithms")
    def if_phase2_encryption_algorithms(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the encryption algorithms that are permitted for a VPN tunnel for the phase 2 IKE negotiations.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toModifyVpnConnection()
        - .toModifyVpnTunnelOptions()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9856c7a6d7fd5c410087129443fe73e36dea843209faf808def30b536458b524)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifPhase2EncryptionAlgorithms", [value, operator]))

    @jsii.member(jsii_name="ifPhase2IntegrityAlgorithms")
    def if_phase2_integrity_algorithms(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the integrity algorithms that are permitted for a VPN tunnel for the phase 2 IKE negotiations.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toModifyVpnConnection()
        - .toModifyVpnTunnelOptions()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e9d60ea292bd33f75c19f2afc2632060245bbe06ecf473189c6515d33a041f96)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifPhase2IntegrityAlgorithms", [value, operator]))

    @jsii.member(jsii_name="ifPhase2LifetimeSeconds")
    def if_phase2_lifetime_seconds(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the lifetime in seconds for phase 2 of the IKE negotiations for a VPN tunnel.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toModifyVpnConnection()
        - .toModifyVpnTunnelOptions()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ca91be3eaae4c71cb0902bf17fd1ea79a05bf10f72c229d978bec0b68ce87ad8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifPhase2LifetimeSeconds", [value, operator]))

    @jsii.member(jsii_name="ifPlacementGroup")
    def if_placement_group(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the placement group.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssociateAddress()
        - .toAssociateIamInstanceProfile()
        - .toAttachClassicLinkVpc()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toCreateFleet()
        - .toCreateImage()
        - .toCreateNetworkInsightsPath()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toDescribeInstanceAttribute()
        - .toDetachClassicLinkVpc()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDisassociateIamInstanceProfile()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetInstanceUefiData()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceMaintenanceOptions()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyPrivateDnsNameOptions()
        - .toMonitorInstances()
        - .toRebootInstances()
        - .toReplaceIamInstanceProfileAssociation()
        - .toRunInstances()
        - .toStartInstances()
        - .toStopInstances()
        - .toTerminateInstances()
        - .toUnmonitorInstances()

        Applies to resource types:

        - instance

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4c60369c5dce8813a268936e13b8b76a6292d1409eae2d0c0f7aca63c1065ee4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifPlacementGroup", [value, operator]))

    @jsii.member(jsii_name="ifPlacementGroupName")
    def if_placement_group_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the name of a placement group.

        Applies to actions:

        - .toCreateFleet()
        - .toCreatePlacementGroup()
        - .toCreateTags()
        - .toDeletePlacementGroup()
        - .toDeleteResourcePolicy()
        - .toGetResourcePolicy()
        - .toModifyInstancePlacement()
        - .toPutResourcePolicy()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toRunInstances()

        Applies to resource types:

        - placement-group

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__afeb6c771b0102b3bd6701302f84cf38462bcd27a40386e25ef33058000b9bf2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifPlacementGroupName", [value, operator]))

    @jsii.member(jsii_name="ifPlacementGroupStrategy")
    def if_placement_group_strategy(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the instance placement strategy used by the placement group (cluster, spread, or partition).

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateFleet()
        - .toCreatePlacementGroup()
        - .toCreateTags()
        - .toDeletePlacementGroup()
        - .toDeleteResourcePolicy()
        - .toGetResourcePolicy()
        - .toModifyInstancePlacement()
        - .toPutResourcePolicy()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toRunInstances()

        Applies to resource types:

        - placement-group

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3b9ab4a9e43256a75a6ded942ef49abd3609eb6f39a98f674dd8111adb593456)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifPlacementGroupStrategy", [value, operator]))

    @jsii.member(jsii_name="ifPreSharedKeys")
    def if_pre_shared_keys(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the pre-shared key (PSK) used to establish the initial IKE security association between a virtual private gateway and a customer gateway.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toModifyVpnConnection()
        - .toModifyVpnTunnelOptions()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3f4c7121bd4130920924192d1d103af855b53fe8a8cff4641220800cdaebf191)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifPreSharedKeys", [value, operator]))

    @jsii.member(jsii_name="ifProductCode")
    def if_product_code(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the product code that is associated with the AMI.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssociateAddress()
        - .toAssociateIamInstanceProfile()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateTags()
        - .toDescribeInstanceAttribute()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDisassociateIamInstanceProfile()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetInstanceUefiData()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceMaintenanceOptions()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyPrivateDnsNameOptions()
        - .toMonitorInstances()
        - .toRebootInstances()
        - .toReplaceIamInstanceProfileAssociation()
        - .toResetInstanceAttribute()
        - .toRunInstances()
        - .toUnmonitorInstances()

        Applies to resource types:

        - instance

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__add02c128de2a520d6474388ea49611421d4de3b78549f6ef8f72851d3f06e74)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifProductCode", [value, operator]))

    @jsii.member(jsii_name="ifPublic")
    def if_public(self, value: typing.Optional[builtins.bool] = None) -> "Ec2":
        '''(experimental) Filters access by whether the image has public launch permissions.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCancelImageLaunchPermission()
        - .toCreateFleet()
        - .toCreateFpgaImage()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateStoreImageTask()
        - .toCreateTags()
        - .toDeleteFpgaImage()
        - .toDeregisterImage()
        - .toDescribeFastLaunchImages()
        - .toDescribeImageAttribute()
        - .toDisableFastLaunch()
        - .toDisableImageDeprecation()
        - .toEnableFastLaunch()
        - .toEnableImageDeprecation()
        - .toExportImage()
        - .toImportImage()
        - .toListImagesInRecycleBin()
        - .toModifyFleet()
        - .toModifyFpgaImageAttribute()
        - .toModifyImageAttribute()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toResetFpgaImageAttribute()
        - .toResetImageAttribute()
        - .toRestoreImageFromRecycleBin()
        - .toRunInstances()

        Applies to resource types:

        - fpga-image
        - image

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fb8404fe2c3546399ec2c84ccced25032b4b2921ec3e9f47af82007da16c5d06)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Ec2", jsii.invoke(self, "ifPublic", [value]))

    @jsii.member(jsii_name="ifPublicIpAddress")
    def if_public_ip_address(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by a public IP address.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAcceptAddressTransfer()
        - .toAssociateAddress()
        - .toAssociateNatGatewayAddress()
        - .toCreateNatGateway()
        - .toCreateTags()
        - .toDescribeAddressesAttribute()
        - .toDisableAddressTransfer()
        - .toDisassociateAddress()
        - .toDisassociateNatGatewayAddress()
        - .toEnableAddressTransfer()
        - .toModifyAddressAttribute()
        - .toReleaseAddress()
        - .toResetAddressAttribute()

        Applies to resource types:

        - elastic-ip

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__81f549bc640045f1cfda4e48c738c89c1d8ae5b3e3b2f0bd74ba88ae29faede5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifPublicIpAddress", [value, operator]))

    @jsii.member(jsii_name="ifQuantity")
    def if_quantity(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the number of Dedicated Hosts in a request.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAllocateHosts()
        - .toCreateTags()

        Applies to resource types:

        - dedicated-host

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b947781677e2a039c582a918717b79b74131458f4570f11df2292b5e0de11c34)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifQuantity", [value, operator]))

    @jsii.member(jsii_name="ifRegion")
    def if_region(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the name of the AWS Region.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAcceptAddressTransfer()
        - .toAcceptReservedInstancesExchangeQuote()
        - .toAcceptTransitGatewayMulticastDomainAssociations()
        - .toAcceptTransitGatewayPeeringAttachment()
        - .toAcceptTransitGatewayVpcAttachment()
        - .toAcceptVpcEndpointConnections()
        - .toAcceptVpcPeeringConnection()
        - .toAdvertiseByoipCidr()
        - .toAllocateAddress()
        - .toAllocateHosts()
        - .toAllocateIpamPoolCidr()
        - .toApplySecurityGroupsToClientVpnTargetNetwork()
        - .toAssignIpv6Addresses()
        - .toAssignPrivateIpAddresses()
        - .toAssignPrivateNatGatewayAddress()
        - .toAssociateAddress()
        - .toAssociateClientVpnTargetNetwork()
        - .toAssociateDhcpOptions()
        - .toAssociateEnclaveCertificateIamRole()
        - .toAssociateIamInstanceProfile()
        - .toAssociateInstanceEventWindow()
        - .toAssociateIpamResourceDiscovery()
        - .toAssociateNatGatewayAddress()
        - .toAssociateRouteTable()
        - .toAssociateSubnetCidrBlock()
        - .toAssociateTransitGatewayMulticastDomain()
        - .toAssociateTransitGatewayPolicyTable()
        - .toAssociateTransitGatewayRouteTable()
        - .toAssociateTrunkInterface()
        - .toAssociateVpcCidrBlock()
        - .toAttachClassicLinkVpc()
        - .toAttachInternetGateway()
        - .toAttachNetworkInterface()
        - .toAttachVerifiedAccessTrustProvider()
        - .toAttachVolume()
        - .toAttachVpnGateway()
        - .toAuthorizeClientVpnIngress()
        - .toAuthorizeSecurityGroupEgress()
        - .toAuthorizeSecurityGroupIngress()
        - .toBundleInstance()
        - .toCancelBundleTask()
        - .toCancelCapacityReservation()
        - .toCancelCapacityReservationFleets()
        - .toCancelConversionTask()
        - .toCancelExportTask()
        - .toCancelImageLaunchPermission()
        - .toCancelImportTask()
        - .toCancelReservedInstancesListing()
        - .toCancelSpotFleetRequests()
        - .toCancelSpotInstanceRequests()
        - .toConfirmProductInstance()
        - .toCopyFpgaImage()
        - .toCopyImage()
        - .toCopySnapshot()
        - .toCreateCapacityReservation()
        - .toCreateCapacityReservationFleet()
        - .toCreateCarrierGateway()
        - .toCreateClientVpnEndpoint()
        - .toCreateClientVpnRoute()
        - .toCreateCoipCidr()
        - .toCreateCoipPool()
        - .toCreateCoipPoolPermission()
        - .toCreateCustomerGateway()
        - .toCreateDefaultSubnet()
        - .toCreateDefaultVpc()
        - .toCreateDhcpOptions()
        - .toCreateEgressOnlyInternetGateway()
        - .toCreateFleet()
        - .toCreateFlowLogs()
        - .toCreateFpgaImage()
        - .toCreateImage()
        - .toCreateInstanceEventWindow()
        - .toCreateInstanceExportTask()
        - .toCreateInternetGateway()
        - .toCreateIpam()
        - .toCreateIpamPool()
        - .toCreateIpamResourceDiscovery()
        - .toCreateIpamScope()
        - .toCreateKeyPair()
        - .toCreateLaunchTemplate()
        - .toCreateLaunchTemplateVersion()
        - .toCreateLocalGatewayRoute()
        - .toCreateLocalGatewayRouteTable()
        - .toCreateLocalGatewayRouteTablePermission()
        - .toCreateLocalGatewayRouteTableVirtualInterfaceGroupAssociation()
        - .toCreateLocalGatewayRouteTableVpcAssociation()
        - .toCreateManagedPrefixList()
        - .toCreateNatGateway()
        - .toCreateNetworkAcl()
        - .toCreateNetworkAclEntry()
        - .toCreateNetworkInsightsAccessScope()
        - .toCreateNetworkInsightsPath()
        - .toCreateNetworkInterface()
        - .toCreateNetworkInterfacePermission()
        - .toCreatePlacementGroup()
        - .toCreatePublicIpv4Pool()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateReservedInstancesListing()
        - .toCreateRestoreImageTask()
        - .toCreateRoute()
        - .toCreateRouteTable()
        - .toCreateSecurityGroup()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateSpotDatafeedSubscription()
        - .toCreateStoreImageTask()
        - .toCreateSubnet()
        - .toCreateSubnetCidrReservation()
        - .toCreateTags()
        - .toCreateTrafficMirrorFilter()
        - .toCreateTrafficMirrorFilterRule()
        - .toCreateTrafficMirrorSession()
        - .toCreateTrafficMirrorTarget()
        - .toCreateTransitGateway()
        - .toCreateTransitGatewayConnect()
        - .toCreateTransitGatewayConnectPeer()
        - .toCreateTransitGatewayMulticastDomain()
        - .toCreateTransitGatewayPeeringAttachment()
        - .toCreateTransitGatewayPolicyTable()
        - .toCreateTransitGatewayPrefixListReference()
        - .toCreateTransitGatewayRoute()
        - .toCreateTransitGatewayRouteTable()
        - .toCreateTransitGatewayRouteTableAnnouncement()
        - .toCreateTransitGatewayVpcAttachment()
        - .toCreateVerifiedAccessEndpoint()
        - .toCreateVerifiedAccessGroup()
        - .toCreateVerifiedAccessInstance()
        - .toCreateVerifiedAccessTrustProvider()
        - .toCreateVolume()
        - .toCreateVpc()
        - .toCreateVpcEndpoint()
        - .toCreateVpcEndpointConnectionNotification()
        - .toCreateVpcEndpointServiceConfiguration()
        - .toCreateVpcPeeringConnection()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toCreateVpnGateway()
        - .toDeleteCarrierGateway()
        - .toDeleteClientVpnEndpoint()
        - .toDeleteClientVpnRoute()
        - .toDeleteCoipCidr()
        - .toDeleteCoipPool()
        - .toDeleteCoipPoolPermission()
        - .toDeleteCustomerGateway()
        - .toDeleteDhcpOptions()
        - .toDeleteEgressOnlyInternetGateway()
        - .toDeleteFleets()
        - .toDeleteFlowLogs()
        - .toDeleteFpgaImage()
        - .toDeleteInstanceEventWindow()
        - .toDeleteInternetGateway()
        - .toDeleteIpam()
        - .toDeleteIpamPool()
        - .toDeleteIpamResourceDiscovery()
        - .toDeleteIpamScope()
        - .toDeleteKeyPair()
        - .toDeleteLaunchTemplate()
        - .toDeleteLaunchTemplateVersions()
        - .toDeleteLocalGatewayRoute()
        - .toDeleteLocalGatewayRouteTable()
        - .toDeleteLocalGatewayRouteTablePermission()
        - .toDeleteLocalGatewayRouteTableVirtualInterfaceGroupAssociation()
        - .toDeleteLocalGatewayRouteTableVpcAssociation()
        - .toDeleteManagedPrefixList()
        - .toDeleteNatGateway()
        - .toDeleteNetworkAcl()
        - .toDeleteNetworkAclEntry()
        - .toDeleteNetworkInsightsAccessScope()
        - .toDeleteNetworkInsightsAccessScopeAnalysis()
        - .toDeleteNetworkInsightsAnalysis()
        - .toDeleteNetworkInsightsPath()
        - .toDeleteNetworkInterface()
        - .toDeleteNetworkInterfacePermission()
        - .toDeletePlacementGroup()
        - .toDeletePublicIpv4Pool()
        - .toDeleteQueuedReservedInstances()
        - .toDeleteResourcePolicy()
        - .toDeleteRoute()
        - .toDeleteRouteTable()
        - .toDeleteSecurityGroup()
        - .toDeleteSnapshot()
        - .toDeleteSpotDatafeedSubscription()
        - .toDeleteSubnet()
        - .toDeleteSubnetCidrReservation()
        - .toDeleteTags()
        - .toDeleteTrafficMirrorFilter()
        - .toDeleteTrafficMirrorFilterRule()
        - .toDeleteTrafficMirrorSession()
        - .toDeleteTrafficMirrorTarget()
        - .toDeleteTransitGateway()
        - .toDeleteTransitGatewayConnect()
        - .toDeleteTransitGatewayConnectPeer()
        - .toDeleteTransitGatewayMulticastDomain()
        - .toDeleteTransitGatewayPeeringAttachment()
        - .toDeleteTransitGatewayPolicyTable()
        - .toDeleteTransitGatewayPrefixListReference()
        - .toDeleteTransitGatewayRoute()
        - .toDeleteTransitGatewayRouteTable()
        - .toDeleteTransitGatewayRouteTableAnnouncement()
        - .toDeleteTransitGatewayVpcAttachment()
        - .toDeleteVerifiedAccessEndpoint()
        - .toDeleteVerifiedAccessGroup()
        - .toDeleteVerifiedAccessInstance()
        - .toDeleteVerifiedAccessTrustProvider()
        - .toDeleteVolume()
        - .toDeleteVpc()
        - .toDeleteVpcEndpointConnectionNotifications()
        - .toDeleteVpcEndpointServiceConfigurations()
        - .toDeleteVpcEndpoints()
        - .toDeleteVpcPeeringConnection()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toDeleteVpnGateway()
        - .toDeprovisionByoipCidr()
        - .toDeprovisionIpamPoolCidr()
        - .toDeprovisionPublicIpv4PoolCidr()
        - .toDeregisterImage()
        - .toDeregisterInstanceEventNotificationAttributes()
        - .toDeregisterTransitGatewayMulticastGroupMembers()
        - .toDeregisterTransitGatewayMulticastGroupSources()
        - .toDescribeAccountAttributes()
        - .toDescribeAddressTransfers()
        - .toDescribeAddresses()
        - .toDescribeAddressesAttribute()
        - .toDescribeAggregateIdFormat()
        - .toDescribeAvailabilityZones()
        - .toDescribeAwsNetworkPerformanceMetricSubscriptions()
        - .toDescribeBundleTasks()
        - .toDescribeByoipCidrs()
        - .toDescribeCapacityReservationFleets()
        - .toDescribeCapacityReservations()
        - .toDescribeCarrierGateways()
        - .toDescribeClassicLinkInstances()
        - .toDescribeClientVpnAuthorizationRules()
        - .toDescribeClientVpnConnections()
        - .toDescribeClientVpnEndpoints()
        - .toDescribeClientVpnRoutes()
        - .toDescribeClientVpnTargetNetworks()
        - .toDescribeCoipPools()
        - .toDescribeConversionTasks()
        - .toDescribeCustomerGateways()
        - .toDescribeDhcpOptions()
        - .toDescribeEgressOnlyInternetGateways()
        - .toDescribeElasticGpus()
        - .toDescribeExportImageTasks()
        - .toDescribeExportTasks()
        - .toDescribeFastLaunchImages()
        - .toDescribeFastSnapshotRestores()
        - .toDescribeFleetHistory()
        - .toDescribeFleetInstances()
        - .toDescribeFleets()
        - .toDescribeFlowLogs()
        - .toDescribeFpgaImageAttribute()
        - .toDescribeFpgaImages()
        - .toDescribeHostReservationOfferings()
        - .toDescribeHostReservations()
        - .toDescribeHosts()
        - .toDescribeIamInstanceProfileAssociations()
        - .toDescribeIdFormat()
        - .toDescribeIdentityIdFormat()
        - .toDescribeImageAttribute()
        - .toDescribeImages()
        - .toDescribeImportImageTasks()
        - .toDescribeImportSnapshotTasks()
        - .toDescribeInstanceAttribute()
        - .toDescribeInstanceCreditSpecifications()
        - .toDescribeInstanceEventNotificationAttributes()
        - .toDescribeInstanceEventWindows()
        - .toDescribeInstanceStatus()
        - .toDescribeInstanceTypeOfferings()
        - .toDescribeInstanceTypes()
        - .toDescribeInstances()
        - .toDescribeInternetGateways()
        - .toDescribeIpamPools()
        - .toDescribeIpamResourceDiscoveries()
        - .toDescribeIpamResourceDiscoveryAssociations()
        - .toDescribeIpamScopes()
        - .toDescribeIpams()
        - .toDescribeIpv6Pools()
        - .toDescribeKeyPairs()
        - .toDescribeLaunchTemplateVersions()
        - .toDescribeLaunchTemplates()
        - .toDescribeLocalGatewayRouteTablePermissions()
        - .toDescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations()
        - .toDescribeLocalGatewayRouteTableVpcAssociations()
        - .toDescribeLocalGatewayRouteTables()
        - .toDescribeLocalGatewayVirtualInterfaceGroups()
        - .toDescribeLocalGatewayVirtualInterfaces()
        - .toDescribeLocalGateways()
        - .toDescribeManagedPrefixLists()
        - .toDescribeMovingAddresses()
        - .toDescribeNatGateways()
        - .toDescribeNetworkAcls()
        - .toDescribeNetworkInsightsAccessScopeAnalyses()
        - .toDescribeNetworkInsightsAccessScopes()
        - .toDescribeNetworkInsightsAnalyses()
        - .toDescribeNetworkInsightsPaths()
        - .toDescribeNetworkInterfaceAttribute()
        - .toDescribeNetworkInterfacePermissions()
        - .toDescribeNetworkInterfaces()
        - .toDescribePlacementGroups()
        - .toDescribePrefixLists()
        - .toDescribePrincipalIdFormat()
        - .toDescribePublicIpv4Pools()
        - .toDescribeRegions()
        - .toDescribeReplaceRootVolumeTasks()
        - .toDescribeReservedInstances()
        - .toDescribeReservedInstancesListings()
        - .toDescribeReservedInstancesModifications()
        - .toDescribeReservedInstancesOfferings()
        - .toDescribeRouteTables()
        - .toDescribeScheduledInstanceAvailability()
        - .toDescribeScheduledInstances()
        - .toDescribeSecurityGroupReferences()
        - .toDescribeSecurityGroupRules()
        - .toDescribeSecurityGroups()
        - .toDescribeSnapshotAttribute()
        - .toDescribeSnapshotTierStatus()
        - .toDescribeSnapshots()
        - .toDescribeSpotDatafeedSubscription()
        - .toDescribeSpotFleetInstances()
        - .toDescribeSpotFleetRequestHistory()
        - .toDescribeSpotFleetRequests()
        - .toDescribeSpotInstanceRequests()
        - .toDescribeSpotPriceHistory()
        - .toDescribeStaleSecurityGroups()
        - .toDescribeStoreImageTasks()
        - .toDescribeSubnets()
        - .toDescribeTags()
        - .toDescribeTrafficMirrorFilters()
        - .toDescribeTrafficMirrorSessions()
        - .toDescribeTrafficMirrorTargets()
        - .toDescribeTransitGatewayAttachments()
        - .toDescribeTransitGatewayConnectPeers()
        - .toDescribeTransitGatewayConnects()
        - .toDescribeTransitGatewayMulticastDomains()
        - .toDescribeTransitGatewayPeeringAttachments()
        - .toDescribeTransitGatewayPolicyTables()
        - .toDescribeTransitGatewayRouteTableAnnouncements()
        - .toDescribeTransitGatewayRouteTables()
        - .toDescribeTransitGatewayVpcAttachments()
        - .toDescribeTransitGateways()
        - .toDescribeTrunkInterfaceAssociations()
        - .toDescribeVerifiedAccessEndpoints()
        - .toDescribeVerifiedAccessGroups()
        - .toDescribeVerifiedAccessInstanceLoggingConfigurations()
        - .toDescribeVerifiedAccessInstances()
        - .toDescribeVerifiedAccessTrustProviders()
        - .toDescribeVolumeAttribute()
        - .toDescribeVolumeStatus()
        - .toDescribeVolumes()
        - .toDescribeVolumesModifications()
        - .toDescribeVpcAttribute()
        - .toDescribeVpcClassicLink()
        - .toDescribeVpcClassicLinkDnsSupport()
        - .toDescribeVpcEndpointConnectionNotifications()
        - .toDescribeVpcEndpointConnections()
        - .toDescribeVpcEndpointServiceConfigurations()
        - .toDescribeVpcEndpointServicePermissions()
        - .toDescribeVpcEndpointServices()
        - .toDescribeVpcEndpoints()
        - .toDescribeVpcPeeringConnections()
        - .toDescribeVpcs()
        - .toDescribeVpnConnections()
        - .toDescribeVpnGateways()
        - .toDetachClassicLinkVpc()
        - .toDetachInternetGateway()
        - .toDetachNetworkInterface()
        - .toDetachVerifiedAccessTrustProvider()
        - .toDetachVolume()
        - .toDetachVpnGateway()
        - .toDisableAddressTransfer()
        - .toDisableAwsNetworkPerformanceMetricSubscription()
        - .toDisableEbsEncryptionByDefault()
        - .toDisableFastLaunch()
        - .toDisableFastSnapshotRestores()
        - .toDisableImageDeprecation()
        - .toDisableIpamOrganizationAdminAccount()
        - .toDisableSerialConsoleAccess()
        - .toDisableTransitGatewayRouteTablePropagation()
        - .toDisableVgwRoutePropagation()
        - .toDisableVpcClassicLink()
        - .toDisableVpcClassicLinkDnsSupport()
        - .toDisassociateAddress()
        - .toDisassociateClientVpnTargetNetwork()
        - .toDisassociateEnclaveCertificateIamRole()
        - .toDisassociateIamInstanceProfile()
        - .toDisassociateInstanceEventWindow()
        - .toDisassociateIpamResourceDiscovery()
        - .toDisassociateNatGatewayAddress()
        - .toDisassociateRouteTable()
        - .toDisassociateSubnetCidrBlock()
        - .toDisassociateTransitGatewayMulticastDomain()
        - .toDisassociateTransitGatewayPolicyTable()
        - .toDisassociateTransitGatewayRouteTable()
        - .toDisassociateTrunkInterface()
        - .toDisassociateVpcCidrBlock()
        - .toEnableAddressTransfer()
        - .toEnableAwsNetworkPerformanceMetricSubscription()
        - .toEnableEbsEncryptionByDefault()
        - .toEnableFastLaunch()
        - .toEnableFastSnapshotRestores()
        - .toEnableImageDeprecation()
        - .toEnableIpamOrganizationAdminAccount()
        - .toEnableReachabilityAnalyzerOrganizationSharing()
        - .toEnableSerialConsoleAccess()
        - .toEnableTransitGatewayRouteTablePropagation()
        - .toEnableVgwRoutePropagation()
        - .toEnableVolumeIO()
        - .toEnableVpcClassicLink()
        - .toEnableVpcClassicLinkDnsSupport()
        - .toExportClientVpnClientCertificateRevocationList()
        - .toExportClientVpnClientConfiguration()
        - .toExportImage()
        - .toExportTransitGatewayRoutes()
        - .toGetAssociatedEnclaveCertificateIamRoles()
        - .toGetAssociatedIpv6PoolCidrs()
        - .toGetAwsNetworkPerformanceData()
        - .toGetCapacityReservationUsage()
        - .toGetCoipPoolUsage()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetDefaultCreditSpecification()
        - .toGetEbsDefaultKmsKeyId()
        - .toGetEbsEncryptionByDefault()
        - .toGetFlowLogsIntegrationTemplate()
        - .toGetGroupsForCapacityReservation()
        - .toGetHostReservationPurchasePreview()
        - .toGetInstanceTypesFromInstanceRequirements()
        - .toGetInstanceUefiData()
        - .toGetIpamAddressHistory()
        - .toGetIpamDiscoveredAccounts()
        - .toGetIpamDiscoveredResourceCidrs()
        - .toGetIpamPoolAllocations()
        - .toGetIpamPoolCidrs()
        - .toGetIpamResourceCidrs()
        - .toGetLaunchTemplateData()
        - .toGetManagedPrefixListAssociations()
        - .toGetManagedPrefixListEntries()
        - .toGetNetworkInsightsAccessScopeAnalysisFindings()
        - .toGetNetworkInsightsAccessScopeContent()
        - .toGetPasswordData()
        - .toGetReservedInstancesExchangeQuote()
        - .toGetResourcePolicy()
        - .toGetSerialConsoleAccessStatus()
        - .toGetSpotPlacementScores()
        - .toGetSubnetCidrReservations()
        - .toGetTransitGatewayAttachmentPropagations()
        - .toGetTransitGatewayMulticastDomainAssociations()
        - .toGetTransitGatewayPolicyTableAssociations()
        - .toGetTransitGatewayPolicyTableEntries()
        - .toGetTransitGatewayPrefixListReferences()
        - .toGetTransitGatewayRouteTableAssociations()
        - .toGetTransitGatewayRouteTablePropagations()
        - .toGetVerifiedAccessEndpointPolicy()
        - .toGetVerifiedAccessGroupPolicy()
        - .toGetVpnConnectionDeviceSampleConfiguration()
        - .toGetVpnConnectionDeviceTypes()
        - .toImportClientVpnClientCertificateRevocationList()
        - .toImportImage()
        - .toImportInstance()
        - .toImportKeyPair()
        - .toImportSnapshot()
        - .toImportVolume()
        - .toListImagesInRecycleBin()
        - .toListSnapshotsInRecycleBin()
        - .toModifyAddressAttribute()
        - .toModifyAvailabilityZoneGroup()
        - .toModifyCapacityReservation()
        - .toModifyCapacityReservationFleet()
        - .toModifyClientVpnEndpoint()
        - .toModifyDefaultCreditSpecification()
        - .toModifyEbsDefaultKmsKeyId()
        - .toModifyFleet()
        - .toModifyFpgaImageAttribute()
        - .toModifyHosts()
        - .toModifyIdFormat()
        - .toModifyIdentityIdFormat()
        - .toModifyImageAttribute()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceEventStartTime()
        - .toModifyInstanceEventWindow()
        - .toModifyInstanceMaintenanceOptions()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyIpam()
        - .toModifyIpamPool()
        - .toModifyIpamResourceCidr()
        - .toModifyIpamResourceDiscovery()
        - .toModifyIpamScope()
        - .toModifyLaunchTemplate()
        - .toModifyLocalGatewayRoute()
        - .toModifyManagedPrefixList()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyPrivateDnsNameOptions()
        - .toModifyReservedInstances()
        - .toModifySecurityGroupRules()
        - .toModifySnapshotAttribute()
        - .toModifySnapshotTier()
        - .toModifySpotFleetRequest()
        - .toModifySubnetAttribute()
        - .toModifyTrafficMirrorFilterNetworkServices()
        - .toModifyTrafficMirrorFilterRule()
        - .toModifyTrafficMirrorSession()
        - .toModifyTransitGateway()
        - .toModifyTransitGatewayPrefixListReference()
        - .toModifyTransitGatewayVpcAttachment()
        - .toModifyVerifiedAccessEndpoint()
        - .toModifyVerifiedAccessEndpointPolicy()
        - .toModifyVerifiedAccessGroup()
        - .toModifyVerifiedAccessGroupPolicy()
        - .toModifyVerifiedAccessInstance()
        - .toModifyVerifiedAccessInstanceLoggingConfiguration()
        - .toModifyVerifiedAccessTrustProvider()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toModifyVpcAttribute()
        - .toModifyVpcEndpoint()
        - .toModifyVpcEndpointConnectionNotification()
        - .toModifyVpcEndpointServiceConfiguration()
        - .toModifyVpcEndpointServicePayerResponsibility()
        - .toModifyVpcEndpointServicePermissions()
        - .toModifyVpcPeeringConnectionOptions()
        - .toModifyVpcTenancy()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toMonitorInstances()
        - .toMoveAddressToVpc()
        - .toMoveByoipCidrToIpam()
        - .toPauseVolumeIO()
        - .toProvisionByoipCidr()
        - .toProvisionIpamPoolCidr()
        - .toProvisionPublicIpv4PoolCidr()
        - .toPurchaseHostReservation()
        - .toPurchaseReservedInstancesOffering()
        - .toPurchaseScheduledInstances()
        - .toPutResourcePolicy()
        - .toRebootInstances()
        - .toRegisterImage()
        - .toRegisterInstanceEventNotificationAttributes()
        - .toRegisterTransitGatewayMulticastGroupMembers()
        - .toRegisterTransitGatewayMulticastGroupSources()
        - .toRejectTransitGatewayMulticastDomainAssociations()
        - .toRejectTransitGatewayPeeringAttachment()
        - .toRejectTransitGatewayVpcAttachment()
        - .toRejectVpcEndpointConnections()
        - .toRejectVpcPeeringConnection()
        - .toReleaseAddress()
        - .toReleaseHosts()
        - .toReleaseIpamPoolAllocation()
        - .toReplaceIamInstanceProfileAssociation()
        - .toReplaceNetworkAclAssociation()
        - .toReplaceNetworkAclEntry()
        - .toReplaceRoute()
        - .toReplaceRouteTableAssociation()
        - .toReplaceTransitGatewayRoute()
        - .toReportInstanceStatus()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toResetAddressAttribute()
        - .toResetEbsDefaultKmsKeyId()
        - .toResetFpgaImageAttribute()
        - .toResetImageAttribute()
        - .toResetInstanceAttribute()
        - .toResetNetworkInterfaceAttribute()
        - .toResetSnapshotAttribute()
        - .toRestoreAddressToClassic()
        - .toRestoreImageFromRecycleBin()
        - .toRestoreManagedPrefixListVersion()
        - .toRestoreSnapshotFromRecycleBin()
        - .toRestoreSnapshotTier()
        - .toRevokeClientVpnIngress()
        - .toRevokeSecurityGroupEgress()
        - .toRevokeSecurityGroupIngress()
        - .toRunInstances()
        - .toRunScheduledInstances()
        - .toSearchLocalGatewayRoutes()
        - .toSearchTransitGatewayMulticastGroups()
        - .toSearchTransitGatewayRoutes()
        - .toSendDiagnosticInterrupt()
        - .toSendSpotInstanceInterruptions()
        - .toStartInstances()
        - .toStartNetworkInsightsAccessScopeAnalysis()
        - .toStartNetworkInsightsAnalysis()
        - .toStartVpcEndpointServicePrivateDnsVerification()
        - .toStopInstances()
        - .toTerminateClientVpnConnections()
        - .toTerminateInstances()
        - .toUnassignIpv6Addresses()
        - .toUnassignPrivateIpAddresses()
        - .toUnassignPrivateNatGatewayAddress()
        - .toUnmonitorInstances()
        - .toUpdateSecurityGroupRuleDescriptionsEgress()
        - .toUpdateSecurityGroupRuleDescriptionsIngress()
        - .toWithdrawByoipCidr()

        Applies to resource types:

        - elastic-ip
        - capacity-reservation-fleet
        - capacity-reservation
        - carrier-gateway
        - client-vpn-endpoint
        - customer-gateway
        - dedicated-host
        - dhcp-options
        - egress-only-internet-gateway
        - elastic-gpu
        - export-image-task
        - export-instance-task
        - fleet
        - fpga-image
        - host-reservation
        - image
        - import-image-task
        - import-snapshot-task
        - instance-event-window
        - instance
        - internet-gateway
        - ipam
        - ipam-pool
        - ipam-resource-discovery-association
        - ipam-resource-discovery
        - ipam-scope
        - coip-pool
        - ipv4pool-ec2
        - ipv6pool-ec2
        - key-pair
        - launch-template
        - local-gateway
        - local-gateway-route-table-virtual-interface-group-association
        - local-gateway-route-table-vpc-association
        - local-gateway-route-table
        - local-gateway-virtual-interface-group
        - local-gateway-virtual-interface
        - natgateway
        - network-acl
        - network-insights-access-scope-analysis
        - network-insights-access-scope
        - network-insights-analysis
        - network-insights-path
        - network-interface
        - placement-group
        - prefix-list
        - replace-root-volume-task
        - reserved-instances
        - route-table
        - security-group
        - security-group-rule
        - snapshot
        - spot-fleet-request
        - spot-instances-request
        - subnet-cidr-reservation
        - subnet
        - traffic-mirror-filter
        - traffic-mirror-filter-rule
        - traffic-mirror-session
        - traffic-mirror-target
        - transit-gateway-attachment
        - transit-gateway-connect-peer
        - transit-gateway
        - transit-gateway-multicast-domain
        - transit-gateway-policy-table
        - transit-gateway-route-table-announcement
        - transit-gateway-route-table
        - verified-access-endpoint
        - verified-access-group
        - verified-access-instance
        - verified-access-policy
        - verified-access-trust-provider
        - volume
        - vpc-endpoint-connection
        - vpc-endpoint
        - vpc-endpoint-service
        - vpc-endpoint-service-permission
        - vpc-flow-log
        - vpc
        - vpc-peering-connection
        - vpn-connection-device-type
        - vpn-connection
        - vpn-gateway

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__30a21d34f4314a4bea0b0cab13ac56d4ffdee644986b4482ca8637fad23eed57)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifRegion", [value, operator]))

    @jsii.member(jsii_name="ifRekeyFuzzPercentage")
    def if_rekey_fuzz_percentage(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the percentage of increase of the rekey window (determined by the rekey margin time) within which the rekey time is randomly selected for a VPN tunnel.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toModifyVpnConnection()
        - .toModifyVpnTunnelOptions()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a031396abcfad7348d1b8c96f92d274179fa17c13269f100d5701dee0fe7a30d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifRekeyFuzzPercentage", [value, operator]))

    @jsii.member(jsii_name="ifRekeyMarginTimeSeconds")
    def if_rekey_margin_time_seconds(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the margin time before the phase 2 lifetime expires for a VPN tunnel.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toModifyVpnConnection()
        - .toModifyVpnTunnelOptions()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4977e9f7c99e431e2b6a10e12f74d57de0d2dedf1327728755a441a05de3e66c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifRekeyMarginTimeSeconds", [value, operator]))

    @jsii.member(jsii_name="ifRemoveGroup")
    def if_remove_group(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the group being removed from a snapshot.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toModifySnapshotAttribute()

        Applies to resource types:

        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__728d2b696dc18b6d1d597c3472f4e7601d2858884625eaa0cae8e8ca969ec944)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifRemoveGroup", [value, operator]))

    @jsii.member(jsii_name="ifRemoveUserId")
    def if_remove_user_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the account id being removed from a snapshot.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toModifySnapshotAttribute()

        Applies to resource types:

        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__729e0117f60c1635b121bfab06254bd35c877d91270928b280a6d6b074454b6b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifRemoveUserId", [value, operator]))

    @jsii.member(jsii_name="ifReplayWindowSizePackets")
    def if_replay_window_size_packets(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the number of packets in an IKE replay window.

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toModifyVpnConnection()
        - .toModifyVpnTunnelOptions()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9c581a6b7a95384840caf15a93e67ef8f32f8252e102c541060a1309a5896c4e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifReplayWindowSizePackets", [value, operator]))

    @jsii.member(jsii_name="ifRequesterVpc")
    def if_requester_vpc(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of a requester VPC in a VPC peering connection.

        https://docs.aws.amazon.com/vpc/latest/peering/security-iam.html

        Applies to actions:

        - .toAcceptVpcPeeringConnection()
        - .toCreateNetworkInsightsPath()
        - .toCreateTags()
        - .toCreateVpcPeeringConnection()
        - .toDeleteVpcPeeringConnection()
        - .toModifyVpcPeeringConnectionOptions()
        - .toRejectVpcPeeringConnection()

        Applies to resource types:

        - vpc-peering-connection

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2e5cb8ec38ce011cd46258253f1d062e6deb91a0a175dbd5f0007c92750cb5c5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifRequesterVpc", [value, operator]))

    @jsii.member(jsii_name="ifReservedInstancesOfferingType")
    def if_reserved_instances_offering_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the payment option of the Reserved Instance offering (No Upfront, Partial Upfront, or All Upfront).

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-reserved-instances.html#ri-payment-options

        Applies to actions:

        - .toCreateTags()
        - .toModifyReservedInstances()

        Applies to resource types:

        - reserved-instances

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7678b1e1add76272c57821ee634b46d113768969ce9f38a22c88bf2eeb6f4062)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifReservedInstancesOfferingType", [value, operator]))

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by a tag key and value pair of a resource.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/control-access-with-tags.html

        Applies to actions:

        - .toAcceptTransitGatewayMulticastDomainAssociations()
        - .toAcceptTransitGatewayPeeringAttachment()
        - .toAcceptTransitGatewayVpcAttachment()
        - .toAcceptVpcEndpointConnections()
        - .toAcceptVpcPeeringConnection()
        - .toAllocateAddress()
        - .toAllocateIpamPoolCidr()
        - .toApplySecurityGroupsToClientVpnTargetNetwork()
        - .toAssignIpv6Addresses()
        - .toAssignPrivateIpAddresses()
        - .toAssignPrivateNatGatewayAddress()
        - .toAssociateAddress()
        - .toAssociateClientVpnTargetNetwork()
        - .toAssociateDhcpOptions()
        - .toAssociateIamInstanceProfile()
        - .toAssociateInstanceEventWindow()
        - .toAssociateIpamResourceDiscovery()
        - .toAssociateNatGatewayAddress()
        - .toAssociateRouteTable()
        - .toAssociateSubnetCidrBlock()
        - .toAssociateTransitGatewayMulticastDomain()
        - .toAssociateTransitGatewayPolicyTable()
        - .toAssociateTransitGatewayRouteTable()
        - .toAssociateVpcCidrBlock()
        - .toAttachClassicLinkVpc()
        - .toAttachInternetGateway()
        - .toAttachNetworkInterface()
        - .toAttachVerifiedAccessTrustProvider()
        - .toAttachVolume()
        - .toAttachVpnGateway()
        - .toAuthorizeClientVpnIngress()
        - .toAuthorizeSecurityGroupEgress()
        - .toAuthorizeSecurityGroupIngress()
        - .toCancelCapacityReservation()
        - .toCancelCapacityReservationFleets()
        - .toCancelExportTask()
        - .toCancelImageLaunchPermission()
        - .toCancelImportTask()
        - .toCancelSpotFleetRequests()
        - .toCancelSpotInstanceRequests()
        - .toCreateCarrierGateway()
        - .toCreateClientVpnEndpoint()
        - .toCreateClientVpnRoute()
        - .toCreateCoipCidr()
        - .toCreateCoipPool()
        - .toCreateCoipPoolPermission()
        - .toCreateEgressOnlyInternetGateway()
        - .toCreateFleet()
        - .toCreateFlowLogs()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateIpamPool()
        - .toCreateIpamScope()
        - .toCreateLaunchTemplateVersion()
        - .toCreateLocalGatewayRoute()
        - .toCreateLocalGatewayRouteTable()
        - .toCreateLocalGatewayRouteTablePermission()
        - .toCreateLocalGatewayRouteTableVirtualInterfaceGroupAssociation()
        - .toCreateLocalGatewayRouteTableVpcAssociation()
        - .toCreateNatGateway()
        - .toCreateNetworkAcl()
        - .toCreateNetworkAclEntry()
        - .toCreateNetworkInsightsPath()
        - .toCreateNetworkInterface()
        - .toCreateNetworkInterfacePermission()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateRoute()
        - .toCreateRouteTable()
        - .toCreateSecurityGroup()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateStoreImageTask()
        - .toCreateSubnet()
        - .toCreateTags()
        - .toCreateTrafficMirrorFilterRule()
        - .toCreateTrafficMirrorSession()
        - .toCreateTrafficMirrorTarget()
        - .toCreateTransitGatewayConnectPeer()
        - .toCreateTransitGatewayMulticastDomain()
        - .toCreateTransitGatewayPeeringAttachment()
        - .toCreateTransitGatewayPolicyTable()
        - .toCreateTransitGatewayPrefixListReference()
        - .toCreateTransitGatewayRoute()
        - .toCreateTransitGatewayRouteTable()
        - .toCreateTransitGatewayRouteTableAnnouncement()
        - .toCreateTransitGatewayVpcAttachment()
        - .toCreateVerifiedAccessEndpoint()
        - .toCreateVerifiedAccessGroup()
        - .toCreateVpc()
        - .toCreateVpcEndpoint()
        - .toCreateVpcEndpointConnectionNotification()
        - .toCreateVpcPeeringConnection()
        - .toCreateVpnConnection()
        - .toCreateVpnConnectionRoute()
        - .toDeleteCarrierGateway()
        - .toDeleteClientVpnEndpoint()
        - .toDeleteClientVpnRoute()
        - .toDeleteCoipCidr()
        - .toDeleteCoipPool()
        - .toDeleteCoipPoolPermission()
        - .toDeleteCustomerGateway()
        - .toDeleteDhcpOptions()
        - .toDeleteEgressOnlyInternetGateway()
        - .toDeleteFleets()
        - .toDeleteFlowLogs()
        - .toDeleteFpgaImage()
        - .toDeleteInstanceEventWindow()
        - .toDeleteInternetGateway()
        - .toDeleteIpam()
        - .toDeleteIpamPool()
        - .toDeleteIpamResourceDiscovery()
        - .toDeleteIpamScope()
        - .toDeleteKeyPair()
        - .toDeleteLaunchTemplate()
        - .toDeleteLaunchTemplateVersions()
        - .toDeleteLocalGatewayRoute()
        - .toDeleteLocalGatewayRouteTable()
        - .toDeleteLocalGatewayRouteTablePermission()
        - .toDeleteLocalGatewayRouteTableVirtualInterfaceGroupAssociation()
        - .toDeleteLocalGatewayRouteTableVpcAssociation()
        - .toDeleteManagedPrefixList()
        - .toDeleteNatGateway()
        - .toDeleteNetworkAcl()
        - .toDeleteNetworkAclEntry()
        - .toDeleteNetworkInsightsAccessScope()
        - .toDeleteNetworkInsightsAccessScopeAnalysis()
        - .toDeleteNetworkInsightsAnalysis()
        - .toDeleteNetworkInsightsPath()
        - .toDeleteNetworkInterface()
        - .toDeleteNetworkInterfacePermission()
        - .toDeletePlacementGroup()
        - .toDeletePublicIpv4Pool()
        - .toDeleteResourcePolicy()
        - .toDeleteRoute()
        - .toDeleteRouteTable()
        - .toDeleteSecurityGroup()
        - .toDeleteSnapshot()
        - .toDeleteSubnet()
        - .toDeleteTags()
        - .toDeleteTrafficMirrorFilter()
        - .toDeleteTrafficMirrorFilterRule()
        - .toDeleteTrafficMirrorSession()
        - .toDeleteTrafficMirrorTarget()
        - .toDeleteTransitGateway()
        - .toDeleteTransitGatewayConnect()
        - .toDeleteTransitGatewayConnectPeer()
        - .toDeleteTransitGatewayMulticastDomain()
        - .toDeleteTransitGatewayPeeringAttachment()
        - .toDeleteTransitGatewayPolicyTable()
        - .toDeleteTransitGatewayPrefixListReference()
        - .toDeleteTransitGatewayRoute()
        - .toDeleteTransitGatewayRouteTable()
        - .toDeleteTransitGatewayRouteTableAnnouncement()
        - .toDeleteTransitGatewayVpcAttachment()
        - .toDeleteVerifiedAccessEndpoint()
        - .toDeleteVerifiedAccessGroup()
        - .toDeleteVerifiedAccessInstance()
        - .toDeleteVerifiedAccessTrustProvider()
        - .toDeleteVolume()
        - .toDeleteVpc()
        - .toDeleteVpcEndpointConnectionNotifications()
        - .toDeleteVpcEndpointServiceConfigurations()
        - .toDeleteVpcEndpoints()
        - .toDeleteVpcPeeringConnection()
        - .toDeleteVpnConnection()
        - .toDeleteVpnConnectionRoute()
        - .toDeleteVpnGateway()
        - .toDeprovisionIpamPoolCidr()
        - .toDeprovisionPublicIpv4PoolCidr()
        - .toDeregisterImage()
        - .toDeregisterTransitGatewayMulticastGroupMembers()
        - .toDeregisterTransitGatewayMulticastGroupSources()
        - .toDescribeAddressesAttribute()
        - .toDescribeClientVpnAuthorizationRules()
        - .toDescribeClientVpnConnections()
        - .toDescribeClientVpnEndpoints()
        - .toDescribeClientVpnRoutes()
        - .toDescribeClientVpnTargetNetworks()
        - .toDescribeFastLaunchImages()
        - .toDescribeFleetHistory()
        - .toDescribeFleetInstances()
        - .toDescribeFpgaImageAttribute()
        - .toDescribeImageAttribute()
        - .toDescribeInstanceAttribute()
        - .toDescribeSnapshotAttribute()
        - .toDescribeSpotFleetInstances()
        - .toDescribeSpotFleetRequestHistory()
        - .toDescribeVolumeAttribute()
        - .toDescribeVpcAttribute()
        - .toDetachClassicLinkVpc()
        - .toDetachInternetGateway()
        - .toDetachNetworkInterface()
        - .toDetachVerifiedAccessTrustProvider()
        - .toDetachVolume()
        - .toDetachVpnGateway()
        - .toDisableAddressTransfer()
        - .toDisableFastLaunch()
        - .toDisableFastSnapshotRestores()
        - .toDisableImageDeprecation()
        - .toDisableTransitGatewayRouteTablePropagation()
        - .toDisableVgwRoutePropagation()
        - .toDisableVpcClassicLink()
        - .toDisableVpcClassicLinkDnsSupport()
        - .toDisassociateAddress()
        - .toDisassociateClientVpnTargetNetwork()
        - .toDisassociateIamInstanceProfile()
        - .toDisassociateInstanceEventWindow()
        - .toDisassociateIpamResourceDiscovery()
        - .toDisassociateNatGatewayAddress()
        - .toDisassociateRouteTable()
        - .toDisassociateSubnetCidrBlock()
        - .toDisassociateTransitGatewayMulticastDomain()
        - .toDisassociateTransitGatewayPolicyTable()
        - .toDisassociateTransitGatewayRouteTable()
        - .toDisassociateVpcCidrBlock()
        - .toEnableAddressTransfer()
        - .toEnableFastLaunch()
        - .toEnableFastSnapshotRestores()
        - .toEnableImageDeprecation()
        - .toEnableTransitGatewayRouteTablePropagation()
        - .toEnableVgwRoutePropagation()
        - .toEnableVolumeIO()
        - .toEnableVpcClassicLink()
        - .toEnableVpcClassicLinkDnsSupport()
        - .toExportClientVpnClientCertificateRevocationList()
        - .toExportClientVpnClientConfiguration()
        - .toExportImage()
        - .toGetCapacityReservationUsage()
        - .toGetCoipPoolUsage()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetFlowLogsIntegrationTemplate()
        - .toGetGroupsForCapacityReservation()
        - .toGetInstanceUefiData()
        - .toGetIpamAddressHistory()
        - .toGetIpamDiscoveredAccounts()
        - .toGetIpamDiscoveredResourceCidrs()
        - .toGetIpamPoolAllocations()
        - .toGetIpamPoolCidrs()
        - .toGetIpamResourceCidrs()
        - .toGetLaunchTemplateData()
        - .toGetManagedPrefixListAssociations()
        - .toGetManagedPrefixListEntries()
        - .toGetPasswordData()
        - .toGetResourcePolicy()
        - .toGetTransitGatewayMulticastDomainAssociations()
        - .toGetTransitGatewayPolicyTableAssociations()
        - .toGetTransitGatewayPolicyTableEntries()
        - .toGetVerifiedAccessEndpointPolicy()
        - .toGetVerifiedAccessGroupPolicy()
        - .toGetVpnConnectionDeviceSampleConfiguration()
        - .toImportClientVpnClientCertificateRevocationList()
        - .toImportImage()
        - .toImportInstance()
        - .toImportVolume()
        - .toListImagesInRecycleBin()
        - .toListSnapshotsInRecycleBin()
        - .toModifyAddressAttribute()
        - .toModifyCapacityReservation()
        - .toModifyCapacityReservationFleet()
        - .toModifyClientVpnEndpoint()
        - .toModifyFleet()
        - .toModifyFpgaImageAttribute()
        - .toModifyHosts()
        - .toModifyImageAttribute()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceEventStartTime()
        - .toModifyInstanceEventWindow()
        - .toModifyInstanceMaintenanceOptions()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyIpam()
        - .toModifyIpamPool()
        - .toModifyIpamResourceCidr()
        - .toModifyIpamResourceDiscovery()
        - .toModifyIpamScope()
        - .toModifyLaunchTemplate()
        - .toModifyLocalGatewayRoute()
        - .toModifyManagedPrefixList()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyPrivateDnsNameOptions()
        - .toModifyReservedInstances()
        - .toModifySecurityGroupRules()
        - .toModifySnapshotAttribute()
        - .toModifySnapshotTier()
        - .toModifySpotFleetRequest()
        - .toModifySubnetAttribute()
        - .toModifyTrafficMirrorFilterNetworkServices()
        - .toModifyTrafficMirrorFilterRule()
        - .toModifyTrafficMirrorSession()
        - .toModifyTransitGateway()
        - .toModifyTransitGatewayPrefixListReference()
        - .toModifyTransitGatewayVpcAttachment()
        - .toModifyVerifiedAccessEndpoint()
        - .toModifyVerifiedAccessEndpointPolicy()
        - .toModifyVerifiedAccessGroup()
        - .toModifyVerifiedAccessGroupPolicy()
        - .toModifyVerifiedAccessInstance()
        - .toModifyVerifiedAccessInstanceLoggingConfiguration()
        - .toModifyVerifiedAccessTrustProvider()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toModifyVpcAttribute()
        - .toModifyVpcEndpoint()
        - .toModifyVpcEndpointConnectionNotification()
        - .toModifyVpcEndpointServiceConfiguration()
        - .toModifyVpcEndpointServicePayerResponsibility()
        - .toModifyVpcEndpointServicePermissions()
        - .toModifyVpcPeeringConnectionOptions()
        - .toModifyVpcTenancy()
        - .toModifyVpnConnection()
        - .toModifyVpnConnectionOptions()
        - .toModifyVpnTunnelCertificate()
        - .toModifyVpnTunnelOptions()
        - .toMonitorInstances()
        - .toMoveByoipCidrToIpam()
        - .toPauseVolumeIO()
        - .toProvisionIpamPoolCidr()
        - .toProvisionPublicIpv4PoolCidr()
        - .toPurchaseHostReservation()
        - .toPutResourcePolicy()
        - .toRebootInstances()
        - .toRegisterImage()
        - .toRegisterTransitGatewayMulticastGroupMembers()
        - .toRegisterTransitGatewayMulticastGroupSources()
        - .toRejectTransitGatewayMulticastDomainAssociations()
        - .toRejectTransitGatewayPeeringAttachment()
        - .toRejectTransitGatewayVpcAttachment()
        - .toRejectVpcEndpointConnections()
        - .toRejectVpcPeeringConnection()
        - .toReleaseAddress()
        - .toReleaseHosts()
        - .toReleaseIpamPoolAllocation()
        - .toReplaceIamInstanceProfileAssociation()
        - .toReplaceNetworkAclAssociation()
        - .toReplaceNetworkAclEntry()
        - .toReplaceRoute()
        - .toReplaceRouteTableAssociation()
        - .toReplaceTransitGatewayRoute()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toResetAddressAttribute()
        - .toResetFpgaImageAttribute()
        - .toResetImageAttribute()
        - .toResetInstanceAttribute()
        - .toResetNetworkInterfaceAttribute()
        - .toResetSnapshotAttribute()
        - .toRestoreImageFromRecycleBin()
        - .toRestoreManagedPrefixListVersion()
        - .toRestoreSnapshotFromRecycleBin()
        - .toRestoreSnapshotTier()
        - .toRevokeClientVpnIngress()
        - .toRevokeSecurityGroupEgress()
        - .toRevokeSecurityGroupIngress()
        - .toRunInstances()
        - .toSearchLocalGatewayRoutes()
        - .toSearchTransitGatewayMulticastGroups()
        - .toSearchTransitGatewayRoutes()
        - .toSendDiagnosticInterrupt()
        - .toSendSpotInstanceInterruptions()
        - .toStartInstances()
        - .toStartNetworkInsightsAccessScopeAnalysis()
        - .toStartNetworkInsightsAnalysis()
        - .toStartVpcEndpointServicePrivateDnsVerification()
        - .toStopInstances()
        - .toTerminateClientVpnConnections()
        - .toTerminateInstances()
        - .toUnassignIpv6Addresses()
        - .toUnassignPrivateIpAddresses()
        - .toUnassignPrivateNatGatewayAddress()
        - .toUnmonitorInstances()
        - .toUpdateSecurityGroupRuleDescriptionsEgress()
        - .toUpdateSecurityGroupRuleDescriptionsIngress()

        Applies to resource types:

        - elastic-ip
        - capacity-reservation-fleet
        - capacity-reservation
        - carrier-gateway
        - client-vpn-endpoint
        - customer-gateway
        - dedicated-host
        - dhcp-options
        - egress-only-internet-gateway
        - elastic-gpu
        - export-image-task
        - export-instance-task
        - fleet
        - fpga-image
        - host-reservation
        - image
        - import-image-task
        - import-snapshot-task
        - instance-event-window
        - instance
        - internet-gateway
        - ipam
        - ipam-pool
        - ipam-resource-discovery-association
        - ipam-resource-discovery
        - ipam-scope
        - coip-pool
        - ipv4pool-ec2
        - ipv6pool-ec2
        - key-pair
        - launch-template
        - local-gateway
        - local-gateway-route-table-virtual-interface-group-association
        - local-gateway-route-table-vpc-association
        - local-gateway-route-table
        - local-gateway-virtual-interface-group
        - local-gateway-virtual-interface
        - natgateway
        - network-acl
        - network-insights-access-scope-analysis
        - network-insights-access-scope
        - network-insights-analysis
        - network-insights-path
        - network-interface
        - placement-group
        - prefix-list
        - replace-root-volume-task
        - reserved-instances
        - route-table
        - security-group
        - security-group-rule
        - snapshot
        - spot-fleet-request
        - spot-instances-request
        - subnet-cidr-reservation
        - subnet
        - traffic-mirror-filter
        - traffic-mirror-session
        - traffic-mirror-target
        - transit-gateway-attachment
        - transit-gateway-connect-peer
        - transit-gateway
        - transit-gateway-multicast-domain
        - transit-gateway-policy-table
        - transit-gateway-route-table-announcement
        - transit-gateway-route-table
        - verified-access-endpoint
        - verified-access-group
        - verified-access-instance
        - verified-access-policy
        - verified-access-trust-provider
        - volume
        - vpc-endpoint-connection
        - vpc-endpoint
        - vpc-endpoint-service
        - vpc-endpoint-service-permission
        - vpc-flow-log
        - vpc
        - vpc-peering-connection
        - vpn-connection
        - vpn-gateway

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__64fd1c3e34c3d18124b0933b762d80718f0e7fba062af7e725f25b1c7aecf600)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifRoleDelivery")
    def if_role_delivery(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the version of the instance metadata service for retrieving IAM role credentials for EC2.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6c6dfbc3cca77d0f5997f9b3421bd10eb935af1f3c6c662e2db00b6a4a9dec31)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifRoleDelivery", [value, operator]))

    @jsii.member(jsii_name="ifRootDeviceType")
    def if_root_device_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the root device type of the instance (ebs or instance-store).

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssociateAddress()
        - .toAssociateIamInstanceProfile()
        - .toAttachClassicLinkVpc()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toCancelImageLaunchPermission()
        - .toCreateFleet()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateNetworkInsightsPath()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateSnapshots()
        - .toCreateStoreImageTask()
        - .toCreateTags()
        - .toDeregisterImage()
        - .toDescribeFastLaunchImages()
        - .toDescribeImageAttribute()
        - .toDescribeInstanceAttribute()
        - .toDetachClassicLinkVpc()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDisableFastLaunch()
        - .toDisableImageDeprecation()
        - .toDisassociateIamInstanceProfile()
        - .toEnableFastLaunch()
        - .toEnableImageDeprecation()
        - .toExportImage()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetInstanceUefiData()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toImportImage()
        - .toListImagesInRecycleBin()
        - .toModifyFleet()
        - .toModifyImageAttribute()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceMaintenanceOptions()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyPrivateDnsNameOptions()
        - .toMonitorInstances()
        - .toPauseVolumeIO()
        - .toRebootInstances()
        - .toReplaceIamInstanceProfileAssociation()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toResetImageAttribute()
        - .toResetInstanceAttribute()
        - .toRestoreImageFromRecycleBin()
        - .toRunInstances()
        - .toSendDiagnosticInterrupt()
        - .toSendSpotInstanceInterruptions()
        - .toStartInstances()
        - .toStopInstances()
        - .toTerminateInstances()
        - .toUnmonitorInstances()

        Applies to resource types:

        - image
        - instance

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ed9db975b7709c2d7806c7d4b9ae2d4b8a8ff848658871f44cc2b9730fa65a95)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifRootDeviceType", [value, operator]))

    @jsii.member(jsii_name="ifRouteTableID")
    def if_route_table_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ID of a route table.

        Applies to actions:

        - .toAssociateRouteTable()
        - .toCreateRoute()
        - .toCreateRouteTable()
        - .toCreateTags()
        - .toCreateVpcEndpoint()
        - .toDeleteRoute()
        - .toDeleteRouteTable()
        - .toDisableVgwRoutePropagation()
        - .toDisassociateRouteTable()
        - .toEnableVgwRoutePropagation()
        - .toModifyVpcEndpoint()
        - .toReplaceRoute()
        - .toReplaceRouteTableAssociation()

        Applies to resource types:

        - route-table

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ee8adf2eadd8bdab0480c3864b9fb65a13ade92e34908d8636c53548b68bf853)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifRouteTableID", [value, operator]))

    @jsii.member(jsii_name="ifRoutingType")
    def if_routing_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the routing type for the VPN connection.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-authentication-access-control.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpnConnection()
        - .toModifyVpnConnection()
        - .toModifyVpnTunnelOptions()

        Applies to resource types:

        - vpn-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ef89ebd18d2eee351060ce079b52f8f85add6e504dbbe193fbd8068657b9b84f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifRoutingType", [value, operator]))

    @jsii.member(jsii_name="ifSamlProviderArn")
    def if_saml_provider_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the IAM SAML identity provider.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toApplySecurityGroupsToClientVpnTargetNetwork()
        - .toAssociateClientVpnTargetNetwork()
        - .toAuthorizeClientVpnIngress()
        - .toCreateClientVpnEndpoint()
        - .toCreateClientVpnRoute()
        - .toCreateTags()
        - .toDeleteClientVpnEndpoint()
        - .toDeleteClientVpnRoute()
        - .toDescribeClientVpnConnections()
        - .toDescribeClientVpnEndpoints()
        - .toDescribeClientVpnRoutes()
        - .toDescribeClientVpnTargetNetworks()
        - .toDisassociateClientVpnTargetNetwork()
        - .toExportClientVpnClientCertificateRevocationList()
        - .toExportClientVpnClientConfiguration()
        - .toImportClientVpnClientCertificateRevocationList()
        - .toModifyClientVpnEndpoint()
        - .toRevokeClientVpnIngress()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - client-vpn-endpoint

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b23b863e5c8d510e062f08db1c2957426ef093870b5bb45add30e26764266c6c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifSamlProviderArn", [value, operator]))

    @jsii.member(jsii_name="ifSecurityGroupID")
    def if_security_group_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ID of a security group.

        Applies to actions:

        - .toApplySecurityGroupsToClientVpnTargetNetwork()
        - .toAttachClassicLinkVpc()
        - .toAuthorizeSecurityGroupEgress()
        - .toAuthorizeSecurityGroupIngress()
        - .toCreateClientVpnEndpoint()
        - .toCreateFleet()
        - .toCreateNetworkInterface()
        - .toCreateSecurityGroup()
        - .toCreateTags()
        - .toCreateVerifiedAccessEndpoint()
        - .toCreateVpcEndpoint()
        - .toDeleteSecurityGroup()
        - .toImportInstance()
        - .toModifyClientVpnEndpoint()
        - .toModifyFleet()
        - .toModifyInstanceAttribute()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifySecurityGroupRules()
        - .toModifyVpcEndpoint()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toRevokeSecurityGroupEgress()
        - .toRevokeSecurityGroupIngress()
        - .toRunInstances()
        - .toUpdateSecurityGroupRuleDescriptionsEgress()
        - .toUpdateSecurityGroupRuleDescriptionsIngress()

        Applies to resource types:

        - security-group

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2f585dd02b001c5ea2aae6d99330e833fb7f2fe3f89e8e513c2c2d8fcddac096)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifSecurityGroupID", [value, operator]))

    @jsii.member(jsii_name="ifServerCertificateArn")
    def if_server_certificate_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the server certificate.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toApplySecurityGroupsToClientVpnTargetNetwork()
        - .toAssociateClientVpnTargetNetwork()
        - .toAuthorizeClientVpnIngress()
        - .toCreateClientVpnEndpoint()
        - .toCreateClientVpnRoute()
        - .toCreateTags()
        - .toDeleteClientVpnEndpoint()
        - .toDeleteClientVpnRoute()
        - .toDescribeClientVpnConnections()
        - .toDescribeClientVpnEndpoints()
        - .toDescribeClientVpnRoutes()
        - .toDescribeClientVpnTargetNetworks()
        - .toDisassociateClientVpnTargetNetwork()
        - .toExportClientVpnClientCertificateRevocationList()
        - .toExportClientVpnClientConfiguration()
        - .toImportClientVpnClientCertificateRevocationList()
        - .toModifyClientVpnEndpoint()
        - .toRevokeClientVpnIngress()
        - .toTerminateClientVpnConnections()

        Applies to resource types:

        - client-vpn-endpoint

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b9c810ea8e3c846f6c593b7269647522cae6d56c2d92633140bcb714c7605721)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifServerCertificateArn", [value, operator]))

    @jsii.member(jsii_name="ifSnapshotID")
    def if_snapshot_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ID of a snapshot.

        Applies to actions:

        - .toCopySnapshot()
        - .toCreateFleet()
        - .toCreateImage()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toDeleteSnapshot()
        - .toDescribeSnapshotAttribute()
        - .toDisableFastSnapshotRestores()
        - .toEnableFastSnapshotRestores()
        - .toImportImage()
        - .toImportSnapshot()
        - .toListSnapshotsInRecycleBin()
        - .toModifyFleet()
        - .toModifySnapshotAttribute()
        - .toModifySnapshotTier()
        - .toRegisterImage()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toResetSnapshotAttribute()
        - .toRestoreSnapshotFromRecycleBin()
        - .toRestoreSnapshotTier()
        - .toRunInstances()

        Applies to resource types:

        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__46331cfd0c0c7c2d4b5d1e877062e0d4a325765cf490eeef7747f34ac47defcc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifSnapshotID", [value, operator]))

    @jsii.member(jsii_name="ifSnapshotTime")
    def if_snapshot_time(
        self,
        value: typing.Union[builtins.str, datetime.datetime, typing.Sequence[typing.Union[builtins.str, datetime.datetime]]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the initiation time of a snapshot.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateFleet()
        - .toCreateImage()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateTags()
        - .toDeleteSnapshot()
        - .toDescribeSnapshotAttribute()
        - .toDisableFastSnapshotRestores()
        - .toEnableFastSnapshotRestores()
        - .toImportImage()
        - .toImportSnapshot()
        - .toListSnapshotsInRecycleBin()
        - .toModifyFleet()
        - .toModifySnapshotAttribute()
        - .toModifySnapshotTier()
        - .toRegisterImage()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toResetSnapshotAttribute()
        - .toRestoreSnapshotFromRecycleBin()
        - .toRestoreSnapshotTier()
        - .toRunInstances()

        Applies to resource types:

        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `date operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Date>`_. **Default:** ``DateEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8b76aabad97a9f11dbf6a3b9f5562bd2b299427a0229bb512af9754f25c04495)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifSnapshotTime", [value, operator]))

    @jsii.member(jsii_name="ifSourceInstanceARN")
    def if_source_instance_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the instance from which the request originated.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8688e151266968a4519d6c3aa91df68de1c398835b6fddd34cf1728dc7da58af)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifSourceInstanceARN", [value, operator]))

    @jsii.member(jsii_name="ifSourceOutpostArn")
    def if_source_outpost_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the Outpost from which the request originated.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toCreateImage()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toDeleteSnapshot()
        - .toDescribeSnapshotAttribute()
        - .toRegisterImage()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()

        Applies to resource types:

        - snapshot

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0498f830912676045d0b3ea7abd6b0ea29d0de3ceef411494ae665b6e4544beb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifSourceOutpostArn", [value, operator]))

    @jsii.member(jsii_name="ifSubnet")
    def if_subnet(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the subnet.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssignIpv6Addresses()
        - .toAssignPrivateIpAddresses()
        - .toAssociateAddress()
        - .toAttachNetworkInterface()
        - .toCreateFleet()
        - .toCreateFlowLogs()
        - .toCreateLocalGatewayRoute()
        - .toCreateNetworkInsightsPath()
        - .toCreateNetworkInterfacePermission()
        - .toCreateTags()
        - .toCreateVerifiedAccessEndpoint()
        - .toDeleteNetworkInterface()
        - .toDeleteNetworkInterfacePermission()
        - .toDeregisterTransitGatewayMulticastGroupMembers()
        - .toDeregisterTransitGatewayMulticastGroupSources()
        - .toDetachNetworkInterface()
        - .toDisassociateAddress()
        - .toDisassociateNatGatewayAddress()
        - .toModifyFleet()
        - .toModifyLocalGatewayRoute()
        - .toModifyNetworkInterfaceAttribute()
        - .toRegisterTransitGatewayMulticastGroupMembers()
        - .toRegisterTransitGatewayMulticastGroupSources()
        - .toRequestSpotInstances()
        - .toResetNetworkInterfaceAttribute()
        - .toRunInstances()
        - .toUnassignIpv6Addresses()
        - .toUnassignPrivateIpAddresses()

        Applies to resource types:

        - network-interface

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__11e32f05be3edd6f29908ed1ddffa69d862d0fecb6083e3a8025d169c9d54180)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifSubnet", [value, operator]))

    @jsii.member(jsii_name="ifSubnetID")
    def if_subnet_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ID of a subnet.

        Applies to actions:

        - .toAssociateClientVpnTargetNetwork()
        - .toAssociateRouteTable()
        - .toAssociateSubnetCidrBlock()
        - .toAssociateTransitGatewayMulticastDomain()
        - .toCreateClientVpnRoute()
        - .toCreateFleet()
        - .toCreateFlowLogs()
        - .toCreateNatGateway()
        - .toCreateNetworkInterface()
        - .toCreateSubnet()
        - .toCreateTags()
        - .toCreateTransitGatewayVpcAttachment()
        - .toCreateVerifiedAccessEndpoint()
        - .toCreateVpcEndpoint()
        - .toDeleteClientVpnRoute()
        - .toDeleteSubnet()
        - .toDisassociateRouteTable()
        - .toDisassociateSubnetCidrBlock()
        - .toDisassociateTransitGatewayMulticastDomain()
        - .toImportInstance()
        - .toModifyFleet()
        - .toModifySpotFleetRequest()
        - .toModifySubnetAttribute()
        - .toModifyTransitGatewayVpcAttachment()
        - .toModifyVerifiedAccessEndpoint()
        - .toModifyVpcEndpoint()
        - .toReplaceNetworkAclAssociation()
        - .toReplaceRouteTableAssociation()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toRunInstances()

        Applies to resource types:

        - subnet

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5b4c9f00a19051e251ba305dc692a6318797379f8d06ae9ef64ea8ba8040617d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifSubnetID", [value, operator]))

    @jsii.member(jsii_name="ifTenancy")
    def if_tenancy(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the tenancy of the VPC or instance (default, dedicated, or host).

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAcceptVpcPeeringConnection()
        - .toAssociateAddress()
        - .toAssociateDhcpOptions()
        - .toAssociateIamInstanceProfile()
        - .toAssociateVpcCidrBlock()
        - .toAttachClassicLinkVpc()
        - .toAttachInternetGateway()
        - .toAttachNetworkInterface()
        - .toAttachVolume()
        - .toAttachVpnGateway()
        - .toCreateCarrierGateway()
        - .toCreateEgressOnlyInternetGateway()
        - .toCreateFleet()
        - .toCreateFlowLogs()
        - .toCreateImage()
        - .toCreateInstanceExportTask()
        - .toCreateLocalGatewayRouteTableVpcAssociation()
        - .toCreateNetworkAcl()
        - .toCreateNetworkInsightsPath()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateRouteTable()
        - .toCreateSecurityGroup()
        - .toCreateSnapshots()
        - .toCreateSubnet()
        - .toCreateTags()
        - .toCreateTransitGatewayVpcAttachment()
        - .toCreateVpcPeeringConnection()
        - .toDeleteVpc()
        - .toDescribeInstanceAttribute()
        - .toDescribeVpcAttribute()
        - .toDetachClassicLinkVpc()
        - .toDetachInternetGateway()
        - .toDetachNetworkInterface()
        - .toDetachVolume()
        - .toDetachVpnGateway()
        - .toDisableVpcClassicLink()
        - .toDisableVpcClassicLinkDnsSupport()
        - .toDisassociateIamInstanceProfile()
        - .toDisassociateVpcCidrBlock()
        - .toEnableVpcClassicLink()
        - .toEnableVpcClassicLinkDnsSupport()
        - .toGetConsoleOutput()
        - .toGetConsoleScreenshot()
        - .toGetInstanceUefiData()
        - .toGetLaunchTemplateData()
        - .toGetPasswordData()
        - .toModifyInstanceAttribute()
        - .toModifyInstanceCapacityReservationAttributes()
        - .toModifyInstanceCreditSpecification()
        - .toModifyInstanceMaintenanceOptions()
        - .toModifyInstanceMetadataOptions()
        - .toModifyInstancePlacement()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifyPrivateDnsNameOptions()
        - .toModifyReservedInstances()
        - .toModifyVpcAttribute()
        - .toModifyVpcTenancy()
        - .toMonitorInstances()
        - .toPauseVolumeIO()
        - .toRebootInstances()
        - .toReplaceIamInstanceProfileAssociation()
        - .toResetInstanceAttribute()
        - .toRunInstances()
        - .toSendDiagnosticInterrupt()
        - .toSendSpotInstanceInterruptions()
        - .toStartInstances()
        - .toStopInstances()
        - .toTerminateInstances()
        - .toUnmonitorInstances()

        Applies to resource types:

        - carrier-gateway
        - instance
        - reserved-instances
        - vpc

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__66818d7aa506e176c3c616136df75b43720f85b480598ad0abdc80c3192cb486)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifTenancy", [value, operator]))

    @jsii.member(jsii_name="ifVolumeID")
    def if_volume_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ID of a volume.

        Applies to actions:

        - .toAttachVolume()
        - .toCreateFleet()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toCreateVolume()
        - .toDeleteVolume()
        - .toDescribeVolumeAttribute()
        - .toDetachVolume()
        - .toEnableVolumeIO()
        - .toImportInstance()
        - .toImportVolume()
        - .toModifyInstanceAttribute()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toPauseVolumeIO()
        - .toRunInstances()

        Applies to resource types:

        - volume

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0492745b87adfce4594c67fef6455ff60c45eb605330c6fa347a7084837e351e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifVolumeID", [value, operator]))

    @jsii.member(jsii_name="ifVolumeIops")
    def if_volume_iops(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the the number of input/output operations per second (IOPS) provisioned for the volume.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAttachVolume()
        - .toCreateFleet()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toCreateVolume()
        - .toDeleteVolume()
        - .toDescribeVolumeAttribute()
        - .toDetachVolume()
        - .toEnableVolumeIO()
        - .toImportInstance()
        - .toImportVolume()
        - .toModifyInstanceAttribute()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toPauseVolumeIO()
        - .toRunInstances()

        Applies to resource types:

        - volume

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c553b20db6ea682669932cadf338ce6c0e2944df41187b452d6c3983f13dc046)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifVolumeIops", [value, operator]))

    @jsii.member(jsii_name="ifVolumeSize")
    def if_volume_size(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the size of the volume, in GiB.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAttachVolume()
        - .toCreateFleet()
        - .toCreateImage()
        - .toCreateReplaceRootVolumeTask()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toCreateVolume()
        - .toDeleteSnapshot()
        - .toDeleteVolume()
        - .toDescribeSnapshotAttribute()
        - .toDescribeVolumeAttribute()
        - .toDetachVolume()
        - .toDisableFastSnapshotRestores()
        - .toEnableFastSnapshotRestores()
        - .toEnableVolumeIO()
        - .toImportImage()
        - .toImportInstance()
        - .toImportSnapshot()
        - .toImportVolume()
        - .toListSnapshotsInRecycleBin()
        - .toModifyFleet()
        - .toModifyInstanceAttribute()
        - .toModifySnapshotAttribute()
        - .toModifySnapshotTier()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toPauseVolumeIO()
        - .toRegisterImage()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toResetSnapshotAttribute()
        - .toRestoreSnapshotFromRecycleBin()
        - .toRestoreSnapshotTier()
        - .toRunInstances()

        Applies to resource types:

        - snapshot
        - volume

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5f42b466f612860e737546e7e13aa82e0f823b7068cf140c7be69b967f12985b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifVolumeSize", [value, operator]))

    @jsii.member(jsii_name="ifVolumeThroughput")
    def if_volume_throughput(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the throughput of the volume, in MiBps.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAttachVolume()
        - .toCreateFleet()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toCreateVolume()
        - .toDeleteVolume()
        - .toDescribeVolumeAttribute()
        - .toDetachVolume()
        - .toEnableVolumeIO()
        - .toImportInstance()
        - .toImportVolume()
        - .toModifyInstanceAttribute()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toPauseVolumeIO()
        - .toRunInstances()

        Applies to resource types:

        - volume

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f77c4cb23f53e2e33089eb01246344d4af0f96edbf1c5ac7dc7e5f4c2b540ef6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifVolumeThroughput", [value, operator]))

    @jsii.member(jsii_name="ifVolumeType")
    def if_volume_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the type of volume (gp2, gp3, io1, io2, st1, sc1, or standard).

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAttachVolume()
        - .toCreateFleet()
        - .toCreateSnapshot()
        - .toCreateSnapshots()
        - .toCreateTags()
        - .toCreateVolume()
        - .toDeleteVolume()
        - .toDescribeVolumeAttribute()
        - .toDetachVolume()
        - .toEnableVolumeIO()
        - .toImportInstance()
        - .toImportVolume()
        - .toModifyInstanceAttribute()
        - .toModifyVolume()
        - .toModifyVolumeAttribute()
        - .toPauseVolumeIO()
        - .toRunInstances()

        Applies to resource types:

        - volume

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__08095bcd183c4f4c660db2be46dbf265ff712759ef6f29dbcc656b543123103d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifVolumeType", [value, operator]))

    @jsii.member(jsii_name="ifVpc")
    def if_vpc(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ARN of the VPC.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#amazon-ec2-keys

        Applies to actions:

        - .toAssignIpv6Addresses()
        - .toAssignPrivateIpAddresses()
        - .toAssociateAddress()
        - .toAssociateRouteTable()
        - .toAssociateSubnetCidrBlock()
        - .toAssociateTransitGatewayMulticastDomain()
        - .toAttachClassicLinkVpc()
        - .toAttachNetworkInterface()
        - .toAuthorizeSecurityGroupEgress()
        - .toAuthorizeSecurityGroupIngress()
        - .toCreateFleet()
        - .toCreateFlowLogs()
        - .toCreateLocalGatewayRoute()
        - .toCreateNatGateway()
        - .toCreateNetworkAclEntry()
        - .toCreateNetworkInsightsPath()
        - .toCreateNetworkInterface()
        - .toCreateNetworkInterfacePermission()
        - .toCreateRoute()
        - .toCreateTags()
        - .toCreateTransitGatewayVpcAttachment()
        - .toCreateVerifiedAccessEndpoint()
        - .toDeleteClientVpnRoute()
        - .toDeleteNetworkAcl()
        - .toDeleteNetworkAclEntry()
        - .toDeleteNetworkInterface()
        - .toDeleteNetworkInterfacePermission()
        - .toDeleteRoute()
        - .toDeleteRouteTable()
        - .toDeleteSecurityGroup()
        - .toDeleteSubnet()
        - .toDeregisterTransitGatewayMulticastGroupMembers()
        - .toDeregisterTransitGatewayMulticastGroupSources()
        - .toDetachNetworkInterface()
        - .toDisableVgwRoutePropagation()
        - .toDisassociateAddress()
        - .toDisassociateNatGatewayAddress()
        - .toDisassociateRouteTable()
        - .toDisassociateSubnetCidrBlock()
        - .toDisassociateTransitGatewayMulticastDomain()
        - .toEnableVgwRoutePropagation()
        - .toImportInstance()
        - .toModifyFleet()
        - .toModifyInstanceAttribute()
        - .toModifyLocalGatewayRoute()
        - .toModifyNetworkInterfaceAttribute()
        - .toModifySecurityGroupRules()
        - .toModifySpotFleetRequest()
        - .toModifySubnetAttribute()
        - .toModifyVerifiedAccessEndpoint()
        - .toRegisterTransitGatewayMulticastGroupMembers()
        - .toRegisterTransitGatewayMulticastGroupSources()
        - .toReplaceNetworkAclAssociation()
        - .toReplaceNetworkAclEntry()
        - .toReplaceRoute()
        - .toReplaceRouteTableAssociation()
        - .toRequestSpotFleet()
        - .toRequestSpotInstances()
        - .toResetNetworkInterfaceAttribute()
        - .toRevokeSecurityGroupEgress()
        - .toRevokeSecurityGroupIngress()
        - .toRunInstances()
        - .toUnassignIpv6Addresses()
        - .toUnassignPrivateIpAddresses()
        - .toUpdateSecurityGroupRuleDescriptionsEgress()
        - .toUpdateSecurityGroupRuleDescriptionsIngress()

        Applies to resource types:

        - carrier-gateway
        - network-acl
        - network-interface
        - route-table
        - security-group
        - subnet

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9b1d701bb947e52c005656e90342e000c213cb5b17b0133b447f6dec0d83f25a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifVpc", [value, operator]))

    @jsii.member(jsii_name="ifVpceServiceName")
    def if_vpce_service_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the name of the VPC endpoint service.

        https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-iam.html

        Applies to actions:

        - .toCreateTrafficMirrorTarget()
        - .toCreateVpcEndpoint()
        - .toDeleteVpcEndpoints()

        Applies to resource types:

        - vpc-endpoint

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__15d3a79b329ebea11ae0c2f3d06886c896a61593597ca92bf8329b58bc9eb602)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifVpceServiceName", [value, operator]))

    @jsii.member(jsii_name="ifVpceServiceOwner")
    def if_vpce_service_owner(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the service owner of the VPC endpoint service (amazon, aws-marketplace, or an AWS account ID).

        https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-iam.html

        Applies to actions:

        - .toCreateTrafficMirrorTarget()
        - .toCreateVpcEndpoint()

        Applies to resource types:

        - vpc-endpoint

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a72c56d3d1da692ed9663e4f5a13af02df79aaf89f93be154e31021c2bf8ea56)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifVpceServiceOwner", [value, operator]))

    @jsii.member(jsii_name="ifVpceServicePrivateDnsName")
    def if_vpce_service_private_dns_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the private DNS name of the VPC endpoint service.

        https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-iam.html

        Applies to actions:

        - .toCreateTags()
        - .toCreateVpcEndpointServiceConfiguration()
        - .toModifyVpcEndpointServiceConfiguration()

        Applies to resource types:

        - vpc-endpoint-service

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7a8d1e6413c5811075f442ce88802ab78216e6567fd85963874773ee1229537b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifVpceServicePrivateDnsName", [value, operator]))

    @jsii.member(jsii_name="ifVpcID")
    def if_vpc_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ID of a virtual private cloud (VPC).

        Applies to actions:

        - .toAcceptVpcPeeringConnection()
        - .toApplySecurityGroupsToClientVpnTargetNetwork()
        - .toAssociateDhcpOptions()
        - .toAssociateVpcCidrBlock()
        - .toAttachClassicLinkVpc()
        - .toAttachInternetGateway()
        - .toAttachVpnGateway()
        - .toCreateCarrierGateway()
        - .toCreateClientVpnEndpoint()
        - .toCreateEgressOnlyInternetGateway()
        - .toCreateFlowLogs()
        - .toCreateLocalGatewayRouteTableVpcAssociation()
        - .toCreateNetworkAcl()
        - .toCreateRouteTable()
        - .toCreateSecurityGroup()
        - .toCreateSubnet()
        - .toCreateTags()
        - .toCreateTransitGatewayVpcAttachment()
        - .toCreateVpc()
        - .toCreateVpcEndpoint()
        - .toCreateVpcPeeringConnection()
        - .toDeleteVpc()
        - .toDescribeVpcAttribute()
        - .toDetachClassicLinkVpc()
        - .toDetachInternetGateway()
        - .toDetachVpnGateway()
        - .toDisableVpcClassicLink()
        - .toDisableVpcClassicLinkDnsSupport()
        - .toDisassociateVpcCidrBlock()
        - .toEnableVpcClassicLink()
        - .toEnableVpcClassicLinkDnsSupport()
        - .toModifyClientVpnEndpoint()
        - .toModifyVpcAttribute()
        - .toModifyVpcTenancy()

        Applies to resource types:

        - vpc

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ccbc0fcf0075038072a22d71e8218fffde1080c03b07db0646a67f1d618c1ca4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifVpcID", [value, operator]))

    @jsii.member(jsii_name="ifVpcPeeringConnectionID")
    def if_vpc_peering_connection_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2":
        '''(experimental) Filters access by the ID of a VPC peering connection.

        Applies to actions:

        - .toAcceptVpcPeeringConnection()
        - .toCreateNetworkInsightsPath()
        - .toCreateTags()
        - .toCreateVpcPeeringConnection()
        - .toDeleteVpcPeeringConnection()
        - .toModifyVpcPeeringConnectionOptions()
        - .toRejectVpcPeeringConnection()

        Applies to resource types:

        - vpc-peering-connection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0d705fb3b0a61baa6495c62618a40a04db586682475217102bdda2dba51fdc06)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2", jsii.invoke(self, "ifVpcPeeringConnectionID", [value, operator]))

    @jsii.member(jsii_name="onCapacityReservation")
    def on_capacity_reservation(
        self,
        capacity_reservation_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type capacity-reservation to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-capacity-reservations.html

        :param capacity_reservation_id: - Identifier for the capacityReservationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifCapacityReservationFleet() - .ifIsLaunchTemplateResource() - .ifLaunchTemplate() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__717a1e756e22dcd2a889546950c634befaef06562a6be8059e55a66f17d0312b)
            check_type(argname="argument capacity_reservation_id", value=capacity_reservation_id, expected_type=type_hints["capacity_reservation_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onCapacityReservation", [capacity_reservation_id, account, region, partition]))

    @jsii.member(jsii_name="onCapacityReservationFleet")
    def on_capacity_reservation_fleet(
        self,
        capacity_reservation_fleet_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type capacity-reservation-fleet to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param capacity_reservation_fleet_id: - Identifier for the capacityReservationFleetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ad1ee2a01da64f4119682fcaa626891c94fdb6c7ccb5eb38cfe9b40216fd9f4a)
            check_type(argname="argument capacity_reservation_fleet_id", value=capacity_reservation_fleet_id, expected_type=type_hints["capacity_reservation_fleet_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onCapacityReservationFleet", [capacity_reservation_fleet_id, account, region, partition]))

    @jsii.member(jsii_name="onCarrierGateway")
    def on_carrier_gateway(
        self,
        carrier_gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type carrier-gateway to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/Carrier_Gateway.html

        :param carrier_gateway_id: - Identifier for the carrierGatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag() - .ifTenancy() - .ifVpc()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d23d21c7b44aff5e92f7a13767520fb2e3d0cc21e6698056a40c94c447db3225)
            check_type(argname="argument carrier_gateway_id", value=carrier_gateway_id, expected_type=type_hints["carrier_gateway_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onCarrierGateway", [carrier_gateway_id, account, region, partition]))

    @jsii.member(jsii_name="onCertificate")
    def on_certificate(
        self,
        certificate_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type certificate to the statement.

        https://docs.aws.amazon.com/acm/latest/userguide/authen-overview.html#acm-resources-operations

        :param certificate_id: - Identifier for the certificateId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3a7a4259fe21a5902002c2ef7197fb89088c0b6eae626c9ea25e374b1ad9a80e)
            check_type(argname="argument certificate_id", value=certificate_id, expected_type=type_hints["certificate_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onCertificate", [certificate_id, account, region, partition]))

    @jsii.member(jsii_name="onClientVpnEndpoint")
    def on_client_vpn_endpoint(
        self,
        client_vpn_endpoint_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type client-vpn-endpoint to the statement.

        https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/what-is.html

        :param client_vpn_endpoint_id: - Identifier for the clientVpnEndpointId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifClientRootCertificateChainArn() - .ifCloudwatchLogGroupArn() - .ifCloudwatchLogStreamArn() - .ifDirectoryArn() - .ifRegion() - .ifResourceTag() - .ifSamlProviderArn() - .ifServerCertificateArn()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__98a6e34125079dae844e8a500ab92eb3575567aab714f968347612c78d33f2c0)
            check_type(argname="argument client_vpn_endpoint_id", value=client_vpn_endpoint_id, expected_type=type_hints["client_vpn_endpoint_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onClientVpnEndpoint", [client_vpn_endpoint_id, account, region, partition]))

    @jsii.member(jsii_name="onCoipPool")
    def on_coip_pool(
        self,
        ipv4_pool_coip_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type coip-pool to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param ipv4_pool_coip_id: - Identifier for the ipv4PoolCoipId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d0417f6a83c364673196e73679d5cfc3b04637ae1a0a5e841f259cfe29f32bd6)
            check_type(argname="argument ipv4_pool_coip_id", value=ipv4_pool_coip_id, expected_type=type_hints["ipv4_pool_coip_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onCoipPool", [ipv4_pool_coip_id, account, region, partition]))

    @jsii.member(jsii_name="onCustomerGateway")
    def on_customer_gateway(
        self,
        customer_gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type customer-gateway to the statement.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html

        :param customer_gateway_id: - Identifier for the customerGatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__366c71feea370281be33f28fa2cfaf0a16e3e2cd5c84c00b1e59afa47ef21d92)
            check_type(argname="argument customer_gateway_id", value=customer_gateway_id, expected_type=type_hints["customer_gateway_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onCustomerGateway", [customer_gateway_id, account, region, partition]))

    @jsii.member(jsii_name="onDedicatedHost")
    def on_dedicated_host(
        self,
        dedicated_host_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type dedicated-host to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/dedicated-hosts-overview.html

        :param dedicated_host_id: - Identifier for the dedicatedHostId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifAutoPlacement() - .ifAvailabilityZone() - .ifHostRecovery() - .ifInstanceType() - .ifIsLaunchTemplateResource() - .ifLaunchTemplate() - .ifQuantity() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ce0f1536ebc42286f0477a27a600b03aa17067949b5ef46e26682f24acaf807d)
            check_type(argname="argument dedicated_host_id", value=dedicated_host_id, expected_type=type_hints["dedicated_host_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onDedicatedHost", [dedicated_host_id, account, region, partition]))

    @jsii.member(jsii_name="onDhcpOptions")
    def on_dhcp_options(
        self,
        dhcp_options_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type dhcp-options to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/VPC_DHCP_Options.html

        :param dhcp_options_id: - Identifier for the dhcpOptionsId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifDhcpOptionsID() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dc4a713632155fabb7c2e47198278b6b1c8c3eb170d900c0137d21150dac3a28)
            check_type(argname="argument dhcp_options_id", value=dhcp_options_id, expected_type=type_hints["dhcp_options_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onDhcpOptions", [dhcp_options_id, account, region, partition]))

    @jsii.member(jsii_name="onEgressOnlyInternetGateway")
    def on_egress_only_internet_gateway(
        self,
        egress_only_internet_gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type egress-only-internet-gateway to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/egress-only-internet-gateway.html

        :param egress_only_internet_gateway_id: - Identifier for the egressOnlyInternetGatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7a18576ad1f3beeb466944b6697aa2fc7ca2e4b02ef76e17c9efc47b7bd16005)
            check_type(argname="argument egress_only_internet_gateway_id", value=egress_only_internet_gateway_id, expected_type=type_hints["egress_only_internet_gateway_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onEgressOnlyInternetGateway", [egress_only_internet_gateway_id, account, region, partition]))

    @jsii.member(jsii_name="onElasticGpu")
    def on_elastic_gpu(
        self,
        elastic_gpu_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type elastic-gpu to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/elastic-gpus.html

        :param elastic_gpu_id: - Identifier for the elasticGpuId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifElasticGpuType() - .ifIsLaunchTemplateResource() - .ifLaunchTemplate() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__92d5ec68f2b55ea3e8ca4cdc294282b08601373205e091d8a753873bab3279f7)
            check_type(argname="argument elastic_gpu_id", value=elastic_gpu_id, expected_type=type_hints["elastic_gpu_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onElasticGpu", [elastic_gpu_id, account, region, partition]))

    @jsii.member(jsii_name="onElasticInference")
    def on_elastic_inference(
        self,
        accelerator_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type elastic-inference to the statement.

        https://docs.aws.amazon.com/elastic-inference/latest/developerguide/what-is-ei.html

        :param accelerator_id: - Identifier for the acceleratorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8e5615b69181db7cb1f79c59071c11d06d2312c77f953c0e779b661f785f9313)
            check_type(argname="argument accelerator_id", value=accelerator_id, expected_type=type_hints["accelerator_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onElasticInference", [accelerator_id, account, region, partition]))

    @jsii.member(jsii_name="onElasticIp")
    def on_elastic_ip(
        self,
        allocation_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type elastic-ip to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html

        :param allocation_id: - Identifier for the allocationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAllocationId() - .ifAttribute() - .ifAttribute() - .ifDomain() - .ifPublicIpAddress() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__30277130d8a6362872ddf625ae814b26f4290a62e3397bda9c5243baaa3eb302)
            check_type(argname="argument allocation_id", value=allocation_id, expected_type=type_hints["allocation_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onElasticIp", [allocation_id, account, region, partition]))

    @jsii.member(jsii_name="onExportImageTask")
    def on_export_image_task(
        self,
        export_image_task_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type export-image-task to the statement.

        https://docs.aws.amazon.com/vm-import/latest/userguide/vmimport-image-import.html#export-vm-image

        :param export_image_task_id: - Identifier for the exportImageTaskId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dfd4445bde43e077e2aeecc55f72dc6b5de874f08e210f3be258f4d199fc23fa)
            check_type(argname="argument export_image_task_id", value=export_image_task_id, expected_type=type_hints["export_image_task_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onExportImageTask", [export_image_task_id, account, region, partition]))

    @jsii.member(jsii_name="onExportInstanceTask")
    def on_export_instance_task(
        self,
        export_task_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type export-instance-task to the statement.

        https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html

        :param export_task_id: - Identifier for the exportTaskId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b9c1c979966c26ae42da14cb81c79cc76487554135939008d3f0636e295b99a7)
            check_type(argname="argument export_task_id", value=export_task_id, expected_type=type_hints["export_task_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onExportInstanceTask", [export_task_id, account, region, partition]))

    @jsii.member(jsii_name="onFleet")
    def on_fleet(
        self,
        fleet_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type fleet to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-fleet.html

        :param fleet_id: - Identifier for the fleetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0a7f4402d4cfbfa6699473e393d6a533664e6b1cb0986d26d6cb5d1385577a6d)
            check_type(argname="argument fleet_id", value=fleet_id, expected_type=type_hints["fleet_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onFleet", [fleet_id, account, region, partition]))

    @jsii.member(jsii_name="onFpgaImage")
    def on_fpga_image(
        self,
        fpga_image_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type fpga-image to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param fpga_image_id: - Identifier for the fpgaImageId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifOwner() - .ifPublic() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6942a4a688459eddf4526b7422f232c3253ee7d7e110281bdc30b4932b9404f6)
            check_type(argname="argument fpga_image_id", value=fpga_image_id, expected_type=type_hints["fpga_image_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onFpgaImage", [fpga_image_id, account, region, partition]))

    @jsii.member(jsii_name="onGroup")
    def on_group(
        self,
        group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type group to the statement.

        https://docs.aws.amazon.com/ARG/latest/userguide/resource-groups.html

        :param group_name: - Identifier for the groupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4583f995412cc0be8cb66e5fce824231971009a573c65a43367844378c415409)
            check_type(argname="argument group_name", value=group_name, expected_type=type_hints["group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onGroup", [group_name, account, region, partition]))

    @jsii.member(jsii_name="onHostReservation")
    def on_host_reservation(
        self,
        host_reservation_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type host-reservation to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param host_reservation_id: - Identifier for the hostReservationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8e29ebe10d1beb485973b4d199175a8e653978109a5ae97e55ad91010810634b)
            check_type(argname="argument host_reservation_id", value=host_reservation_id, expected_type=type_hints["host_reservation_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onHostReservation", [host_reservation_id, account, region, partition]))

    @jsii.member(jsii_name="onImage")
    def on_image(
        self,
        image_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type image to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html

        :param image_id: - Identifier for the imageId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifImageID() - .ifImageType() - .ifIsLaunchTemplateResource() - .ifLaunchTemplate() - .ifOwner() - .ifPublic() - .ifRegion() - .ifResourceTag() - .ifRootDeviceType()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__846340e54d658d7190a4ff648eeaa891500fdc0d7efd04015bb8a8af634b8b11)
            check_type(argname="argument image_id", value=image_id, expected_type=type_hints["image_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onImage", [image_id, region, partition]))

    @jsii.member(jsii_name="onImportImageTask")
    def on_import_image_task(
        self,
        import_image_task_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type import-image-task to the statement.

        https://docs.aws.amazon.com/vm-import/latest/userguide/vmimport-image-import.html#import-vm-image

        :param import_image_task_id: - Identifier for the importImageTaskId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__05dff41b44644dabc90cb09b3ffcac81de3ce15aeab40f3b54cdcb4133ce7600)
            check_type(argname="argument import_image_task_id", value=import_image_task_id, expected_type=type_hints["import_image_task_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onImportImageTask", [import_image_task_id, account, region, partition]))

    @jsii.member(jsii_name="onImportSnapshotTask")
    def on_import_snapshot_task(
        self,
        import_snapshot_task_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type import-snapshot-task to the statement.

        https://docs.aws.amazon.com/vm-import/latest/userguide/vmimport-import-snapshot.html

        :param import_snapshot_task_id: - Identifier for the importSnapshotTaskId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6a56551eadf133085111101d9948ab61b8c8a507864d35306caa9805cda499c0)
            check_type(argname="argument import_snapshot_task_id", value=import_snapshot_task_id, expected_type=type_hints["import_snapshot_task_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onImportSnapshotTask", [import_snapshot_task_id, account, region, partition]))

    @jsii.member(jsii_name="onInstance")
    def on_instance(
        self,
        instance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type instance to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Instances.html

        :param instance_id: - Identifier for the instanceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifAvailabilityZone() - .ifEbsOptimized() - .ifInstanceAutoRecovery() - .ifInstanceID() - .ifInstanceMarketType() - .ifInstanceMetadataTags() - .ifInstanceProfile() - .ifInstanceType() - .ifIsLaunchTemplateResource() - .ifLaunchTemplate() - .ifMetadataHttpEndpoint() - .ifMetadataHttpPutResponseHopLimit() - .ifMetadataHttpTokens() - .ifNewInstanceProfile() - .ifPlacementGroup() - .ifProductCode() - .ifRegion() - .ifResourceTag() - .ifRootDeviceType() - .ifTenancy()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__155ba578f275e49c728c28ecb629609468cf08f8fe48e7777be460e0f7ccb7da)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onInstance", [instance_id, account, region, partition]))

    @jsii.member(jsii_name="onInstanceEventWindow")
    def on_instance_event_window(
        self,
        instance_event_window_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type instance-event-window to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param instance_event_window_id: - Identifier for the instanceEventWindowId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bf66bebacba7b9001bf53d209820c0027cc901131863032b60112a43511c16b7)
            check_type(argname="argument instance_event_window_id", value=instance_event_window_id, expected_type=type_hints["instance_event_window_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onInstanceEventWindow", [instance_event_window_id, account, region, partition]))

    @jsii.member(jsii_name="onInternetGateway")
    def on_internet_gateway(
        self,
        internet_gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type internet-gateway to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html

        :param internet_gateway_id: - Identifier for the internetGatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifInternetGatewayID() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eab662207a5d44e2b2ee50ae76f785ceacad783a2b00aa5364b8fb556213a01f)
            check_type(argname="argument internet_gateway_id", value=internet_gateway_id, expected_type=type_hints["internet_gateway_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onInternetGateway", [internet_gateway_id, account, region, partition]))

    @jsii.member(jsii_name="onIpam")
    def on_ipam(
        self,
        ipam_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type ipam to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param ipam_id: - Identifier for the ipamId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__20521ffacbe8d8c6c911bf004d6e6e7ea826e5ade091f546769b914ebad83982)
            check_type(argname="argument ipam_id", value=ipam_id, expected_type=type_hints["ipam_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onIpam", [ipam_id, account, partition]))

    @jsii.member(jsii_name="onIpamPool")
    def on_ipam_pool(
        self,
        ipam_pool_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type ipam-pool to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param ipam_pool_id: - Identifier for the ipamPoolId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ff6b9be5b3a16b8e439304b779e14baa8acb1bac24c161a472a7a9c9d4ef76cb)
            check_type(argname="argument ipam_pool_id", value=ipam_pool_id, expected_type=type_hints["ipam_pool_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onIpamPool", [ipam_pool_id, account, partition]))

    @jsii.member(jsii_name="onIpamResourceDiscovery")
    def on_ipam_resource_discovery(
        self,
        ipam_resource_discovery_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type ipam-resource-discovery to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param ipam_resource_discovery_id: - Identifier for the ipamResourceDiscoveryId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e684f5b9ab22caaec053019dc9e1b46d239daf09d8f10ae8283c900daef2f290)
            check_type(argname="argument ipam_resource_discovery_id", value=ipam_resource_discovery_id, expected_type=type_hints["ipam_resource_discovery_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onIpamResourceDiscovery", [ipam_resource_discovery_id, account, partition]))

    @jsii.member(jsii_name="onIpamResourceDiscoveryAssociation")
    def on_ipam_resource_discovery_association(
        self,
        ipam_resource_discovery_association_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type ipam-resource-discovery-association to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param ipam_resource_discovery_association_id: - Identifier for the ipamResourceDiscoveryAssociationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8e5740cfff9d4d41c0de5ff7a3fc262030ecac10f82fad0a64e359050f5e77c9)
            check_type(argname="argument ipam_resource_discovery_association_id", value=ipam_resource_discovery_association_id, expected_type=type_hints["ipam_resource_discovery_association_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onIpamResourceDiscoveryAssociation", [ipam_resource_discovery_association_id, account, partition]))

    @jsii.member(jsii_name="onIpamScope")
    def on_ipam_scope(
        self,
        ipam_scope_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type ipam-scope to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param ipam_scope_id: - Identifier for the ipamScopeId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f8ce1c82977366a34b4c12470f59c8ee67cd93c36e33f3c44da6736827ab8de8)
            check_type(argname="argument ipam_scope_id", value=ipam_scope_id, expected_type=type_hints["ipam_scope_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onIpamScope", [ipam_scope_id, account, partition]))

    @jsii.member(jsii_name="onIpv4poolEc2")
    def on_ipv4pool_ec2(
        self,
        ipv4_pool_ec2_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type ipv4pool-ec2 to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#ip-addressing-eips

        :param ipv4_pool_ec2_id: - Identifier for the ipv4PoolEc2Id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e593933736aeaf8b360fc3457ab3c8c14db1bf6e5e3323359edfbd77f7aec2f7)
            check_type(argname="argument ipv4_pool_ec2_id", value=ipv4_pool_ec2_id, expected_type=type_hints["ipv4_pool_ec2_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onIpv4poolEc2", [ipv4_pool_ec2_id, account, region, partition]))

    @jsii.member(jsii_name="onIpv6poolEc2")
    def on_ipv6pool_ec2(
        self,
        ipv6_pool_ec2_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type ipv6pool-ec2 to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#ipv6-addressing

        :param ipv6_pool_ec2_id: - Identifier for the ipv6PoolEc2Id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b9827d83845d0116249dfbc93ab40b0d99d8e9ae1d2fd31599616eec84a8f180)
            check_type(argname="argument ipv6_pool_ec2_id", value=ipv6_pool_ec2_id, expected_type=type_hints["ipv6_pool_ec2_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onIpv6poolEc2", [ipv6_pool_ec2_id, account, region, partition]))

    @jsii.member(jsii_name="onKeyPair")
    def on_key_pair(
        self,
        key_pair_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type key-pair to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html

        :param key_pair_name: - Identifier for the keyPairName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifIsLaunchTemplateResource() - .ifKeyPairName() - .ifKeyPairType() - .ifLaunchTemplate() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__139b493644862a63a48bcc05b5536dedbc427c56a716136450d682c66c91a0d1)
            check_type(argname="argument key_pair_name", value=key_pair_name, expected_type=type_hints["key_pair_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onKeyPair", [key_pair_name, account, region, partition]))

    @jsii.member(jsii_name="onLaunchTemplate")
    def on_launch_template(
        self,
        launch_template_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type launch-template to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-launch-templates.html

        :param launch_template_id: - Identifier for the launchTemplateId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifIsLaunchTemplateResource() - .ifLaunchTemplate() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__39234178c162fb2a147e12f97838ef01a96da6640d6391ec64fa18fd0e5782cd)
            check_type(argname="argument launch_template_id", value=launch_template_id, expected_type=type_hints["launch_template_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onLaunchTemplate", [launch_template_id, account, region, partition]))

    @jsii.member(jsii_name="onLicenseConfiguration")
    def on_license_configuration(
        self,
        license_configuration_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type license-configuration to the statement.

        https://docs.aws.amazon.com/license-manager/latest/userguide/create-license-configuration.html

        :param license_configuration_id: - Identifier for the licenseConfigurationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bbae18392b4dcacec0cb0d12e8a098ee0410f378cf79b0c0b6eaf62a05e8a595)
            check_type(argname="argument license_configuration_id", value=license_configuration_id, expected_type=type_hints["license_configuration_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onLicenseConfiguration", [license_configuration_id, account, region, partition]))

    @jsii.member(jsii_name="onLocalGateway")
    def on_local_gateway(
        self,
        local_gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type local-gateway to the statement.

        https://docs.aws.amazon.com/outposts/latest/userguide/outposts-local-gateways.html#lgw

        :param local_gateway_id: - Identifier for the localGatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__216ab8a863908f4ba88705f9614569ae9cf103fc3542db03ff8ec5bfb388e53b)
            check_type(argname="argument local_gateway_id", value=local_gateway_id, expected_type=type_hints["local_gateway_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onLocalGateway", [local_gateway_id, account, region, partition]))

    @jsii.member(jsii_name="onLocalGatewayRouteTable")
    def on_local_gateway_route_table(
        self,
        local_gateway_routetable_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type local-gateway-route-table to the statement.

        https://docs.aws.amazon.com/outposts/latest/userguide/outposts-local-gateways.html#route-tables

        :param local_gateway_routetable_id: - Identifier for the localGatewayRoutetableId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1237b5134a519dbbd265c8a555c13370ea10c33c130f0633f2aa063dc957ea9b)
            check_type(argname="argument local_gateway_routetable_id", value=local_gateway_routetable_id, expected_type=type_hints["local_gateway_routetable_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onLocalGatewayRouteTable", [local_gateway_routetable_id, account, region, partition]))

    @jsii.member(jsii_name="onLocalGatewayRouteTableVirtualInterfaceGroupAssociation")
    def on_local_gateway_route_table_virtual_interface_group_association(
        self,
        local_gateway_route_table_virtual_interface_group_association_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type local-gateway-route-table-virtual-interface-group-association to the statement.

        https://docs.aws.amazon.com/outposts/latest/userguide/outposts-local-gateways.html

        :param local_gateway_route_table_virtual_interface_group_association_id: - Identifier for the localGatewayRouteTableVirtualInterfaceGroupAssociationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ee533ec719b5b5bbafa68172181a0cda7a12053b081d6c0c07844eafbb31f0b4)
            check_type(argname="argument local_gateway_route_table_virtual_interface_group_association_id", value=local_gateway_route_table_virtual_interface_group_association_id, expected_type=type_hints["local_gateway_route_table_virtual_interface_group_association_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onLocalGatewayRouteTableVirtualInterfaceGroupAssociation", [local_gateway_route_table_virtual_interface_group_association_id, account, region, partition]))

    @jsii.member(jsii_name="onLocalGatewayRouteTableVpcAssociation")
    def on_local_gateway_route_table_vpc_association(
        self,
        local_gateway_route_table_vpc_association_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type local-gateway-route-table-vpc-association to the statement.

        https://docs.aws.amazon.com/outposts/latest/userguide/outposts-local-gateways.html#vpc-associations

        :param local_gateway_route_table_vpc_association_id: - Identifier for the localGatewayRouteTableVpcAssociationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5ac53d99c8677d900702d88dbe29d2dd9d64147307cb0a0996cb7348e09dd322)
            check_type(argname="argument local_gateway_route_table_vpc_association_id", value=local_gateway_route_table_vpc_association_id, expected_type=type_hints["local_gateway_route_table_vpc_association_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onLocalGatewayRouteTableVpcAssociation", [local_gateway_route_table_vpc_association_id, account, region, partition]))

    @jsii.member(jsii_name="onLocalGatewayVirtualInterface")
    def on_local_gateway_virtual_interface(
        self,
        local_gateway_virtual_interface_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type local-gateway-virtual-interface to the statement.

        https://docs.aws.amazon.com/outposts/latest/userguide/outposts-local-gateways.html

        :param local_gateway_virtual_interface_id: - Identifier for the localGatewayVirtualInterfaceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__674380f5c84e241c9c4aeaab91816e9474d26ab90f6fb69c8bf80dd04b09429f)
            check_type(argname="argument local_gateway_virtual_interface_id", value=local_gateway_virtual_interface_id, expected_type=type_hints["local_gateway_virtual_interface_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onLocalGatewayVirtualInterface", [local_gateway_virtual_interface_id, account, region, partition]))

    @jsii.member(jsii_name="onLocalGatewayVirtualInterfaceGroup")
    def on_local_gateway_virtual_interface_group(
        self,
        local_gateway_virtual_interface_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type local-gateway-virtual-interface-group to the statement.

        https://docs.aws.amazon.com/outposts/latest/userguide/outposts-local-gateways.html

        :param local_gateway_virtual_interface_group_id: - Identifier for the localGatewayVirtualInterfaceGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1a9763373b25e56ae9d9fcdda672360c0b4cb85168a85f7c518b5207eb17485b)
            check_type(argname="argument local_gateway_virtual_interface_group_id", value=local_gateway_virtual_interface_group_id, expected_type=type_hints["local_gateway_virtual_interface_group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onLocalGatewayVirtualInterfaceGroup", [local_gateway_virtual_interface_group_id, account, region, partition]))

    @jsii.member(jsii_name="onNatgateway")
    def on_natgateway(
        self,
        nat_gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type natgateway to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html

        :param nat_gateway_id: - Identifier for the natGatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fb841dd6e5e94efa67c638f906e56ff4bed4a7cc4a9b5bc4d7dd9dcc3886fe00)
            check_type(argname="argument nat_gateway_id", value=nat_gateway_id, expected_type=type_hints["nat_gateway_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onNatgateway", [nat_gateway_id, account, region, partition]))

    @jsii.member(jsii_name="onNetworkAcl")
    def on_network_acl(
        self,
        nacl_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type network-acl to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html

        :param nacl_id: - Identifier for the naclId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifNetworkAclID() - .ifRegion() - .ifResourceTag() - .ifVpc()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4fac62f149c4e5cdc584e6a7801e90e64019b2ea68392641749c1a5763302690)
            check_type(argname="argument nacl_id", value=nacl_id, expected_type=type_hints["nacl_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onNetworkAcl", [nacl_id, account, region, partition]))

    @jsii.member(jsii_name="onNetworkInsightsAccessScope")
    def on_network_insights_access_scope(
        self,
        network_insights_access_scope_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type network-insights-access-scope to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param network_insights_access_scope_id: - Identifier for the networkInsightsAccessScopeId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ab52065e614fe7d13f4a993dad0e356fb8b1a4d3dc32406cc51f6f3ebcbe6555)
            check_type(argname="argument network_insights_access_scope_id", value=network_insights_access_scope_id, expected_type=type_hints["network_insights_access_scope_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onNetworkInsightsAccessScope", [network_insights_access_scope_id, account, region, partition]))

    @jsii.member(jsii_name="onNetworkInsightsAccessScopeAnalysis")
    def on_network_insights_access_scope_analysis(
        self,
        network_insights_access_scope_analysis_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type network-insights-access-scope-analysis to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param network_insights_access_scope_analysis_id: - Identifier for the networkInsightsAccessScopeAnalysisId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bd60747a1fc7a82b5f09f2acc39e06d6744f547e51ec81269aee2467d6281322)
            check_type(argname="argument network_insights_access_scope_analysis_id", value=network_insights_access_scope_analysis_id, expected_type=type_hints["network_insights_access_scope_analysis_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onNetworkInsightsAccessScopeAnalysis", [network_insights_access_scope_analysis_id, account, region, partition]))

    @jsii.member(jsii_name="onNetworkInsightsAnalysis")
    def on_network_insights_analysis(
        self,
        network_insights_analysis_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type network-insights-analysis to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param network_insights_analysis_id: - Identifier for the networkInsightsAnalysisId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__80db809cd18668d52c74afb8e764b10bf64d224ef2a05cd1b4782d9ea38995ae)
            check_type(argname="argument network_insights_analysis_id", value=network_insights_analysis_id, expected_type=type_hints["network_insights_analysis_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onNetworkInsightsAnalysis", [network_insights_analysis_id, account, region, partition]))

    @jsii.member(jsii_name="onNetworkInsightsPath")
    def on_network_insights_path(
        self,
        network_insights_path_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type network-insights-path to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param network_insights_path_id: - Identifier for the networkInsightsPathId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__167d6eb403e18c28fdb50b642e4f0db9c8549df4d408f2d1ac8d46320dc3c9a9)
            check_type(argname="argument network_insights_path_id", value=network_insights_path_id, expected_type=type_hints["network_insights_path_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onNetworkInsightsPath", [network_insights_path_id, account, region, partition]))

    @jsii.member(jsii_name="onNetworkInterface")
    def on_network_interface(
        self,
        network_interface_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type network-interface to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html

        :param network_interface_id: - Identifier for the networkInterfaceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAssociatePublicIpAddress() - .ifAttribute() - .ifAttribute() - .ifAuthorizedService() - .ifAuthorizedUser() - .ifAvailabilityZone() - .ifIsLaunchTemplateResource() - .ifLaunchTemplate() - .ifNetworkInterfaceID() - .ifPermission() - .ifRegion() - .ifResourceTag() - .ifSubnet() - .ifVpc()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0abc842d073a818566d39d338363d06c972e35f07fbe1a06fca75918f43bf301)
            check_type(argname="argument network_interface_id", value=network_interface_id, expected_type=type_hints["network_interface_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onNetworkInterface", [network_interface_id, account, region, partition]))

    @jsii.member(jsii_name="onPlacementGroup")
    def on_placement_group(
        self,
        placement_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type placement-group to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/placement-groups.html

        :param placement_group_name: - Identifier for the placementGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifIsLaunchTemplateResource() - .ifLaunchTemplate() - .ifPlacementGroupName() - .ifPlacementGroupStrategy() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__43a90f18262d6521b855e972936da0b630595a6dd5a8536fa8a3ce1d4b0ee078)
            check_type(argname="argument placement_group_name", value=placement_group_name, expected_type=type_hints["placement_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onPlacementGroup", [placement_group_name, account, region, partition]))

    @jsii.member(jsii_name="onPrefixList")
    def on_prefix_list(
        self,
        prefix_list_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type prefix-list to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/managed-prefix-lists.html

        :param prefix_list_id: - Identifier for the prefixListId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fe9295e492149c61b105960627b069dfb88b486a2db200d817205ff2beaa15db)
            check_type(argname="argument prefix_list_id", value=prefix_list_id, expected_type=type_hints["prefix_list_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onPrefixList", [prefix_list_id, account, region, partition]))

    @jsii.member(jsii_name="onReplaceRootVolumeTask")
    def on_replace_root_volume_task(
        self,
        replace_root_volume_task_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type replace-root-volume-task to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/replace-root.html

        :param replace_root_volume_task_id: - Identifier for the replaceRootVolumeTaskId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__51e54cca3083b01983998e828602367255aa01598e200e314428d4730537c8fc)
            check_type(argname="argument replace_root_volume_task_id", value=replace_root_volume_task_id, expected_type=type_hints["replace_root_volume_task_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onReplaceRootVolumeTask", [replace_root_volume_task_id, account, region, partition]))

    @jsii.member(jsii_name="onReservedInstances")
    def on_reserved_instances(
        self,
        reservation_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type reserved-instances to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-reserved-instances.html

        :param reservation_id: - Identifier for the reservationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifAvailabilityZone() - .ifInstanceType() - .ifRegion() - .ifReservedInstancesOfferingType() - .ifResourceTag() - .ifTenancy()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a71085ed0c68e554124fab98f810ce589a59194b414111a26f60d90ea35e0e46)
            check_type(argname="argument reservation_id", value=reservation_id, expected_type=type_hints["reservation_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onReservedInstances", [reservation_id, account, region, partition]))

    @jsii.member(jsii_name="onRole")
    def on_role(
        self,
        role_name_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type role to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html

        :param role_name_with_path: - Identifier for the roleNameWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8ecd5790ece1906c6076daae786421471c9e33a438c8443c17c2777a85498068)
            check_type(argname="argument role_name_with_path", value=role_name_with_path, expected_type=type_hints["role_name_with_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onRole", [role_name_with_path, account, partition]))

    @jsii.member(jsii_name="onRouteTable")
    def on_route_table(
        self,
        route_table_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type route-table to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html

        :param route_table_id: - Identifier for the routeTableId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag() - .ifRouteTableID() - .ifVpc()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b06b7217f2686850f66e5806947c345cde9e6efa225bb9293bdbec2d9ad69254)
            check_type(argname="argument route_table_id", value=route_table_id, expected_type=type_hints["route_table_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onRouteTable", [route_table_id, account, region, partition]))

    @jsii.member(jsii_name="onSecurityGroup")
    def on_security_group(
        self,
        security_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type security-group to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html

        :param security_group_id: - Identifier for the securityGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifIsLaunchTemplateResource() - .ifLaunchTemplate() - .ifRegion() - .ifResourceTag() - .ifSecurityGroupID() - .ifVpc()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__faff0b60832790af808f66c088b6fad045d9bc23530ac1e0a2cd643a9a4251e8)
            check_type(argname="argument security_group_id", value=security_group_id, expected_type=type_hints["security_group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onSecurityGroup", [security_group_id, account, region, partition]))

    @jsii.member(jsii_name="onSecurityGroupRule")
    def on_security_group_rule(
        self,
        security_group_rule_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type security-group-rule to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param security_group_rule_id: - Identifier for the securityGroupRuleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9eadfb413c3d00f76cea99159de933532f1dc87e4733f55ec73343cfd6e5317e)
            check_type(argname="argument security_group_rule_id", value=security_group_rule_id, expected_type=type_hints["security_group_rule_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onSecurityGroupRule", [security_group_rule_id, account, region, partition]))

    @jsii.member(jsii_name="onSnapshot")
    def on_snapshot(
        self,
        snapshot_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type snapshot to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSSnapshots.html

        :param snapshot_id: - Identifier for the snapshotId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAddGroup() - .ifAddUserId() - .ifAttribute() - .ifAttribute() - .ifAvailabilityZone() - .ifEncrypted() - .ifIsLaunchTemplateResource() - .ifLaunchTemplate() - .ifOutpostArn() - .ifOwner() - .ifParentVolume() - .ifRegion() - .ifRemoveGroup() - .ifRemoveUserId() - .ifResourceTag() - .ifSnapshotID() - .ifSnapshotTime() - .ifSourceOutpostArn() - .ifVolumeSize()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f14e451dd80f618c3faa11528f213b0913602d806c47083a1fc79af554ce4ec5)
            check_type(argname="argument snapshot_id", value=snapshot_id, expected_type=type_hints["snapshot_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onSnapshot", [snapshot_id, region, partition]))

    @jsii.member(jsii_name="onSpotFleetRequest")
    def on_spot_fleet_request(
        self,
        spot_fleet_request_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type spot-fleet-request to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param spot_fleet_request_id: - Identifier for the spotFleetRequestId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dae70ec2c98a7c1449d42e1ac33a29aedcc5144fbd811744d5c97b90eea1f55a)
            check_type(argname="argument spot_fleet_request_id", value=spot_fleet_request_id, expected_type=type_hints["spot_fleet_request_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onSpotFleetRequest", [spot_fleet_request_id, account, region, partition]))

    @jsii.member(jsii_name="onSpotInstancesRequest")
    def on_spot_instances_request(
        self,
        spot_instance_request_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type spot-instances-request to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-spot-instances.html

        :param spot_instance_request_id: - Identifier for the spotInstanceRequestId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b4221864c532e0ff2f008bd7acf9a8b0ec1cff222863075dc18e0321d3ffac41)
            check_type(argname="argument spot_instance_request_id", value=spot_instance_request_id, expected_type=type_hints["spot_instance_request_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onSpotInstancesRequest", [spot_instance_request_id, account, region, partition]))

    @jsii.member(jsii_name="onSubnet")
    def on_subnet(
        self,
        subnet_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type subnet to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html

        :param subnet_id: - Identifier for the subnetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifAvailabilityZone() - .ifIsLaunchTemplateResource() - .ifLaunchTemplate() - .ifRegion() - .ifResourceTag() - .ifSubnetID() - .ifVpc()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__feaefd785194b53166d438c9c563c069178969e1a207b8a6b159a69397aeb462)
            check_type(argname="argument subnet_id", value=subnet_id, expected_type=type_hints["subnet_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onSubnet", [subnet_id, account, region, partition]))

    @jsii.member(jsii_name="onSubnetCidrReservation")
    def on_subnet_cidr_reservation(
        self,
        subnet_cidr_reservation_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type subnet-cidr-reservation to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/subnet-cidr-reservation.html

        :param subnet_cidr_reservation_id: - Identifier for the subnetCidrReservationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5827f664fb30515f5c15b0e2ca45a3c6f51c729ff9bef9b4e9cb45c816d770f5)
            check_type(argname="argument subnet_cidr_reservation_id", value=subnet_cidr_reservation_id, expected_type=type_hints["subnet_cidr_reservation_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onSubnetCidrReservation", [subnet_cidr_reservation_id, account, region, partition]))

    @jsii.member(jsii_name="onTrafficMirrorFilter")
    def on_traffic_mirror_filter(
        self,
        traffic_mirror_filter_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type traffic-mirror-filter to the statement.

        https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-filter.html

        :param traffic_mirror_filter_id: - Identifier for the trafficMirrorFilterId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__54ed3cc6283a2ff20e86628ccd18327af2acad6a03bf9c1d7a06cc6a584bbde7)
            check_type(argname="argument traffic_mirror_filter_id", value=traffic_mirror_filter_id, expected_type=type_hints["traffic_mirror_filter_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onTrafficMirrorFilter", [traffic_mirror_filter_id, account, region, partition]))

    @jsii.member(jsii_name="onTrafficMirrorFilterRule")
    def on_traffic_mirror_filter_rule(
        self,
        traffic_mirror_filter_rule_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type traffic-mirror-filter-rule to the statement.

        https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-filter.html

        :param traffic_mirror_filter_rule_id: - Identifier for the trafficMirrorFilterRuleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAttribute() - .ifAttribute() - .ifRegion()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2e658428cb21c16c93fe42b3fdc30d4d6c5d73f69220978488a20314c32b91dd)
            check_type(argname="argument traffic_mirror_filter_rule_id", value=traffic_mirror_filter_rule_id, expected_type=type_hints["traffic_mirror_filter_rule_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onTrafficMirrorFilterRule", [traffic_mirror_filter_rule_id, account, region, partition]))

    @jsii.member(jsii_name="onTrafficMirrorSession")
    def on_traffic_mirror_session(
        self,
        traffic_mirror_session_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type traffic-mirror-session to the statement.

        https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-session.html

        :param traffic_mirror_session_id: - Identifier for the trafficMirrorSessionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0317d68b66cab3dba3f3bc609f95bd12fc94740790fb79475000e5b0676b1f77)
            check_type(argname="argument traffic_mirror_session_id", value=traffic_mirror_session_id, expected_type=type_hints["traffic_mirror_session_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onTrafficMirrorSession", [traffic_mirror_session_id, account, region, partition]))

    @jsii.member(jsii_name="onTrafficMirrorTarget")
    def on_traffic_mirror_target(
        self,
        traffic_mirror_target_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type traffic-mirror-target to the statement.

        https://docs.aws.amazon.com/vpc/latest/mirroring/traffic-mirroring-target.html

        :param traffic_mirror_target_id: - Identifier for the trafficMirrorTargetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c9eb4929f52ad9072e6aff5400f0d3b5c576e999c64b1c4c8f3cdff5e28afc18)
            check_type(argname="argument traffic_mirror_target_id", value=traffic_mirror_target_id, expected_type=type_hints["traffic_mirror_target_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onTrafficMirrorTarget", [traffic_mirror_target_id, account, region, partition]))

    @jsii.member(jsii_name="onTransitGateway")
    def on_transit_gateway(
        self,
        transit_gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type transit-gateway to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/how-transit-gateways-work.html

        :param transit_gateway_id: - Identifier for the transitGatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fa3ce81e4790a3c50843e8e766aef2781cca4f20e7934049648e477865735ca2)
            check_type(argname="argument transit_gateway_id", value=transit_gateway_id, expected_type=type_hints["transit_gateway_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onTransitGateway", [transit_gateway_id, account, region, partition]))

    @jsii.member(jsii_name="onTransitGatewayAttachment")
    def on_transit_gateway_attachment(
        self,
        transit_gateway_attachment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type transit-gateway-attachment to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/how-transit-gateways-work.html

        :param transit_gateway_attachment_id: - Identifier for the transitGatewayAttachmentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__83e2d7a127c28c68c7975ba3ed983aa5ee78b097a4f38419c5eb1d3187c6e5d1)
            check_type(argname="argument transit_gateway_attachment_id", value=transit_gateway_attachment_id, expected_type=type_hints["transit_gateway_attachment_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onTransitGatewayAttachment", [transit_gateway_attachment_id, account, region, partition]))

    @jsii.member(jsii_name="onTransitGatewayConnectPeer")
    def on_transit_gateway_connect_peer(
        self,
        transit_gateway_connect_peer_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type transit-gateway-connect-peer to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param transit_gateway_connect_peer_id: - Identifier for the transitGatewayConnectPeerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bd48db95363b9da9d0bcb6d94118a99dfe745613516f80e57ddb73b85fb79710)
            check_type(argname="argument transit_gateway_connect_peer_id", value=transit_gateway_connect_peer_id, expected_type=type_hints["transit_gateway_connect_peer_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onTransitGatewayConnectPeer", [transit_gateway_connect_peer_id, account, region, partition]))

    @jsii.member(jsii_name="onTransitGatewayMulticastDomain")
    def on_transit_gateway_multicast_domain(
        self,
        transit_gateway_multicast_domain_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type transit-gateway-multicast-domain to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/tgw-multicast-overview.html

        :param transit_gateway_multicast_domain_id: - Identifier for the transitGatewayMulticastDomainId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__93c72275fb6ad81e3424941efda13489014be57436a70b6b1f49d3bb314ce2ed)
            check_type(argname="argument transit_gateway_multicast_domain_id", value=transit_gateway_multicast_domain_id, expected_type=type_hints["transit_gateway_multicast_domain_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onTransitGatewayMulticastDomain", [transit_gateway_multicast_domain_id, account, region, partition]))

    @jsii.member(jsii_name="onTransitGatewayPolicyTable")
    def on_transit_gateway_policy_table(
        self,
        transit_gateway_policy_table_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type transit-gateway-policy-table to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param transit_gateway_policy_table_id: - Identifier for the transitGatewayPolicyTableId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eca29b77fea5b244e79fc7273c572e2d6c77ac25789fc10c80e0ae010b9a1f09)
            check_type(argname="argument transit_gateway_policy_table_id", value=transit_gateway_policy_table_id, expected_type=type_hints["transit_gateway_policy_table_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onTransitGatewayPolicyTable", [transit_gateway_policy_table_id, account, region, partition]))

    @jsii.member(jsii_name="onTransitGatewayRouteTable")
    def on_transit_gateway_route_table(
        self,
        transit_gateway_route_table_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type transit-gateway-route-table to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/how-transit-gateways-work.html

        :param transit_gateway_route_table_id: - Identifier for the transitGatewayRouteTableId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c54d1068dda0f3c6e7878a5cff6d3aa2680918b7386ddb2c7680d1db6fdf5f58)
            check_type(argname="argument transit_gateway_route_table_id", value=transit_gateway_route_table_id, expected_type=type_hints["transit_gateway_route_table_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onTransitGatewayRouteTable", [transit_gateway_route_table_id, account, region, partition]))

    @jsii.member(jsii_name="onTransitGatewayRouteTableAnnouncement")
    def on_transit_gateway_route_table_announcement(
        self,
        transit_gateway_route_table_announcement_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type transit-gateway-route-table-announcement to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param transit_gateway_route_table_announcement_id: - Identifier for the transitGatewayRouteTableAnnouncementId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e79276e67f74be243f520408a7a26db3e6ee09864fdfb3957a15809311ebb3a4)
            check_type(argname="argument transit_gateway_route_table_announcement_id", value=transit_gateway_route_table_announcement_id, expected_type=type_hints["transit_gateway_route_table_announcement_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onTransitGatewayRouteTableAnnouncement", [transit_gateway_route_table_announcement_id, account, region, partition]))

    @jsii.member(jsii_name="onVerifiedAccessEndpoint")
    def on_verified_access_endpoint(
        self,
        verified_access_endpoint_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type verified-access-endpoint to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param verified_access_endpoint_id: - Identifier for the verifiedAccessEndpointId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifDomainCertificateArn() - .ifLoadBalancerArn() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9a71736479b8bf3805c8f1c9fd592b361ac7a6c2346edfb9ba82cf35ff7698bf)
            check_type(argname="argument verified_access_endpoint_id", value=verified_access_endpoint_id, expected_type=type_hints["verified_access_endpoint_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onVerifiedAccessEndpoint", [verified_access_endpoint_id, account, region, partition]))

    @jsii.member(jsii_name="onVerifiedAccessGroup")
    def on_verified_access_group(
        self,
        verified_access_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type verified-access-group to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param verified_access_group_id: - Identifier for the verifiedAccessGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f2b17f6c408268917952f00c17486cc303e50f111b7f5293fd3ca8fa4c1b38cc)
            check_type(argname="argument verified_access_group_id", value=verified_access_group_id, expected_type=type_hints["verified_access_group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onVerifiedAccessGroup", [verified_access_group_id, account, region, partition]))

    @jsii.member(jsii_name="onVerifiedAccessInstance")
    def on_verified_access_instance(
        self,
        verified_access_instance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type verified-access-instance to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param verified_access_instance_id: - Identifier for the verifiedAccessInstanceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1e1e184639034da799263432efc39a4c37afae3ced7d2c8849f0017ce14d8771)
            check_type(argname="argument verified_access_instance_id", value=verified_access_instance_id, expected_type=type_hints["verified_access_instance_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onVerifiedAccessInstance", [verified_access_instance_id, account, region, partition]))

    @jsii.member(jsii_name="onVerifiedAccessPolicy")
    def on_verified_access_policy(
        self,
        verified_access_policy_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type verified-access-policy to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param verified_access_policy_id: - Identifier for the verifiedAccessPolicyId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__64f7763fa0440a1c9f89b2cc2c12ae015f49d7db4e26b6d6e8a502ad95055075)
            check_type(argname="argument verified_access_policy_id", value=verified_access_policy_id, expected_type=type_hints["verified_access_policy_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onVerifiedAccessPolicy", [verified_access_policy_id, account, region, partition]))

    @jsii.member(jsii_name="onVerifiedAccessTrustProvider")
    def on_verified_access_trust_provider(
        self,
        verified_access_trust_provider_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type verified-access-trust-provider to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param verified_access_trust_provider_id: - Identifier for the verifiedAccessTrustProviderId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__561e5ba9aac93b5f2160c3f0fd918a1fc0925163c6d00645813cfdb35a5ab274)
            check_type(argname="argument verified_access_trust_provider_id", value=verified_access_trust_provider_id, expected_type=type_hints["verified_access_trust_provider_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onVerifiedAccessTrustProvider", [verified_access_trust_provider_id, account, region, partition]))

    @jsii.member(jsii_name="onVolume")
    def on_volume(
        self,
        volume_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type volume to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-volumes.html

        :param volume_id: - Identifier for the volumeId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifAvailabilityZone() - .ifEncrypted() - .ifIsLaunchTemplateResource() - .ifKmsKeyId() - .ifLaunchTemplate() - .ifParentSnapshot() - .ifRegion() - .ifResourceTag() - .ifVolumeID() - .ifVolumeIops() - .ifVolumeSize() - .ifVolumeThroughput() - .ifVolumeType()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__260d813613f8a2e1f53dac1a81d1c4d503de6d454233938da8bbdacc740ac860)
            check_type(argname="argument volume_id", value=volume_id, expected_type=type_hints["volume_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onVolume", [volume_id, account, region, partition]))

    @jsii.member(jsii_name="onVpc")
    def on_vpc(
        self,
        vpc_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type vpc to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html

        :param vpc_id: - Identifier for the vpcId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifIpv4IpamPoolId() - .ifIpv6IpamPoolId() - .ifRegion() - .ifResourceTag() - .ifTenancy() - .ifVpcID()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__25dd221ba3faa713e2db800c08294005de7a334063de3a8b011e3cefb51397bb)
            check_type(argname="argument vpc_id", value=vpc_id, expected_type=type_hints["vpc_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onVpc", [vpc_id, account, region, partition]))

    @jsii.member(jsii_name="onVpcEndpoint")
    def on_vpc_endpoint(
        self,
        vpc_endpoint_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type vpc-endpoint to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/endpoint-services-overview.html

        :param vpc_endpoint_id: - Identifier for the vpcEndpointId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifRegion() - .ifResourceTag() - .ifVpceServiceName() - .ifVpceServiceOwner()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__26fca99190cee2d3a8bb1921e1a9b277a0efdb66f140d0253e53a1231acd9993)
            check_type(argname="argument vpc_endpoint_id", value=vpc_endpoint_id, expected_type=type_hints["vpc_endpoint_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onVpcEndpoint", [vpc_endpoint_id, account, region, partition]))

    @jsii.member(jsii_name="onVpcEndpointConnection")
    def on_vpc_endpoint_connection(
        self,
        vpc_endpoint_connection_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type vpc-endpoint-connection to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/endpoint-services-overview.html

        :param vpc_endpoint_connection_id: - Identifier for the vpcEndpointConnectionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d57b9579d14056f4dd8999ebd120497f509e642b997cdc740fdb4e53a18bdcdf)
            check_type(argname="argument vpc_endpoint_connection_id", value=vpc_endpoint_connection_id, expected_type=type_hints["vpc_endpoint_connection_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onVpcEndpointConnection", [vpc_endpoint_connection_id, account, region, partition]))

    @jsii.member(jsii_name="onVpcEndpointService")
    def on_vpc_endpoint_service(
        self,
        vpc_endpoint_service_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type vpc-endpoint-service to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/endpoint-services-overview.html

        :param vpc_endpoint_service_id: - Identifier for the vpcEndpointServiceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifRegion() - .ifResourceTag() - .ifVpceServicePrivateDnsName()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9b7b695f5f356baf9a0aecb48e1236c31aa1d37d76f127c2a555468eee38c97c)
            check_type(argname="argument vpc_endpoint_service_id", value=vpc_endpoint_service_id, expected_type=type_hints["vpc_endpoint_service_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onVpcEndpointService", [vpc_endpoint_service_id, account, region, partition]))

    @jsii.member(jsii_name="onVpcEndpointServicePermission")
    def on_vpc_endpoint_service_permission(
        self,
        vpc_endpoint_service_permission_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type vpc-endpoint-service-permission to the statement.

        https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-access.html#vpc-endpoint-policies

        :param vpc_endpoint_service_permission_id: - Identifier for the vpcEndpointServicePermissionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ffd4a365b9cdb9f6ae08ab3d1d2fd665f30ecd4a98c028864a7aed423b2a9feb)
            check_type(argname="argument vpc_endpoint_service_permission_id", value=vpc_endpoint_service_permission_id, expected_type=type_hints["vpc_endpoint_service_permission_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onVpcEndpointServicePermission", [vpc_endpoint_service_permission_id, account, region, partition]))

    @jsii.member(jsii_name="onVpcFlowLog")
    def on_vpc_flow_log(
        self,
        vpc_flow_log_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type vpc-flow-log to the statement.

        https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html

        :param vpc_flow_log_id: - Identifier for the vpcFlowLogId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__22f2bc05196f7d23bbb9688410bc8d32be24907b6a1d541f39da500382f0f7ee)
            check_type(argname="argument vpc_flow_log_id", value=vpc_flow_log_id, expected_type=type_hints["vpc_flow_log_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onVpcFlowLog", [vpc_flow_log_id, account, region, partition]))

    @jsii.member(jsii_name="onVpcPeeringConnection")
    def on_vpc_peering_connection(
        self,
        vpc_peering_connection_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type vpc-peering-connection to the statement.

        https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html

        :param vpc_peering_connection_id: - Identifier for the vpcPeeringConnectionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAccepterVpc() - .ifAttribute() - .ifAttribute() - .ifRegion() - .ifRequesterVpc() - .ifResourceTag() - .ifVpcPeeringConnectionID()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2b170c4599bacb72ac07f2da8c111a78b83b0bfe03942acfd68fe353d884c960)
            check_type(argname="argument vpc_peering_connection_id", value=vpc_peering_connection_id, expected_type=type_hints["vpc_peering_connection_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onVpcPeeringConnection", [vpc_peering_connection_id, account, region, partition]))

    @jsii.member(jsii_name="onVpnConnection")
    def on_vpn_connection(
        self,
        vpn_connection_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type vpn-connection to the statement.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html

        :param vpn_connection_id: - Identifier for the vpnConnectionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAttribute() - .ifAttribute() - .ifAuthenticationType() - .ifDPDTimeoutSeconds() - .ifGatewayType() - .ifIKEVersions() - .ifInsideTunnelCidr() - .ifInsideTunnelIpv6Cidr() - .ifPhase1DHGroup() - .ifPhase1EncryptionAlgorithms() - .ifPhase1IntegrityAlgorithms() - .ifPhase1LifetimeSeconds() - .ifPhase2DHGroup() - .ifPhase2EncryptionAlgorithms() - .ifPhase2IntegrityAlgorithms() - .ifPhase2LifetimeSeconds() - .ifPreSharedKeys() - .ifRegion() - .ifRekeyFuzzPercentage() - .ifRekeyMarginTimeSeconds() - .ifReplayWindowSizePackets() - .ifResourceTag() - .ifRoutingType()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8161e785fb5fde354236904e8d38eda76909e219705d45cb10ebcb0b8ad31091)
            check_type(argname="argument vpn_connection_id", value=vpn_connection_id, expected_type=type_hints["vpn_connection_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onVpnConnection", [vpn_connection_id, account, region, partition]))

    @jsii.member(jsii_name="onVpnConnectionDeviceType")
    def on_vpn_connection_device_type(
        self,
        vpn_connection_device_type_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type vpn-connection-device-type to the statement.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html

        :param vpn_connection_device_type_id: - Identifier for the vpnConnectionDeviceTypeId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifRegion()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e49bbf903414fce70f0ca61dc3b94c87a56b000c4aff63e0aacde55e6cae3082)
            check_type(argname="argument vpn_connection_device_type_id", value=vpn_connection_device_type_id, expected_type=type_hints["vpn_connection_device_type_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onVpnConnectionDeviceType", [vpn_connection_device_type_id, account, region, partition]))

    @jsii.member(jsii_name="onVpnGateway")
    def on_vpn_gateway(
        self,
        vpn_gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2":
        '''(experimental) Adds a resource of type vpn-gateway to the statement.

        https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html

        :param vpn_gateway_id: - Identifier for the vpnGatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifRegion() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ff487bcdc1ce41e9740b7ec81875728fca35bb262d1656197a673f48003d6bf1)
            check_type(argname="argument vpn_gateway_id", value=vpn_gateway_id, expected_type=type_hints["vpn_gateway_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2", jsii.invoke(self, "onVpnGateway", [vpn_gateway_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptAddressTransfer")
    def to_accept_address_transfer(self) -> "Ec2":
        '''(experimental) Grants permission to accept an Elastic IP address transfer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AcceptAddressTransfer.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAcceptAddressTransfer", []))

    @jsii.member(jsii_name="toAcceptReservedInstancesExchangeQuote")
    def to_accept_reserved_instances_exchange_quote(self) -> "Ec2":
        '''(experimental) Grants permission to accept a Convertible Reserved Instance exchange quote.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AcceptReservedInstancesExchangeQuote.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAcceptReservedInstancesExchangeQuote", []))

    @jsii.member(jsii_name="toAcceptTransitGatewayMulticastDomainAssociations")
    def to_accept_transit_gateway_multicast_domain_associations(self) -> "Ec2":
        '''(experimental) Grants permission to accept a request to associate subnets with a transit gateway multicast domain.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AcceptTransitGatewayMulticastDomainAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAcceptTransitGatewayMulticastDomainAssociations", []))

    @jsii.member(jsii_name="toAcceptTransitGatewayPeeringAttachment")
    def to_accept_transit_gateway_peering_attachment(self) -> "Ec2":
        '''(experimental) Grants permission to accept a transit gateway peering attachment request.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AcceptTransitGatewayPeeringAttachment.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAcceptTransitGatewayPeeringAttachment", []))

    @jsii.member(jsii_name="toAcceptTransitGatewayVpcAttachment")
    def to_accept_transit_gateway_vpc_attachment(self) -> "Ec2":
        '''(experimental) Grants permission to accept a request to attach a VPC to a transit gateway.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AcceptTransitGatewayVpcAttachment.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAcceptTransitGatewayVpcAttachment", []))

    @jsii.member(jsii_name="toAcceptVpcEndpointConnections")
    def to_accept_vpc_endpoint_connections(self) -> "Ec2":
        '''(experimental) Grants permission to accept one or more interface VPC endpoint connections to your VPC endpoint service.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AcceptVpcEndpointConnections.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAcceptVpcEndpointConnections", []))

    @jsii.member(jsii_name="toAcceptVpcPeeringConnection")
    def to_accept_vpc_peering_connection(self) -> "Ec2":
        '''(experimental) Grants permission to accept a VPC peering connection request.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AcceptVpcPeeringConnection.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAcceptVpcPeeringConnection", []))

    @jsii.member(jsii_name="toAdvertiseByoipCidr")
    def to_advertise_byoip_cidr(self) -> "Ec2":
        '''(experimental) Grants permission to advertise an IP address range that is provisioned for use in AWS through bring your own IP addresses (BYOIP).

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AdvertiseByoipCidr.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAdvertiseByoipCidr", []))

    @jsii.member(jsii_name="toAllocateAddress")
    def to_allocate_address(self) -> "Ec2":
        '''(experimental) Grants permission to allocate an Elastic IP address (EIP) to your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AllocateAddress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAllocateAddress", []))

    @jsii.member(jsii_name="toAllocateHosts")
    def to_allocate_hosts(self) -> "Ec2":
        '''(experimental) Grants permission to allocate a Dedicated Host to your account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AllocateHosts.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAllocateHosts", []))

    @jsii.member(jsii_name="toAllocateIpamPoolCidr")
    def to_allocate_ipam_pool_cidr(self) -> "Ec2":
        '''(experimental) Grants permission to allocate a CIDR from an Amazon VPC IP Address Manager (IPAM) pool.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AllocateIpamPoolCidr.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAllocateIpamPoolCidr", []))

    @jsii.member(jsii_name="toApplySecurityGroupsToClientVpnTargetNetwork")
    def to_apply_security_groups_to_client_vpn_target_network(self) -> "Ec2":
        '''(experimental) Grants permission to apply a security group to the association between a Client VPN endpoint and a target network.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ApplySecurityGroupsToClientVpnTargetNetwork.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toApplySecurityGroupsToClientVpnTargetNetwork", []))

    @jsii.member(jsii_name="toAssignIpv6Addresses")
    def to_assign_ipv6_addresses(self) -> "Ec2":
        '''(experimental) Grants permission to assign one or more IPv6 addresses to a network interface.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssignIpv6Addresses.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssignIpv6Addresses", []))

    @jsii.member(jsii_name="toAssignPrivateIpAddresses")
    def to_assign_private_ip_addresses(self) -> "Ec2":
        '''(experimental) Grants permission to assign one or more secondary private IP addresses to a network interface.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssignPrivateIpAddresses.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssignPrivateIpAddresses", []))

    @jsii.member(jsii_name="toAssignPrivateNatGatewayAddress")
    def to_assign_private_nat_gateway_address(self) -> "Ec2":
        '''(experimental) Grants permission to assign one or more secondary private IP addresses to a private NAT gateway.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssignPrivateNatGatewayAddress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssignPrivateNatGatewayAddress", []))

    @jsii.member(jsii_name="toAssociateAddress")
    def to_associate_address(self) -> "Ec2":
        '''(experimental) Grants permission to associate an Elastic IP address (EIP) with an instance or a network interface.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateAddress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateAddress", []))

    @jsii.member(jsii_name="toAssociateClientVpnTargetNetwork")
    def to_associate_client_vpn_target_network(self) -> "Ec2":
        '''(experimental) Grants permission to associate a target network with a Client VPN endpoint.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateClientVpnTargetNetwork.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateClientVpnTargetNetwork", []))

    @jsii.member(jsii_name="toAssociateDhcpOptions")
    def to_associate_dhcp_options(self) -> "Ec2":
        '''(experimental) Grants permission to associate or disassociate a set of DHCP options with a VPC.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateDhcpOptions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateDhcpOptions", []))

    @jsii.member(jsii_name="toAssociateEnclaveCertificateIamRole")
    def to_associate_enclave_certificate_iam_role(self) -> "Ec2":
        '''(experimental) Grants permission to associate an ACM certificate with an IAM role to be used in an EC2 Enclave.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateEnclaveCertificateIamRole.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateEnclaveCertificateIamRole", []))

    @jsii.member(jsii_name="toAssociateIamInstanceProfile")
    def to_associate_iam_instance_profile(self) -> "Ec2":
        '''(experimental) Grants permission to associate an IAM instance profile with a running or stopped instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateIamInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateIamInstanceProfile", []))

    @jsii.member(jsii_name="toAssociateInstanceEventWindow")
    def to_associate_instance_event_window(self) -> "Ec2":
        '''(experimental) Grants permission to associate one or more targets with an event window.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateInstanceEventWindow.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateInstanceEventWindow", []))

    @jsii.member(jsii_name="toAssociateIpamResourceDiscovery")
    def to_associate_ipam_resource_discovery(self) -> "Ec2":
        '''(experimental) Grants permission to associate an IPAM resource discovery with an Amazon VPC IPAM.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateIpamResourceDiscovery.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateIpamResourceDiscovery", []))

    @jsii.member(jsii_name="toAssociateNatGatewayAddress")
    def to_associate_nat_gateway_address(self) -> "Ec2":
        '''(experimental) Grants permission to associate an Elastic IP address and private IP address with a public Nat gateway.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateNatGatewayAddress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateNatGatewayAddress", []))

    @jsii.member(jsii_name="toAssociateRouteTable")
    def to_associate_route_table(self) -> "Ec2":
        '''(experimental) Grants permission to associate a subnet or gateway with a route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateRouteTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateRouteTable", []))

    @jsii.member(jsii_name="toAssociateSubnetCidrBlock")
    def to_associate_subnet_cidr_block(self) -> "Ec2":
        '''(experimental) Grants permission to associate a CIDR block with a subnet.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateSubnetCidrBlock.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateSubnetCidrBlock", []))

    @jsii.member(jsii_name="toAssociateTransitGatewayMulticastDomain")
    def to_associate_transit_gateway_multicast_domain(self) -> "Ec2":
        '''(experimental) Grants permission to associate an attachment and list of subnets with a transit gateway multicast domain.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateTransitGatewayMulticastDomain.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateTransitGatewayMulticastDomain", []))

    @jsii.member(jsii_name="toAssociateTransitGatewayPolicyTable")
    def to_associate_transit_gateway_policy_table(self) -> "Ec2":
        '''(experimental) Grants permission to associate a policy table with a transit gateway attachment.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateTransitGatewayPolicyTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateTransitGatewayPolicyTable", []))

    @jsii.member(jsii_name="toAssociateTransitGatewayRouteTable")
    def to_associate_transit_gateway_route_table(self) -> "Ec2":
        '''(experimental) Grants permission to associate an attachment with a transit gateway route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateTransitGatewayRouteTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateTransitGatewayRouteTable", []))

    @jsii.member(jsii_name="toAssociateTrunkInterface")
    def to_associate_trunk_interface(self) -> "Ec2":
        '''(experimental) Grants permission to associate a branch network interface with a trunk network interface.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateTrunkInterface.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateTrunkInterface", []))

    @jsii.member(jsii_name="toAssociateVpcCidrBlock")
    def to_associate_vpc_cidr_block(self) -> "Ec2":
        '''(experimental) Grants permission to associate a CIDR block with a VPC.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateVpcCidrBlock.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAssociateVpcCidrBlock", []))

    @jsii.member(jsii_name="toAttachClassicLinkVpc")
    def to_attach_classic_link_vpc(self) -> "Ec2":
        '''(experimental) Grants permission to link an EC2-Classic instance to a ClassicLink-enabled VPC through one or more of the VPC's security groups.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AttachClassicLinkVpc.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAttachClassicLinkVpc", []))

    @jsii.member(jsii_name="toAttachInternetGateway")
    def to_attach_internet_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to attach an internet gateway to a VPC.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AttachInternetGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAttachInternetGateway", []))

    @jsii.member(jsii_name="toAttachNetworkInterface")
    def to_attach_network_interface(self) -> "Ec2":
        '''(experimental) Grants permission to attach a network interface to an instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AttachNetworkInterface.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAttachNetworkInterface", []))

    @jsii.member(jsii_name="toAttachVerifiedAccessTrustProvider")
    def to_attach_verified_access_trust_provider(self) -> "Ec2":
        '''(experimental) Grants permission to attach a trust provider to a Verified Access instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AttachVerifiedAccessTrustProvider.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAttachVerifiedAccessTrustProvider", []))

    @jsii.member(jsii_name="toAttachVolume")
    def to_attach_volume(self) -> "Ec2":
        '''(experimental) Grants permission to attach an EBS volume to a running or stopped instance and expose it to the instance with the specified device name.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AttachVolume.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAttachVolume", []))

    @jsii.member(jsii_name="toAttachVpnGateway")
    def to_attach_vpn_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to attach a virtual private gateway to a VPC.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AttachVpnGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAttachVpnGateway", []))

    @jsii.member(jsii_name="toAuthorizeClientVpnIngress")
    def to_authorize_client_vpn_ingress(self) -> "Ec2":
        '''(experimental) Grants permission to add an inbound authorization rule to a Client VPN endpoint.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeClientVpnIngress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAuthorizeClientVpnIngress", []))

    @jsii.member(jsii_name="toAuthorizeSecurityGroupEgress")
    def to_authorize_security_group_egress(self) -> "Ec2":
        '''(experimental) Grants permission to add one or more outbound rules to a VPC security group.

        Policies using the security-group-rule resource-level permission are only enforced when the API request includes TagSpecifications

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeSecurityGroupEgress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAuthorizeSecurityGroupEgress", []))

    @jsii.member(jsii_name="toAuthorizeSecurityGroupIngress")
    def to_authorize_security_group_ingress(self) -> "Ec2":
        '''(experimental) Grants permission to add one or more inbound rules to a VPC security group.

        Policies using the security-group-rule resource-level permission are only enforced when the API request includes TagSpecifications

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeSecurityGroupIngress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toAuthorizeSecurityGroupIngress", []))

    @jsii.member(jsii_name="toBundleInstance")
    def to_bundle_instance(self) -> "Ec2":
        '''(experimental) Grants permission to bundle an instance store-backed Windows instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_BundleInstance.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toBundleInstance", []))

    @jsii.member(jsii_name="toCancelBundleTask")
    def to_cancel_bundle_task(self) -> "Ec2":
        '''(experimental) Grants permission to cancel a bundling operation.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelBundleTask.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCancelBundleTask", []))

    @jsii.member(jsii_name="toCancelCapacityReservation")
    def to_cancel_capacity_reservation(self) -> "Ec2":
        '''(experimental) Grants permission to cancel a Capacity Reservation and release the reserved capacity.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelCapacityReservation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCancelCapacityReservation", []))

    @jsii.member(jsii_name="toCancelCapacityReservationFleets")
    def to_cancel_capacity_reservation_fleets(self) -> "Ec2":
        '''(experimental) Grants permission to cancel one or more Capacity Reservation Fleets.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelCapacityReservationFleets.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCancelCapacityReservationFleets", []))

    @jsii.member(jsii_name="toCancelConversionTask")
    def to_cancel_conversion_task(self) -> "Ec2":
        '''(experimental) Grants permission to cancel an active conversion task.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelConversionTask.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCancelConversionTask", []))

    @jsii.member(jsii_name="toCancelExportTask")
    def to_cancel_export_task(self) -> "Ec2":
        '''(experimental) Grants permission to cancel an active export task.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelExportTask.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCancelExportTask", []))

    @jsii.member(jsii_name="toCancelImageLaunchPermission")
    def to_cancel_image_launch_permission(self) -> "Ec2":
        '''(experimental) Grants permission to remove your AWS account from the launch permissions for the specified AMI.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelImageLaunchPermission.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCancelImageLaunchPermission", []))

    @jsii.member(jsii_name="toCancelImportTask")
    def to_cancel_import_task(self) -> "Ec2":
        '''(experimental) Grants permission to cancel an in-process import virtual machine or import snapshot task.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelImportTask.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCancelImportTask", []))

    @jsii.member(jsii_name="toCancelReservedInstancesListing")
    def to_cancel_reserved_instances_listing(self) -> "Ec2":
        '''(experimental) Grants permission to cancel a Reserved Instance listing on the Reserved Instance Marketplace.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelReservedInstancesListing.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCancelReservedInstancesListing", []))

    @jsii.member(jsii_name="toCancelSpotFleetRequests")
    def to_cancel_spot_fleet_requests(self) -> "Ec2":
        '''(experimental) Grants permission to cancel one or more Spot Fleet requests.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelSpotFleetRequests.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCancelSpotFleetRequests", []))

    @jsii.member(jsii_name="toCancelSpotInstanceRequests")
    def to_cancel_spot_instance_requests(self) -> "Ec2":
        '''(experimental) Grants permission to cancel one or more Spot Instance requests.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CancelSpotInstanceRequests.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCancelSpotInstanceRequests", []))

    @jsii.member(jsii_name="toConfirmProductInstance")
    def to_confirm_product_instance(self) -> "Ec2":
        '''(experimental) Grants permission to determine whether an owned product code is associated with an instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ConfirmProductInstance.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toConfirmProductInstance", []))

    @jsii.member(jsii_name="toCopyFpgaImage")
    def to_copy_fpga_image(self) -> "Ec2":
        '''(experimental) Grants permission to copy a source Amazon FPGA image (AFI) to the current Region.

        Resource-level permissions specified for this action apply to the new AFI only. They do not apply to the source AFI

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CopyFpgaImage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCopyFpgaImage", []))

    @jsii.member(jsii_name="toCopyImage")
    def to_copy_image(self) -> "Ec2":
        '''(experimental) Grants permission to copy an Amazon Machine Image (AMI) from a source Region to the current Region.

        Resource-level permissions specified for this action apply to the new AMI only. They do not apply to the source AMI

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CopyImage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCopyImage", []))

    @jsii.member(jsii_name="toCopySnapshot")
    def to_copy_snapshot(self) -> "Ec2":
        '''(experimental) Grants permission to copy a point-in-time snapshot of an EBS volume and store it in Amazon S3.

        Resource-level permissions specified for this action apply to the new snapshot only. They do not apply to the source snapshot

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CopySnapshot.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCopySnapshot", []))

    @jsii.member(jsii_name="toCreateCapacityReservation")
    def to_create_capacity_reservation(self) -> "Ec2":
        '''(experimental) Grants permission to create a Capacity Reservation.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateCapacityReservation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateCapacityReservation", []))

    @jsii.member(jsii_name="toCreateCapacityReservationFleet")
    def to_create_capacity_reservation_fleet(self) -> "Ec2":
        '''(experimental) Grants permission to create a Capacity Reservation Fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateCapacityReservationFleet.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateCapacityReservationFleet", []))

    @jsii.member(jsii_name="toCreateCarrierGateway")
    def to_create_carrier_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to create a carrier gateway and provides CSP connectivity to VPC customers.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateCarrierGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateCarrierGateway", []))

    @jsii.member(jsii_name="toCreateClientVpnEndpoint")
    def to_create_client_vpn_endpoint(self) -> "Ec2":
        '''(experimental) Grants permission to create a Client VPN endpoint.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateClientVpnEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateClientVpnEndpoint", []))

    @jsii.member(jsii_name="toCreateClientVpnRoute")
    def to_create_client_vpn_route(self) -> "Ec2":
        '''(experimental) Grants permission to add a network route to a Client VPN endpoint's route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateClientVpnRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateClientVpnRoute", []))

    @jsii.member(jsii_name="toCreateCoipCidr")
    def to_create_coip_cidr(self) -> "Ec2":
        '''(experimental) Grants permission to create a range of customer-owned IP (CoIP) addresses.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateCoipCidr.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateCoipCidr", []))

    @jsii.member(jsii_name="toCreateCoipPool")
    def to_create_coip_pool(self) -> "Ec2":
        '''(experimental) Grants permission to create a pool of customer-owned IP (CoIP) addresses.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateCoipPool.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateCoipPool", []))

    @jsii.member(jsii_name="toCreateCoipPoolPermission")
    def to_create_coip_pool_permission(self) -> "Ec2":
        '''(experimental) Grants permission to allow a service to access a customer-owned IP (CoIP) pool.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/outposts/latest/userguide/identity-access-management.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateCoipPoolPermission", []))

    @jsii.member(jsii_name="toCreateCustomerGateway")
    def to_create_customer_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to create a customer gateway, which provides information to AWS about your customer gateway device.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateCustomerGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateCustomerGateway", []))

    @jsii.member(jsii_name="toCreateDefaultSubnet")
    def to_create_default_subnet(self) -> "Ec2":
        '''(experimental) Grants permission to create a default subnet in a specified Availability Zone in a default VPC.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateDefaultSubnet.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateDefaultSubnet", []))

    @jsii.member(jsii_name="toCreateDefaultVpc")
    def to_create_default_vpc(self) -> "Ec2":
        '''(experimental) Grants permission to create a default VPC with a default subnet in each Availability Zone.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateDefaultVpc.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateDefaultVpc", []))

    @jsii.member(jsii_name="toCreateDhcpOptions")
    def to_create_dhcp_options(self) -> "Ec2":
        '''(experimental) Grants permission to create a set of DHCP options for a VPC.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateDhcpOptions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateDhcpOptions", []))

    @jsii.member(jsii_name="toCreateEgressOnlyInternetGateway")
    def to_create_egress_only_internet_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to create an egress-only internet gateway for a VPC.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateEgressOnlyInternetGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateEgressOnlyInternetGateway", []))

    @jsii.member(jsii_name="toCreateFleet")
    def to_create_fleet(self) -> "Ec2":
        '''(experimental) Grants permission to launch an EC2 Fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFleet.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateFleet", []))

    @jsii.member(jsii_name="toCreateFlowLogs")
    def to_create_flow_logs(self) -> "Ec2":
        '''(experimental) Grants permission to create one or more flow logs to capture IP traffic for a network interface.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags
        - iam:PassRole

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFlowLogs.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateFlowLogs", []))

    @jsii.member(jsii_name="toCreateFpgaImage")
    def to_create_fpga_image(self) -> "Ec2":
        '''(experimental) Grants permission to create an Amazon FPGA Image (AFI) from a design checkpoint (DCP).

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFpgaImage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateFpgaImage", []))

    @jsii.member(jsii_name="toCreateImage")
    def to_create_image(self) -> "Ec2":
        '''(experimental) Grants permission to create an Amazon EBS-backed AMI from a stopped or running Amazon EBS-backed instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateImage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateImage", []))

    @jsii.member(jsii_name="toCreateInstanceEventWindow")
    def to_create_instance_event_window(self) -> "Ec2":
        '''(experimental) Grants permission to create an event window in which scheduled events for the associated Amazon EC2 instances can run.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateInstanceEventWindow.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateInstanceEventWindow", []))

    @jsii.member(jsii_name="toCreateInstanceExportTask")
    def to_create_instance_export_task(self) -> "Ec2":
        '''(experimental) Grants permission to export a running or stopped instance to an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateInstanceExportTask.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateInstanceExportTask", []))

    @jsii.member(jsii_name="toCreateInternetGateway")
    def to_create_internet_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to create an internet gateway for a VPC.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateInternetGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateInternetGateway", []))

    @jsii.member(jsii_name="toCreateIpam")
    def to_create_ipam(self) -> "Ec2":
        '''(experimental) Grants permission to create an Amazon VPC IP Address Manager (IPAM).

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags
        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateIpam.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateIpam", []))

    @jsii.member(jsii_name="toCreateIpamPool")
    def to_create_ipam_pool(self) -> "Ec2":
        '''(experimental) Grants permission to create an IP address pool for Amazon VPC IP Address Manager (IPAM), which is a collection of contiguous IP address CIDRs.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateIpamPool.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateIpamPool", []))

    @jsii.member(jsii_name="toCreateIpamResourceDiscovery")
    def to_create_ipam_resource_discovery(self) -> "Ec2":
        '''(experimental) Grants permission to create an IPAM resource discovery.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags
        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateIpamResourceDiscovery.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateIpamResourceDiscovery", []))

    @jsii.member(jsii_name="toCreateIpamScope")
    def to_create_ipam_scope(self) -> "Ec2":
        '''(experimental) Grants permission to create an Amazon VPC IP Address Manager (IPAM) scope, which is the highest-level container within IPAM.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateIpamScope.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateIpamScope", []))

    @jsii.member(jsii_name="toCreateKeyPair")
    def to_create_key_pair(self) -> "Ec2":
        '''(experimental) Grants permission to create a 2048-bit RSA key pair.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateKeyPair", []))

    @jsii.member(jsii_name="toCreateLaunchTemplate")
    def to_create_launch_template(self) -> "Ec2":
        '''(experimental) Grants permission to create a launch template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateLaunchTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateLaunchTemplate", []))

    @jsii.member(jsii_name="toCreateLaunchTemplateVersion")
    def to_create_launch_template_version(self) -> "Ec2":
        '''(experimental) Grants permission to create a new version of a launch template.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateLaunchTemplateVersion.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateLaunchTemplateVersion", []))

    @jsii.member(jsii_name="toCreateLocalGatewayRoute")
    def to_create_local_gateway_route(self) -> "Ec2":
        '''(experimental) Grants permission to create a static route for a local gateway route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateLocalGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateLocalGatewayRoute", []))

    @jsii.member(jsii_name="toCreateLocalGatewayRouteTable")
    def to_create_local_gateway_route_table(self) -> "Ec2":
        '''(experimental) Grants permission to create a local gateway route table.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateLocalGatewayRouteTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateLocalGatewayRouteTable", []))

    @jsii.member(jsii_name="toCreateLocalGatewayRouteTablePermission")
    def to_create_local_gateway_route_table_permission(self) -> "Ec2":
        '''(experimental) Grants permission to allow a service to access a local gateway route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/outposts/latest/userguide/identity-access-management.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateLocalGatewayRouteTablePermission", []))

    @jsii.member(jsii_name="toCreateLocalGatewayRouteTableVirtualInterfaceGroupAssociation")
    def to_create_local_gateway_route_table_virtual_interface_group_association(
        self,
    ) -> "Ec2":
        '''(experimental) Grants permission to create a local gateway route table virtual interface group association.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateLocalGatewayRouteTableVirtualInterfaceGroupAssociation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateLocalGatewayRouteTableVirtualInterfaceGroupAssociation", []))

    @jsii.member(jsii_name="toCreateLocalGatewayRouteTableVpcAssociation")
    def to_create_local_gateway_route_table_vpc_association(self) -> "Ec2":
        '''(experimental) Grants permission to associate a VPC with a local gateway route table.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateLocalGatewayRouteTableVpcAssociation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateLocalGatewayRouteTableVpcAssociation", []))

    @jsii.member(jsii_name="toCreateManagedPrefixList")
    def to_create_managed_prefix_list(self) -> "Ec2":
        '''(experimental) Grants permission to create a managed prefix list.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateManagedPrefixList.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateManagedPrefixList", []))

    @jsii.member(jsii_name="toCreateNatGateway")
    def to_create_nat_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to create a NAT gateway in a subnet.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNatGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateNatGateway", []))

    @jsii.member(jsii_name="toCreateNetworkAcl")
    def to_create_network_acl(self) -> "Ec2":
        '''(experimental) Grants permission to create a network ACL in a VPC.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNetworkAcl.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateNetworkAcl", []))

    @jsii.member(jsii_name="toCreateNetworkAclEntry")
    def to_create_network_acl_entry(self) -> "Ec2":
        '''(experimental) Grants permission to create a numbered entry (a rule) in a network ACL.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNetworkAclEntry.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateNetworkAclEntry", []))

    @jsii.member(jsii_name="toCreateNetworkInsightsAccessScope")
    def to_create_network_insights_access_scope(self) -> "Ec2":
        '''(experimental) Grants permission to create a Network Access Scope.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNetworkInsightsAccessScope.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateNetworkInsightsAccessScope", []))

    @jsii.member(jsii_name="toCreateNetworkInsightsPath")
    def to_create_network_insights_path(self) -> "Ec2":
        '''(experimental) Grants permission to create a path to analyze for reachability.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNetworkInsightsPath.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateNetworkInsightsPath", []))

    @jsii.member(jsii_name="toCreateNetworkInterface")
    def to_create_network_interface(self) -> "Ec2":
        '''(experimental) Grants permission to create a network interface in a subnet.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNetworkInterface.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateNetworkInterface", []))

    @jsii.member(jsii_name="toCreateNetworkInterfacePermission")
    def to_create_network_interface_permission(self) -> "Ec2":
        '''(experimental) Grants permission to create a permission for an AWS-authorized user to perform certain operations on a network interface.

        Access Level: Permissions management

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNetworkInterfacePermission.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateNetworkInterfacePermission", []))

    @jsii.member(jsii_name="toCreatePlacementGroup")
    def to_create_placement_group(self) -> "Ec2":
        '''(experimental) Grants permission to create a placement group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreatePlacementGroup.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreatePlacementGroup", []))

    @jsii.member(jsii_name="toCreatePublicIpv4Pool")
    def to_create_public_ipv4_pool(self) -> "Ec2":
        '''(experimental) Grants permission to create a public IPv4 address pool for public IPv4 CIDRs that you own and bring to Amazon to manage with Amazon VPC IP Address Manager (IPAM).

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreatePublicIpv4Pool.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreatePublicIpv4Pool", []))

    @jsii.member(jsii_name="toCreateReplaceRootVolumeTask")
    def to_create_replace_root_volume_task(self) -> "Ec2":
        '''(experimental) Grants permission to create a root volume replacement task.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateReplaceRootVolumeTask.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateReplaceRootVolumeTask", []))

    @jsii.member(jsii_name="toCreateReservedInstancesListing")
    def to_create_reserved_instances_listing(self) -> "Ec2":
        '''(experimental) Grants permission to create a listing for Standard Reserved Instances to be sold in the Reserved Instance Marketplace.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateReservedInstancesListing.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateReservedInstancesListing", []))

    @jsii.member(jsii_name="toCreateRestoreImageTask")
    def to_create_restore_image_task(self) -> "Ec2":
        '''(experimental) Grants permission to start a task that restores an AMI from an S3 object previously created by using CreateStoreImageTask.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateRestoreImageTask.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateRestoreImageTask", []))

    @jsii.member(jsii_name="toCreateRoute")
    def to_create_route(self) -> "Ec2":
        '''(experimental) Grants permission to create a route in a VPC route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateRoute", []))

    @jsii.member(jsii_name="toCreateRouteTable")
    def to_create_route_table(self) -> "Ec2":
        '''(experimental) Grants permission to create a route table for a VPC.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateRouteTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateRouteTable", []))

    @jsii.member(jsii_name="toCreateSecurityGroup")
    def to_create_security_group(self) -> "Ec2":
        '''(experimental) Grants permission to create a security group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateSecurityGroup.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateSecurityGroup", []))

    @jsii.member(jsii_name="toCreateSnapshot")
    def to_create_snapshot(self) -> "Ec2":
        '''(experimental) Grants permission to create a snapshot of an EBS volume and store it in Amazon S3.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateSnapshot", []))

    @jsii.member(jsii_name="toCreateSnapshots")
    def to_create_snapshots(self) -> "Ec2":
        '''(experimental) Grants permission to create crash-consistent snapshots of multiple EBS volumes and store them in Amazon S3.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateSnapshots", []))

    @jsii.member(jsii_name="toCreateSpotDatafeedSubscription")
    def to_create_spot_datafeed_subscription(self) -> "Ec2":
        '''(experimental) Grants permission to create a data feed for Spot Instances to view Spot Instance usage logs.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateSpotDatafeedSubscription.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateSpotDatafeedSubscription", []))

    @jsii.member(jsii_name="toCreateStoreImageTask")
    def to_create_store_image_task(self) -> "Ec2":
        '''(experimental) Grants permission to store an AMI as a single object in an S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateStoreImageTask.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateStoreImageTask", []))

    @jsii.member(jsii_name="toCreateSubnet")
    def to_create_subnet(self) -> "Ec2":
        '''(experimental) Grants permission to create a subnet in a VPC.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateSubnet.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateSubnet", []))

    @jsii.member(jsii_name="toCreateSubnetCidrReservation")
    def to_create_subnet_cidr_reservation(self) -> "Ec2":
        '''(experimental) Grants permission to create a subnet CIDR reservation.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateSubnetCidrReservation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateSubnetCidrReservation", []))

    @jsii.member(jsii_name="toCreateTags")
    def to_create_tags(self) -> "Ec2":
        '''(experimental) Grants permission to add or overwrite one or more tags for Amazon EC2 resources.

        Access Level: Tagging

        Possible conditions:

        - .ifCreateAction()
        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTags.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTags", []))

    @jsii.member(jsii_name="toCreateTrafficMirrorFilter")
    def to_create_traffic_mirror_filter(self) -> "Ec2":
        '''(experimental) Grants permission to create a traffic mirror filter.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTrafficMirrorFilter.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTrafficMirrorFilter", []))

    @jsii.member(jsii_name="toCreateTrafficMirrorFilterRule")
    def to_create_traffic_mirror_filter_rule(self) -> "Ec2":
        '''(experimental) Grants permission to create a traffic mirror filter rule.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTrafficMirrorFilterRule.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTrafficMirrorFilterRule", []))

    @jsii.member(jsii_name="toCreateTrafficMirrorSession")
    def to_create_traffic_mirror_session(self) -> "Ec2":
        '''(experimental) Grants permission to create a traffic mirror session.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTrafficMirrorSession.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTrafficMirrorSession", []))

    @jsii.member(jsii_name="toCreateTrafficMirrorTarget")
    def to_create_traffic_mirror_target(self) -> "Ec2":
        '''(experimental) Grants permission to create a traffic mirror target.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTrafficMirrorTarget.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTrafficMirrorTarget", []))

    @jsii.member(jsii_name="toCreateTransitGateway")
    def to_create_transit_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to create a transit gateway.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTransitGateway", []))

    @jsii.member(jsii_name="toCreateTransitGatewayConnect")
    def to_create_transit_gateway_connect(self) -> "Ec2":
        '''(experimental) Grants permission to create a Connect attachment from a specified transit gateway attachment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGatewayConnect.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTransitGatewayConnect", []))

    @jsii.member(jsii_name="toCreateTransitGatewayConnectPeer")
    def to_create_transit_gateway_connect_peer(self) -> "Ec2":
        '''(experimental) Grants permission to create a Connect peer between a transit gateway and an appliance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGatewayConnectPeer.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTransitGatewayConnectPeer", []))

    @jsii.member(jsii_name="toCreateTransitGatewayMulticastDomain")
    def to_create_transit_gateway_multicast_domain(self) -> "Ec2":
        '''(experimental) Grants permission to create a multicast domain for a transit gateway.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGatewayMulticastDomain.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTransitGatewayMulticastDomain", []))

    @jsii.member(jsii_name="toCreateTransitGatewayPeeringAttachment")
    def to_create_transit_gateway_peering_attachment(self) -> "Ec2":
        '''(experimental) Grants permission to request a transit gateway peering attachment between a requester and accepter transit gateway.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGatewayPeeringAttachment.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTransitGatewayPeeringAttachment", []))

    @jsii.member(jsii_name="toCreateTransitGatewayPolicyTable")
    def to_create_transit_gateway_policy_table(self) -> "Ec2":
        '''(experimental) Grants permission to create a transit gateway policy table.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGatewayPolicyTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTransitGatewayPolicyTable", []))

    @jsii.member(jsii_name="toCreateTransitGatewayPrefixListReference")
    def to_create_transit_gateway_prefix_list_reference(self) -> "Ec2":
        '''(experimental) Grants permission to create a transit gateway prefix list reference.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGatewayPrefixListReference.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTransitGatewayPrefixListReference", []))

    @jsii.member(jsii_name="toCreateTransitGatewayRoute")
    def to_create_transit_gateway_route(self) -> "Ec2":
        '''(experimental) Grants permission to create a static route for a transit gateway route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTransitGatewayRoute", []))

    @jsii.member(jsii_name="toCreateTransitGatewayRouteTable")
    def to_create_transit_gateway_route_table(self) -> "Ec2":
        '''(experimental) Grants permission to create a route table for a transit gateway.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGatewayRouteTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTransitGatewayRouteTable", []))

    @jsii.member(jsii_name="toCreateTransitGatewayRouteTableAnnouncement")
    def to_create_transit_gateway_route_table_announcement(self) -> "Ec2":
        '''(experimental) Grants permission to create an announcement for a transit gateway route table.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGatewayRouteTableAnnouncement.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTransitGatewayRouteTableAnnouncement", []))

    @jsii.member(jsii_name="toCreateTransitGatewayVpcAttachment")
    def to_create_transit_gateway_vpc_attachment(self) -> "Ec2":
        '''(experimental) Grants permission to attach a VPC to a transit gateway.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTransitGatewayVpcAttachment.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateTransitGatewayVpcAttachment", []))

    @jsii.member(jsii_name="toCreateVerifiedAccessEndpoint")
    def to_create_verified_access_endpoint(self) -> "Ec2":
        '''(experimental) Grants permission to create a Verified Access endpoint.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVerifiedAccessEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVerifiedAccessEndpoint", []))

    @jsii.member(jsii_name="toCreateVerifiedAccessGroup")
    def to_create_verified_access_group(self) -> "Ec2":
        '''(experimental) Grants permission to create a Verified Access group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVerifiedAccessGroup.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVerifiedAccessGroup", []))

    @jsii.member(jsii_name="toCreateVerifiedAccessInstance")
    def to_create_verified_access_instance(self) -> "Ec2":
        '''(experimental) Grants permission to create a Verified Access instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVerifiedAccessInstance.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVerifiedAccessInstance", []))

    @jsii.member(jsii_name="toCreateVerifiedAccessTrustProvider")
    def to_create_verified_access_trust_provider(self) -> "Ec2":
        '''(experimental) Grants permission to create a verified trust provider.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVerifiedAccessTrustProvider.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVerifiedAccessTrustProvider", []))

    @jsii.member(jsii_name="toCreateVolume")
    def to_create_volume(self) -> "Ec2":
        '''(experimental) Grants permission to create an EBS volume.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVolume.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVolume", []))

    @jsii.member(jsii_name="toCreateVpc")
    def to_create_vpc(self) -> "Ec2":
        '''(experimental) Grants permission to create a VPC with a specified CIDR block.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpc.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVpc", []))

    @jsii.member(jsii_name="toCreateVpcEndpoint")
    def to_create_vpc_endpoint(self) -> "Ec2":
        '''(experimental) Grants permission to create a VPC endpoint for an AWS service.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags
        - route53:AssociateVPCWithHostedZone

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpcEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVpcEndpoint", []))

    @jsii.member(jsii_name="toCreateVpcEndpointConnectionNotification")
    def to_create_vpc_endpoint_connection_notification(self) -> "Ec2":
        '''(experimental) Grants permission to create a connection notification for a VPC endpoint or VPC endpoint service.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpcEndpointConnectionNotification.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVpcEndpointConnectionNotification", []))

    @jsii.member(jsii_name="toCreateVpcEndpointServiceConfiguration")
    def to_create_vpc_endpoint_service_configuration(self) -> "Ec2":
        '''(experimental) Grants permission to create a VPC endpoint service configuration to which service consumers (AWS accounts, IAM users, and IAM roles) can connect.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpcEndpointServiceConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVpcEndpointServiceConfiguration", []))

    @jsii.member(jsii_name="toCreateVpcPeeringConnection")
    def to_create_vpc_peering_connection(self) -> "Ec2":
        '''(experimental) Grants permission to request a VPC peering connection between two VPCs.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpcPeeringConnection.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVpcPeeringConnection", []))

    @jsii.member(jsii_name="toCreateVpnConnection")
    def to_create_vpn_connection(self) -> "Ec2":
        '''(experimental) Grants permission to create a VPN connection between a virtual private gateway or transit gateway and a customer gateway.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpnConnection.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVpnConnection", []))

    @jsii.member(jsii_name="toCreateVpnConnectionRoute")
    def to_create_vpn_connection_route(self) -> "Ec2":
        '''(experimental) Grants permission to create a static route for a VPN connection between a virtual private gateway and a customer gateway.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpnConnectionRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVpnConnectionRoute", []))

    @jsii.member(jsii_name="toCreateVpnGateway")
    def to_create_vpn_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to create a virtual private gateway.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpnGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toCreateVpnGateway", []))

    @jsii.member(jsii_name="toDeleteCarrierGateway")
    def to_delete_carrier_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to delete a carrier gateway.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteCarrierGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteCarrierGateway", []))

    @jsii.member(jsii_name="toDeleteClientVpnEndpoint")
    def to_delete_client_vpn_endpoint(self) -> "Ec2":
        '''(experimental) Grants permission to delete a Client VPN endpoint.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteClientVpnEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteClientVpnEndpoint", []))

    @jsii.member(jsii_name="toDeleteClientVpnRoute")
    def to_delete_client_vpn_route(self) -> "Ec2":
        '''(experimental) Grants permission to delete a route from a Client VPN endpoint.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteClientVpnRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteClientVpnRoute", []))

    @jsii.member(jsii_name="toDeleteCoipCidr")
    def to_delete_coip_cidr(self) -> "Ec2":
        '''(experimental) Grants permission to delete a range of customer-owned IP (CoIP) addresses.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteCoipCidr.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteCoipCidr", []))

    @jsii.member(jsii_name="toDeleteCoipPool")
    def to_delete_coip_pool(self) -> "Ec2":
        '''(experimental) Grants permission to delete a pool of customer-owned IP (CoIP) addresses.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteCoipPool.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteCoipPool", []))

    @jsii.member(jsii_name="toDeleteCoipPoolPermission")
    def to_delete_coip_pool_permission(self) -> "Ec2":
        '''(experimental) Grants permission to deny a service from accessing a customer-owned IP (CoIP) pool.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/outposts/latest/userguide/identity-access-management.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteCoipPoolPermission", []))

    @jsii.member(jsii_name="toDeleteCustomerGateway")
    def to_delete_customer_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to delete a customer gateway.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteCustomerGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteCustomerGateway", []))

    @jsii.member(jsii_name="toDeleteDhcpOptions")
    def to_delete_dhcp_options(self) -> "Ec2":
        '''(experimental) Grants permission to delete a set of DHCP options.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteDhcpOptions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteDhcpOptions", []))

    @jsii.member(jsii_name="toDeleteEgressOnlyInternetGateway")
    def to_delete_egress_only_internet_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to delete an egress-only internet gateway.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteEgressOnlyInternetGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteEgressOnlyInternetGateway", []))

    @jsii.member(jsii_name="toDeleteFleets")
    def to_delete_fleets(self) -> "Ec2":
        '''(experimental) Grants permission to delete one or more EC2 Fleets.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFleets.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteFleets", []))

    @jsii.member(jsii_name="toDeleteFlowLogs")
    def to_delete_flow_logs(self) -> "Ec2":
        '''(experimental) Grants permission to delete one or more flow logs.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteFlowLogs", []))

    @jsii.member(jsii_name="toDeleteFpgaImage")
    def to_delete_fpga_image(self) -> "Ec2":
        '''(experimental) Grants permission to delete an Amazon FPGA Image (AFI).

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFpgaImage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteFpgaImage", []))

    @jsii.member(jsii_name="toDeleteInstanceEventWindow")
    def to_delete_instance_event_window(self) -> "Ec2":
        '''(experimental) Grants permission to delete the specified event window.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteInstanceEventWindow.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteInstanceEventWindow", []))

    @jsii.member(jsii_name="toDeleteInternetGateway")
    def to_delete_internet_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to delete an internet gateway.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteInternetGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteInternetGateway", []))

    @jsii.member(jsii_name="toDeleteIpam")
    def to_delete_ipam(self) -> "Ec2":
        '''(experimental) Grants permission to delete an Amazon VPC IP Address Manager (IPAM) and remove all monitored data associated with the IPAM including the historical data for CIDRs.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteIpam.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteIpam", []))

    @jsii.member(jsii_name="toDeleteIpamPool")
    def to_delete_ipam_pool(self) -> "Ec2":
        '''(experimental) Grants permission to delete an Amazon VPC IP Address Manager (IPAM) pool.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteIpamPool.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteIpamPool", []))

    @jsii.member(jsii_name="toDeleteIpamResourceDiscovery")
    def to_delete_ipam_resource_discovery(self) -> "Ec2":
        '''(experimental) Grants permission to delete an IPAM resource discovery.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteIpamResourceDiscovery.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteIpamResourceDiscovery", []))

    @jsii.member(jsii_name="toDeleteIpamScope")
    def to_delete_ipam_scope(self) -> "Ec2":
        '''(experimental) Grants permission to delete the scope for an Amazon VPC IP Address Manager (IPAM).

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteIpamScope.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteIpamScope", []))

    @jsii.member(jsii_name="toDeleteKeyPair")
    def to_delete_key_pair(self) -> "Ec2":
        '''(experimental) Grants permission to delete a key pair by removing the public key from Amazon EC2.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteKeyPair", []))

    @jsii.member(jsii_name="toDeleteLaunchTemplate")
    def to_delete_launch_template(self) -> "Ec2":
        '''(experimental) Grants permission to delete a launch template and its associated versions.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteLaunchTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteLaunchTemplate", []))

    @jsii.member(jsii_name="toDeleteLaunchTemplateVersions")
    def to_delete_launch_template_versions(self) -> "Ec2":
        '''(experimental) Grants permission to delete one or more versions of a launch template.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteLaunchTemplateVersions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteLaunchTemplateVersions", []))

    @jsii.member(jsii_name="toDeleteLocalGatewayRoute")
    def to_delete_local_gateway_route(self) -> "Ec2":
        '''(experimental) Grants permission to delete a route from a local gateway route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteLocalGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteLocalGatewayRoute", []))

    @jsii.member(jsii_name="toDeleteLocalGatewayRouteTable")
    def to_delete_local_gateway_route_table(self) -> "Ec2":
        '''(experimental) Grants permission to delete a local gateway route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteLocalGatewayRouteTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteLocalGatewayRouteTable", []))

    @jsii.member(jsii_name="toDeleteLocalGatewayRouteTablePermission")
    def to_delete_local_gateway_route_table_permission(self) -> "Ec2":
        '''(experimental) Grants permission to deny a service from accessing a local gateway route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/outposts/latest/userguide/identity-access-management.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteLocalGatewayRouteTablePermission", []))

    @jsii.member(jsii_name="toDeleteLocalGatewayRouteTableVirtualInterfaceGroupAssociation")
    def to_delete_local_gateway_route_table_virtual_interface_group_association(
        self,
    ) -> "Ec2":
        '''(experimental) Grants permission to delete a local gateway route table virtual interface group association.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteLocalGatewayRouteTableVirtualInterfaceGroupAssociation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteLocalGatewayRouteTableVirtualInterfaceGroupAssociation", []))

    @jsii.member(jsii_name="toDeleteLocalGatewayRouteTableVpcAssociation")
    def to_delete_local_gateway_route_table_vpc_association(self) -> "Ec2":
        '''(experimental) Grants permission to delete an association between a VPC and local gateway route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteLocalGatewayRouteTableVpcAssociation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteLocalGatewayRouteTableVpcAssociation", []))

    @jsii.member(jsii_name="toDeleteManagedPrefixList")
    def to_delete_managed_prefix_list(self) -> "Ec2":
        '''(experimental) Grants permission to delete a managed prefix list.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteManagedPrefixList.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteManagedPrefixList", []))

    @jsii.member(jsii_name="toDeleteNatGateway")
    def to_delete_nat_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to delete a NAT gateway.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNatGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteNatGateway", []))

    @jsii.member(jsii_name="toDeleteNetworkAcl")
    def to_delete_network_acl(self) -> "Ec2":
        '''(experimental) Grants permission to delete a network ACL.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNetworkAcl.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteNetworkAcl", []))

    @jsii.member(jsii_name="toDeleteNetworkAclEntry")
    def to_delete_network_acl_entry(self) -> "Ec2":
        '''(experimental) Grants permission to delete an inbound or outbound entry (rule) from a network ACL.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNetworkAclEntry.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteNetworkAclEntry", []))

    @jsii.member(jsii_name="toDeleteNetworkInsightsAccessScope")
    def to_delete_network_insights_access_scope(self) -> "Ec2":
        '''(experimental) Grants permission to delete a Network Access Scope.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNetworkInsightsAccessScope.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteNetworkInsightsAccessScope", []))

    @jsii.member(jsii_name="toDeleteNetworkInsightsAccessScopeAnalysis")
    def to_delete_network_insights_access_scope_analysis(self) -> "Ec2":
        '''(experimental) Grants permission to delete a Network Access Scope analysis.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNetworkInsightsAccessScopeAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteNetworkInsightsAccessScopeAnalysis", []))

    @jsii.member(jsii_name="toDeleteNetworkInsightsAnalysis")
    def to_delete_network_insights_analysis(self) -> "Ec2":
        '''(experimental) Grants permission to delete a network insights analysis.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNetworkInsightsAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteNetworkInsightsAnalysis", []))

    @jsii.member(jsii_name="toDeleteNetworkInsightsPath")
    def to_delete_network_insights_path(self) -> "Ec2":
        '''(experimental) Grants permission to delete a network insights path.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNetworkInsightsPath.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteNetworkInsightsPath", []))

    @jsii.member(jsii_name="toDeleteNetworkInterface")
    def to_delete_network_interface(self) -> "Ec2":
        '''(experimental) Grants permission to delete a detached network interface.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNetworkInterface.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteNetworkInterface", []))

    @jsii.member(jsii_name="toDeleteNetworkInterfacePermission")
    def to_delete_network_interface_permission(self) -> "Ec2":
        '''(experimental) Grants permission to delete a permission that is associated with a network interface.

        Access Level: Permissions management

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNetworkInterfacePermission.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteNetworkInterfacePermission", []))

    @jsii.member(jsii_name="toDeletePlacementGroup")
    def to_delete_placement_group(self) -> "Ec2":
        '''(experimental) Grants permission to delete a placement group.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeletePlacementGroup.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeletePlacementGroup", []))

    @jsii.member(jsii_name="toDeletePublicIpv4Pool")
    def to_delete_public_ipv4_pool(self) -> "Ec2":
        '''(experimental) Grants permission to delete a public IPv4 address pool for public IPv4 CIDRs that you own and brought to Amazon to manage with Amazon VPC IP Address Manager (IPAM).

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeletePublicIpv4Pool.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeletePublicIpv4Pool", []))

    @jsii.member(jsii_name="toDeleteQueuedReservedInstances")
    def to_delete_queued_reserved_instances(self) -> "Ec2":
        '''(experimental) Grants permission to delete the queued purchases for the specified Reserved Instances.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteQueuedReservedInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteQueuedReservedInstances", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "Ec2":
        '''(experimental) Grants permission to remove an IAM policy that enables cross-account sharing from a resource.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/vpc/latest/ipam/share-pool-ipam.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteRoute")
    def to_delete_route(self) -> "Ec2":
        '''(experimental) Grants permission to delete a route from a route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteRoute", []))

    @jsii.member(jsii_name="toDeleteRouteTable")
    def to_delete_route_table(self) -> "Ec2":
        '''(experimental) Grants permission to delete a route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteRouteTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteRouteTable", []))

    @jsii.member(jsii_name="toDeleteSecurityGroup")
    def to_delete_security_group(self) -> "Ec2":
        '''(experimental) Grants permission to delete a security group.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteSecurityGroup.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteSecurityGroup", []))

    @jsii.member(jsii_name="toDeleteSnapshot")
    def to_delete_snapshot(self) -> "Ec2":
        '''(experimental) Grants permission to delete a snapshot of an EBS volume.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteSnapshot", []))

    @jsii.member(jsii_name="toDeleteSpotDatafeedSubscription")
    def to_delete_spot_datafeed_subscription(self) -> "Ec2":
        '''(experimental) Grants permission to delete a data feed for Spot Instances.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteSpotDatafeedSubscription.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteSpotDatafeedSubscription", []))

    @jsii.member(jsii_name="toDeleteSubnet")
    def to_delete_subnet(self) -> "Ec2":
        '''(experimental) Grants permission to delete a subnet.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteSubnet.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteSubnet", []))

    @jsii.member(jsii_name="toDeleteSubnetCidrReservation")
    def to_delete_subnet_cidr_reservation(self) -> "Ec2":
        '''(experimental) Grants permission to delete a subnet CIDR reservation.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteSubnetCidrReservation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteSubnetCidrReservation", []))

    @jsii.member(jsii_name="toDeleteTags")
    def to_delete_tags(self) -> "Ec2":
        '''(experimental) Grants permission to delete one or more tags from Amazon EC2 resources.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTags.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTags", []))

    @jsii.member(jsii_name="toDeleteTrafficMirrorFilter")
    def to_delete_traffic_mirror_filter(self) -> "Ec2":
        '''(experimental) Grants permission to delete a traffic mirror filter.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTrafficMirrorFilter.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTrafficMirrorFilter", []))

    @jsii.member(jsii_name="toDeleteTrafficMirrorFilterRule")
    def to_delete_traffic_mirror_filter_rule(self) -> "Ec2":
        '''(experimental) Grants permission to delete a traffic mirror filter rule.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTrafficMirrorFilterRule.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTrafficMirrorFilterRule", []))

    @jsii.member(jsii_name="toDeleteTrafficMirrorSession")
    def to_delete_traffic_mirror_session(self) -> "Ec2":
        '''(experimental) Grants permission to delete a traffic mirror session.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTrafficMirrorSession.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTrafficMirrorSession", []))

    @jsii.member(jsii_name="toDeleteTrafficMirrorTarget")
    def to_delete_traffic_mirror_target(self) -> "Ec2":
        '''(experimental) Grants permission to delete a traffic mirror target.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTrafficMirrorTarget.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTrafficMirrorTarget", []))

    @jsii.member(jsii_name="toDeleteTransitGateway")
    def to_delete_transit_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to delete a transit gateway.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTransitGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTransitGateway", []))

    @jsii.member(jsii_name="toDeleteTransitGatewayConnect")
    def to_delete_transit_gateway_connect(self) -> "Ec2":
        '''(experimental) Grants permission to delete a transit gateway connect attachment.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTransitGatewayConnect.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTransitGatewayConnect", []))

    @jsii.member(jsii_name="toDeleteTransitGatewayConnectPeer")
    def to_delete_transit_gateway_connect_peer(self) -> "Ec2":
        '''(experimental) Grants permission to delete a transit gateway connect peer.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTransitGatewayConnectPeer.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTransitGatewayConnectPeer", []))

    @jsii.member(jsii_name="toDeleteTransitGatewayMulticastDomain")
    def to_delete_transit_gateway_multicast_domain(self) -> "Ec2":
        '''(experimental) Grants permission to delete a transit gateway multicast domain.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTransitGatewayMulticastDomain.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTransitGatewayMulticastDomain", []))

    @jsii.member(jsii_name="toDeleteTransitGatewayPeeringAttachment")
    def to_delete_transit_gateway_peering_attachment(self) -> "Ec2":
        '''(experimental) Grants permission to delete a peering attachment from a transit gateway.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTransitGatewayPeeringAttachment.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTransitGatewayPeeringAttachment", []))

    @jsii.member(jsii_name="toDeleteTransitGatewayPolicyTable")
    def to_delete_transit_gateway_policy_table(self) -> "Ec2":
        '''(experimental) Grants permission to delete a transit gateway policy table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTransitGatewayPolicyTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTransitGatewayPolicyTable", []))

    @jsii.member(jsii_name="toDeleteTransitGatewayPrefixListReference")
    def to_delete_transit_gateway_prefix_list_reference(self) -> "Ec2":
        '''(experimental) Grants permission to delete a transit gateway prefix list reference.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTransitGatewayPrefixListReference.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTransitGatewayPrefixListReference", []))

    @jsii.member(jsii_name="toDeleteTransitGatewayRoute")
    def to_delete_transit_gateway_route(self) -> "Ec2":
        '''(experimental) Grants permission to delete a route from a transit gateway route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTransitGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTransitGatewayRoute", []))

    @jsii.member(jsii_name="toDeleteTransitGatewayRouteTable")
    def to_delete_transit_gateway_route_table(self) -> "Ec2":
        '''(experimental) Grants permission to delete a transit gateway route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTransitGatewayRouteTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTransitGatewayRouteTable", []))

    @jsii.member(jsii_name="toDeleteTransitGatewayRouteTableAnnouncement")
    def to_delete_transit_gateway_route_table_announcement(self) -> "Ec2":
        '''(experimental) Grants permission to delete a transit gateway route table announcement.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTransitGatewayRouteTableAnnouncement.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTransitGatewayRouteTableAnnouncement", []))

    @jsii.member(jsii_name="toDeleteTransitGatewayVpcAttachment")
    def to_delete_transit_gateway_vpc_attachment(self) -> "Ec2":
        '''(experimental) Grants permission to delete a VPC attachment from a transit gateway.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTransitGatewayVpcAttachment.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteTransitGatewayVpcAttachment", []))

    @jsii.member(jsii_name="toDeleteVerifiedAccessEndpoint")
    def to_delete_verified_access_endpoint(self) -> "Ec2":
        '''(experimental) Grants permission to delete a Verified Access endpoint.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVerifiedAccessEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVerifiedAccessEndpoint", []))

    @jsii.member(jsii_name="toDeleteVerifiedAccessGroup")
    def to_delete_verified_access_group(self) -> "Ec2":
        '''(experimental) Grants permission to delete a Verified Access group.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVerifiedAccessGroup.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVerifiedAccessGroup", []))

    @jsii.member(jsii_name="toDeleteVerifiedAccessInstance")
    def to_delete_verified_access_instance(self) -> "Ec2":
        '''(experimental) Grants permission to delete a Verified Access instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVerifiedAccessInstance.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVerifiedAccessInstance", []))

    @jsii.member(jsii_name="toDeleteVerifiedAccessTrustProvider")
    def to_delete_verified_access_trust_provider(self) -> "Ec2":
        '''(experimental) Grants permission to delete a verified trust provider.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVerifiedAccessTrustProvider.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVerifiedAccessTrustProvider", []))

    @jsii.member(jsii_name="toDeleteVolume")
    def to_delete_volume(self) -> "Ec2":
        '''(experimental) Grants permission to delete an EBS volume.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVolume.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVolume", []))

    @jsii.member(jsii_name="toDeleteVpc")
    def to_delete_vpc(self) -> "Ec2":
        '''(experimental) Grants permission to delete a VPC.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpc.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVpc", []))

    @jsii.member(jsii_name="toDeleteVpcEndpointConnectionNotifications")
    def to_delete_vpc_endpoint_connection_notifications(self) -> "Ec2":
        '''(experimental) Grants permission to delete one or more VPC endpoint connection notifications.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpcEndpointConnectionNotifications.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVpcEndpointConnectionNotifications", []))

    @jsii.member(jsii_name="toDeleteVpcEndpoints")
    def to_delete_vpc_endpoints(self) -> "Ec2":
        '''(experimental) Grants permission to delete one or more VPC endpoints.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpcEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVpcEndpoints", []))

    @jsii.member(jsii_name="toDeleteVpcEndpointServiceConfigurations")
    def to_delete_vpc_endpoint_service_configurations(self) -> "Ec2":
        '''(experimental) Grants permission to delete one or more VPC endpoint service configurations.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpcEndpointServiceConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVpcEndpointServiceConfigurations", []))

    @jsii.member(jsii_name="toDeleteVpcPeeringConnection")
    def to_delete_vpc_peering_connection(self) -> "Ec2":
        '''(experimental) Grants permission to delete a VPC peering connection.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpcPeeringConnection.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVpcPeeringConnection", []))

    @jsii.member(jsii_name="toDeleteVpnConnection")
    def to_delete_vpn_connection(self) -> "Ec2":
        '''(experimental) Grants permission to delete a VPN connection.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpnConnection.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVpnConnection", []))

    @jsii.member(jsii_name="toDeleteVpnConnectionRoute")
    def to_delete_vpn_connection_route(self) -> "Ec2":
        '''(experimental) Grants permission to delete a static route for a VPN connection between a virtual private gateway and a customer gateway.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpnConnectionRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVpnConnectionRoute", []))

    @jsii.member(jsii_name="toDeleteVpnGateway")
    def to_delete_vpn_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to delete a virtual private gateway.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpnGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeleteVpnGateway", []))

    @jsii.member(jsii_name="toDeprovisionByoipCidr")
    def to_deprovision_byoip_cidr(self) -> "Ec2":
        '''(experimental) Grants permission to release an IP address range that was provisioned through bring your own IP addresses (BYOIP), and to delete the corresponding address pool.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeprovisionByoipCidr.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeprovisionByoipCidr", []))

    @jsii.member(jsii_name="toDeprovisionIpamPoolCidr")
    def to_deprovision_ipam_pool_cidr(self) -> "Ec2":
        '''(experimental) Grants permission to deprovision a CIDR provisioned from an Amazon VPC IP Address Manager (IPAM) pool.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeprovisionIpamPoolCidr.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeprovisionIpamPoolCidr", []))

    @jsii.member(jsii_name="toDeprovisionPublicIpv4PoolCidr")
    def to_deprovision_public_ipv4_pool_cidr(self) -> "Ec2":
        '''(experimental) Grants permission to deprovision a CIDR from a public IPv4 pool.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeprovisionPublicIpv4PoolCidr.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeprovisionPublicIpv4PoolCidr", []))

    @jsii.member(jsii_name="toDeregisterImage")
    def to_deregister_image(self) -> "Ec2":
        '''(experimental) Grants permission to deregister an Amazon Machine Image (AMI).

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeregisterImage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeregisterImage", []))

    @jsii.member(jsii_name="toDeregisterInstanceEventNotificationAttributes")
    def to_deregister_instance_event_notification_attributes(self) -> "Ec2":
        '''(experimental) Grants permission to remove tags from the set of tags to include in notifications about scheduled events for your instances.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeregisterInstanceEventNotificationAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeregisterInstanceEventNotificationAttributes", []))

    @jsii.member(jsii_name="toDeregisterTransitGatewayMulticastGroupMembers")
    def to_deregister_transit_gateway_multicast_group_members(self) -> "Ec2":
        '''(experimental) Grants permission to deregister one or more network interface members from a group IP address in a transit gateway multicast domain.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeregisterTransitGatewayMulticastGroupMembers.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeregisterTransitGatewayMulticastGroupMembers", []))

    @jsii.member(jsii_name="toDeregisterTransitGatewayMulticastGroupSources")
    def to_deregister_transit_gateway_multicast_group_sources(self) -> "Ec2":
        '''(experimental) Grants permission to deregister one or more network interface sources from a group IP address in a transit gateway multicast domain.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeregisterTransitGatewayMulticastGroupSources.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDeregisterTransitGatewayMulticastGroupSources", []))

    @jsii.member(jsii_name="toDescribeAccountAttributes")
    def to_describe_account_attributes(self) -> "Ec2":
        '''(experimental) Grants permission to describe the attributes of the AWS account.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAccountAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeAccountAttributes", []))

    @jsii.member(jsii_name="toDescribeAddresses")
    def to_describe_addresses(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more Elastic IP addresses.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAddresses.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeAddresses", []))

    @jsii.member(jsii_name="toDescribeAddressesAttribute")
    def to_describe_addresses_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to describe the attributes of the specified Elastic IP addresses.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAddressesAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeAddressesAttribute", []))

    @jsii.member(jsii_name="toDescribeAddressTransfers")
    def to_describe_address_transfers(self) -> "Ec2":
        '''(experimental) Grants permission to describe an Elastic IP address transfer.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAddressTransfers.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeAddressTransfers", []))

    @jsii.member(jsii_name="toDescribeAggregateIdFormat")
    def to_describe_aggregate_id_format(self) -> "Ec2":
        '''(experimental) Grants permission to describe the longer ID format settings for all resource types.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAggregateIdFormat.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeAggregateIdFormat", []))

    @jsii.member(jsii_name="toDescribeAvailabilityZones")
    def to_describe_availability_zones(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more of the Availability Zones that are available to you.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAvailabilityZones.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeAvailabilityZones", []))

    @jsii.member(jsii_name="toDescribeAwsNetworkPerformanceMetricSubscriptions")
    def to_describe_aws_network_performance_metric_subscriptions(self) -> "Ec2":
        '''(experimental) Grants permission to describe the current infrastructure performance metric subscriptions.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAwsNetworkPerformanceMetricSubscriptions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeAwsNetworkPerformanceMetricSubscriptions", []))

    @jsii.member(jsii_name="toDescribeBundleTasks")
    def to_describe_bundle_tasks(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more bundling tasks.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeBundleTasks.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeBundleTasks", []))

    @jsii.member(jsii_name="toDescribeByoipCidrs")
    def to_describe_byoip_cidrs(self) -> "Ec2":
        '''(experimental) Grants permission to describe the IP address ranges that were provisioned through bring your own IP addresses (BYOIP).

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeByoipCidrs.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeByoipCidrs", []))

    @jsii.member(jsii_name="toDescribeCapacityReservationFleets")
    def to_describe_capacity_reservation_fleets(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more Capacity Reservation Fleets.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeCapacityReservationFleets.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeCapacityReservationFleets", []))

    @jsii.member(jsii_name="toDescribeCapacityReservations")
    def to_describe_capacity_reservations(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more Capacity Reservations.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeCapacityReservations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeCapacityReservations", []))

    @jsii.member(jsii_name="toDescribeCarrierGateways")
    def to_describe_carrier_gateways(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more Carrier Gateways.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeCarrierGateways.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeCarrierGateways", []))

    @jsii.member(jsii_name="toDescribeClassicLinkInstances")
    def to_describe_classic_link_instances(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more linked EC2-Classic instances.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeClassicLinkInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeClassicLinkInstances", []))

    @jsii.member(jsii_name="toDescribeClientVpnAuthorizationRules")
    def to_describe_client_vpn_authorization_rules(self) -> "Ec2":
        '''(experimental) Grants permission to describe the authorization rules for a Client VPN endpoint.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeClientVpnAuthorizationRules.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeClientVpnAuthorizationRules", []))

    @jsii.member(jsii_name="toDescribeClientVpnConnections")
    def to_describe_client_vpn_connections(self) -> "Ec2":
        '''(experimental) Grants permission to describe active client connections and connections that have been terminated within the last 60 minutes for a Client VPN endpoint.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeClientVpnConnections.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeClientVpnConnections", []))

    @jsii.member(jsii_name="toDescribeClientVpnEndpoints")
    def to_describe_client_vpn_endpoints(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more Client VPN endpoints.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeClientVpnEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeClientVpnEndpoints", []))

    @jsii.member(jsii_name="toDescribeClientVpnRoutes")
    def to_describe_client_vpn_routes(self) -> "Ec2":
        '''(experimental) Grants permission to describe the routes for a Client VPN endpoint.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeClientVpnRoutes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeClientVpnRoutes", []))

    @jsii.member(jsii_name="toDescribeClientVpnTargetNetworks")
    def to_describe_client_vpn_target_networks(self) -> "Ec2":
        '''(experimental) Grants permission to describe the target networks that are associated with a Client VPN endpoint.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeClientVpnTargetNetworks.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeClientVpnTargetNetworks", []))

    @jsii.member(jsii_name="toDescribeCoipPools")
    def to_describe_coip_pools(self) -> "Ec2":
        '''(experimental) Grants permission to describe the specified customer-owned address pools or all of your customer-owned address pools.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeCoipPools.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeCoipPools", []))

    @jsii.member(jsii_name="toDescribeConversionTasks")
    def to_describe_conversion_tasks(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more conversion tasks.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeConversionTasks.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeConversionTasks", []))

    @jsii.member(jsii_name="toDescribeCustomerGateways")
    def to_describe_customer_gateways(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more customer gateways.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeCustomerGateways.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeCustomerGateways", []))

    @jsii.member(jsii_name="toDescribeDhcpOptions")
    def to_describe_dhcp_options(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more DHCP options sets.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeDhcpOptions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeDhcpOptions", []))

    @jsii.member(jsii_name="toDescribeEgressOnlyInternetGateways")
    def to_describe_egress_only_internet_gateways(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more egress-only internet gateways.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeEgressOnlyInternetGateways.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeEgressOnlyInternetGateways", []))

    @jsii.member(jsii_name="toDescribeElasticGpus")
    def to_describe_elastic_gpus(self) -> "Ec2":
        '''(experimental) Grants permission to describe an Elastic Graphics accelerator that is associated with an instance.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeElasticGpus.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeElasticGpus", []))

    @jsii.member(jsii_name="toDescribeExportImageTasks")
    def to_describe_export_image_tasks(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more export image tasks.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeExportImageTasks.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeExportImageTasks", []))

    @jsii.member(jsii_name="toDescribeExportTasks")
    def to_describe_export_tasks(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more export instance tasks.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeExportTasks.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeExportTasks", []))

    @jsii.member(jsii_name="toDescribeFastLaunchImages")
    def to_describe_fast_launch_images(self) -> "Ec2":
        '''(experimental) Grants permission to describe fast-launch enabled Windows AMIs.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeFastLaunchImages.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeFastLaunchImages", []))

    @jsii.member(jsii_name="toDescribeFastSnapshotRestores")
    def to_describe_fast_snapshot_restores(self) -> "Ec2":
        '''(experimental) Grants permission to describe the state of fast snapshot restores for snapshots.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeFastSnapshotRestores.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeFastSnapshotRestores", []))

    @jsii.member(jsii_name="toDescribeFleetHistory")
    def to_describe_fleet_history(self) -> "Ec2":
        '''(experimental) Grants permission to describe the events for an EC2 Fleet during a specified time.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeFleetHistory.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeFleetHistory", []))

    @jsii.member(jsii_name="toDescribeFleetInstances")
    def to_describe_fleet_instances(self) -> "Ec2":
        '''(experimental) Grants permission to describe the running instances for an EC2 Fleet.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeFleetInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeFleetInstances", []))

    @jsii.member(jsii_name="toDescribeFleets")
    def to_describe_fleets(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more EC2 Fleets.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeFleets.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeFleets", []))

    @jsii.member(jsii_name="toDescribeFlowLogs")
    def to_describe_flow_logs(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more flow logs.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeFlowLogs.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeFlowLogs", []))

    @jsii.member(jsii_name="toDescribeFpgaImageAttribute")
    def to_describe_fpga_image_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to describe the attributes of an Amazon FPGA Image (AFI).

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeFpgaImageAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeFpgaImageAttribute", []))

    @jsii.member(jsii_name="toDescribeFpgaImages")
    def to_describe_fpga_images(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more Amazon FPGA Images (AFIs).

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeFpgaImages.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeFpgaImages", []))

    @jsii.member(jsii_name="toDescribeHostReservationOfferings")
    def to_describe_host_reservation_offerings(self) -> "Ec2":
        '''(experimental) Grants permission to describe the Dedicated Host Reservations that are available to purchase.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeHostReservationOfferings.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeHostReservationOfferings", []))

    @jsii.member(jsii_name="toDescribeHostReservations")
    def to_describe_host_reservations(self) -> "Ec2":
        '''(experimental) Grants permission to describe the Dedicated Host Reservations that are associated with Dedicated Hosts in the AWS account.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeHostReservations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeHostReservations", []))

    @jsii.member(jsii_name="toDescribeHosts")
    def to_describe_hosts(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more Dedicated Hosts.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeHosts.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeHosts", []))

    @jsii.member(jsii_name="toDescribeIamInstanceProfileAssociations")
    def to_describe_iam_instance_profile_associations(self) -> "Ec2":
        '''(experimental) Grants permission to describe the IAM instance profile associations.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeIamInstanceProfileAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeIamInstanceProfileAssociations", []))

    @jsii.member(jsii_name="toDescribeIdentityIdFormat")
    def to_describe_identity_id_format(self) -> "Ec2":
        '''(experimental) Grants permission to describe the ID format settings for resources for an IAM user, IAM role, or root user.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeIdentityIdFormat.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeIdentityIdFormat", []))

    @jsii.member(jsii_name="toDescribeIdFormat")
    def to_describe_id_format(self) -> "Ec2":
        '''(experimental) Grants permission to describe the ID format settings for resources.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeIdFormat.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeIdFormat", []))

    @jsii.member(jsii_name="toDescribeImageAttribute")
    def to_describe_image_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to describe an attribute of an Amazon Machine Image (AMI).

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeImageAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeImageAttribute", []))

    @jsii.member(jsii_name="toDescribeImages")
    def to_describe_images(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more images (AMIs, AKIs, and ARIs).

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeImages.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeImages", []))

    @jsii.member(jsii_name="toDescribeImportImageTasks")
    def to_describe_import_image_tasks(self) -> "Ec2":
        '''(experimental) Grants permission to describe import virtual machine or import snapshot tasks.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeImportImageTasks.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeImportImageTasks", []))

    @jsii.member(jsii_name="toDescribeImportSnapshotTasks")
    def to_describe_import_snapshot_tasks(self) -> "Ec2":
        '''(experimental) Grants permission to describe import snapshot tasks.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeImportSnapshotTasks.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeImportSnapshotTasks", []))

    @jsii.member(jsii_name="toDescribeInstanceAttribute")
    def to_describe_instance_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to describe the attributes of an instance.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeInstanceAttribute", []))

    @jsii.member(jsii_name="toDescribeInstanceCreditSpecifications")
    def to_describe_instance_credit_specifications(self) -> "Ec2":
        '''(experimental) Grants permission to describe the credit option for CPU usage of one or more burstable performance instances.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceCreditSpecifications.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeInstanceCreditSpecifications", []))

    @jsii.member(jsii_name="toDescribeInstanceEventNotificationAttributes")
    def to_describe_instance_event_notification_attributes(self) -> "Ec2":
        '''(experimental) Grants permission to describe the set of tags to include in notifications about scheduled events for your instances.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceEventNotificationAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeInstanceEventNotificationAttributes", []))

    @jsii.member(jsii_name="toDescribeInstanceEventWindows")
    def to_describe_instance_event_windows(self) -> "Ec2":
        '''(experimental) Grants permission to describe the specified event windows or all event windows.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceEventWindows.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeInstanceEventWindows", []))

    @jsii.member(jsii_name="toDescribeInstances")
    def to_describe_instances(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more instances.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeInstances", []))

    @jsii.member(jsii_name="toDescribeInstanceStatus")
    def to_describe_instance_status(self) -> "Ec2":
        '''(experimental) Grants permission to describe the status of one or more instances.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceStatus.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeInstanceStatus", []))

    @jsii.member(jsii_name="toDescribeInstanceTypeOfferings")
    def to_describe_instance_type_offerings(self) -> "Ec2":
        '''(experimental) Grants permission to describe the set of instance types that are offered in a location.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypeOfferings.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeInstanceTypeOfferings", []))

    @jsii.member(jsii_name="toDescribeInstanceTypes")
    def to_describe_instance_types(self) -> "Ec2":
        '''(experimental) Grants permission to describe the details of instance types that are offered in a location.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeInstanceTypes", []))

    @jsii.member(jsii_name="toDescribeInternetGateways")
    def to_describe_internet_gateways(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more internet gateways.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInternetGateways.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeInternetGateways", []))

    @jsii.member(jsii_name="toDescribeIpamPools")
    def to_describe_ipam_pools(self) -> "Ec2":
        '''(experimental) Grants permission to describe Amazon VPC IP Address Manager (IPAM) pools.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeIpamPools.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeIpamPools", []))

    @jsii.member(jsii_name="toDescribeIpamResourceDiscoveries")
    def to_describe_ipam_resource_discoveries(self) -> "Ec2":
        '''(experimental) Grants permission to describe IPAM resource discoveries.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeIpamResourceDiscoveries.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeIpamResourceDiscoveries", []))

    @jsii.member(jsii_name="toDescribeIpamResourceDiscoveryAssociations")
    def to_describe_ipam_resource_discovery_associations(self) -> "Ec2":
        '''(experimental) Grants permission to describe resource discovery associations with an Amazon VPC IPAM.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeIpamResourceDiscoveryAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeIpamResourceDiscoveryAssociations", []))

    @jsii.member(jsii_name="toDescribeIpams")
    def to_describe_ipams(self) -> "Ec2":
        '''(experimental) Grants permission to describe an Amazon VPC IP Address Manager (IPAM).

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeIpams.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeIpams", []))

    @jsii.member(jsii_name="toDescribeIpamScopes")
    def to_describe_ipam_scopes(self) -> "Ec2":
        '''(experimental) Grants permission to describe Amazon VPC IP Address Manager (IPAM) scopes.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeIpamScopes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeIpamScopes", []))

    @jsii.member(jsii_name="toDescribeIpv6Pools")
    def to_describe_ipv6_pools(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more IPv6 address pools.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeIpv6Pools.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeIpv6Pools", []))

    @jsii.member(jsii_name="toDescribeKeyPairs")
    def to_describe_key_pairs(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more key pairs.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeKeyPairs.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeKeyPairs", []))

    @jsii.member(jsii_name="toDescribeLaunchTemplates")
    def to_describe_launch_templates(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more launch templates.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLaunchTemplates.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeLaunchTemplates", []))

    @jsii.member(jsii_name="toDescribeLaunchTemplateVersions")
    def to_describe_launch_template_versions(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more launch template versions.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLaunchTemplateVersions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeLaunchTemplateVersions", []))

    @jsii.member(jsii_name="toDescribeLocalGatewayRouteTablePermissions")
    def to_describe_local_gateway_route_table_permissions(self) -> "Ec2":
        '''(experimental) Grants permission to allow a service to describe local gateway route table permissions.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/outposts/latest/userguide/identity-access-management.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeLocalGatewayRouteTablePermissions", []))

    @jsii.member(jsii_name="toDescribeLocalGatewayRouteTables")
    def to_describe_local_gateway_route_tables(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more local gateway route tables.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGatewayRouteTables.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeLocalGatewayRouteTables", []))

    @jsii.member(jsii_name="toDescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations")
    def to_describe_local_gateway_route_table_virtual_interface_group_associations(
        self,
    ) -> "Ec2":
        '''(experimental) Grants permission to describe the associations between virtual interface groups and local gateway route tables.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", []))

    @jsii.member(jsii_name="toDescribeLocalGatewayRouteTableVpcAssociations")
    def to_describe_local_gateway_route_table_vpc_associations(self) -> "Ec2":
        '''(experimental) Grants permission to describe an association between VPCs and local gateway route tables.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGatewayRouteTableVpcAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeLocalGatewayRouteTableVpcAssociations", []))

    @jsii.member(jsii_name="toDescribeLocalGateways")
    def to_describe_local_gateways(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more local gateways.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGateways.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeLocalGateways", []))

    @jsii.member(jsii_name="toDescribeLocalGatewayVirtualInterfaceGroups")
    def to_describe_local_gateway_virtual_interface_groups(self) -> "Ec2":
        '''(experimental) Grants permission to describe local gateway virtual interface groups.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGatewayVirtualInterfaceGroups.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeLocalGatewayVirtualInterfaceGroups", []))

    @jsii.member(jsii_name="toDescribeLocalGatewayVirtualInterfaces")
    def to_describe_local_gateway_virtual_interfaces(self) -> "Ec2":
        '''(experimental) Grants permission to describe local gateway virtual interfaces.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLocalGatewayVirtualInterfaces.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeLocalGatewayVirtualInterfaces", []))

    @jsii.member(jsii_name="toDescribeManagedPrefixLists")
    def to_describe_managed_prefix_lists(self) -> "Ec2":
        '''(experimental) Grants permission to describe your managed prefix lists and any AWS-managed prefix lists.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeManagedPrefixLists.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeManagedPrefixLists", []))

    @jsii.member(jsii_name="toDescribeMovingAddresses")
    def to_describe_moving_addresses(self) -> "Ec2":
        '''(experimental) Grants permission to describe Elastic IP addresses that are being moved to the EC2-VPC platform.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeMovingAddresses.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeMovingAddresses", []))

    @jsii.member(jsii_name="toDescribeNatGateways")
    def to_describe_nat_gateways(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more NAT gateways.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNatGateways.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeNatGateways", []))

    @jsii.member(jsii_name="toDescribeNetworkAcls")
    def to_describe_network_acls(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more network ACLs.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkAcls.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeNetworkAcls", []))

    @jsii.member(jsii_name="toDescribeNetworkInsightsAccessScopeAnalyses")
    def to_describe_network_insights_access_scope_analyses(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more Network Access Scope analyses.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInsightsAccessScopeAnalyses.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeNetworkInsightsAccessScopeAnalyses", []))

    @jsii.member(jsii_name="toDescribeNetworkInsightsAccessScopes")
    def to_describe_network_insights_access_scopes(self) -> "Ec2":
        '''(experimental) Grants permission to describe the Network Access Scopes.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInsightsAccessScopes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeNetworkInsightsAccessScopes", []))

    @jsii.member(jsii_name="toDescribeNetworkInsightsAnalyses")
    def to_describe_network_insights_analyses(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more network insights analyses.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInsightsAnalyses.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeNetworkInsightsAnalyses", []))

    @jsii.member(jsii_name="toDescribeNetworkInsightsPaths")
    def to_describe_network_insights_paths(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more network insights paths.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInsightsPaths.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeNetworkInsightsPaths", []))

    @jsii.member(jsii_name="toDescribeNetworkInterfaceAttribute")
    def to_describe_network_interface_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to describe a network interface attribute.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInterfaceAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeNetworkInterfaceAttribute", []))

    @jsii.member(jsii_name="toDescribeNetworkInterfacePermissions")
    def to_describe_network_interface_permissions(self) -> "Ec2":
        '''(experimental) Grants permission to describe the permissions that are associated with a network interface.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInterfacePermissions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeNetworkInterfacePermissions", []))

    @jsii.member(jsii_name="toDescribeNetworkInterfaces")
    def to_describe_network_interfaces(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more network interfaces.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInterfaces.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeNetworkInterfaces", []))

    @jsii.member(jsii_name="toDescribePlacementGroups")
    def to_describe_placement_groups(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more placement groups.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribePlacementGroups.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribePlacementGroups", []))

    @jsii.member(jsii_name="toDescribePrefixLists")
    def to_describe_prefix_lists(self) -> "Ec2":
        '''(experimental) Grants permission to describe available AWS services in a prefix list format.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribePrefixLists.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribePrefixLists", []))

    @jsii.member(jsii_name="toDescribePrincipalIdFormat")
    def to_describe_principal_id_format(self) -> "Ec2":
        '''(experimental) Grants permission to describe the ID format settings for the root user and all IAM roles and IAM users that have explicitly specified a longer ID (17-character ID) preference.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribePrincipalIdFormat.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribePrincipalIdFormat", []))

    @jsii.member(jsii_name="toDescribePublicIpv4Pools")
    def to_describe_public_ipv4_pools(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more IPv4 address pools.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribePublicIpv4Pools.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribePublicIpv4Pools", []))

    @jsii.member(jsii_name="toDescribeRegions")
    def to_describe_regions(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more AWS Regions that are currently available in your account.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeRegions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeRegions", []))

    @jsii.member(jsii_name="toDescribeReplaceRootVolumeTasks")
    def to_describe_replace_root_volume_tasks(self) -> "Ec2":
        '''(experimental) Grants permission to describe a root volume replacement task.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeReplaceRootVolumeTasks.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeReplaceRootVolumeTasks", []))

    @jsii.member(jsii_name="toDescribeReservedInstances")
    def to_describe_reserved_instances(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more purchased Reserved Instances in your account.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeReservedInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeReservedInstances", []))

    @jsii.member(jsii_name="toDescribeReservedInstancesListings")
    def to_describe_reserved_instances_listings(self) -> "Ec2":
        '''(experimental) Grants permission to describe your account's Reserved Instance listings in the Reserved Instance Marketplace.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeReservedInstancesListings.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeReservedInstancesListings", []))

    @jsii.member(jsii_name="toDescribeReservedInstancesModifications")
    def to_describe_reserved_instances_modifications(self) -> "Ec2":
        '''(experimental) Grants permission to describe the modifications made to one or more Reserved Instances.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeReservedInstancesModifications.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeReservedInstancesModifications", []))

    @jsii.member(jsii_name="toDescribeReservedInstancesOfferings")
    def to_describe_reserved_instances_offerings(self) -> "Ec2":
        '''(experimental) Grants permission to describe the Reserved Instance offerings that are available for purchase.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeReservedInstancesOfferings.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeReservedInstancesOfferings", []))

    @jsii.member(jsii_name="toDescribeRouteTables")
    def to_describe_route_tables(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more route tables.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeRouteTables.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeRouteTables", []))

    @jsii.member(jsii_name="toDescribeScheduledInstanceAvailability")
    def to_describe_scheduled_instance_availability(self) -> "Ec2":
        '''(experimental) Grants permission to find available schedules for Scheduled Instances.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeScheduledInstanceAvailability.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeScheduledInstanceAvailability", []))

    @jsii.member(jsii_name="toDescribeScheduledInstances")
    def to_describe_scheduled_instances(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more Scheduled Instances in your account.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeScheduledInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeScheduledInstances", []))

    @jsii.member(jsii_name="toDescribeSecurityGroupReferences")
    def to_describe_security_group_references(self) -> "Ec2":
        '''(experimental) Grants permission to describe the VPCs on the other side of a VPC peering connection that are referencing specified VPC security groups.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroupReferences.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSecurityGroupReferences", []))

    @jsii.member(jsii_name="toDescribeSecurityGroupRules")
    def to_describe_security_group_rules(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more of your security group rules.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroupRules.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSecurityGroupRules", []))

    @jsii.member(jsii_name="toDescribeSecurityGroups")
    def to_describe_security_groups(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more security groups.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroups.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSecurityGroups", []))

    @jsii.member(jsii_name="toDescribeSnapshotAttribute")
    def to_describe_snapshot_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to describe an attribute of a snapshot.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSnapshotAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSnapshotAttribute", []))

    @jsii.member(jsii_name="toDescribeSnapshots")
    def to_describe_snapshots(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more EBS snapshots.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSnapshots", []))

    @jsii.member(jsii_name="toDescribeSnapshotTierStatus")
    def to_describe_snapshot_tier_status(self) -> "Ec2":
        '''(experimental) Grants permission to describe the storage tier status for Amazon EBS snapshots.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSnapshotTierStatus.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSnapshotTierStatus", []))

    @jsii.member(jsii_name="toDescribeSpotDatafeedSubscription")
    def to_describe_spot_datafeed_subscription(self) -> "Ec2":
        '''(experimental) Grants permission to describe the data feed for Spot Instances.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSpotDatafeedSubscription.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSpotDatafeedSubscription", []))

    @jsii.member(jsii_name="toDescribeSpotFleetInstances")
    def to_describe_spot_fleet_instances(self) -> "Ec2":
        '''(experimental) Grants permission to describe the running instances for a Spot Fleet.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSpotFleetInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSpotFleetInstances", []))

    @jsii.member(jsii_name="toDescribeSpotFleetRequestHistory")
    def to_describe_spot_fleet_request_history(self) -> "Ec2":
        '''(experimental) Grants permission to describe the events for a Spot Fleet request during a specified time.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSpotFleetRequestHistory.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSpotFleetRequestHistory", []))

    @jsii.member(jsii_name="toDescribeSpotFleetRequests")
    def to_describe_spot_fleet_requests(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more Spot Fleet requests.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSpotFleetRequests.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSpotFleetRequests", []))

    @jsii.member(jsii_name="toDescribeSpotInstanceRequests")
    def to_describe_spot_instance_requests(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more Spot Instance requests.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSpotInstanceRequests.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSpotInstanceRequests", []))

    @jsii.member(jsii_name="toDescribeSpotPriceHistory")
    def to_describe_spot_price_history(self) -> "Ec2":
        '''(experimental) Grants permission to describe the Spot Instance price history.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSpotPriceHistory.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSpotPriceHistory", []))

    @jsii.member(jsii_name="toDescribeStaleSecurityGroups")
    def to_describe_stale_security_groups(self) -> "Ec2":
        '''(experimental) Grants permission to describe the stale security group rules for security groups in a specified VPC.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeStaleSecurityGroups.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeStaleSecurityGroups", []))

    @jsii.member(jsii_name="toDescribeStoreImageTasks")
    def to_describe_store_image_tasks(self) -> "Ec2":
        '''(experimental) Grants permission to describe the progress of the AMI store tasks.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeStoreImageTasks.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeStoreImageTasks", []))

    @jsii.member(jsii_name="toDescribeSubnets")
    def to_describe_subnets(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more subnets.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSubnets.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeSubnets", []))

    @jsii.member(jsii_name="toDescribeTags")
    def to_describe_tags(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more tags for an Amazon EC2 resource.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTags.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTags", []))

    @jsii.member(jsii_name="toDescribeTrafficMirrorFilters")
    def to_describe_traffic_mirror_filters(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more traffic mirror filters.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTrafficMirrorFilters.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTrafficMirrorFilters", []))

    @jsii.member(jsii_name="toDescribeTrafficMirrorSessions")
    def to_describe_traffic_mirror_sessions(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more traffic mirror sessions.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTrafficMirrorSessions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTrafficMirrorSessions", []))

    @jsii.member(jsii_name="toDescribeTrafficMirrorTargets")
    def to_describe_traffic_mirror_targets(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more traffic mirror targets.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTrafficMirrorTargets.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTrafficMirrorTargets", []))

    @jsii.member(jsii_name="toDescribeTransitGatewayAttachments")
    def to_describe_transit_gateway_attachments(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more attachments between resources and transit gateways.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayAttachments.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTransitGatewayAttachments", []))

    @jsii.member(jsii_name="toDescribeTransitGatewayConnectPeers")
    def to_describe_transit_gateway_connect_peers(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more transit gateway connect peers.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayConnectPeers.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTransitGatewayConnectPeers", []))

    @jsii.member(jsii_name="toDescribeTransitGatewayConnects")
    def to_describe_transit_gateway_connects(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more transit gateway connect attachments.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayConnects.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTransitGatewayConnects", []))

    @jsii.member(jsii_name="toDescribeTransitGatewayMulticastDomains")
    def to_describe_transit_gateway_multicast_domains(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more transit gateway multicast domains.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayMulticastDomains.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTransitGatewayMulticastDomains", []))

    @jsii.member(jsii_name="toDescribeTransitGatewayPeeringAttachments")
    def to_describe_transit_gateway_peering_attachments(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more transit gateway peering attachments.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayPeeringAttachments.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTransitGatewayPeeringAttachments", []))

    @jsii.member(jsii_name="toDescribeTransitGatewayPolicyTables")
    def to_describe_transit_gateway_policy_tables(self) -> "Ec2":
        '''(experimental) Grants permission to describe a transit gateway policy table.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayPolicyTables.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTransitGatewayPolicyTables", []))

    @jsii.member(jsii_name="toDescribeTransitGatewayRouteTableAnnouncements")
    def to_describe_transit_gateway_route_table_announcements(self) -> "Ec2":
        '''(experimental) Grants permission to describe a transit gateway route table announcement.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayRouteTableAnnouncements.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTransitGatewayRouteTableAnnouncements", []))

    @jsii.member(jsii_name="toDescribeTransitGatewayRouteTables")
    def to_describe_transit_gateway_route_tables(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more transit gateway route tables.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayRouteTables.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTransitGatewayRouteTables", []))

    @jsii.member(jsii_name="toDescribeTransitGateways")
    def to_describe_transit_gateways(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more transit gateways.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGateways.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTransitGateways", []))

    @jsii.member(jsii_name="toDescribeTransitGatewayVpcAttachments")
    def to_describe_transit_gateway_vpc_attachments(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more VPC attachments on a transit gateway.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTransitGatewayVpcAttachments.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTransitGatewayVpcAttachments", []))

    @jsii.member(jsii_name="toDescribeTrunkInterfaceAssociations")
    def to_describe_trunk_interface_associations(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more network interface trunk associations.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTrunkInterfaceAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeTrunkInterfaceAssociations", []))

    @jsii.member(jsii_name="toDescribeVerifiedAccessEndpoints")
    def to_describe_verified_access_endpoints(self) -> "Ec2":
        '''(experimental) Grants permission to describe the specified Verified Access endpoints or all Verified Access endpoints.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVerifiedAccessEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVerifiedAccessEndpoints", []))

    @jsii.member(jsii_name="toDescribeVerifiedAccessGroups")
    def to_describe_verified_access_groups(self) -> "Ec2":
        '''(experimental) Grants permission to describe the specified Verified Access groups or all Verified Access groups.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVerifiedAccessGroups.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVerifiedAccessGroups", []))

    @jsii.member(jsii_name="toDescribeVerifiedAccessInstanceLoggingConfigurations")
    def to_describe_verified_access_instance_logging_configurations(self) -> "Ec2":
        '''(experimental) Grants permission to describe the current logging configuration for the Verified Access instances.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVerifiedAccessInstanceLoggingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVerifiedAccessInstanceLoggingConfigurations", []))

    @jsii.member(jsii_name="toDescribeVerifiedAccessInstances")
    def to_describe_verified_access_instances(self) -> "Ec2":
        '''(experimental) Grants permission to describe the specified Verified Access instances or all Verified Access instances.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVerifiedAccessInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVerifiedAccessInstances", []))

    @jsii.member(jsii_name="toDescribeVerifiedAccessTrustProviders")
    def to_describe_verified_access_trust_providers(self) -> "Ec2":
        '''(experimental) Grants permission to describe details of existing Verified Access trust providers.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVerifiedAccessTrustProviders.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVerifiedAccessTrustProviders", []))

    @jsii.member(jsii_name="toDescribeVolumeAttribute")
    def to_describe_volume_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to describe an attribute of an EBS volume.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVolumeAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVolumeAttribute", []))

    @jsii.member(jsii_name="toDescribeVolumes")
    def to_describe_volumes(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more EBS volumes.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVolumes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVolumes", []))

    @jsii.member(jsii_name="toDescribeVolumesModifications")
    def to_describe_volumes_modifications(self) -> "Ec2":
        '''(experimental) Grants permission to describe the current modification status of one or more EBS volumes.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVolumesModifications.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVolumesModifications", []))

    @jsii.member(jsii_name="toDescribeVolumeStatus")
    def to_describe_volume_status(self) -> "Ec2":
        '''(experimental) Grants permission to describe the status of one or more EBS volumes.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVolumeStatus.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVolumeStatus", []))

    @jsii.member(jsii_name="toDescribeVpcAttribute")
    def to_describe_vpc_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to describe an attribute of a VPC.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcAttribute", []))

    @jsii.member(jsii_name="toDescribeVpcClassicLink")
    def to_describe_vpc_classic_link(self) -> "Ec2":
        '''(experimental) Grants permission to describe the ClassicLink status of one or more VPCs.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcClassicLink.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcClassicLink", []))

    @jsii.member(jsii_name="toDescribeVpcClassicLinkDnsSupport")
    def to_describe_vpc_classic_link_dns_support(self) -> "Ec2":
        '''(experimental) Grants permission to describe the ClassicLink DNS support status of one or more VPCs.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcClassicLinkDnsSupport.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcClassicLinkDnsSupport", []))

    @jsii.member(jsii_name="toDescribeVpcEndpointConnectionNotifications")
    def to_describe_vpc_endpoint_connection_notifications(self) -> "Ec2":
        '''(experimental) Grants permission to describe the connection notifications for VPC endpoints and VPC endpoint services.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcEndpointConnectionNotifications.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcEndpointConnectionNotifications", []))

    @jsii.member(jsii_name="toDescribeVpcEndpointConnections")
    def to_describe_vpc_endpoint_connections(self) -> "Ec2":
        '''(experimental) Grants permission to describe the VPC endpoint connections to your VPC endpoint services.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcEndpointConnections.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcEndpointConnections", []))

    @jsii.member(jsii_name="toDescribeVpcEndpoints")
    def to_describe_vpc_endpoints(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more VPC endpoints.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcEndpoints", []))

    @jsii.member(jsii_name="toDescribeVpcEndpointServiceConfigurations")
    def to_describe_vpc_endpoint_service_configurations(self) -> "Ec2":
        '''(experimental) Grants permission to describe VPC endpoint service configurations (your services).

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcEndpointServiceConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcEndpointServiceConfigurations", []))

    @jsii.member(jsii_name="toDescribeVpcEndpointServicePermissions")
    def to_describe_vpc_endpoint_service_permissions(self) -> "Ec2":
        '''(experimental) Grants permission to describe the principals (service consumers) that are permitted to discover your VPC endpoint service.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcEndpointServicePermissions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcEndpointServicePermissions", []))

    @jsii.member(jsii_name="toDescribeVpcEndpointServices")
    def to_describe_vpc_endpoint_services(self) -> "Ec2":
        '''(experimental) Grants permission to describe all supported AWS services that can be specified when creating a VPC endpoint.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcEndpointServices.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcEndpointServices", []))

    @jsii.member(jsii_name="toDescribeVpcPeeringConnections")
    def to_describe_vpc_peering_connections(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more VPC peering connections.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcPeeringConnections.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcPeeringConnections", []))

    @jsii.member(jsii_name="toDescribeVpcs")
    def to_describe_vpcs(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more VPCs.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcs.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpcs", []))

    @jsii.member(jsii_name="toDescribeVpnConnections")
    def to_describe_vpn_connections(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more VPN connections.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpnConnections.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpnConnections", []))

    @jsii.member(jsii_name="toDescribeVpnGateways")
    def to_describe_vpn_gateways(self) -> "Ec2":
        '''(experimental) Grants permission to describe one or more virtual private gateways.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpnGateways.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDescribeVpnGateways", []))

    @jsii.member(jsii_name="toDetachClassicLinkVpc")
    def to_detach_classic_link_vpc(self) -> "Ec2":
        '''(experimental) Grants permission to unlink (detach) a linked EC2-Classic instance from a VPC.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DetachClassicLinkVpc.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDetachClassicLinkVpc", []))

    @jsii.member(jsii_name="toDetachInternetGateway")
    def to_detach_internet_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to detach an internet gateway from a VPC.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DetachInternetGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDetachInternetGateway", []))

    @jsii.member(jsii_name="toDetachNetworkInterface")
    def to_detach_network_interface(self) -> "Ec2":
        '''(experimental) Grants permission to detach a network interface from an instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DetachNetworkInterface.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDetachNetworkInterface", []))

    @jsii.member(jsii_name="toDetachVerifiedAccessTrustProvider")
    def to_detach_verified_access_trust_provider(self) -> "Ec2":
        '''(experimental) Grants permission to detach a trust provider from a Verified Access instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DetachVerifiedAccessTrustProvider.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDetachVerifiedAccessTrustProvider", []))

    @jsii.member(jsii_name="toDetachVolume")
    def to_detach_volume(self) -> "Ec2":
        '''(experimental) Grants permission to detach an EBS volume from an instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DetachVolume.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDetachVolume", []))

    @jsii.member(jsii_name="toDetachVpnGateway")
    def to_detach_vpn_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to detach a virtual private gateway from a VPC.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DetachVpnGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDetachVpnGateway", []))

    @jsii.member(jsii_name="toDisableAddressTransfer")
    def to_disable_address_transfer(self) -> "Ec2":
        '''(experimental) Grants permission to disable Elastic IP address transfer.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableAddressTransfer.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisableAddressTransfer", []))

    @jsii.member(jsii_name="toDisableAwsNetworkPerformanceMetricSubscription")
    def to_disable_aws_network_performance_metric_subscription(self) -> "Ec2":
        '''(experimental) Grants permission to disable infrastructure performance metric subscriptions.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableAwsNetworkPerformanceMetricSubscription.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisableAwsNetworkPerformanceMetricSubscription", []))

    @jsii.member(jsii_name="toDisableEbsEncryptionByDefault")
    def to_disable_ebs_encryption_by_default(self) -> "Ec2":
        '''(experimental) Grants permission to disable EBS encryption by default for your account.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableEbsEncryptionByDefault.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisableEbsEncryptionByDefault", []))

    @jsii.member(jsii_name="toDisableFastLaunch")
    def to_disable_fast_launch(self) -> "Ec2":
        '''(experimental) Grants permission to disable faster launching for Windows AMIs.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableFastLaunch.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisableFastLaunch", []))

    @jsii.member(jsii_name="toDisableFastSnapshotRestores")
    def to_disable_fast_snapshot_restores(self) -> "Ec2":
        '''(experimental) Grants permission to disable fast snapshot restores for one or more snapshots in specified Availability Zones.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableFastSnapshotRestores.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisableFastSnapshotRestores", []))

    @jsii.member(jsii_name="toDisableImageDeprecation")
    def to_disable_image_deprecation(self) -> "Ec2":
        '''(experimental) Grants permission to cancel the deprecation of the specified AMI.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableImageDeprecation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisableImageDeprecation", []))

    @jsii.member(jsii_name="toDisableIpamOrganizationAdminAccount")
    def to_disable_ipam_organization_admin_account(self) -> "Ec2":
        '''(experimental) Grants permission to disable an AWS Organizations member account as an Amazon VPC IP Address Manager (IPAM) admin account.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        Dependent actions:

        - organizations:DeregisterDelegatedAdministrator

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableIpamOrganizationAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisableIpamOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toDisableSerialConsoleAccess")
    def to_disable_serial_console_access(self) -> "Ec2":
        '''(experimental) Grants permission to disable access to the EC2 serial console of all instances for your account.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableSerialConsoleAccess.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisableSerialConsoleAccess", []))

    @jsii.member(jsii_name="toDisableTransitGatewayRouteTablePropagation")
    def to_disable_transit_gateway_route_table_propagation(self) -> "Ec2":
        '''(experimental) Grants permission to disable a resource attachment from propagating routes to the specified propagation route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableTransitGatewayRouteTablePropagation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisableTransitGatewayRouteTablePropagation", []))

    @jsii.member(jsii_name="toDisableVgwRoutePropagation")
    def to_disable_vgw_route_propagation(self) -> "Ec2":
        '''(experimental) Grants permission to disable a virtual private gateway from propagating routes to a specified route table of a VPC.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableVgwRoutePropagation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisableVgwRoutePropagation", []))

    @jsii.member(jsii_name="toDisableVpcClassicLink")
    def to_disable_vpc_classic_link(self) -> "Ec2":
        '''(experimental) Grants permission to disable ClassicLink for a VPC.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableVpcClassicLink.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisableVpcClassicLink", []))

    @jsii.member(jsii_name="toDisableVpcClassicLinkDnsSupport")
    def to_disable_vpc_classic_link_dns_support(self) -> "Ec2":
        '''(experimental) Grants permission to disable ClassicLink DNS support for a VPC.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableVpcClassicLinkDnsSupport.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisableVpcClassicLinkDnsSupport", []))

    @jsii.member(jsii_name="toDisassociateAddress")
    def to_disassociate_address(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate an Elastic IP address from an instance or network interface.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateAddress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateAddress", []))

    @jsii.member(jsii_name="toDisassociateClientVpnTargetNetwork")
    def to_disassociate_client_vpn_target_network(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate a target network from a Client VPN endpoint.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateClientVpnTargetNetwork.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateClientVpnTargetNetwork", []))

    @jsii.member(jsii_name="toDisassociateEnclaveCertificateIamRole")
    def to_disassociate_enclave_certificate_iam_role(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate an ACM certificate from a IAM role.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateEnclaveCertificateIamRole.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateEnclaveCertificateIamRole", []))

    @jsii.member(jsii_name="toDisassociateIamInstanceProfile")
    def to_disassociate_iam_instance_profile(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate an IAM instance profile from a running or stopped instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateIamInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateIamInstanceProfile", []))

    @jsii.member(jsii_name="toDisassociateInstanceEventWindow")
    def to_disassociate_instance_event_window(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate one or more targets from an event window.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateInstanceEventWindow.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateInstanceEventWindow", []))

    @jsii.member(jsii_name="toDisassociateIpamResourceDiscovery")
    def to_disassociate_ipam_resource_discovery(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate a resource discovery from an Amazon VPC IPAM.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateIpamResourceDiscovery.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateIpamResourceDiscovery", []))

    @jsii.member(jsii_name="toDisassociateNatGatewayAddress")
    def to_disassociate_nat_gateway_address(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate a secondary Elastic IP address from a public NAT gateway.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateNatGatewayAddress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateNatGatewayAddress", []))

    @jsii.member(jsii_name="toDisassociateRouteTable")
    def to_disassociate_route_table(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate a subnet from a route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateRouteTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateRouteTable", []))

    @jsii.member(jsii_name="toDisassociateSubnetCidrBlock")
    def to_disassociate_subnet_cidr_block(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate a CIDR block from a subnet.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateSubnetCidrBlock.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateSubnetCidrBlock", []))

    @jsii.member(jsii_name="toDisassociateTransitGatewayMulticastDomain")
    def to_disassociate_transit_gateway_multicast_domain(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate one or more subnets from a transit gateway multicast domain.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateTransitGatewayMulticastDomain.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateTransitGatewayMulticastDomain", []))

    @jsii.member(jsii_name="toDisassociateTransitGatewayPolicyTable")
    def to_disassociate_transit_gateway_policy_table(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate a policy table from a transit gateway.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateTransitGatewayPolicyTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateTransitGatewayPolicyTable", []))

    @jsii.member(jsii_name="toDisassociateTransitGatewayRouteTable")
    def to_disassociate_transit_gateway_route_table(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate a resource attachment from a transit gateway route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateTransitGatewayRouteTable.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateTransitGatewayRouteTable", []))

    @jsii.member(jsii_name="toDisassociateTrunkInterface")
    def to_disassociate_trunk_interface(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate a branch network interface to a trunk network interface.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateTrunkInterface.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateTrunkInterface", []))

    @jsii.member(jsii_name="toDisassociateVpcCidrBlock")
    def to_disassociate_vpc_cidr_block(self) -> "Ec2":
        '''(experimental) Grants permission to disassociate a CIDR block from a VPC.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateVpcCidrBlock.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toDisassociateVpcCidrBlock", []))

    @jsii.member(jsii_name="toEnableAddressTransfer")
    def to_enable_address_transfer(self) -> "Ec2":
        '''(experimental) Grants permission to enable Elastic IP address transfer.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableAddressTransfer.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableAddressTransfer", []))

    @jsii.member(jsii_name="toEnableAwsNetworkPerformanceMetricSubscription")
    def to_enable_aws_network_performance_metric_subscription(self) -> "Ec2":
        '''(experimental) Grants permission to enable infrastructure performance subscriptions.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableAwsNetworkPerformanceMetricSubscription.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableAwsNetworkPerformanceMetricSubscription", []))

    @jsii.member(jsii_name="toEnableEbsEncryptionByDefault")
    def to_enable_ebs_encryption_by_default(self) -> "Ec2":
        '''(experimental) Grants permission to enable EBS encryption by default for your account.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableEbsEncryptionByDefault.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableEbsEncryptionByDefault", []))

    @jsii.member(jsii_name="toEnableFastLaunch")
    def to_enable_fast_launch(self) -> "Ec2":
        '''(experimental) Grants permission to enable faster launching for Windows AMIs.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableFastLaunch.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableFastLaunch", []))

    @jsii.member(jsii_name="toEnableFastSnapshotRestores")
    def to_enable_fast_snapshot_restores(self) -> "Ec2":
        '''(experimental) Grants permission to enable fast snapshot restores for one or more snapshots in specified Availability Zones.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableFastSnapshotRestores.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableFastSnapshotRestores", []))

    @jsii.member(jsii_name="toEnableImageDeprecation")
    def to_enable_image_deprecation(self) -> "Ec2":
        '''(experimental) Grants permission to enable deprecation of the specified AMI at the specified date and time.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableImageDeprecation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableImageDeprecation", []))

    @jsii.member(jsii_name="toEnableIpamOrganizationAdminAccount")
    def to_enable_ipam_organization_admin_account(self) -> "Ec2":
        '''(experimental) Grants permission to enable an AWS Organizations member account as an Amazon VPC IP Address Manager (IPAM) admin account.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - organizations:EnableAWSServiceAccess
        - organizations:RegisterDelegatedAdministrator

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableIpamOrganizationAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableIpamOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toEnableReachabilityAnalyzerOrganizationSharing")
    def to_enable_reachability_analyzer_organization_sharing(self) -> "Ec2":
        '''(experimental) Grants permission to enable organization sharing of reachability analyzer.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - organizations:EnableAWSServiceAccess

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableReachabilityAnalyzerOrganizationSharing.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableReachabilityAnalyzerOrganizationSharing", []))

    @jsii.member(jsii_name="toEnableSerialConsoleAccess")
    def to_enable_serial_console_access(self) -> "Ec2":
        '''(experimental) Grants permission to enable access to the EC2 serial console of all instances for your account.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableSerialConsoleAccess.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableSerialConsoleAccess", []))

    @jsii.member(jsii_name="toEnableTransitGatewayRouteTablePropagation")
    def to_enable_transit_gateway_route_table_propagation(self) -> "Ec2":
        '''(experimental) Grants permission to enable an attachment to propagate routes to a propagation route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableTransitGatewayRouteTablePropagation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableTransitGatewayRouteTablePropagation", []))

    @jsii.member(jsii_name="toEnableVgwRoutePropagation")
    def to_enable_vgw_route_propagation(self) -> "Ec2":
        '''(experimental) Grants permission to enable a virtual private gateway to propagate routes to a VPC route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableVgwRoutePropagation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableVgwRoutePropagation", []))

    @jsii.member(jsii_name="toEnableVolumeIO")
    def to_enable_volume_io(self) -> "Ec2":
        '''(experimental) Grants permission to enable I/O operations for a volume that had I/O operations disabled.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableVolumeIO.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableVolumeIO", []))

    @jsii.member(jsii_name="toEnableVpcClassicLink")
    def to_enable_vpc_classic_link(self) -> "Ec2":
        '''(experimental) Grants permission to enable a VPC for ClassicLink.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableVpcClassicLink.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableVpcClassicLink", []))

    @jsii.member(jsii_name="toEnableVpcClassicLinkDnsSupport")
    def to_enable_vpc_classic_link_dns_support(self) -> "Ec2":
        '''(experimental) Grants permission to enable a VPC to support DNS hostname resolution for ClassicLink.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_EnableVpcClassicLinkDnsSupport.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toEnableVpcClassicLinkDnsSupport", []))

    @jsii.member(jsii_name="toExportClientVpnClientCertificateRevocationList")
    def to_export_client_vpn_client_certificate_revocation_list(self) -> "Ec2":
        '''(experimental) Grants permission to download the client certificate revocation list for a Client VPN endpoint.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ExportClientVpnClientCertificateRevocationList.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toExportClientVpnClientCertificateRevocationList", []))

    @jsii.member(jsii_name="toExportClientVpnClientConfiguration")
    def to_export_client_vpn_client_configuration(self) -> "Ec2":
        '''(experimental) Grants permission to download the contents of the Client VPN endpoint configuration file for a Client VPN endpoint.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ExportClientVpnClientConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toExportClientVpnClientConfiguration", []))

    @jsii.member(jsii_name="toExportImage")
    def to_export_image(self) -> "Ec2":
        '''(experimental) Grants permission to export an Amazon Machine Image (AMI) to a VM file.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ExportImage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toExportImage", []))

    @jsii.member(jsii_name="toExportTransitGatewayRoutes")
    def to_export_transit_gateway_routes(self) -> "Ec2":
        '''(experimental) Grants permission to export routes from a transit gateway route table to an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ExportTransitGatewayRoutes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toExportTransitGatewayRoutes", []))

    @jsii.member(jsii_name="toGetAssociatedEnclaveCertificateIamRoles")
    def to_get_associated_enclave_certificate_iam_roles(self) -> "Ec2":
        '''(experimental) Grants permission to get the list of roles associated with an ACM certificate.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetAssociatedEnclaveCertificateIamRoles.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetAssociatedEnclaveCertificateIamRoles", []))

    @jsii.member(jsii_name="toGetAssociatedIpv6PoolCidrs")
    def to_get_associated_ipv6_pool_cidrs(self) -> "Ec2":
        '''(experimental) Grants permission to get information about the IPv6 CIDR block associations for a specified IPv6 address pool.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetAssociatedIpv6PoolCidrs.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetAssociatedIpv6PoolCidrs", []))

    @jsii.member(jsii_name="toGetAwsNetworkPerformanceData")
    def to_get_aws_network_performance_data(self) -> "Ec2":
        '''(experimental) Grants permission to get network performance data.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetAwsNetworkPerformanceData.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetAwsNetworkPerformanceData", []))

    @jsii.member(jsii_name="toGetCapacityReservationUsage")
    def to_get_capacity_reservation_usage(self) -> "Ec2":
        '''(experimental) Grants permission to get usage information about a Capacity Reservation.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetCapacityReservationUsage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetCapacityReservationUsage", []))

    @jsii.member(jsii_name="toGetCoipPoolUsage")
    def to_get_coip_pool_usage(self) -> "Ec2":
        '''(experimental) Grants permission to describe the allocations from the specified customer-owned address pool.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetCoipPoolUsage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetCoipPoolUsage", []))

    @jsii.member(jsii_name="toGetConsoleOutput")
    def to_get_console_output(self) -> "Ec2":
        '''(experimental) Grants permission to get the console output for an instance.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetConsoleOutput.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetConsoleOutput", []))

    @jsii.member(jsii_name="toGetConsoleScreenshot")
    def to_get_console_screenshot(self) -> "Ec2":
        '''(experimental) Grants permission to retrieve a JPG-format screenshot of a running instance.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetConsoleScreenshot.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetConsoleScreenshot", []))

    @jsii.member(jsii_name="toGetDefaultCreditSpecification")
    def to_get_default_credit_specification(self) -> "Ec2":
        '''(experimental) Grants permission to get the default credit option for CPU usage of a burstable performance instance family.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetDefaultCreditSpecification.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetDefaultCreditSpecification", []))

    @jsii.member(jsii_name="toGetEbsDefaultKmsKeyId")
    def to_get_ebs_default_kms_key_id(self) -> "Ec2":
        '''(experimental) Grants permission to get the ID of the default customer master key (CMK) for EBS encryption by default.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetEbsDefaultKmsKeyId.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetEbsDefaultKmsKeyId", []))

    @jsii.member(jsii_name="toGetEbsEncryptionByDefault")
    def to_get_ebs_encryption_by_default(self) -> "Ec2":
        '''(experimental) Grants permission to describe whether EBS encryption by default is enabled for your account.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetEbsEncryptionByDefault.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetEbsEncryptionByDefault", []))

    @jsii.member(jsii_name="toGetFlowLogsIntegrationTemplate")
    def to_get_flow_logs_integration_template(self) -> "Ec2":
        '''(experimental) Grants permission to generate a CloudFormation template to streamline the integration of VPC flow logs with Amazon Athena.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetFlowLogsIntegrationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetFlowLogsIntegrationTemplate", []))

    @jsii.member(jsii_name="toGetGroupsForCapacityReservation")
    def to_get_groups_for_capacity_reservation(self) -> "Ec2":
        '''(experimental) Grants permission to list the resource groups to which a Capacity Reservation has been added.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetGroupsForCapacityReservation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetGroupsForCapacityReservation", []))

    @jsii.member(jsii_name="toGetHostReservationPurchasePreview")
    def to_get_host_reservation_purchase_preview(self) -> "Ec2":
        '''(experimental) Grants permission to preview a reservation purchase with configurations that match those of a Dedicated Host.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetHostReservationPurchasePreview.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetHostReservationPurchasePreview", []))

    @jsii.member(jsii_name="toGetInstanceTypesFromInstanceRequirements")
    def to_get_instance_types_from_instance_requirements(self) -> "Ec2":
        '''(experimental) Grants permission to view a list of instance types with specified instance attributes.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetInstanceTypesFromInstanceRequirements.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetInstanceTypesFromInstanceRequirements", []))

    @jsii.member(jsii_name="toGetInstanceUefiData")
    def to_get_instance_uefi_data(self) -> "Ec2":
        '''(experimental) Grants permission to retrieve the binary representation of the UEFI variable store.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetInstanceUefiData.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetInstanceUefiData", []))

    @jsii.member(jsii_name="toGetIpamAddressHistory")
    def to_get_ipam_address_history(self) -> "Ec2":
        '''(experimental) Grants permission to retrieve historical information about a CIDR within an Amazon VPC IP Address Manager (IPAM) scope.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetIpamAddressHistory.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetIpamAddressHistory", []))

    @jsii.member(jsii_name="toGetIpamDiscoveredAccounts")
    def to_get_ipam_discovered_accounts(self) -> "Ec2":
        '''(experimental) Grants permission to retrieve IPAM discovered accounts.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetIpamDiscoveredAccounts.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetIpamDiscoveredAccounts", []))

    @jsii.member(jsii_name="toGetIpamDiscoveredResourceCidrs")
    def to_get_ipam_discovered_resource_cidrs(self) -> "Ec2":
        '''(experimental) Grants permission to retrieve the resource CIDRs that are monitored as part of a resource discovery.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetIpamDiscoveredResourceCidrs.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetIpamDiscoveredResourceCidrs", []))

    @jsii.member(jsii_name="toGetIpamPoolAllocations")
    def to_get_ipam_pool_allocations(self) -> "Ec2":
        '''(experimental) Grants permission to get a list of all the CIDR allocations in an Amazon VPC IP Address Manager (IPAM) pool.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetIpamPoolAllocations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetIpamPoolAllocations", []))

    @jsii.member(jsii_name="toGetIpamPoolCidrs")
    def to_get_ipam_pool_cidrs(self) -> "Ec2":
        '''(experimental) Grants permission to get the CIDRs provisioned to an Amazon VPC IP Address Manager (IPAM) pool.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetIpamPoolCidrs.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetIpamPoolCidrs", []))

    @jsii.member(jsii_name="toGetIpamResourceCidrs")
    def to_get_ipam_resource_cidrs(self) -> "Ec2":
        '''(experimental) Grants permission to get information about the resources in an Amazon VPC IP Address Manager (IPAM) scope.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetIpamResourceCidrs.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetIpamResourceCidrs", []))

    @jsii.member(jsii_name="toGetLaunchTemplateData")
    def to_get_launch_template_data(self) -> "Ec2":
        '''(experimental) Grants permission to get the configuration data of the specified instance for use with a new launch template or launch template version.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetLaunchTemplateData.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetLaunchTemplateData", []))

    @jsii.member(jsii_name="toGetManagedPrefixListAssociations")
    def to_get_managed_prefix_list_associations(self) -> "Ec2":
        '''(experimental) Grants permission to get information about the resources that are associated with the specified managed prefix list.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetManagedPrefixListAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetManagedPrefixListAssociations", []))

    @jsii.member(jsii_name="toGetManagedPrefixListEntries")
    def to_get_managed_prefix_list_entries(self) -> "Ec2":
        '''(experimental) Grants permission to get information about the entries for a specified managed prefix list.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetManagedPrefixListEntries.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetManagedPrefixListEntries", []))

    @jsii.member(jsii_name="toGetNetworkInsightsAccessScopeAnalysisFindings")
    def to_get_network_insights_access_scope_analysis_findings(self) -> "Ec2":
        '''(experimental) Grants permission to get the findings for one or more Network Access Scope analyses.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetNetworkInsightsAccessScopeAnalysisFindings.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetNetworkInsightsAccessScopeAnalysisFindings", []))

    @jsii.member(jsii_name="toGetNetworkInsightsAccessScopeContent")
    def to_get_network_insights_access_scope_content(self) -> "Ec2":
        '''(experimental) Grants permission to get the content for a specified Network Access Scope.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetNetworkInsightsAccessScopeContent.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetNetworkInsightsAccessScopeContent", []))

    @jsii.member(jsii_name="toGetPasswordData")
    def to_get_password_data(self) -> "Ec2":
        '''(experimental) Grants permission to retrieve the encrypted administrator password for a running Windows instance.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetPasswordData.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetPasswordData", []))

    @jsii.member(jsii_name="toGetReservedInstancesExchangeQuote")
    def to_get_reserved_instances_exchange_quote(self) -> "Ec2":
        '''(experimental) Grants permission to return a quote and exchange information for exchanging one or more Convertible Reserved Instances for a new Convertible Reserved Instance.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetReservedInstancesExchangeQuote.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetReservedInstancesExchangeQuote", []))

    @jsii.member(jsii_name="toGetResourcePolicy")
    def to_get_resource_policy(self) -> "Ec2":
        '''(experimental) Grants permission to describe an IAM policy that enables cross-account sharing.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/vpc/latest/ipam/share-pool-ipam.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetResourcePolicy", []))

    @jsii.member(jsii_name="toGetSerialConsoleAccessStatus")
    def to_get_serial_console_access_status(self) -> "Ec2":
        '''(experimental) Grants permission to retrieve the access status of your account to the EC2 serial console of all instances.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetSerialConsoleAccessStatus.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetSerialConsoleAccessStatus", []))

    @jsii.member(jsii_name="toGetSpotPlacementScores")
    def to_get_spot_placement_scores(self) -> "Ec2":
        '''(experimental) Grants permission to calculate the Spot placement score for a Region or Availability Zone based on the specified target capacity and compute requirements.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetSpotPlacementScores.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetSpotPlacementScores", []))

    @jsii.member(jsii_name="toGetSubnetCidrReservations")
    def to_get_subnet_cidr_reservations(self) -> "Ec2":
        '''(experimental) Grants permission to retrieve information about the subnet CIDR reservations.

        Access Level: Read

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetSubnetCidrReservations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetSubnetCidrReservations", []))

    @jsii.member(jsii_name="toGetTransitGatewayAttachmentPropagations")
    def to_get_transit_gateway_attachment_propagations(self) -> "Ec2":
        '''(experimental) Grants permission to list the route tables to which a resource attachment propagates routes.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetTransitGatewayAttachmentPropagations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetTransitGatewayAttachmentPropagations", []))

    @jsii.member(jsii_name="toGetTransitGatewayMulticastDomainAssociations")
    def to_get_transit_gateway_multicast_domain_associations(self) -> "Ec2":
        '''(experimental) Grants permission to get information about the associations for a transit gateway multicast domain.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetTransitGatewayMulticastDomainAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetTransitGatewayMulticastDomainAssociations", []))

    @jsii.member(jsii_name="toGetTransitGatewayPolicyTableAssociations")
    def to_get_transit_gateway_policy_table_associations(self) -> "Ec2":
        '''(experimental) Grants permission to get information about associations for a transit gateway policy table.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetTransitGatewayPolicyTableAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetTransitGatewayPolicyTableAssociations", []))

    @jsii.member(jsii_name="toGetTransitGatewayPolicyTableEntries")
    def to_get_transit_gateway_policy_table_entries(self) -> "Ec2":
        '''(experimental) Grants permission to get information about associations for a transit gateway policy table entry.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetTransitGatewayPolicyTableEntries.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetTransitGatewayPolicyTableEntries", []))

    @jsii.member(jsii_name="toGetTransitGatewayPrefixListReferences")
    def to_get_transit_gateway_prefix_list_references(self) -> "Ec2":
        '''(experimental) Grants permission to get information about prefix list references for a transit gateway route table.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetTransitGatewayPrefixListReferences.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetTransitGatewayPrefixListReferences", []))

    @jsii.member(jsii_name="toGetTransitGatewayRouteTableAssociations")
    def to_get_transit_gateway_route_table_associations(self) -> "Ec2":
        '''(experimental) Grants permission to get information about associations for a transit gateway route table.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetTransitGatewayRouteTableAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetTransitGatewayRouteTableAssociations", []))

    @jsii.member(jsii_name="toGetTransitGatewayRouteTablePropagations")
    def to_get_transit_gateway_route_table_propagations(self) -> "Ec2":
        '''(experimental) Grants permission to get information about the route table propagations for a transit gateway route table.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetTransitGatewayRouteTablePropagations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetTransitGatewayRouteTablePropagations", []))

    @jsii.member(jsii_name="toGetVerifiedAccessEndpointPolicy")
    def to_get_verified_access_endpoint_policy(self) -> "Ec2":
        '''(experimental) Grants permission to show the Verified Access policy associated with the endpoint.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetVerifiedAccessEndpointPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetVerifiedAccessEndpointPolicy", []))

    @jsii.member(jsii_name="toGetVerifiedAccessGroupPolicy")
    def to_get_verified_access_group_policy(self) -> "Ec2":
        '''(experimental) Grants permission to show the contents of the Verified Access policy associated with the group.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetVerifiedAccessGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetVerifiedAccessGroupPolicy", []))

    @jsii.member(jsii_name="toGetVpnConnectionDeviceSampleConfiguration")
    def to_get_vpn_connection_device_sample_configuration(self) -> "Ec2":
        '''(experimental) Grants permission to download an AWS-provided sample configuration file to be used with the customer gateway device.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetVpnConnectionDeviceSampleConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetVpnConnectionDeviceSampleConfiguration", []))

    @jsii.member(jsii_name="toGetVpnConnectionDeviceTypes")
    def to_get_vpn_connection_device_types(self) -> "Ec2":
        '''(experimental) Grants permission to obtain a list of customer gateway devices for which sample configuration files can be provided.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_GetVpnConnectionDeviceTypes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toGetVpnConnectionDeviceTypes", []))

    @jsii.member(jsii_name="toImportClientVpnClientCertificateRevocationList")
    def to_import_client_vpn_client_certificate_revocation_list(self) -> "Ec2":
        '''(experimental) Grants permission to upload a client certificate revocation list to a Client VPN endpoint.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportClientVpnClientCertificateRevocationList.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toImportClientVpnClientCertificateRevocationList", []))

    @jsii.member(jsii_name="toImportImage")
    def to_import_image(self) -> "Ec2":
        '''(experimental) Grants permission to import single or multi-volume disk images or EBS snapshots into an Amazon Machine Image (AMI).

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportImage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toImportImage", []))

    @jsii.member(jsii_name="toImportInstance")
    def to_import_instance(self) -> "Ec2":
        '''(experimental) Grants permission to create an import instance task using metadata from a disk image.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportInstance.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toImportInstance", []))

    @jsii.member(jsii_name="toImportKeyPair")
    def to_import_key_pair(self) -> "Ec2":
        '''(experimental) Grants permission to import a public key from an RSA key pair that was created with a third-party tool.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toImportKeyPair", []))

    @jsii.member(jsii_name="toImportSnapshot")
    def to_import_snapshot(self) -> "Ec2":
        '''(experimental) Grants permission to import a disk into an EBS snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toImportSnapshot", []))

    @jsii.member(jsii_name="toImportVolume")
    def to_import_volume(self) -> "Ec2":
        '''(experimental) Grants permission to create an import volume task using metadata from a disk image.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportVolume.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toImportVolume", []))

    @jsii.member(jsii_name="toListImagesInRecycleBin")
    def to_list_images_in_recycle_bin(self) -> "Ec2":
        '''(experimental) Grants permission to list Amazon Machine Images (AMIs) that are currently in the Recycle Bin.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ListImagesInRecycleBin.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toListImagesInRecycleBin", []))

    @jsii.member(jsii_name="toListSnapshotsInRecycleBin")
    def to_list_snapshots_in_recycle_bin(self) -> "Ec2":
        '''(experimental) Grants permission to list the Amazon EBS snapshots that are currently in the Recycle Bin.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ListSnapshotsInRecycleBin.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toListSnapshotsInRecycleBin", []))

    @jsii.member(jsii_name="toModifyAddressAttribute")
    def to_modify_address_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to modify an attribute of the specified Elastic IP address.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyAddressAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyAddressAttribute", []))

    @jsii.member(jsii_name="toModifyAvailabilityZoneGroup")
    def to_modify_availability_zone_group(self) -> "Ec2":
        '''(experimental) Grants permission to modify the opt-in status of the Local Zone and Wavelength Zone group for your account.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyAvailabilityZoneGroup.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyAvailabilityZoneGroup", []))

    @jsii.member(jsii_name="toModifyCapacityReservation")
    def to_modify_capacity_reservation(self) -> "Ec2":
        '''(experimental) Grants permission to modify a Capacity Reservation's capacity and the conditions under which it is to be released.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyCapacityReservation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyCapacityReservation", []))

    @jsii.member(jsii_name="toModifyCapacityReservationFleet")
    def to_modify_capacity_reservation_fleet(self) -> "Ec2":
        '''(experimental) Grants permission to modify a Capacity Reservation Fleet.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyCapacityReservationFleet.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyCapacityReservationFleet", []))

    @jsii.member(jsii_name="toModifyClientVpnEndpoint")
    def to_modify_client_vpn_endpoint(self) -> "Ec2":
        '''(experimental) Grants permission to modify a Client VPN endpoint.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyClientVpnEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyClientVpnEndpoint", []))

    @jsii.member(jsii_name="toModifyDefaultCreditSpecification")
    def to_modify_default_credit_specification(self) -> "Ec2":
        '''(experimental) Grants permission to change the account level default credit option for CPU usage of burstable performance instances.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyDefaultCreditSpecification.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyDefaultCreditSpecification", []))

    @jsii.member(jsii_name="toModifyEbsDefaultKmsKeyId")
    def to_modify_ebs_default_kms_key_id(self) -> "Ec2":
        '''(experimental) Grants permission to change the default customer master key (CMK) for EBS encryption by default for your account.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyEbsDefaultKmsKeyId.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyEbsDefaultKmsKeyId", []))

    @jsii.member(jsii_name="toModifyFleet")
    def to_modify_fleet(self) -> "Ec2":
        '''(experimental) Grants permission to modify an EC2 Fleet.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyFleet.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyFleet", []))

    @jsii.member(jsii_name="toModifyFpgaImageAttribute")
    def to_modify_fpga_image_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to modify an attribute of an Amazon FPGA Image (AFI).

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyFpgaImageAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyFpgaImageAttribute", []))

    @jsii.member(jsii_name="toModifyHosts")
    def to_modify_hosts(self) -> "Ec2":
        '''(experimental) Grants permission to modify a Dedicated Host.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyHosts.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyHosts", []))

    @jsii.member(jsii_name="toModifyIdentityIdFormat")
    def to_modify_identity_id_format(self) -> "Ec2":
        '''(experimental) Grants permission to modify the ID format of a resource for a specific principal in your account.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyIdentityIdFormat.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyIdentityIdFormat", []))

    @jsii.member(jsii_name="toModifyIdFormat")
    def to_modify_id_format(self) -> "Ec2":
        '''(experimental) Grants permission to modify the ID format for a resource.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyIdFormat.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyIdFormat", []))

    @jsii.member(jsii_name="toModifyImageAttribute")
    def to_modify_image_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to modify an attribute of an Amazon Machine Image (AMI).

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyImageAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyImageAttribute", []))

    @jsii.member(jsii_name="toModifyInstanceAttribute")
    def to_modify_instance_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to modify an attribute of an instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyInstanceAttribute", []))

    @jsii.member(jsii_name="toModifyInstanceCapacityReservationAttributes")
    def to_modify_instance_capacity_reservation_attributes(self) -> "Ec2":
        '''(experimental) Grants permission to modify the Capacity Reservation settings for a stopped instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceCapacityReservationAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyInstanceCapacityReservationAttributes", []))

    @jsii.member(jsii_name="toModifyInstanceCreditSpecification")
    def to_modify_instance_credit_specification(self) -> "Ec2":
        '''(experimental) Grants permission to modify the credit option for CPU usage on an instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceCreditSpecification.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyInstanceCreditSpecification", []))

    @jsii.member(jsii_name="toModifyInstanceEventStartTime")
    def to_modify_instance_event_start_time(self) -> "Ec2":
        '''(experimental) Grants permission to modify the start time for a scheduled EC2 instance event.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceEventStartTime.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyInstanceEventStartTime", []))

    @jsii.member(jsii_name="toModifyInstanceEventWindow")
    def to_modify_instance_event_window(self) -> "Ec2":
        '''(experimental) Grants permission to modify the specified event window.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceEventWindow.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyInstanceEventWindow", []))

    @jsii.member(jsii_name="toModifyInstanceMaintenanceOptions")
    def to_modify_instance_maintenance_options(self) -> "Ec2":
        '''(experimental) Grants permission to modify the recovery behaviour for an instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMaintenanceOptions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyInstanceMaintenanceOptions", []))

    @jsii.member(jsii_name="toModifyInstanceMetadataOptions")
    def to_modify_instance_metadata_options(self) -> "Ec2":
        '''(experimental) Grants permission to modify the metadata options for an instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyInstanceMetadataOptions", []))

    @jsii.member(jsii_name="toModifyInstancePlacement")
    def to_modify_instance_placement(self) -> "Ec2":
        '''(experimental) Grants permission to modify the placement attributes for an instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstancePlacement.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyInstancePlacement", []))

    @jsii.member(jsii_name="toModifyIpam")
    def to_modify_ipam(self) -> "Ec2":
        '''(experimental) Grants permission to modify the configurations of an Amazon VPC IP Address Manager (IPAM).

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyIpam.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyIpam", []))

    @jsii.member(jsii_name="toModifyIpamPool")
    def to_modify_ipam_pool(self) -> "Ec2":
        '''(experimental) Grants permission to modify the configurations of an Amazon VPC IP Address Manager (IPAM) pool.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyIpamPool.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyIpamPool", []))

    @jsii.member(jsii_name="toModifyIpamResourceCidr")
    def to_modify_ipam_resource_cidr(self) -> "Ec2":
        '''(experimental) Grants permission to modify the configurations of an Amazon VPC IP Address Manager (IPAM) resource CIDR.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyIpamResourceCidr.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyIpamResourceCidr", []))

    @jsii.member(jsii_name="toModifyIpamResourceDiscovery")
    def to_modify_ipam_resource_discovery(self) -> "Ec2":
        '''(experimental) Grants permission to modify a resource discovery.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyIpamResourceDiscovery.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyIpamResourceDiscovery", []))

    @jsii.member(jsii_name="toModifyIpamScope")
    def to_modify_ipam_scope(self) -> "Ec2":
        '''(experimental) Grants permission to modify the configurations of an Amazon VPC IP Address Manager (IPAM) scope.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyIpamScope.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyIpamScope", []))

    @jsii.member(jsii_name="toModifyLaunchTemplate")
    def to_modify_launch_template(self) -> "Ec2":
        '''(experimental) Grants permission to modify a launch template.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyLaunchTemplate.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyLaunchTemplate", []))

    @jsii.member(jsii_name="toModifyLocalGatewayRoute")
    def to_modify_local_gateway_route(self) -> "Ec2":
        '''(experimental) Grants permission to modify a local gateway route.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyLocalGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyLocalGatewayRoute", []))

    @jsii.member(jsii_name="toModifyManagedPrefixList")
    def to_modify_managed_prefix_list(self) -> "Ec2":
        '''(experimental) Grants permission to modify a managed prefix list.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyManagedPrefixList.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyManagedPrefixList", []))

    @jsii.member(jsii_name="toModifyNetworkInterfaceAttribute")
    def to_modify_network_interface_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to modify an attribute of a network interface.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyNetworkInterfaceAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyNetworkInterfaceAttribute", []))

    @jsii.member(jsii_name="toModifyPrivateDnsNameOptions")
    def to_modify_private_dns_name_options(self) -> "Ec2":
        '''(experimental) Grants permission to modify the options for instance hostnames for the specified instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyPrivateDnsNameOptions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyPrivateDnsNameOptions", []))

    @jsii.member(jsii_name="toModifyReservedInstances")
    def to_modify_reserved_instances(self) -> "Ec2":
        '''(experimental) Grants permission to modify attributes of one or more Reserved Instances.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyReservedInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyReservedInstances", []))

    @jsii.member(jsii_name="toModifySecurityGroupRules")
    def to_modify_security_group_rules(self) -> "Ec2":
        '''(experimental) Grants permission to modify the rules of a security group.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySecurityGroupRules.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifySecurityGroupRules", []))

    @jsii.member(jsii_name="toModifySnapshotAttribute")
    def to_modify_snapshot_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to add or remove permission settings for a snapshot.

        Access Level: Permissions management

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySnapshotAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifySnapshotAttribute", []))

    @jsii.member(jsii_name="toModifySnapshotTier")
    def to_modify_snapshot_tier(self) -> "Ec2":
        '''(experimental) Grants permission to archive Amazon EBS snapshots.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySnapshotTier.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifySnapshotTier", []))

    @jsii.member(jsii_name="toModifySpotFleetRequest")
    def to_modify_spot_fleet_request(self) -> "Ec2":
        '''(experimental) Grants permission to modify a Spot Fleet request.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySpotFleetRequest.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifySpotFleetRequest", []))

    @jsii.member(jsii_name="toModifySubnetAttribute")
    def to_modify_subnet_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to modify an attribute of a subnet.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySubnetAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifySubnetAttribute", []))

    @jsii.member(jsii_name="toModifyTrafficMirrorFilterNetworkServices")
    def to_modify_traffic_mirror_filter_network_services(self) -> "Ec2":
        '''(experimental) Grants permission to allow or restrict mirroring network services.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyTrafficMirrorFilterNetworkServices.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyTrafficMirrorFilterNetworkServices", []))

    @jsii.member(jsii_name="toModifyTrafficMirrorFilterRule")
    def to_modify_traffic_mirror_filter_rule(self) -> "Ec2":
        '''(experimental) Grants permission to modify a traffic mirror rule.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyTrafficMirrorFilterRule.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyTrafficMirrorFilterRule", []))

    @jsii.member(jsii_name="toModifyTrafficMirrorSession")
    def to_modify_traffic_mirror_session(self) -> "Ec2":
        '''(experimental) Grants permission to modify a traffic mirror session.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyTrafficMirrorSession.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyTrafficMirrorSession", []))

    @jsii.member(jsii_name="toModifyTransitGateway")
    def to_modify_transit_gateway(self) -> "Ec2":
        '''(experimental) Grants permission to modify a transit gateway.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyTransitGateway.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyTransitGateway", []))

    @jsii.member(jsii_name="toModifyTransitGatewayPrefixListReference")
    def to_modify_transit_gateway_prefix_list_reference(self) -> "Ec2":
        '''(experimental) Grants permission to modify a transit gateway prefix list reference.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyTransitGatewayPrefixListReference.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyTransitGatewayPrefixListReference", []))

    @jsii.member(jsii_name="toModifyTransitGatewayVpcAttachment")
    def to_modify_transit_gateway_vpc_attachment(self) -> "Ec2":
        '''(experimental) Grants permission to modify a VPC attachment on a transit gateway.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyTransitGatewayVpcAttachment.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyTransitGatewayVpcAttachment", []))

    @jsii.member(jsii_name="toModifyVerifiedAccessEndpoint")
    def to_modify_verified_access_endpoint(self) -> "Ec2":
        '''(experimental) Grants permission to modify the configuration of a Verified Access endpoint.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVerifiedAccessEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVerifiedAccessEndpoint", []))

    @jsii.member(jsii_name="toModifyVerifiedAccessEndpointPolicy")
    def to_modify_verified_access_endpoint_policy(self) -> "Ec2":
        '''(experimental) Grants permission to modify the specified Verified Access endpoint policy.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVerifiedAccessEndpointPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVerifiedAccessEndpointPolicy", []))

    @jsii.member(jsii_name="toModifyVerifiedAccessGroup")
    def to_modify_verified_access_group(self) -> "Ec2":
        '''(experimental) Grants permission to modify the specified Verified Access Group configuration.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVerifiedAccessGroup.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVerifiedAccessGroup", []))

    @jsii.member(jsii_name="toModifyVerifiedAccessGroupPolicy")
    def to_modify_verified_access_group_policy(self) -> "Ec2":
        '''(experimental) Grants permission to modify the specified Verified Access group policy.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVerifiedAccessGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVerifiedAccessGroupPolicy", []))

    @jsii.member(jsii_name="toModifyVerifiedAccessInstance")
    def to_modify_verified_access_instance(self) -> "Ec2":
        '''(experimental) Grants permission to modify the configuration of the specified Verified Access instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVerifiedAccessInstance.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVerifiedAccessInstance", []))

    @jsii.member(jsii_name="toModifyVerifiedAccessInstanceLoggingConfiguration")
    def to_modify_verified_access_instance_logging_configuration(self) -> "Ec2":
        '''(experimental) Grants permission to modify the logging configuration for the specified Verified Access instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVerifiedAccessInstanceLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVerifiedAccessInstanceLoggingConfiguration", []))

    @jsii.member(jsii_name="toModifyVerifiedAccessTrustProvider")
    def to_modify_verified_access_trust_provider(self) -> "Ec2":
        '''(experimental) Grants permission to modify the configuration of the specified Verified Access trust provider.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVerifiedAccessTrustProvider.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVerifiedAccessTrustProvider", []))

    @jsii.member(jsii_name="toModifyVolume")
    def to_modify_volume(self) -> "Ec2":
        '''(experimental) Grants permission to modify the parameters of an EBS volume.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVolume.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVolume", []))

    @jsii.member(jsii_name="toModifyVolumeAttribute")
    def to_modify_volume_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to modify an attribute of a volume.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVolumeAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVolumeAttribute", []))

    @jsii.member(jsii_name="toModifyVpcAttribute")
    def to_modify_vpc_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to modify an attribute of a VPC.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpcAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpcAttribute", []))

    @jsii.member(jsii_name="toModifyVpcEndpoint")
    def to_modify_vpc_endpoint(self) -> "Ec2":
        '''(experimental) Grants permission to modify an attribute of a VPC endpoint.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpcEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpcEndpoint", []))

    @jsii.member(jsii_name="toModifyVpcEndpointConnectionNotification")
    def to_modify_vpc_endpoint_connection_notification(self) -> "Ec2":
        '''(experimental) Grants permission to modify a connection notification for a VPC endpoint or VPC endpoint service.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpcEndpointConnectionNotification.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpcEndpointConnectionNotification", []))

    @jsii.member(jsii_name="toModifyVpcEndpointServiceConfiguration")
    def to_modify_vpc_endpoint_service_configuration(self) -> "Ec2":
        '''(experimental) Grants permission to modify the attributes of a VPC endpoint service configuration.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpcEndpointServiceConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpcEndpointServiceConfiguration", []))

    @jsii.member(jsii_name="toModifyVpcEndpointServicePayerResponsibility")
    def to_modify_vpc_endpoint_service_payer_responsibility(self) -> "Ec2":
        '''(experimental) Grants permission to modify the payer responsibility for a VPC endpoint service.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpcEndpointServicePayerResponsibility.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpcEndpointServicePayerResponsibility", []))

    @jsii.member(jsii_name="toModifyVpcEndpointServicePermissions")
    def to_modify_vpc_endpoint_service_permissions(self) -> "Ec2":
        '''(experimental) Grants permission to modify the permissions for a VPC endpoint service.

        Access Level: Permissions management

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpcEndpointServicePermissions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpcEndpointServicePermissions", []))

    @jsii.member(jsii_name="toModifyVpcPeeringConnectionOptions")
    def to_modify_vpc_peering_connection_options(self) -> "Ec2":
        '''(experimental) Grants permission to modify the VPC peering connection options on one side of a VPC peering connection.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpcPeeringConnectionOptions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpcPeeringConnectionOptions", []))

    @jsii.member(jsii_name="toModifyVpcTenancy")
    def to_modify_vpc_tenancy(self) -> "Ec2":
        '''(experimental) Grants permission to modify the instance tenancy attribute of a VPC.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpcTenancy.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpcTenancy", []))

    @jsii.member(jsii_name="toModifyVpnConnection")
    def to_modify_vpn_connection(self) -> "Ec2":
        '''(experimental) Grants permission to modify the target gateway of a Site-to-Site VPN connection.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpnConnection.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpnConnection", []))

    @jsii.member(jsii_name="toModifyVpnConnectionOptions")
    def to_modify_vpn_connection_options(self) -> "Ec2":
        '''(experimental) Grants permission to modify the connection options for your Site-to-Site VPN connection.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpnConnectionOptions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpnConnectionOptions", []))

    @jsii.member(jsii_name="toModifyVpnTunnelCertificate")
    def to_modify_vpn_tunnel_certificate(self) -> "Ec2":
        '''(experimental) Grants permission to modify the certificate for a Site-to-Site VPN connection.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpnTunnelCertificate.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpnTunnelCertificate", []))

    @jsii.member(jsii_name="toModifyVpnTunnelOptions")
    def to_modify_vpn_tunnel_options(self) -> "Ec2":
        '''(experimental) Grants permission to modify the options for a Site-to-Site VPN connection.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpnTunnelOptions.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toModifyVpnTunnelOptions", []))

    @jsii.member(jsii_name="toMonitorInstances")
    def to_monitor_instances(self) -> "Ec2":
        '''(experimental) Grants permission to enable detailed monitoring for a running instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_MonitorInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toMonitorInstances", []))

    @jsii.member(jsii_name="toMoveAddressToVpc")
    def to_move_address_to_vpc(self) -> "Ec2":
        '''(experimental) Grants permission to move an Elastic IP address from the EC2-Classic platform to the EC2-VPC platform.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_MoveAddressToVpc.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toMoveAddressToVpc", []))

    @jsii.member(jsii_name="toMoveByoipCidrToIpam")
    def to_move_byoip_cidr_to_ipam(self) -> "Ec2":
        '''(experimental) Grants permission to move a BYOIP IPv4 CIDR to Amazon VPC IP Address Manager (IPAM) from a public IPv4 pool.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_MoveByoipCidrToIpam.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toMoveByoipCidrToIpam", []))

    @jsii.member(jsii_name="toPauseVolumeIO")
    def to_pause_volume_io(self) -> "Ec2":
        '''(experimental) Grants permission to temporarily pause I/O operations for a target Amazon EBS volume.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/fis/latest/userguide/fis-actions-reference.html#ebs-actions-reference

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toPauseVolumeIO", []))

    @jsii.member(jsii_name="toProvisionByoipCidr")
    def to_provision_byoip_cidr(self) -> "Ec2":
        '''(experimental) Grants permission to provision an address range for use in AWS through bring your own IP addresses (BYOIP), and to create a corresponding address pool.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ProvisionByoipCidr.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toProvisionByoipCidr", []))

    @jsii.member(jsii_name="toProvisionIpamPoolCidr")
    def to_provision_ipam_pool_cidr(self) -> "Ec2":
        '''(experimental) Grants permission to provision a CIDR to an Amazon VPC IP Address Manager (IPAM) pool.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ProvisionIpamPoolCidr.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toProvisionIpamPoolCidr", []))

    @jsii.member(jsii_name="toProvisionPublicIpv4PoolCidr")
    def to_provision_public_ipv4_pool_cidr(self) -> "Ec2":
        '''(experimental) Grants permission to provision a CIDR to a public IPv4 pool.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ProvisionPublicIpv4PoolCidr.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toProvisionPublicIpv4PoolCidr", []))

    @jsii.member(jsii_name="toPurchaseHostReservation")
    def to_purchase_host_reservation(self) -> "Ec2":
        '''(experimental) Grants permission to purchase a reservation with configurations that match those of a Dedicated Host.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_PurchaseHostReservation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toPurchaseHostReservation", []))

    @jsii.member(jsii_name="toPurchaseReservedInstancesOffering")
    def to_purchase_reserved_instances_offering(self) -> "Ec2":
        '''(experimental) Grants permission to purchase a Reserved Instance offering.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_PurchaseReservedInstancesOffering.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toPurchaseReservedInstancesOffering", []))

    @jsii.member(jsii_name="toPurchaseScheduledInstances")
    def to_purchase_scheduled_instances(self) -> "Ec2":
        '''(experimental) Grants permission to purchase one or more Scheduled Instances with a specified schedule.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_PurchaseScheduledInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toPurchaseScheduledInstances", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "Ec2":
        '''(experimental) Grants permission to attach an IAM policy that enables cross-account sharing to a resource.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/vpc/latest/ipam/share-pool-ipam.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toRebootInstances")
    def to_reboot_instances(self) -> "Ec2":
        '''(experimental) Grants permission to request a reboot of one or more instances.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RebootInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRebootInstances", []))

    @jsii.member(jsii_name="toRegisterImage")
    def to_register_image(self) -> "Ec2":
        '''(experimental) Grants permission to register an Amazon Machine Image (AMI).

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RegisterImage.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRegisterImage", []))

    @jsii.member(jsii_name="toRegisterInstanceEventNotificationAttributes")
    def to_register_instance_event_notification_attributes(self) -> "Ec2":
        '''(experimental) Grants permission to add tags to the set of tags to include in notifications about scheduled events for your instances.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RegisterInstanceEventNotificationAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRegisterInstanceEventNotificationAttributes", []))

    @jsii.member(jsii_name="toRegisterTransitGatewayMulticastGroupMembers")
    def to_register_transit_gateway_multicast_group_members(self) -> "Ec2":
        '''(experimental) Grants permission to register one or more network interfaces as a member of a group IP address in a transit gateway multicast domain.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RegisterTransitGatewayMulticastGroupMembers.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRegisterTransitGatewayMulticastGroupMembers", []))

    @jsii.member(jsii_name="toRegisterTransitGatewayMulticastGroupSources")
    def to_register_transit_gateway_multicast_group_sources(self) -> "Ec2":
        '''(experimental) Grants permission to register one or more network interfaces as a source of a group IP address in a transit gateway multicast domain.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RegisterTransitGatewayMulticastGroupSources.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRegisterTransitGatewayMulticastGroupSources", []))

    @jsii.member(jsii_name="toRejectTransitGatewayMulticastDomainAssociations")
    def to_reject_transit_gateway_multicast_domain_associations(self) -> "Ec2":
        '''(experimental) Grants permission to reject requests to associate cross-account subnets with a transit gateway multicast domain.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RejectTransitGatewayMulticastDomainAssociations.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRejectTransitGatewayMulticastDomainAssociations", []))

    @jsii.member(jsii_name="toRejectTransitGatewayPeeringAttachment")
    def to_reject_transit_gateway_peering_attachment(self) -> "Ec2":
        '''(experimental) Grants permission to reject a transit gateway peering attachment request.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RejectTransitGatewayPeeringAttachment.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRejectTransitGatewayPeeringAttachment", []))

    @jsii.member(jsii_name="toRejectTransitGatewayVpcAttachment")
    def to_reject_transit_gateway_vpc_attachment(self) -> "Ec2":
        '''(experimental) Grants permission to reject a request to attach a VPC to a transit gateway.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RejectTransitGatewayVpcAttachment.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRejectTransitGatewayVpcAttachment", []))

    @jsii.member(jsii_name="toRejectVpcEndpointConnections")
    def to_reject_vpc_endpoint_connections(self) -> "Ec2":
        '''(experimental) Grants permission to reject one or more VPC endpoint connection requests to a VPC endpoint service.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RejectVpcEndpointConnections.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRejectVpcEndpointConnections", []))

    @jsii.member(jsii_name="toRejectVpcPeeringConnection")
    def to_reject_vpc_peering_connection(self) -> "Ec2":
        '''(experimental) Grants permission to reject a VPC peering connection request.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RejectVpcPeeringConnection.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRejectVpcPeeringConnection", []))

    @jsii.member(jsii_name="toReleaseAddress")
    def to_release_address(self) -> "Ec2":
        '''(experimental) Grants permission to release an Elastic IP address.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReleaseAddress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toReleaseAddress", []))

    @jsii.member(jsii_name="toReleaseHosts")
    def to_release_hosts(self) -> "Ec2":
        '''(experimental) Grants permission to release one or more On-Demand Dedicated Hosts.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReleaseHosts.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toReleaseHosts", []))

    @jsii.member(jsii_name="toReleaseIpamPoolAllocation")
    def to_release_ipam_pool_allocation(self) -> "Ec2":
        '''(experimental) Grants permission to release an allocation within an Amazon VPC IP Address Manager (IPAM) pool.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReleaseIpamPoolAllocation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toReleaseIpamPoolAllocation", []))

    @jsii.member(jsii_name="toReplaceIamInstanceProfileAssociation")
    def to_replace_iam_instance_profile_association(self) -> "Ec2":
        '''(experimental) Grants permission to replace an IAM instance profile for an instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceIamInstanceProfileAssociation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toReplaceIamInstanceProfileAssociation", []))

    @jsii.member(jsii_name="toReplaceNetworkAclAssociation")
    def to_replace_network_acl_association(self) -> "Ec2":
        '''(experimental) Grants permission to change which network ACL a subnet is associated with.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceNetworkAclAssociation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toReplaceNetworkAclAssociation", []))

    @jsii.member(jsii_name="toReplaceNetworkAclEntry")
    def to_replace_network_acl_entry(self) -> "Ec2":
        '''(experimental) Grants permission to replace an entry (rule) in a network ACL.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceNetworkAclEntry.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toReplaceNetworkAclEntry", []))

    @jsii.member(jsii_name="toReplaceRoute")
    def to_replace_route(self) -> "Ec2":
        '''(experimental) Grants permission to replace a route within a route table in a VPC.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toReplaceRoute", []))

    @jsii.member(jsii_name="toReplaceRouteTableAssociation")
    def to_replace_route_table_association(self) -> "Ec2":
        '''(experimental) Grants permission to change the route table that is associated with a subnet.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceRouteTableAssociation.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toReplaceRouteTableAssociation", []))

    @jsii.member(jsii_name="toReplaceTransitGatewayRoute")
    def to_replace_transit_gateway_route(self) -> "Ec2":
        '''(experimental) Grants permission to replace a route in a transit gateway route table.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceTransitGatewayRoute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toReplaceTransitGatewayRoute", []))

    @jsii.member(jsii_name="toReportInstanceStatus")
    def to_report_instance_status(self) -> "Ec2":
        '''(experimental) Grants permission to submit feedback about the status of an instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReportInstanceStatus.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toReportInstanceStatus", []))

    @jsii.member(jsii_name="toRequestSpotFleet")
    def to_request_spot_fleet(self) -> "Ec2":
        '''(experimental) Grants permission to create a Spot Fleet request.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RequestSpotFleet.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRequestSpotFleet", []))

    @jsii.member(jsii_name="toRequestSpotInstances")
    def to_request_spot_instances(self) -> "Ec2":
        '''(experimental) Grants permission to create a Spot Instance request.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RequestSpotInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRequestSpotInstances", []))

    @jsii.member(jsii_name="toResetAddressAttribute")
    def to_reset_address_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to reset the attribute of the specified IP address.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ResetAddressAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toResetAddressAttribute", []))

    @jsii.member(jsii_name="toResetEbsDefaultKmsKeyId")
    def to_reset_ebs_default_kms_key_id(self) -> "Ec2":
        '''(experimental) Grants permission to reset the default customer master key (CMK) for EBS encryption for your account to use the AWS-managed CMK for EBS.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ResetEbsDefaultKmsKeyId.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toResetEbsDefaultKmsKeyId", []))

    @jsii.member(jsii_name="toResetFpgaImageAttribute")
    def to_reset_fpga_image_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to reset an attribute of an Amazon FPGA Image (AFI) to its default value.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ResetFpgaImageAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toResetFpgaImageAttribute", []))

    @jsii.member(jsii_name="toResetImageAttribute")
    def to_reset_image_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to reset an attribute of an Amazon Machine Image (AMI) to its default value.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ResetImageAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toResetImageAttribute", []))

    @jsii.member(jsii_name="toResetInstanceAttribute")
    def to_reset_instance_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to reset an attribute of an instance to its default value.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ResetInstanceAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toResetInstanceAttribute", []))

    @jsii.member(jsii_name="toResetNetworkInterfaceAttribute")
    def to_reset_network_interface_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to reset an attribute of a network interface.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ResetNetworkInterfaceAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toResetNetworkInterfaceAttribute", []))

    @jsii.member(jsii_name="toResetSnapshotAttribute")
    def to_reset_snapshot_attribute(self) -> "Ec2":
        '''(experimental) Grants permission to reset permission settings for a snapshot.

        Access Level: Permissions management

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ResetSnapshotAttribute.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toResetSnapshotAttribute", []))

    @jsii.member(jsii_name="toRestoreAddressToClassic")
    def to_restore_address_to_classic(self) -> "Ec2":
        '''(experimental) Grants permission to restore an Elastic IP address that was previously moved to the EC2-VPC platform back to the EC2-Classic platform.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RestoreAddressToClassic.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRestoreAddressToClassic", []))

    @jsii.member(jsii_name="toRestoreImageFromRecycleBin")
    def to_restore_image_from_recycle_bin(self) -> "Ec2":
        '''(experimental) Grants permission to restore an Amazon Machine Image (AMI) from the Recycle Bin.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RestoreImageFromRecycleBin.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRestoreImageFromRecycleBin", []))

    @jsii.member(jsii_name="toRestoreManagedPrefixListVersion")
    def to_restore_managed_prefix_list_version(self) -> "Ec2":
        '''(experimental) Grants permission to restore the entries from a previous version of a managed prefix list to a new version of the prefix list.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RestoreManagedPrefixListVersion.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRestoreManagedPrefixListVersion", []))

    @jsii.member(jsii_name="toRestoreSnapshotFromRecycleBin")
    def to_restore_snapshot_from_recycle_bin(self) -> "Ec2":
        '''(experimental) Grants permission to restore an Amazon EBS snapshot from the Recycle Bin.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RestoreSnapshotFromRecycleBin.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRestoreSnapshotFromRecycleBin", []))

    @jsii.member(jsii_name="toRestoreSnapshotTier")
    def to_restore_snapshot_tier(self) -> "Ec2":
        '''(experimental) Grants permission to restore an archived Amazon EBS snapshot for use temporarily or permanently, or modify the restore period or restore type for a snapshot that was previously temporarily restored.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RestoreSnapshotTier.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRestoreSnapshotTier", []))

    @jsii.member(jsii_name="toRevokeClientVpnIngress")
    def to_revoke_client_vpn_ingress(self) -> "Ec2":
        '''(experimental) Grants permission to remove an inbound authorization rule from a Client VPN endpoint.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RevokeClientVpnIngress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRevokeClientVpnIngress", []))

    @jsii.member(jsii_name="toRevokeSecurityGroupEgress")
    def to_revoke_security_group_egress(self) -> "Ec2":
        '''(experimental) Grants permission to remove one or more outbound rules from a VPC security group.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RevokeSecurityGroupEgress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRevokeSecurityGroupEgress", []))

    @jsii.member(jsii_name="toRevokeSecurityGroupIngress")
    def to_revoke_security_group_ingress(self) -> "Ec2":
        '''(experimental) Grants permission to remove one or more inbound rules from a security group.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RevokeSecurityGroupIngress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRevokeSecurityGroupIngress", []))

    @jsii.member(jsii_name="toRunInstances")
    def to_run_instances(self) -> "Ec2":
        '''(experimental) Grants permission to launch one or more instances.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRunInstances", []))

    @jsii.member(jsii_name="toRunScheduledInstances")
    def to_run_scheduled_instances(self) -> "Ec2":
        '''(experimental) Grants permission to launch one or more Scheduled Instances.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunScheduledInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toRunScheduledInstances", []))

    @jsii.member(jsii_name="toSearchLocalGatewayRoutes")
    def to_search_local_gateway_routes(self) -> "Ec2":
        '''(experimental) Grants permission to search for routes in a local gateway route table.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_SearchLocalGatewayRoutes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toSearchLocalGatewayRoutes", []))

    @jsii.member(jsii_name="toSearchTransitGatewayMulticastGroups")
    def to_search_transit_gateway_multicast_groups(self) -> "Ec2":
        '''(experimental) Grants permission to search for groups, sources, and members in a transit gateway multicast domain.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_SearchTransitGatewayMulticastGroups.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toSearchTransitGatewayMulticastGroups", []))

    @jsii.member(jsii_name="toSearchTransitGatewayRoutes")
    def to_search_transit_gateway_routes(self) -> "Ec2":
        '''(experimental) Grants permission to search for routes in a transit gateway route table.

        Access Level: List

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_SearchTransitGatewayRoutes.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toSearchTransitGatewayRoutes", []))

    @jsii.member(jsii_name="toSendDiagnosticInterrupt")
    def to_send_diagnostic_interrupt(self) -> "Ec2":
        '''(experimental) Grants permission to send a diagnostic interrupt to an Amazon EC2 instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_SendDiagnosticInterrupt.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toSendDiagnosticInterrupt", []))

    @jsii.member(jsii_name="toSendSpotInstanceInterruptions")
    def to_send_spot_instance_interruptions(self) -> "Ec2":
        '''(experimental) Grants permission to interrupt a Spot Instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/fis/latest/userguide/fis-actions-reference.html#send-spot-instance-interruptions

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toSendSpotInstanceInterruptions", []))

    @jsii.member(jsii_name="toStartInstances")
    def to_start_instances(self) -> "Ec2":
        '''(experimental) Grants permission to start a stopped instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_StartInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toStartInstances", []))

    @jsii.member(jsii_name="toStartNetworkInsightsAccessScopeAnalysis")
    def to_start_network_insights_access_scope_analysis(self) -> "Ec2":
        '''(experimental) Grants permission to start a Network Access Scope analysis.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_StartNetworkInsightsAccessScopeAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toStartNetworkInsightsAccessScopeAnalysis", []))

    @jsii.member(jsii_name="toStartNetworkInsightsAnalysis")
    def to_start_network_insights_analysis(self) -> "Ec2":
        '''(experimental) Grants permission to start analyzing a specified path.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRegion()

        Dependent actions:

        - ec2:CreateTags

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_StartNetworkInsightsAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toStartNetworkInsightsAnalysis", []))

    @jsii.member(jsii_name="toStartVpcEndpointServicePrivateDnsVerification")
    def to_start_vpc_endpoint_service_private_dns_verification(self) -> "Ec2":
        '''(experimental) Grants permission to start the private DNS verification process for a VPC endpoint service.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_StartVpcEndpointServicePrivateDnsVerification.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toStartVpcEndpointServicePrivateDnsVerification", []))

    @jsii.member(jsii_name="toStopInstances")
    def to_stop_instances(self) -> "Ec2":
        '''(experimental) Grants permission to stop an Amazon EBS-backed instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_StopInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toStopInstances", []))

    @jsii.member(jsii_name="toTerminateClientVpnConnections")
    def to_terminate_client_vpn_connections(self) -> "Ec2":
        '''(experimental) Grants permission to terminate active Client VPN endpoint connections.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_TerminateClientVpnConnections.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toTerminateClientVpnConnections", []))

    @jsii.member(jsii_name="toTerminateInstances")
    def to_terminate_instances(self) -> "Ec2":
        '''(experimental) Grants permission to shut down one or more instances.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_TerminateInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toTerminateInstances", []))

    @jsii.member(jsii_name="toUnassignIpv6Addresses")
    def to_unassign_ipv6_addresses(self) -> "Ec2":
        '''(experimental) Grants permission to unassign one or more IPv6 addresses from a network interface.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_UnassignIpv6Addresses.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toUnassignIpv6Addresses", []))

    @jsii.member(jsii_name="toUnassignPrivateIpAddresses")
    def to_unassign_private_ip_addresses(self) -> "Ec2":
        '''(experimental) Grants permission to unassign one or more secondary private IP addresses from a network interface.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_UnassignPrivateIpAddresses.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toUnassignPrivateIpAddresses", []))

    @jsii.member(jsii_name="toUnassignPrivateNatGatewayAddress")
    def to_unassign_private_nat_gateway_address(self) -> "Ec2":
        '''(experimental) Grants permission to unassign secondary private IPv4 addresses from a private NAT gateway.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_UnassignPrivateNatGatewayAddress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toUnassignPrivateNatGatewayAddress", []))

    @jsii.member(jsii_name="toUnmonitorInstances")
    def to_unmonitor_instances(self) -> "Ec2":
        '''(experimental) Grants permission to disable detailed monitoring for a running instance.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_UnmonitorInstances.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toUnmonitorInstances", []))

    @jsii.member(jsii_name="toUpdateSecurityGroupRuleDescriptionsEgress")
    def to_update_security_group_rule_descriptions_egress(self) -> "Ec2":
        '''(experimental) Grants permission to update descriptions for one or more outbound rules in a VPC security group.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_UpdateSecurityGroupRuleDescriptionsEgress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toUpdateSecurityGroupRuleDescriptionsEgress", []))

    @jsii.member(jsii_name="toUpdateSecurityGroupRuleDescriptionsIngress")
    def to_update_security_group_rule_descriptions_ingress(self) -> "Ec2":
        '''(experimental) Grants permission to update descriptions for one or more inbound rules in a security group.

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_UpdateSecurityGroupRuleDescriptionsIngress.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toUpdateSecurityGroupRuleDescriptionsIngress", []))

    @jsii.member(jsii_name="toWithdrawByoipCidr")
    def to_withdraw_byoip_cidr(self) -> "Ec2":
        '''(experimental) Grants permission to stop advertising an address range that was provisioned for use in AWS through bring your own IP addresses (BYOIP).

        Access Level: Write

        Possible conditions:

        - .ifRegion()

        https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_WithdrawByoipCidr.html

        :stability: experimental
        '''
        return typing.cast("Ec2", jsii.invoke(self, "toWithdrawByoipCidr", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ff777e7d539384a605bdd56c4251967bd32ef555e5a385ad05827b764edcd2b2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3089450c8f670bf45b35c7add21178553f26b3671fd226b16804508996c9d6e8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Ec2InstanceConnect(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Ec2InstanceConnect",
):
    '''(experimental) Statement provider for service `ec2-instance-connect <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2instanceconnect.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ec2-instance-connect <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2instanceconnect.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1169d981c374405dd06915ff9e6de64733d0588ab1cfe5490ba5afdae96eedd0)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifEc2Osuser")
    def if_ec2_osuser(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2InstanceConnect":
        '''(experimental) Filters access by specifying the default user name for the AMI that you used to launch your instance.

        https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSSHPublicKey.html

        Applies to actions:

        - .toSendSSHPublicKey()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cd640bd3d258d34eff3f904a0ceb962ff56462b25c98137158dba770fa23d249)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2InstanceConnect", jsii.invoke(self, "ifEc2Osuser", [value, operator]))

    @jsii.member(jsii_name="ifEc2ResourceTag")
    def if_ec2_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2InstanceConnect":
        '''(experimental) Filters access based on the tags associated with the resource.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag

        Applies to resource types:

        - instance

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e4e5205a78596436dcf92a9b23001971343f908279557188b39dfa662afad935)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2InstanceConnect", jsii.invoke(self, "ifEc2ResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onInstance")
    def on_instance(
        self,
        instance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ec2InstanceConnect":
        '''(experimental) Adds a resource of type instance to the statement.

        https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#EC2_ARN_Format

        :param instance_id: - Identifier for the instanceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifEc2ResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__310c3fc54ff77be8ac769cfbae3bb5989fe07b9ce1af90edb0a807605407ed51)
            check_type(argname="argument instance_id", value=instance_id, expected_type=type_hints["instance_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ec2InstanceConnect", jsii.invoke(self, "onInstance", [instance_id, account, region, partition]))

    @jsii.member(jsii_name="toSendSerialConsoleSSHPublicKey")
    def to_send_serial_console_ssh_public_key(self) -> "Ec2InstanceConnect":
        '''(experimental) Grants access to push an SSH public key to the specified EC2 instance to be used for serial console SSH.

        Access Level: Write

        https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSerialConsoleSSHPublicKey.html

        :stability: experimental
        '''
        return typing.cast("Ec2InstanceConnect", jsii.invoke(self, "toSendSerialConsoleSSHPublicKey", []))

    @jsii.member(jsii_name="toSendSSHPublicKey")
    def to_send_ssh_public_key(self) -> "Ec2InstanceConnect":
        '''(experimental) Grants access to push an SSH public key to the specified EC2 instance to be used for standard SSH.

        Access Level: Write

        Possible conditions:

        - .ifEc2Osuser()

        https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSSHPublicKey.html

        :stability: experimental
        '''
        return typing.cast("Ec2InstanceConnect", jsii.invoke(self, "toSendSSHPublicKey", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0b9f5e6dfca517d47b322feddc91836bab25361fb9440ca8f735d02cfa3becbf)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__51839935f4357250368ffc1e8e7957741ab3e0bb784a84a4ed023754ddb3858a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Ec2messages(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Ec2messages",
):
    '''(experimental) Statement provider for service `ec2messages <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmessagedeliveryservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ec2messages <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmessagedeliveryservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ab6c5657f447fd27a35cf806972a6650fb79a1f3df75a259b4baca925d094d92)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifSsmSourceInstanceARN")
    def if_ssm_source_instance_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ec2messages":
        '''(experimental) Filters access by verifying the Amazon Resource Name (ARN) of the AWS Systems Manager's managed instance from which the request is made.

        This key is not present when the request comes from the managed instance authenticated with an IAM role associated with EC2 instance profile

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssystemsmanager.html#awssystemsmanager-policy-keys

        Applies to actions:

        - .toGetMessages()
        - .toSendReply()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__786fc2387b83f0c25131a94fb1197be9782dd36108f1beb5ae39ee5189cdd438)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ec2messages", jsii.invoke(self, "ifSsmSourceInstanceARN", [value, operator]))

    @jsii.member(jsii_name="toAcknowledgeMessage")
    def to_acknowledge_message(self) -> "Ec2messages":
        '''(experimental) Grants permission to acknowledge a message, ensuring it will not be delivered again.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html

        :stability: experimental
        '''
        return typing.cast("Ec2messages", jsii.invoke(self, "toAcknowledgeMessage", []))

    @jsii.member(jsii_name="toDeleteMessage")
    def to_delete_message(self) -> "Ec2messages":
        '''(experimental) Grants permission to delete a message.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html

        :stability: experimental
        '''
        return typing.cast("Ec2messages", jsii.invoke(self, "toDeleteMessage", []))

    @jsii.member(jsii_name="toFailMessage")
    def to_fail_message(self) -> "Ec2messages":
        '''(experimental) Grants permission to fail a message, signifying the message could not be processed successfully, ensuring it cannot be replied to or delivered again.

        Access Level: Write

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html

        :stability: experimental
        '''
        return typing.cast("Ec2messages", jsii.invoke(self, "toFailMessage", []))

    @jsii.member(jsii_name="toGetEndpoint")
    def to_get_endpoint(self) -> "Ec2messages":
        '''(experimental) Grants permission to route traffic to the correct endpoint based on the given destination for the messages.

        Access Level: Read

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html

        :stability: experimental
        '''
        return typing.cast("Ec2messages", jsii.invoke(self, "toGetEndpoint", []))

    @jsii.member(jsii_name="toGetMessages")
    def to_get_messages(self) -> "Ec2messages":
        '''(experimental) Grants permission to deliver messages to clients/instances using long polling.

        Access Level: Read

        Possible conditions:

        - .ifSsmSourceInstanceARN()

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html

        :stability: experimental
        '''
        return typing.cast("Ec2messages", jsii.invoke(self, "toGetMessages", []))

    @jsii.member(jsii_name="toSendReply")
    def to_send_reply(self) -> "Ec2messages":
        '''(experimental) Grants permission to send replies from clients/instances to upstream service.

        Access Level: Write

        Possible conditions:

        - .ifSsmSourceInstanceARN()

        https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-setting-up-messageAPIs.html

        :stability: experimental
        '''
        return typing.cast("Ec2messages", jsii.invoke(self, "toSendReply", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bcfc93069b701c1852a7602beb6092fc3a81cb2743a02f816a2692ca28e1eab6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d99c78b352a1e6903fff7b013676283dabb0f49830ff82f406bbc71997a993dd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Ecr(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ecr"):
    '''(experimental) Statement provider for service `ecr <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticcontainerregistry.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ecr <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticcontainerregistry.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__384ccb4e5a3d25f9a51e0d5409aba44a5a03fcd09ec430bb3ef3aabbd68187a2)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ecr":
        '''(experimental) Filters access by tag-value associated with the resource.

        https://docs.aws.amazon.com/AmazonECR/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to resource types:

        - repository

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__196106ad0a629752048195caa45e92018cb41eb48e01ca8c960827486c120268)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ecr", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onRepository")
    def on_repository(
        self,
        repository_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ecr":
        '''(experimental) Adds a resource of type repository to the statement.

        https://docs.aws.amazon.com/AmazonECR/latest/userguide/Repositories.html

        :param repository_name: - Identifier for the repositoryName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b2accb150a6da0e48f585f861699c3bc905d8a44b7ac35066352f3686b4ab10d)
            check_type(argname="argument repository_name", value=repository_name, expected_type=type_hints["repository_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ecr", jsii.invoke(self, "onRepository", [repository_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchCheckLayerAvailability")
    def to_batch_check_layer_availability(self) -> "Ecr":
        '''(experimental) Grants permission to check the availability of multiple image layers in a specified registry and repository.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_BatchCheckLayerAvailability.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toBatchCheckLayerAvailability", []))

    @jsii.member(jsii_name="toBatchDeleteImage")
    def to_batch_delete_image(self) -> "Ecr":
        '''(experimental) Grants permission to delete a list of specified images within a specified repository.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_BatchDeleteImage.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toBatchDeleteImage", []))

    @jsii.member(jsii_name="toBatchGetImage")
    def to_batch_get_image(self) -> "Ecr":
        '''(experimental) Grants permission to get detailed information for specified images within a specified repository.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_BatchGetImage.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toBatchGetImage", []))

    @jsii.member(jsii_name="toBatchGetRepositoryScanningConfiguration")
    def to_batch_get_repository_scanning_configuration(self) -> "Ecr":
        '''(experimental) Grants permission to retrieve repository scanning configuration for a list of repositories.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_BatchGetRepositoryScanningConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toBatchGetRepositoryScanningConfiguration", []))

    @jsii.member(jsii_name="toBatchImportUpstreamImage")
    def to_batch_import_upstream_image(self) -> "Ecr":
        '''(experimental) Grants permission to retrieve the image from the upstream registry and import it to your private registry.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_BatchImportUpstreamImage.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toBatchImportUpstreamImage", []))

    @jsii.member(jsii_name="toCompleteLayerUpload")
    def to_complete_layer_upload(self) -> "Ecr":
        '''(experimental) Grants permission to inform Amazon ECR that the image layer upload for a specified registry, repository name, and upload ID, has completed.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_CompleteLayerUpload.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toCompleteLayerUpload", []))

    @jsii.member(jsii_name="toCreatePullThroughCacheRule")
    def to_create_pull_through_cache_rule(self) -> "Ecr":
        '''(experimental) Grants permission to create new pull-through cache rule.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_CreatePullThroughCacheRule.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toCreatePullThroughCacheRule", []))

    @jsii.member(jsii_name="toCreateRepository")
    def to_create_repository(self) -> "Ecr":
        '''(experimental) Grants permission to create an image repository.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ecr:TagResource

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_CreateRepository.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toCreateRepository", []))

    @jsii.member(jsii_name="toDeleteLifecyclePolicy")
    def to_delete_lifecycle_policy(self) -> "Ecr":
        '''(experimental) Grants permission to delete the specified lifecycle policy.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DeleteLifecyclePolicy.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toDeleteLifecyclePolicy", []))

    @jsii.member(jsii_name="toDeletePullThroughCacheRule")
    def to_delete_pull_through_cache_rule(self) -> "Ecr":
        '''(experimental) Grants permission to delete the pull-through cache rule.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DeletePullThroughCacheRule.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toDeletePullThroughCacheRule", []))

    @jsii.member(jsii_name="toDeleteRegistryPolicy")
    def to_delete_registry_policy(self) -> "Ecr":
        '''(experimental) Grants permission to delete the registry policy.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DeleteRegistryPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toDeleteRegistryPolicy", []))

    @jsii.member(jsii_name="toDeleteRepository")
    def to_delete_repository(self) -> "Ecr":
        '''(experimental) Grants permission to delete an existing image repository.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DeleteRepository.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toDeleteRepository", []))

    @jsii.member(jsii_name="toDeleteRepositoryPolicy")
    def to_delete_repository_policy(self) -> "Ecr":
        '''(experimental) Grants permission to delete the repository policy from a specified repository.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DeleteRepositoryPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toDeleteRepositoryPolicy", []))

    @jsii.member(jsii_name="toDescribeImageReplicationStatus")
    def to_describe_image_replication_status(self) -> "Ecr":
        '''(experimental) Grants permission to retrieve replication status about an image in a registry, including failure reason if replication fails.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DescribeImageReplicationStatus.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toDescribeImageReplicationStatus", []))

    @jsii.member(jsii_name="toDescribeImages")
    def to_describe_images(self) -> "Ecr":
        '''(experimental) Grants permission to get metadata about the images in a repository, including image size, image tags, and creation date.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DescribeImages.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toDescribeImages", []))

    @jsii.member(jsii_name="toDescribeImageScanFindings")
    def to_describe_image_scan_findings(self) -> "Ecr":
        '''(experimental) Grants permission to describe the image scan findings for the specified image.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DescribeImageScanFindings.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toDescribeImageScanFindings", []))

    @jsii.member(jsii_name="toDescribePullThroughCacheRules")
    def to_describe_pull_through_cache_rules(self) -> "Ecr":
        '''(experimental) Grants permission to describe the pull-through cache rules.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DescribePullThroughCacheRules.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toDescribePullThroughCacheRules", []))

    @jsii.member(jsii_name="toDescribeRegistry")
    def to_describe_registry(self) -> "Ecr":
        '''(experimental) Grants permission to describe the registry settings.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DescribeRegistry.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toDescribeRegistry", []))

    @jsii.member(jsii_name="toDescribeRepositories")
    def to_describe_repositories(self) -> "Ecr":
        '''(experimental) Grants permission to describe image repositories in a registry.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_DescribeRepositories.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toDescribeRepositories", []))

    @jsii.member(jsii_name="toGetAuthorizationToken")
    def to_get_authorization_token(self) -> "Ecr":
        '''(experimental) Grants permission to retrieve a token that is valid for a specified registry for 12 hours.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_GetAuthorizationToken.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toGetAuthorizationToken", []))

    @jsii.member(jsii_name="toGetDownloadUrlForLayer")
    def to_get_download_url_for_layer(self) -> "Ecr":
        '''(experimental) Grants permission to retrieve the download URL corresponding to an image layer.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_GetDownloadUrlForLayer.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toGetDownloadUrlForLayer", []))

    @jsii.member(jsii_name="toGetLifecyclePolicy")
    def to_get_lifecycle_policy(self) -> "Ecr":
        '''(experimental) Grants permission to retrieve the specified lifecycle policy.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_GetLifecyclePolicy.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toGetLifecyclePolicy", []))

    @jsii.member(jsii_name="toGetLifecyclePolicyPreview")
    def to_get_lifecycle_policy_preview(self) -> "Ecr":
        '''(experimental) Grants permission to retrieve the results of the specified lifecycle policy preview request.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_GetLifecyclePolicyPreview.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toGetLifecyclePolicyPreview", []))

    @jsii.member(jsii_name="toGetRegistryPolicy")
    def to_get_registry_policy(self) -> "Ecr":
        '''(experimental) Grants permission to retrieve the registry policy.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_GetRegistryPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toGetRegistryPolicy", []))

    @jsii.member(jsii_name="toGetRegistryScanningConfiguration")
    def to_get_registry_scanning_configuration(self) -> "Ecr":
        '''(experimental) Grants permission to retrieve registry scanning configuration.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_GetRegistryScanningConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toGetRegistryScanningConfiguration", []))

    @jsii.member(jsii_name="toGetRepositoryPolicy")
    def to_get_repository_policy(self) -> "Ecr":
        '''(experimental) Grants permission to retrieve the repository policy for a specified repository.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_GetRepositoryPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toGetRepositoryPolicy", []))

    @jsii.member(jsii_name="toInitiateLayerUpload")
    def to_initiate_layer_upload(self) -> "Ecr":
        '''(experimental) Grants permission to notify Amazon ECR that you intend to upload an image layer.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_InitiateLayerUpload.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toInitiateLayerUpload", []))

    @jsii.member(jsii_name="toListImages")
    def to_list_images(self) -> "Ecr":
        '''(experimental) Grants permission to list all the image IDs for a given repository.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_ListImages.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toListImages", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Ecr":
        '''(experimental) Grants permission to list the tags for an Amazon ECR resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutImage")
    def to_put_image(self) -> "Ecr":
        '''(experimental) Grants permission to create or update the image manifest associated with an image.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_PutImage.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toPutImage", []))

    @jsii.member(jsii_name="toPutImageScanningConfiguration")
    def to_put_image_scanning_configuration(self) -> "Ecr":
        '''(experimental) Grants permission to update the image scanning configuration for a repository.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_PutImageScanningConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toPutImageScanningConfiguration", []))

    @jsii.member(jsii_name="toPutImageTagMutability")
    def to_put_image_tag_mutability(self) -> "Ecr":
        '''(experimental) Grants permission to update the image tag mutability settings for a repository.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_PutImageTagMutability.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toPutImageTagMutability", []))

    @jsii.member(jsii_name="toPutLifecyclePolicy")
    def to_put_lifecycle_policy(self) -> "Ecr":
        '''(experimental) Grants permission to create or update a lifecycle policy.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_PutLifecyclePolicy.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toPutLifecyclePolicy", []))

    @jsii.member(jsii_name="toPutRegistryPolicy")
    def to_put_registry_policy(self) -> "Ecr":
        '''(experimental) Grants permission to update the registry policy.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_PutRegistryPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toPutRegistryPolicy", []))

    @jsii.member(jsii_name="toPutRegistryScanningConfiguration")
    def to_put_registry_scanning_configuration(self) -> "Ecr":
        '''(experimental) Grants permission to update registry scanning configuration.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_PutRegistryScanningConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toPutRegistryScanningConfiguration", []))

    @jsii.member(jsii_name="toPutReplicationConfiguration")
    def to_put_replication_configuration(self) -> "Ecr":
        '''(experimental) Grants permission to update the replication configuration for the registry.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_PutReplicationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toPutReplicationConfiguration", []))

    @jsii.member(jsii_name="toReplicateImage")
    def to_replicate_image(self) -> "Ecr":
        '''(experimental) Grants permission to replicate images to the destination registry.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry-permissions.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toReplicateImage", []))

    @jsii.member(jsii_name="toSetRepositoryPolicy")
    def to_set_repository_policy(self) -> "Ecr":
        '''(experimental) Grants permission to apply a repository policy on a specified repository to control access permissions.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_SetRepositoryPolicy.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toSetRepositoryPolicy", []))

    @jsii.member(jsii_name="toStartImageScan")
    def to_start_image_scan(self) -> "Ecr":
        '''(experimental) Grants permission to start an image scan.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_StartImageScan.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toStartImageScan", []))

    @jsii.member(jsii_name="toStartLifecyclePolicyPreview")
    def to_start_lifecycle_policy_preview(self) -> "Ecr":
        '''(experimental) Grants permission to start a preview of the specified lifecycle policy.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_StartLifecyclePolicyPreview.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toStartLifecyclePolicyPreview", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Ecr":
        '''(experimental) Grants permission to tag an Amazon ECR resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Ecr":
        '''(experimental) Grants permission to untag an Amazon ECR resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUploadLayerPart")
    def to_upload_layer_part(self) -> "Ecr":
        '''(experimental) Grants permission to upload an image layer part to Amazon ECR.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_UploadLayerPart.html

        :stability: experimental
        '''
        return typing.cast("Ecr", jsii.invoke(self, "toUploadLayerPart", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__17bfda66e4cc14a2580b5df5b0a3536bd7ffeda5c2b840065713df16abcc8c80)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dd2841111c8ea6b6f3d19a5c4bb4d20fabff507afd0837b95754597d9164e610)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class EcrPublic(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.EcrPublic",
):
    '''(experimental) Statement provider for service `ecr-public <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticcontainerregistrypublic.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ecr-public <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticcontainerregistrypublic.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__603b0dc13ce75318a43a363885345286d08166ee4b2ec1e3e859a0efb5416a41)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "EcrPublic":
        '''(experimental) Filters actions based on tag-value associated with the resource.

        https://docs.aws.amazon.com/AmazonECR/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to resource types:

        - repository

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d411194841f415c243e8efa3aab978c456975ca602b32d82828f8ad131ad997d)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("EcrPublic", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onRegistry")
    def on_registry(
        self,
        registry_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "EcrPublic":
        '''(experimental) Adds a resource of type registry to the statement.

        https://docs.aws.amazon.com/AmazonECR/latest/userguide/iam-policy-structure.html#ECR-Public_ARN_Format

        :param registry_id: - Identifier for the registryId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__43132fc6a7fb8ab7c5d8eb18bd353ac2879dec353e5a58ff19e1df832ff723af)
            check_type(argname="argument registry_id", value=registry_id, expected_type=type_hints["registry_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("EcrPublic", jsii.invoke(self, "onRegistry", [registry_id, account, partition]))

    @jsii.member(jsii_name="onRepository")
    def on_repository(
        self,
        repository_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "EcrPublic":
        '''(experimental) Adds a resource of type repository to the statement.

        https://docs.aws.amazon.com/AmazonECR/latest/userguide/iam-policy-structure.html#ECR-Public_ARN_Format

        :param repository_name: - Identifier for the repositoryName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2d60056714095fd1e2199bd5d9932c4c64963a4d5cce23a94912f71271808a42)
            check_type(argname="argument repository_name", value=repository_name, expected_type=type_hints["repository_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("EcrPublic", jsii.invoke(self, "onRepository", [repository_name, account, partition]))

    @jsii.member(jsii_name="toBatchCheckLayerAvailability")
    def to_batch_check_layer_availability(self) -> "EcrPublic":
        '''(experimental) Grants permission to check the availability of multiple image layers in a specified registry and repository.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_BatchCheckLayerAvailability.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toBatchCheckLayerAvailability", []))

    @jsii.member(jsii_name="toBatchDeleteImage")
    def to_batch_delete_image(self) -> "EcrPublic":
        '''(experimental) Grants permission to delete a list of specified images within a specified repository.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_BatchDeleteImage.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toBatchDeleteImage", []))

    @jsii.member(jsii_name="toCompleteLayerUpload")
    def to_complete_layer_upload(self) -> "EcrPublic":
        '''(experimental) Grants permission to inform Amazon ECR that the image layer upload for a specified registry, repository name, and upload ID, has completed.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_CompleteLayerUpload.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toCompleteLayerUpload", []))

    @jsii.member(jsii_name="toCreateRepository")
    def to_create_repository(self) -> "EcrPublic":
        '''(experimental) Grants permission to create an image repository.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_CreateRepository.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toCreateRepository", []))

    @jsii.member(jsii_name="toDeleteRepository")
    def to_delete_repository(self) -> "EcrPublic":
        '''(experimental) Grants permission to delete an existing image repository.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_DeleteRepository.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toDeleteRepository", []))

    @jsii.member(jsii_name="toDeleteRepositoryPolicy")
    def to_delete_repository_policy(self) -> "EcrPublic":
        '''(experimental) Grants permission to delete the repository policy from a specified repository.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_DeleteRepositoryPolicy.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toDeleteRepositoryPolicy", []))

    @jsii.member(jsii_name="toDescribeImages")
    def to_describe_images(self) -> "EcrPublic":
        '''(experimental) Grants permission to get metadata about the images in a repository, including image size, image tags, and creation date.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_DescribeImages.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toDescribeImages", []))

    @jsii.member(jsii_name="toDescribeImageTags")
    def to_describe_image_tags(self) -> "EcrPublic":
        '''(experimental) Grants permission to describe all the image tags for a given repository.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_DescribeImageTags.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toDescribeImageTags", []))

    @jsii.member(jsii_name="toDescribeRegistries")
    def to_describe_registries(self) -> "EcrPublic":
        '''(experimental) Grants permission to retrieve the catalog data associated with a registry.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_DescribeRegistries.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toDescribeRegistries", []))

    @jsii.member(jsii_name="toDescribeRepositories")
    def to_describe_repositories(self) -> "EcrPublic":
        '''(experimental) Grants permission to describe image repositories in a registry.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_DescribeRepositories.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toDescribeRepositories", []))

    @jsii.member(jsii_name="toGetAuthorizationToken")
    def to_get_authorization_token(self) -> "EcrPublic":
        '''(experimental) Grants permission to retrieve a token that is valid for a specified registry for 12 hours.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_GetAuthorizationToken.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toGetAuthorizationToken", []))

    @jsii.member(jsii_name="toGetRegistryCatalogData")
    def to_get_registry_catalog_data(self) -> "EcrPublic":
        '''(experimental) Grants permission to retrieve the catalog data associated with a registry.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_GetRegistryCatalogData.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toGetRegistryCatalogData", []))

    @jsii.member(jsii_name="toGetRepositoryCatalogData")
    def to_get_repository_catalog_data(self) -> "EcrPublic":
        '''(experimental) Grants permission to retrieve the catalog data associated with a repository.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_GetRepositoryCatalogData.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toGetRepositoryCatalogData", []))

    @jsii.member(jsii_name="toGetRepositoryPolicy")
    def to_get_repository_policy(self) -> "EcrPublic":
        '''(experimental) Grants permission to retrieve the repository policy for a specified repository.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_GetRepositoryPolicy.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toGetRepositoryPolicy", []))

    @jsii.member(jsii_name="toInitiateLayerUpload")
    def to_initiate_layer_upload(self) -> "EcrPublic":
        '''(experimental) Grants permission to notify Amazon ECR that you intend to upload an image layer.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_InitiateLayerUpload.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toInitiateLayerUpload", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "EcrPublic":
        '''(experimental) Grants permission to list the tags for an Amazon ECR resource.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutImage")
    def to_put_image(self) -> "EcrPublic":
        '''(experimental) Grants permission to create or update the image manifest associated with an image.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_PutImage.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toPutImage", []))

    @jsii.member(jsii_name="toPutRegistryCatalogData")
    def to_put_registry_catalog_data(self) -> "EcrPublic":
        '''(experimental) Grants permission to create and update the catalog data associated with a registry.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_PutRegistryCatalogData.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toPutRegistryCatalogData", []))

    @jsii.member(jsii_name="toPutRepositoryCatalogData")
    def to_put_repository_catalog_data(self) -> "EcrPublic":
        '''(experimental) Grants permission to update the catalog data associated with a repository.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_PutRepositoryCatalogData.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toPutRepositoryCatalogData", []))

    @jsii.member(jsii_name="toSetRepositoryPolicy")
    def to_set_repository_policy(self) -> "EcrPublic":
        '''(experimental) Grants permission to apply a repository policy on a specified repository to control access permissions.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_SetRepositoryPolicy.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toSetRepositoryPolicy", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "EcrPublic":
        '''(experimental) Grants permission to tag an Amazon ECR resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "EcrPublic":
        '''(experimental) Grants permission to untag an Amazon ECR resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUploadLayerPart")
    def to_upload_layer_part(self) -> "EcrPublic":
        '''(experimental) Grants permission to upload an image layer part to Amazon ECR Public.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECRPublic/latest/APIReference/API_UploadLayerPart.html

        :stability: experimental
        '''
        return typing.cast("EcrPublic", jsii.invoke(self, "toUploadLayerPart", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6b846bdfddc4ca9b87d6d82ea0b85d421e5f87df6f90b2636b3281e5980b7464)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__73c181304a8fb513c2f0f7007e63f701ed82008bc720b8f7ddc970a3517b3722)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Ecs(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ecs"):
    '''(experimental) Statement provider for service `ecs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticcontainerservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ecs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticcontainerservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e435f6d1d7a06ca8afa7016090c3bbd32e233b9ae8fad4bb7ce6c2985103be2f)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifCapacityProvider")
    def if_capacity_provider(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ecs":
        '''(experimental) Filters access by the ARN of an Amazon ECS capacity provider.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toCreateCluster()
        - .toCreateService()
        - .toCreateTaskSet()
        - .toPutClusterCapacityProviders()
        - .toRunTask()
        - .toUpdateService()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2c191f0056d0efef39b1f7b47b4e4bcd4d7286b142aafede758010df738bee80)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ecs", jsii.invoke(self, "ifCapacityProvider", [value, operator]))

    @jsii.member(jsii_name="ifCluster")
    def if_cluster(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ecs":
        '''(experimental) Filters access by the ARN of an Amazon ECS cluster.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toCreateService()
        - .toCreateTaskSet()
        - .toDeleteAttributes()
        - .toDeleteService()
        - .toDeleteTaskSet()
        - .toDescribeContainerInstances()
        - .toDescribeServices()
        - .toDescribeTaskSets()
        - .toDescribeTasks()
        - .toExecuteCommand()
        - .toGetTaskProtection()
        - .toListServices()
        - .toListTasks()
        - .toPoll()
        - .toPutAttributes()
        - .toRunTask()
        - .toStartTask()
        - .toStartTelemetrySession()
        - .toStopTask()
        - .toUpdateContainerAgent()
        - .toUpdateContainerInstancesState()
        - .toUpdateService()
        - .toUpdateServicePrimaryTaskSet()
        - .toUpdateTaskProtection()
        - .toUpdateTaskSet()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d6ae9e056f39b8e58f6eb914539e0ba61623af277bccc41ef52aa40a9a74cc3e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ecs", jsii.invoke(self, "ifCluster", [value, operator]))

    @jsii.member(jsii_name="ifContainerInstances")
    def if_container_instances(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ecs":
        '''(experimental) Filters access by the ARN of an Amazon ECS container instance.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toStartTask()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d95914bd90704bf6f28215974b91db503c645d3ed222ed1dad23aa86be5c15e8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ecs", jsii.invoke(self, "ifContainerInstances", [value, operator]))

    @jsii.member(jsii_name="ifContainerName")
    def if_container_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ecs":
        '''(experimental) Filters access by the name of an Amazon ECS container which is defined in the ECS task definition.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toExecuteCommand()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b4c1866490f0eab5936cbe4101c331753cc6fae45f55b12af269f137ae73608f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ecs", jsii.invoke(self, "ifContainerName", [value, operator]))

    @jsii.member(jsii_name="ifEnableExecuteCommand")
    def if_enable_execute_command(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ecs":
        '''(experimental) Filters access by the execute-command capability of your Amazon ECS task or Amazon ECS service.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toCreateService()
        - .toRunTask()
        - .toStartTask()
        - .toUpdateService()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__efca0b2c8262f6b177b913254c5eacf12c70760cfffbf43d6cc73cddfa98d1ad)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ecs", jsii.invoke(self, "ifEnableExecuteCommand", [value, operator]))

    @jsii.member(jsii_name="ifEnableServiceConnect")
    def if_enable_service_connect(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ecs":
        '''(experimental) Filters access by the enable field value in the Service Connect configuration.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toCreateService()
        - .toUpdateService()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b1c6361593e93ceb4e2ddd0c352232345fe567638ee94066939dbbd78736c711)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ecs", jsii.invoke(self, "ifEnableServiceConnect", [value, operator]))

    @jsii.member(jsii_name="ifNamespace")
    def if_namespace(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ecs":
        '''(experimental) Filters access by the ARN of AWS Cloud Map namespace which is defined in the Service Connect Configuration.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toCreateService()
        - .toListServicesByNamespace()
        - .toUpdateService()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7a3c48cb8ea513a0e91903898b9594e1d3bd1c8a240b8e58ba5c0f2ecfcd22c4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ecs", jsii.invoke(self, "ifNamespace", [value, operator]))

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ecs":
        '''(experimental) Filters access by the tag key-value pairs attached to the resource.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies

        Applies to resource types:

        - cluster
        - container-instance
        - service
        - task
        - task-definition
        - capacity-provider
        - task-set

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9fde84a360c6026def77647a851fbfc1589960a39b7e04dd712b5362dbe825f6)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ecs", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifService")
    def if_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ecs":
        '''(experimental) Filters access by the ARN of an Amazon ECS service.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toCreateTaskSet()
        - .toDeleteTaskSet()
        - .toDescribeTaskSets()
        - .toUpdateTaskSet()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b77672e80080fa535725599b5a53348f8b6f81eef2e4fb87d44323e42de3fd9e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ecs", jsii.invoke(self, "ifService", [value, operator]))

    @jsii.member(jsii_name="ifTask")
    def if_task(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ecs":
        '''(experimental) Filters access by the ARN of an Amazon ECS task.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toExecuteCommand()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2d24671bfa22ce9de8d2a0a4151ecc6ff584ea3b65016d0b4963723d56789143)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ecs", jsii.invoke(self, "ifTask", [value, operator]))

    @jsii.member(jsii_name="ifTaskDefinition")
    def if_task_definition(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Ecs":
        '''(experimental) Filters access by the ARN of an Amazon ECS task definition.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toCreateService()
        - .toCreateTaskSet()
        - .toUpdateService()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ebc04d3a22b0386355a675dc1a1c7f77b57e49b222ef543a17fc4f38f962a7c7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Ecs", jsii.invoke(self, "ifTaskDefinition", [value, operator]))

    @jsii.member(jsii_name="onCapacityProvider")
    def on_capacity_provider(
        self,
        capacity_provider_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ecs":
        '''(experimental) Adds a resource of type capacity-provider to the statement.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cluster-capacity-providers.html

        :param capacity_provider_name: - Identifier for the capacityProviderName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4a336b6f8a58ecce8fb4cf29e679d83b69ea0cfbd1f864b48263d7b003e00744)
            check_type(argname="argument capacity_provider_name", value=capacity_provider_name, expected_type=type_hints["capacity_provider_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ecs", jsii.invoke(self, "onCapacityProvider", [capacity_provider_name, account, region, partition]))

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        cluster_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ecs":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/clusters.html

        :param cluster_name: - Identifier for the clusterName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3558db6445a41a720234aef79378cb3e0f6a2a4a47fc364d754f5f58f4f73025)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ecs", jsii.invoke(self, "onCluster", [cluster_name, account, region, partition]))

    @jsii.member(jsii_name="onContainerInstance")
    def on_container_instance(
        self,
        cluster_name: builtins.str,
        container_instance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ecs":
        '''(experimental) Adds a resource of type container-instance to the statement.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ECS_instances.html

        :param cluster_name: - Identifier for the clusterName.
        :param container_instance_id: - Identifier for the containerInstanceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f4af35c8a8737e388615332e95af180db0e81bf9b098f6b61860f17420875b89)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument container_instance_id", value=container_instance_id, expected_type=type_hints["container_instance_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ecs", jsii.invoke(self, "onContainerInstance", [cluster_name, container_instance_id, account, region, partition]))

    @jsii.member(jsii_name="onService")
    def on_service(
        self,
        cluster_name: builtins.str,
        service_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ecs":
        '''(experimental) Adds a resource of type service to the statement.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs_services.html

        :param cluster_name: - Identifier for the clusterName.
        :param service_name: - Identifier for the serviceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__24e6e41bbab9c1abc3639a1e5eed82c653543246ccb7468cfc1bdbec0d3d27c3)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument service_name", value=service_name, expected_type=type_hints["service_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ecs", jsii.invoke(self, "onService", [cluster_name, service_name, account, region, partition]))

    @jsii.member(jsii_name="onTask")
    def on_task(
        self,
        cluster_name: builtins.str,
        task_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ecs":
        '''(experimental) Adds a resource of type task to the statement.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/scheduling_tasks.html

        :param cluster_name: - Identifier for the clusterName.
        :param task_id: - Identifier for the taskId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__217033cdab58b67977e0dd605e152ae3270fa1eda47f0dd1876cc023cc1d08fd)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument task_id", value=task_id, expected_type=type_hints["task_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ecs", jsii.invoke(self, "onTask", [cluster_name, task_id, account, region, partition]))

    @jsii.member(jsii_name="onTaskDefinition")
    def on_task_definition(
        self,
        task_definition_family_name: builtins.str,
        task_definition_revision_number: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ecs":
        '''(experimental) Adds a resource of type task-definition to the statement.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definitions.html

        :param task_definition_family_name: - Identifier for the taskDefinitionFamilyName.
        :param task_definition_revision_number: - Identifier for the taskDefinitionRevisionNumber.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__86a547247414eb81c090f57975210ceb77429014b456bb22a8642754b42ba7e6)
            check_type(argname="argument task_definition_family_name", value=task_definition_family_name, expected_type=type_hints["task_definition_family_name"])
            check_type(argname="argument task_definition_revision_number", value=task_definition_revision_number, expected_type=type_hints["task_definition_revision_number"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ecs", jsii.invoke(self, "onTaskDefinition", [task_definition_family_name, task_definition_revision_number, account, region, partition]))

    @jsii.member(jsii_name="onTaskSet")
    def on_task_set(
        self,
        cluster_name: builtins.str,
        service_name: builtins.str,
        task_set_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ecs":
        '''(experimental) Adds a resource of type task-set to the statement.

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/deployment-type-external.html

        :param cluster_name: - Identifier for the clusterName.
        :param service_name: - Identifier for the serviceName.
        :param task_set_id: - Identifier for the taskSetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e404b04096310adb420ad6e21e5f0d454589379ab6a83bf95d996f560b088911)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument service_name", value=service_name, expected_type=type_hints["service_name"])
            check_type(argname="argument task_set_id", value=task_set_id, expected_type=type_hints["task_set_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ecs", jsii.invoke(self, "onTaskSet", [cluster_name, service_name, task_set_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateCapacityProvider")
    def to_create_capacity_provider(self) -> "Ecs":
        '''(experimental) Grants permission to create a new capacity provider.

        Capacity providers are associated with an Amazon ECS cluster and are used in capacity provider strategies to facilitate cluster auto scaling

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateCapacityProvider.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toCreateCapacityProvider", []))

    @jsii.member(jsii_name="toCreateCluster")
    def to_create_cluster(self) -> "Ecs":
        '''(experimental) Grants permission to create a new Amazon ECS cluster.

        Access Level: Write

        Possible conditions:

        - .ifCapacityProvider()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateCluster.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toCreateCluster", []))

    @jsii.member(jsii_name="toCreateService")
    def to_create_service(self) -> "Ecs":
        '''(experimental) Grants permission to run and maintain a desired number of tasks from a specified task definition via service creation.

        Access Level: Write

        Possible conditions:

        - .ifCluster()
        - .ifCapacityProvider()
        - .ifTaskDefinition()
        - .ifEnableExecuteCommand()
        - .ifEnableServiceConnect()
        - .ifNamespace()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateService.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toCreateService", []))

    @jsii.member(jsii_name="toCreateTaskSet")
    def to_create_task_set(self) -> "Ecs":
        '''(experimental) Grants permission to create a new Amazon ECS task set.

        Access Level: Write

        Possible conditions:

        - .ifCluster()
        - .ifCapacityProvider()
        - .ifService()
        - .ifTaskDefinition()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_CreateTaskSet.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toCreateTaskSet", []))

    @jsii.member(jsii_name="toDeleteAccountSetting")
    def to_delete_account_setting(self) -> "Ecs":
        '''(experimental) Grants permission to modify the ARN and resource ID format of a resource for a specified IAM user, IAM role, or the root user for an account.

        You can specify whether the new ARN and resource ID format are disabled for new resources that are created

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteAccountSetting.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDeleteAccountSetting", []))

    @jsii.member(jsii_name="toDeleteAttributes")
    def to_delete_attributes(self) -> "Ecs":
        '''(experimental) Grants permission to delete one or more custom attributes from an Amazon ECS resource.

        Access Level: Write

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDeleteAttributes", []))

    @jsii.member(jsii_name="toDeleteCapacityProvider")
    def to_delete_capacity_provider(self) -> "Ecs":
        '''(experimental) Grants permission to delete the specified capacity provider.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteCapacityProvider.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDeleteCapacityProvider", []))

    @jsii.member(jsii_name="toDeleteCluster")
    def to_delete_cluster(self) -> "Ecs":
        '''(experimental) Grants permission to delete the specified cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteCluster.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDeleteCluster", []))

    @jsii.member(jsii_name="toDeleteService")
    def to_delete_service(self) -> "Ecs":
        '''(experimental) Grants permission to delete a specified service within a cluster.

        Access Level: Write

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteService.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDeleteService", []))

    @jsii.member(jsii_name="toDeleteTaskDefinitions")
    def to_delete_task_definitions(self) -> "Ecs":
        '''(experimental) Grants permission to delete the specified task definitions by family and revision.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteTaskDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDeleteTaskDefinitions", []))

    @jsii.member(jsii_name="toDeleteTaskSet")
    def to_delete_task_set(self) -> "Ecs":
        '''(experimental) Grants permission to delete the specified task set.

        Access Level: Write

        Possible conditions:

        - .ifCluster()
        - .ifService()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeleteTaskSet.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDeleteTaskSet", []))

    @jsii.member(jsii_name="toDeregisterContainerInstance")
    def to_deregister_container_instance(self) -> "Ecs":
        '''(experimental) Grants permission to deregister an Amazon ECS container instance from the specified cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeregisterContainerInstance.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDeregisterContainerInstance", []))

    @jsii.member(jsii_name="toDeregisterTaskDefinition")
    def to_deregister_task_definition(self) -> "Ecs":
        '''(experimental) Grants permission to deregister the specified task definition by family and revision.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeregisterTaskDefinition.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDeregisterTaskDefinition", []))

    @jsii.member(jsii_name="toDescribeCapacityProviders")
    def to_describe_capacity_providers(self) -> "Ecs":
        '''(experimental) Grants permission to describe one or more Amazon ECS capacity providers.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeCapacityProviders.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDescribeCapacityProviders", []))

    @jsii.member(jsii_name="toDescribeClusters")
    def to_describe_clusters(self) -> "Ecs":
        '''(experimental) Grants permission to describes one or more of your clusters.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeClusters.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDescribeClusters", []))

    @jsii.member(jsii_name="toDescribeContainerInstances")
    def to_describe_container_instances(self) -> "Ecs":
        '''(experimental) Grants permission to describes Amazon ECS container instances.

        Access Level: Read

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeContainerInstances.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDescribeContainerInstances", []))

    @jsii.member(jsii_name="toDescribeServices")
    def to_describe_services(self) -> "Ecs":
        '''(experimental) Grants permission to describe the specified services running in your cluster.

        Access Level: Read

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeServices.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDescribeServices", []))

    @jsii.member(jsii_name="toDescribeTaskDefinition")
    def to_describe_task_definition(self) -> "Ecs":
        '''(experimental) Grants permission to describe a task definition.

        You can specify a family and revision to find information about a specific task definition, or you can simply specify the family to find the latest ACTIVE revision in that family

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeTaskDefinition.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDescribeTaskDefinition", []))

    @jsii.member(jsii_name="toDescribeTasks")
    def to_describe_tasks(self) -> "Ecs":
        '''(experimental) Grants permission to describe a specified task or tasks.

        Access Level: Read

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeTasks.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDescribeTasks", []))

    @jsii.member(jsii_name="toDescribeTaskSets")
    def to_describe_task_sets(self) -> "Ecs":
        '''(experimental) Grants permission to describe Amazon ECS task sets.

        Access Level: Read

        Possible conditions:

        - .ifCluster()
        - .ifService()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeTaskSets.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDescribeTaskSets", []))

    @jsii.member(jsii_name="toDiscoverPollEndpoint")
    def to_discover_poll_endpoint(self) -> "Ecs":
        '''(experimental) Grants permission to get an endpoint for the Amazon ECS agent to poll for updates.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DiscoverPollEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toDiscoverPollEndpoint", []))

    @jsii.member(jsii_name="toExecuteCommand")
    def to_execute_command(self) -> "Ecs":
        '''(experimental) Grants permission to run a command remotely on an Amazon ECS container.

        Access Level: Write

        Possible conditions:

        - .ifCluster()
        - .ifContainerName()
        - .ifTask()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ExecuteCommand.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toExecuteCommand", []))

    @jsii.member(jsii_name="toGetTaskProtection")
    def to_get_task_protection(self) -> "Ecs":
        '''(experimental) Grants permission to retrieve the protection status of tasks in an Amazon ECS service.

        Access Level: Read

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_GetTaskProtection.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toGetTaskProtection", []))

    @jsii.member(jsii_name="toListAccountSettings")
    def to_list_account_settings(self) -> "Ecs":
        '''(experimental) Grants permission to list the account settings for an Amazon ECS resource for a specified principal.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListAccountSettings.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toListAccountSettings", []))

    @jsii.member(jsii_name="toListAttributes")
    def to_list_attributes(self) -> "Ecs":
        '''(experimental) Grants permission to lists the attributes for Amazon ECS resources within a specified target type and cluster.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toListAttributes", []))

    @jsii.member(jsii_name="toListClusters")
    def to_list_clusters(self) -> "Ecs":
        '''(experimental) Grants permission to get a list of existing clusters.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListClusters.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toListClusters", []))

    @jsii.member(jsii_name="toListContainerInstances")
    def to_list_container_instances(self) -> "Ecs":
        '''(experimental) Grants permission to get a list of container instances in a specified cluster.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListContainerInstances.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toListContainerInstances", []))

    @jsii.member(jsii_name="toListServices")
    def to_list_services(self) -> "Ecs":
        '''(experimental) Grants permission to get a list of services that are running in a specified cluster.

        Access Level: List

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListServices.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toListServices", []))

    @jsii.member(jsii_name="toListServicesByNamespace")
    def to_list_services_by_namespace(self) -> "Ecs":
        '''(experimental) Grants permission to get a list of services that are running in a specified AWS Cloud Map Namespace.

        Access Level: List

        Possible conditions:

        - .ifNamespace()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListServicesByNamespace.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toListServicesByNamespace", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Ecs":
        '''(experimental) Grants permission to get a list of tags for the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTaskDefinitionFamilies")
    def to_list_task_definition_families(self) -> "Ecs":
        '''(experimental) Grants permission to get a list of task definition families that are registered to your account (which may include task definition families that no longer have any ACTIVE task definitions).

        Access Level: List

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListServices.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toListTaskDefinitionFamilies", []))

    @jsii.member(jsii_name="toListTaskDefinitions")
    def to_list_task_definitions(self) -> "Ecs":
        '''(experimental) Grants permission to get a list of task definitions that are registered to your account.

        Access Level: List

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListTaskDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toListTaskDefinitions", []))

    @jsii.member(jsii_name="toListTasks")
    def to_list_tasks(self) -> "Ecs":
        '''(experimental) Grants permission to get a list of tasks for a specified cluster.

        Access Level: List

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListTasks.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toListTasks", []))

    @jsii.member(jsii_name="toPoll")
    def to_poll(self) -> "Ecs":
        '''(experimental) Grants permission to an agent to connect with the Amazon ECS service to report status and get commands.

        Access Level: Write

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/instance_IAM_role.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toPoll", []))

    @jsii.member(jsii_name="toPutAccountSetting")
    def to_put_account_setting(self) -> "Ecs":
        '''(experimental) Grants permission to modify the ARN and resource ID format of a resource for a specified IAM user, IAM role, or the root user for an account.

        You can specify whether the new ARN and resource ID format are enabled for new resources that are created. Enabling this setting is required to use new Amazon ECS features such as resource tagging

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PutAccountSetting.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toPutAccountSetting", []))

    @jsii.member(jsii_name="toPutAccountSettingDefault")
    def to_put_account_setting_default(self) -> "Ecs":
        '''(experimental) Grants permission to modify the ARN and resource ID format of a resource type for all IAM users on an account for which no individual account setting has been set.

        Enabling this setting is required to use new Amazon ECS features such as resource tagging

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PutAccountSettingDefault.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toPutAccountSettingDefault", []))

    @jsii.member(jsii_name="toPutAttributes")
    def to_put_attributes(self) -> "Ecs":
        '''(experimental) Grants permission to create or update an attribute on an Amazon ECS resource.

        Access Level: Write

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PutAttributes.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toPutAttributes", []))

    @jsii.member(jsii_name="toPutClusterCapacityProviders")
    def to_put_cluster_capacity_providers(self) -> "Ecs":
        '''(experimental) Grants permission to modify the available capacity providers and the default capacity provider strategy for a cluster.

        Access Level: Write

        Possible conditions:

        - .ifCapacityProvider()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PutClusterCapacityProviders.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toPutClusterCapacityProviders", []))

    @jsii.member(jsii_name="toRegisterContainerInstance")
    def to_register_container_instance(self) -> "Ecs":
        '''(experimental) Grants permission to register an EC2 instance into the specified cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RegisterContainerInstance.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toRegisterContainerInstance", []))

    @jsii.member(jsii_name="toRegisterTaskDefinition")
    def to_register_task_definition(self) -> "Ecs":
        '''(experimental) Grants permission to register a new task definition from the supplied family and containerDefinitions.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RegisterTaskDefinition.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toRegisterTaskDefinition", []))

    @jsii.member(jsii_name="toRunTask")
    def to_run_task(self) -> "Ecs":
        '''(experimental) Grants permission to start a task using random placement and the default Amazon ECS scheduler.

        Access Level: Write

        Possible conditions:

        - .ifCluster()
        - .ifCapacityProvider()
        - .ifEnableExecuteCommand()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RunTask.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toRunTask", []))

    @jsii.member(jsii_name="toStartTask")
    def to_start_task(self) -> "Ecs":
        '''(experimental) Grants permission to start a new task from the specified task definition on the specified container instance or instances.

        Access Level: Write

        Possible conditions:

        - .ifCluster()
        - .ifContainerInstances()
        - .ifEnableExecuteCommand()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_StartTask.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toStartTask", []))

    @jsii.member(jsii_name="toStartTelemetrySession")
    def to_start_telemetry_session(self) -> "Ecs":
        '''(experimental) Grants permission to start a telemetry session.

        Access Level: Write

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cloudwatch-metrics.html#enable_cloudwatch

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toStartTelemetrySession", []))

    @jsii.member(jsii_name="toStopTask")
    def to_stop_task(self) -> "Ecs":
        '''(experimental) Grants permission to stop a running task.

        Access Level: Write

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_StopTask.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toStopTask", []))

    @jsii.member(jsii_name="toSubmitAttachmentStateChanges")
    def to_submit_attachment_state_changes(self) -> "Ecs":
        '''(experimental) Grants permission to send an acknowledgement that attachments changed states.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_SubmitAttachmentStateChanges.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toSubmitAttachmentStateChanges", []))

    @jsii.member(jsii_name="toSubmitContainerStateChange")
    def to_submit_container_state_change(self) -> "Ecs":
        '''(experimental) Grants permission to send an acknowledgement that a container changed states.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_SubmitContainerStateChange.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toSubmitContainerStateChange", []))

    @jsii.member(jsii_name="toSubmitTaskStateChange")
    def to_submit_task_state_change(self) -> "Ecs":
        '''(experimental) Grants permission to send an acknowledgement that a task changed states.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_SubmitTaskStateChange.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toSubmitTaskStateChange", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Ecs":
        '''(experimental) Grants permission to tag the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Ecs":
        '''(experimental) Grants permission to untag the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateCapacityProvider")
    def to_update_capacity_provider(self) -> "Ecs":
        '''(experimental) Grants permission to update the specified capacity provider.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_UpdateCapacityProvider.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toUpdateCapacityProvider", []))

    @jsii.member(jsii_name="toUpdateCluster")
    def to_update_cluster(self) -> "Ecs":
        '''(experimental) Grants permission to modify the configuration or settings to use for a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_UpdateCluster.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toUpdateCluster", []))

    @jsii.member(jsii_name="toUpdateClusterSettings")
    def to_update_cluster_settings(self) -> "Ecs":
        '''(experimental) Grants permission to modify the settings to use for a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_UpdateClusterSettings.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toUpdateClusterSettings", []))

    @jsii.member(jsii_name="toUpdateContainerAgent")
    def to_update_container_agent(self) -> "Ecs":
        '''(experimental) Grants permission to update the Amazon ECS container agent on a specified container instance.

        Access Level: Write

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_UpdateContainerAgent.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toUpdateContainerAgent", []))

    @jsii.member(jsii_name="toUpdateContainerInstancesState")
    def to_update_container_instances_state(self) -> "Ecs":
        '''(experimental) Grants permission to the user to modify the status of an Amazon ECS container instance.

        Access Level: Write

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_UpdateContainerInstancesState.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toUpdateContainerInstancesState", []))

    @jsii.member(jsii_name="toUpdateService")
    def to_update_service(self) -> "Ecs":
        '''(experimental) Grants permission to modify the parameters of a service.

        Access Level: Write

        Possible conditions:

        - .ifCluster()
        - .ifCapacityProvider()
        - .ifEnableExecuteCommand()
        - .ifEnableServiceConnect()
        - .ifNamespace()
        - .ifTaskDefinition()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_UpdateService.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toUpdateService", []))

    @jsii.member(jsii_name="toUpdateServicePrimaryTaskSet")
    def to_update_service_primary_task_set(self) -> "Ecs":
        '''(experimental) Grants permission to modify the primary task set used in a service.

        Access Level: Write

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_UpdateServicePrimaryTaskSet.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toUpdateServicePrimaryTaskSet", []))

    @jsii.member(jsii_name="toUpdateTaskProtection")
    def to_update_task_protection(self) -> "Ecs":
        '''(experimental) Grants permission to modify the protection status of a task.

        Access Level: Write

        Possible conditions:

        - .ifCluster()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_UpdateTaskProtection.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toUpdateTaskProtection", []))

    @jsii.member(jsii_name="toUpdateTaskSet")
    def to_update_task_set(self) -> "Ecs":
        '''(experimental) Grants permission to update the specified task set.

        Access Level: Write

        Possible conditions:

        - .ifCluster()
        - .ifService()

        https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_UpdateTaskSet.html

        :stability: experimental
        '''
        return typing.cast("Ecs", jsii.invoke(self, "toUpdateTaskSet", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__35b76c999f917ec3f9351c064463f91587a37133d1ad1c13d767cb21f6ef0356)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__14c508649ab6b1792b7ef06896794e59c17fd4649336ccc36094f2e14274ffb8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Eks(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Eks"):
    '''(experimental) Statement provider for service `eks <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelastickubernetesservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `eks <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelastickubernetesservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__558f2dfe7c079116ff214f386064be5f064f9526a8bcf6cfc4e49a56125eae21)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifClientId")
    def if_client_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Eks":
        '''(experimental) Filters access by the clientId present in the associateIdentityProviderConfig request the user makes to the EKS service.

        https://docs.aws.amazon.com/eks/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies

        Applies to actions:

        - .toAssociateIdentityProviderConfig()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__182d4d9dc033f2b86a12e519fabfd5696e2acb9f155d65c42a35c670904a6029)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Eks", jsii.invoke(self, "ifClientId", [value, operator]))

    @jsii.member(jsii_name="ifIssuerUrl")
    def if_issuer_url(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Eks":
        '''(experimental) Filters access by the issuerUrl present in the associateIdentityProviderConfig request the user makes to the EKS service.

        https://docs.aws.amazon.com/eks/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies

        Applies to actions:

        - .toAssociateIdentityProviderConfig()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2e3952a86ac869f23d5d13aeed7602f2c1506ea687de490a4dd364b7cdccefe6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Eks", jsii.invoke(self, "ifIssuerUrl", [value, operator]))

    @jsii.member(jsii_name="onAddon")
    def on_addon(
        self,
        cluster_name: builtins.str,
        addon_name: builtins.str,
        u_uid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Eks":
        '''(experimental) Adds a resource of type addon to the statement.

        https://docs.aws.amazon.com/eks/latest/userguide/eks-add-ons.html

        :param cluster_name: - Identifier for the clusterName.
        :param addon_name: - Identifier for the addonName.
        :param u_uid: - Identifier for the uUID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__794709031dce878d784ad0894a3a81bb553f53957f178aecc89873ca7699a07b)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument addon_name", value=addon_name, expected_type=type_hints["addon_name"])
            check_type(argname="argument u_uid", value=u_uid, expected_type=type_hints["u_uid"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Eks", jsii.invoke(self, "onAddon", [cluster_name, addon_name, u_uid, account, region, partition]))

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        cluster_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Eks":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/eks/latest/userguide/clusters.html

        :param cluster_name: - Identifier for the clusterName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6a9e2d3eab2c93a42c584bf926afebc0e52222e4b1af29363e5b46b9151d3c86)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Eks", jsii.invoke(self, "onCluster", [cluster_name, account, region, partition]))

    @jsii.member(jsii_name="onFargateprofile")
    def on_fargateprofile(
        self,
        cluster_name: builtins.str,
        fargate_profile_name: builtins.str,
        u_uid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Eks":
        '''(experimental) Adds a resource of type fargateprofile to the statement.

        https://docs.aws.amazon.com/eks/latest/userguide/fargate-profile.html

        :param cluster_name: - Identifier for the clusterName.
        :param fargate_profile_name: - Identifier for the fargateProfileName.
        :param u_uid: - Identifier for the uUID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7a2487c586512d7db00a7d4c2aea68b874ab8134e518d98d4048cc4673a05beb)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument fargate_profile_name", value=fargate_profile_name, expected_type=type_hints["fargate_profile_name"])
            check_type(argname="argument u_uid", value=u_uid, expected_type=type_hints["u_uid"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Eks", jsii.invoke(self, "onFargateprofile", [cluster_name, fargate_profile_name, u_uid, account, region, partition]))

    @jsii.member(jsii_name="onIdentityproviderconfig")
    def on_identityproviderconfig(
        self,
        cluster_name: builtins.str,
        identity_provider_type: builtins.str,
        identity_provider_config_name: builtins.str,
        u_uid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Eks":
        '''(experimental) Adds a resource of type identityproviderconfig to the statement.

        https://docs.aws.amazon.com/eks/latest/userguide/authenticate-oidc-identity-provider.html

        :param cluster_name: - Identifier for the clusterName.
        :param identity_provider_type: - Identifier for the identityProviderType.
        :param identity_provider_config_name: - Identifier for the identityProviderConfigName.
        :param u_uid: - Identifier for the uUID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f73a02d3b488a8d04bc82824d1dc032432e6efe2f191df231223c3179a0b9057)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument identity_provider_type", value=identity_provider_type, expected_type=type_hints["identity_provider_type"])
            check_type(argname="argument identity_provider_config_name", value=identity_provider_config_name, expected_type=type_hints["identity_provider_config_name"])
            check_type(argname="argument u_uid", value=u_uid, expected_type=type_hints["u_uid"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Eks", jsii.invoke(self, "onIdentityproviderconfig", [cluster_name, identity_provider_type, identity_provider_config_name, u_uid, account, region, partition]))

    @jsii.member(jsii_name="onNodegroup")
    def on_nodegroup(
        self,
        cluster_name: builtins.str,
        nodegroup_name: builtins.str,
        u_uid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Eks":
        '''(experimental) Adds a resource of type nodegroup to the statement.

        https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html

        :param cluster_name: - Identifier for the clusterName.
        :param nodegroup_name: - Identifier for the nodegroupName.
        :param u_uid: - Identifier for the uUID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ae890d005e16f041afcc63f69ca2cbc85f1b43b9a14c6136068157141c830483)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument nodegroup_name", value=nodegroup_name, expected_type=type_hints["nodegroup_name"])
            check_type(argname="argument u_uid", value=u_uid, expected_type=type_hints["u_uid"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Eks", jsii.invoke(self, "onNodegroup", [cluster_name, nodegroup_name, u_uid, account, region, partition]))

    @jsii.member(jsii_name="toAccessKubernetesApi")
    def to_access_kubernetes_api(self) -> "Eks":
        '''(experimental) Grants permission to view Kubernetes objects via AWS EKS console.

        Access Level: Read

        https://docs.aws.amazon.com/eks/latest/userguide/view-workloads.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toAccessKubernetesApi", []))

    @jsii.member(jsii_name="toAssociateEncryptionConfig")
    def to_associate_encryption_config(self) -> "Eks":
        '''(experimental) Grants permission to associate encryption configuration to a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_AssociateEncryptionConfig.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toAssociateEncryptionConfig", []))

    @jsii.member(jsii_name="toAssociateIdentityProviderConfig")
    def to_associate_identity_provider_config(self) -> "Eks":
        '''(experimental) Grants permission to associate an identity provider configuration to a cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifClientId()
        - .ifIssuerUrl()

        https://docs.aws.amazon.com/eks/latest/APIReference/API_AssociateIdentityProviderConfig.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toAssociateIdentityProviderConfig", []))

    @jsii.member(jsii_name="toCreateAddon")
    def to_create_addon(self) -> "Eks":
        '''(experimental) Grants permission to create an Amazon EKS add-on.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eks/latest/APIReference/API_CreateAddon.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toCreateAddon", []))

    @jsii.member(jsii_name="toCreateCluster")
    def to_create_cluster(self) -> "Eks":
        '''(experimental) Grants permission to create an Amazon EKS cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eks/latest/APIReference/API_CreateCluster.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toCreateCluster", []))

    @jsii.member(jsii_name="toCreateFargateProfile")
    def to_create_fargate_profile(self) -> "Eks":
        '''(experimental) Grants permission to create an AWS Fargate profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eks/latest/APIReference/API_CreateFargateProfile.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toCreateFargateProfile", []))

    @jsii.member(jsii_name="toCreateNodegroup")
    def to_create_nodegroup(self) -> "Eks":
        '''(experimental) Grants permission to create an Amazon EKS Nodegroup.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eks/latest/APIReference/API_CreateNodegroup.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toCreateNodegroup", []))

    @jsii.member(jsii_name="toDeleteAddon")
    def to_delete_addon(self) -> "Eks":
        '''(experimental) Grants permission to delete an Amazon EKS add-on.

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DeleteAddon.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDeleteAddon", []))

    @jsii.member(jsii_name="toDeleteCluster")
    def to_delete_cluster(self) -> "Eks":
        '''(experimental) Grants permission to delete an Amazon EKS cluster.

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DeleteCluster.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDeleteCluster", []))

    @jsii.member(jsii_name="toDeleteFargateProfile")
    def to_delete_fargate_profile(self) -> "Eks":
        '''(experimental) Grants permission to delete an AWS Fargate profile.

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DeleteFargateProfile.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDeleteFargateProfile", []))

    @jsii.member(jsii_name="toDeleteNodegroup")
    def to_delete_nodegroup(self) -> "Eks":
        '''(experimental) Grants permission to delete an Amazon EKS Nodegroup.

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DeleteNodegroup.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDeleteNodegroup", []))

    @jsii.member(jsii_name="toDeregisterCluster")
    def to_deregister_cluster(self) -> "Eks":
        '''(experimental) Grants permission to deregister an External cluster.

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DeregisterCluster.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDeregisterCluster", []))

    @jsii.member(jsii_name="toDescribeAddon")
    def to_describe_addon(self) -> "Eks":
        '''(experimental) Grants permission to retrieve descriptive information about an Amazon EKS add-on.

        Access Level: Read

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeAddon.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDescribeAddon", []))

    @jsii.member(jsii_name="toDescribeAddonConfiguration")
    def to_describe_addon_configuration(self) -> "Eks":
        '''(experimental) Grants permission to list configuration options about an Amazon EKS add-on.

        Access Level: Read

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeAddonConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDescribeAddonConfiguration", []))

    @jsii.member(jsii_name="toDescribeAddonVersions")
    def to_describe_addon_versions(self) -> "Eks":
        '''(experimental) Grants permission to retrieve descriptive version information about the add-ons that Amazon EKS Add-ons supports.

        Access Level: Read

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeAddonVersions.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDescribeAddonVersions", []))

    @jsii.member(jsii_name="toDescribeCluster")
    def to_describe_cluster(self) -> "Eks":
        '''(experimental) Grants permission to retrieve descriptive information about an Amazon EKS cluster.

        Access Level: Read

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeCluster.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDescribeCluster", []))

    @jsii.member(jsii_name="toDescribeFargateProfile")
    def to_describe_fargate_profile(self) -> "Eks":
        '''(experimental) Grants permission to retrieve descriptive information about an AWS Fargate profile associated with a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeFargateProfile.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDescribeFargateProfile", []))

    @jsii.member(jsii_name="toDescribeIdentityProviderConfig")
    def to_describe_identity_provider_config(self) -> "Eks":
        '''(experimental) Grants permission to retrieve descriptive information about an Idp config associated with a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeIdentityProviderConfig.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDescribeIdentityProviderConfig", []))

    @jsii.member(jsii_name="toDescribeNodegroup")
    def to_describe_nodegroup(self) -> "Eks":
        '''(experimental) Grants permission to retrieve descriptive information about an Amazon EKS nodegroup.

        Access Level: Read

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeNodegroup.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDescribeNodegroup", []))

    @jsii.member(jsii_name="toDescribeUpdate")
    def to_describe_update(self) -> "Eks":
        '''(experimental) Grants permission to retrieve a given update for a given Amazon EKS cluster/nodegroup/add-on (in the specified or default region).

        Access Level: Read

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeUpdate.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDescribeUpdate", []))

    @jsii.member(jsii_name="toDisassociateIdentityProviderConfig")
    def to_disassociate_identity_provider_config(self) -> "Eks":
        '''(experimental) Grants permission to delete an asssociated Idp config.

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_DisassociateIdentityProviderConfig.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toDisassociateIdentityProviderConfig", []))

    @jsii.member(jsii_name="toListAddons")
    def to_list_addons(self) -> "Eks":
        '''(experimental) Grants permission to list the Amazon EKS add-ons in your AWS account (in the specified or default region) for a given cluster.

        Access Level: List

        https://docs.aws.amazon.com/eks/latest/APIReference/API_ListAddons.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toListAddons", []))

    @jsii.member(jsii_name="toListClusters")
    def to_list_clusters(self) -> "Eks":
        '''(experimental) Grants permission to list the Amazon EKS clusters in your AWS account (in the specified or default region).

        Access Level: List

        https://docs.aws.amazon.com/eks/latest/APIReference/API_ListClusters.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toListClusters", []))

    @jsii.member(jsii_name="toListFargateProfiles")
    def to_list_fargate_profiles(self) -> "Eks":
        '''(experimental) Grants permission to list the AWS Fargate profiles in your AWS account (in the specified or default region) associated with a given cluster.

        Access Level: List

        https://docs.aws.amazon.com/eks/latest/APIReference/API_ListFargateProfiles.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toListFargateProfiles", []))

    @jsii.member(jsii_name="toListIdentityProviderConfigs")
    def to_list_identity_provider_configs(self) -> "Eks":
        '''(experimental) Grants permission to list the Idp configs in your AWS account (in the specified or default region) associated with a given cluster.

        Access Level: List

        https://docs.aws.amazon.com/eks/latest/APIReference/API_ListIdentityProviderConfigs.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toListIdentityProviderConfigs", []))

    @jsii.member(jsii_name="toListNodegroups")
    def to_list_nodegroups(self) -> "Eks":
        '''(experimental) Grants permission to list the Amazon EKS nodegroups in your AWS account (in the specified or default region) attached to given cluster.

        Access Level: List

        https://docs.aws.amazon.com/eks/latest/APIReference/API_ListNodegroups.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toListNodegroups", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Eks":
        '''(experimental) Grants permission to list tags for the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/eks/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListUpdates")
    def to_list_updates(self) -> "Eks":
        '''(experimental) Grants permission to list the updates for a given Amazon EKS cluster/nodegroup/add-on (in the specified or default region).

        Access Level: List

        https://docs.aws.amazon.com/eks/latest/APIReference/API_ListUpdates.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toListUpdates", []))

    @jsii.member(jsii_name="toRegisterCluster")
    def to_register_cluster(self) -> "Eks":
        '''(experimental) Grants permission to register an External cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eks/latest/APIReference/API_RegisterCluster.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toRegisterCluster", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Eks":
        '''(experimental) Grants permission to tag the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eks/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Eks":
        '''(experimental) Grants permission to untag the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eks/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAddon")
    def to_update_addon(self) -> "Eks":
        '''(experimental) Grants permission to update Amazon EKS add-on configurations, such as the VPC-CNI version.

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateAddon.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toUpdateAddon", []))

    @jsii.member(jsii_name="toUpdateClusterConfig")
    def to_update_cluster_config(self) -> "Eks":
        '''(experimental) Grants permission to update Amazon EKS cluster configurations (eg: API server endpoint access).

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateClusterConfig.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toUpdateClusterConfig", []))

    @jsii.member(jsii_name="toUpdateClusterVersion")
    def to_update_cluster_version(self) -> "Eks":
        '''(experimental) Grants permission to update the Kubernetes version of an Amazon EKS cluster.

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateClusterVersion.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toUpdateClusterVersion", []))

    @jsii.member(jsii_name="toUpdateNodegroupConfig")
    def to_update_nodegroup_config(self) -> "Eks":
        '''(experimental) Grants permission to update Amazon EKS nodegroup configurations (eg: min/max/desired capacity or labels).

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateNodegroupConfig.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toUpdateNodegroupConfig", []))

    @jsii.member(jsii_name="toUpdateNodegroupVersion")
    def to_update_nodegroup_version(self) -> "Eks":
        '''(experimental) Grants permission to update the Kubernetes version of an Amazon EKS nodegroup.

        Access Level: Write

        https://docs.aws.amazon.com/eks/latest/APIReference/API_UpdateNodegroupVersion.html

        :stability: experimental
        '''
        return typing.cast("Eks", jsii.invoke(self, "toUpdateNodegroupVersion", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bea4502371416eb6193c2b75042cbe051fbdecd3f1f9f5be744a111c5f424303)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8298e502cc40163261e9ed26ef5c9bf0407cdf2a77810c2e77ecbd6e1fefb529)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class ElasticInference(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ElasticInference",
):
    '''(experimental) Statement provider for service `elastic-inference <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticinference.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elastic-inference <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticinference.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a021d698fadadbc360231aa0db171de693094907dfcb6d3ecb65f62da69e557f)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAccelerator")
    def on_accelerator(
        self,
        accelerator_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ElasticInference":
        '''(experimental) Adds a resource of type accelerator to the statement.

        :param accelerator_id: - Identifier for the acceleratorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1bcde0bd6357f19056925c20b29e56eab04e56bd230683231de3eda9b4262564)
            check_type(argname="argument accelerator_id", value=accelerator_id, expected_type=type_hints["accelerator_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ElasticInference", jsii.invoke(self, "onAccelerator", [accelerator_id, account, region, partition]))

    @jsii.member(jsii_name="toConnect")
    def to_connect(self) -> "ElasticInference":
        '''(experimental) Grants permission to customer for connecting to Elastic Inference accelerator.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("ElasticInference", jsii.invoke(self, "toConnect", []))

    @jsii.member(jsii_name="toDescribeAcceleratorOfferings")
    def to_describe_accelerator_offerings(self) -> "ElasticInference":
        '''(experimental) Grants permission to describe the locations in which a given accelerator type or set of types is present in a given region.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("ElasticInference", jsii.invoke(self, "toDescribeAcceleratorOfferings", []))

    @jsii.member(jsii_name="toDescribeAccelerators")
    def to_describe_accelerators(self) -> "ElasticInference":
        '''(experimental) Grants permission to describe information over a provided set of accelerators belonging to an account.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("ElasticInference", jsii.invoke(self, "toDescribeAccelerators", []))

    @jsii.member(jsii_name="toDescribeAcceleratorTypes")
    def to_describe_accelerator_types(self) -> "ElasticInference":
        '''(experimental) Grants permission to describe the accelerator types available in a given region, as well as their characteristics, such as memory and throughput.

        Access Level: List

        :stability: experimental
        '''
        return typing.cast("ElasticInference", jsii.invoke(self, "toDescribeAcceleratorTypes", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "ElasticInference":
        '''(experimental) Grants permission to list all tags on an Amazon RDS resource.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("ElasticInference", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "ElasticInference":
        '''(experimental) Grants permission to assign one or more tags (key-value pairs) to the specified QuickSight resource.

        Access Level: Tagging

        :stability: experimental
        '''
        return typing.cast("ElasticInference", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "ElasticInference":
        '''(experimental) Grants permission to remove a tag or tags from a resource.

        Access Level: Tagging

        :stability: experimental
        '''
        return typing.cast("ElasticInference", jsii.invoke(self, "toUntagResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a1b5557b2cd425e802c6b94e04829297d07401f1689c483b6f9a1721be34df8d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3647aed313e015f54e7ca1c8b96a9aecea18802e1fdb506d324d98d910d91b5f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Elasticache(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Elasticache",
):
    '''(experimental) Statement provider for service `elasticache <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticache.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elasticache <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticache.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__66d83fb86e1e6b1a36f76613dfaf9b47a1357f9a09cd5e01f68a39cb44f8aeab)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAtRestEncryptionEnabled")
    def if_at_rest_encryption_enabled(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the AtRestEncryptionEnabled parameter present in the request or default false value if parameter is not present.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateReplicationGroup()

        Applies to resource types:

        - replicationgroup
        - globalreplicationgroup

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ee901fd8ad4b9e3dbe5ff8d8d351f71c15943fb6aed5ad3ff65c71deb500fc0e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Elasticache", jsii.invoke(self, "ifAtRestEncryptionEnabled", [value]))

    @jsii.member(jsii_name="ifAuthTokenEnabled")
    def if_auth_token_enabled(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the presence of non empty AuthToken parameter in the request.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateCacheCluster()
        - .toCreateReplicationGroup()
        - .toModifyCacheCluster()
        - .toModifyReplicationGroup()

        Applies to resource types:

        - replicationgroup
        - cluster
        - globalreplicationgroup

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5b29c2b648c9de0e0cd2564e0813baa57a90540d89c2645fc698ae784727a3b7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Elasticache", jsii.invoke(self, "ifAuthTokenEnabled", [value]))

    @jsii.member(jsii_name="ifAutomaticFailoverEnabled")
    def if_automatic_failover_enabled(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the AutomaticFailoverEnabled parameter in the request.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateReplicationGroup()
        - .toModifyGlobalReplicationGroup()
        - .toModifyReplicationGroup()

        Applies to resource types:

        - replicationgroup
        - globalreplicationgroup

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__23f8def0053af575d7cb0c02dff8af118e2241a598d83ef9c635b93f2107642e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Elasticache", jsii.invoke(self, "ifAutomaticFailoverEnabled", [value]))

    @jsii.member(jsii_name="ifCacheNodeType")
    def if_cache_node_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the cacheNodeType parameter present in the request.

        This key can be used to restrict which cache node types can be used on cluster creation or scaling operations

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateCacheCluster()
        - .toCreateReplicationGroup()
        - .toModifyCacheCluster()
        - .toModifyGlobalReplicationGroup()
        - .toModifyReplicationGroup()

        Applies to resource types:

        - replicationgroup
        - cluster
        - globalreplicationgroup

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__afe3f42707a0026b995cf424fe889efaae70b2b4e352eecb731a9123293df433)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticache", jsii.invoke(self, "ifCacheNodeType", [value, operator]))

    @jsii.member(jsii_name="ifCacheParameterGroupName")
    def if_cache_parameter_group_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the CacheParameterGroupName parameter in the request.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateCacheCluster()
        - .toCreateCacheParameterGroup()
        - .toCreateReplicationGroup()
        - .toDeleteCacheParameterGroup()
        - .toModifyCacheCluster()
        - .toModifyCacheParameterGroup()
        - .toModifyReplicationGroup()
        - .toResetCacheParameterGroup()

        Applies to resource types:

        - parametergroup
        - replicationgroup
        - cluster
        - globalreplicationgroup

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ab0e0668de326b7a6fffbc2cb2ab0f3d4f9332c05e2fd73a587b885191dffb82)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticache", jsii.invoke(self, "ifCacheParameterGroupName", [value, operator]))

    @jsii.member(jsii_name="ifClusterModeEnabled")
    def if_cluster_mode_enabled(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the cluster mode parameter present in the request.

        Default value for single node group (shard) creations is false

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateReplicationGroup()

        Applies to resource types:

        - replicationgroup
        - globalreplicationgroup

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__009f4efc99a270b6b7cc335885bb04795168c847e5a578375c13d031b97f435f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Elasticache", jsii.invoke(self, "ifClusterModeEnabled", [value]))

    @jsii.member(jsii_name="ifEngineType")
    def if_engine_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the engine type present in creation requests.

        For replication group creations, default engine 'redis' is used as key if parameter is not present

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateCacheCluster()
        - .toCreateReplicationGroup()

        Applies to resource types:

        - replicationgroup
        - cluster
        - globalreplicationgroup

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f0a5fc2b8f85983ad863344fb3d6230e5e64fd43d58b4209b1de518cd794b717)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticache", jsii.invoke(self, "ifEngineType", [value, operator]))

    @jsii.member(jsii_name="ifEngineVersion")
    def if_engine_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the engineVersion parameter present in creation or cluster modification requests.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateCacheCluster()
        - .toCreateReplicationGroup()
        - .toModifyCacheCluster()
        - .toModifyGlobalReplicationGroup()
        - .toModifyReplicationGroup()

        Applies to resource types:

        - replicationgroup
        - cluster
        - globalreplicationgroup

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f995bae47bc02f7c5ca6300ee20f681901a535b2f704b3ccf6ec735d9e2dec3b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticache", jsii.invoke(self, "ifEngineVersion", [value, operator]))

    @jsii.member(jsii_name="ifKmsKeyId")
    def if_kms_key_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the KmsKeyId parameter in the request.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCopySnapshot()
        - .toCreateReplicationGroup()
        - .toCreateSnapshot()

        Applies to resource types:

        - replicationgroup
        - snapshot
        - globalreplicationgroup

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f595992c245cb1a0dcdff40fd82342fbaac336cda346f18089df712bc104ac1c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticache", jsii.invoke(self, "ifKmsKeyId", [value, operator]))

    @jsii.member(jsii_name="ifMultiAZEnabled")
    def if_multi_az_enabled(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the AZMode parameter, MultiAZEnabled parameter or the number of availability zones that the cluster or replication group can be placed in.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateCacheCluster()
        - .toCreateReplicationGroup()
        - .toModifyCacheCluster()
        - .toModifyReplicationGroup()

        Applies to resource types:

        - replicationgroup
        - cluster
        - globalreplicationgroup

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4bd3a73a10a190b0d183ac5fd05f929bd7ce17a9a2516511c2aec2dce9da3596)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Elasticache", jsii.invoke(self, "ifMultiAZEnabled", [value]))

    @jsii.member(jsii_name="ifNumNodeGroups")
    def if_num_node_groups(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the NumNodeGroups or NodeGroupCount parameter specified in the request.

        This key can be used to restrict the number of node groups (shards) clusters can have after creation or scaling operations

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateReplicationGroup()
        - .toDecreaseNodeGroupsInGlobalReplicationGroup()
        - .toIncreaseNodeGroupsInGlobalReplicationGroup()
        - .toModifyReplicationGroupShardConfiguration()

        Applies to resource types:

        - replicationgroup
        - globalreplicationgroup

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8de95110bf93fdcb7cf8ffa07f389205b96cb1d39812ffbf1d881d2d1dd2d9ee)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticache", jsii.invoke(self, "ifNumNodeGroups", [value, operator]))

    @jsii.member(jsii_name="ifReplicasPerNodeGroup")
    def if_replicas_per_node_group(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the number of replicas per node group (shards) specified in creations or scaling requests.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateReplicationGroup()
        - .toDecreaseReplicaCount()
        - .toIncreaseReplicaCount()

        Applies to resource types:

        - replicationgroup
        - globalreplicationgroup

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__838ce25de6c97386a660e68b544abdfcd54d917581a9ea149e1d3206a304d871)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticache", jsii.invoke(self, "ifReplicasPerNodeGroup", [value, operator]))

    @jsii.member(jsii_name="ifSnapshotRetentionLimit")
    def if_snapshot_retention_limit(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the SnapshotRetentionLimit parameter in the request.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateCacheCluster()
        - .toCreateReplicationGroup()
        - .toModifyCacheCluster()
        - .toModifyReplicationGroup()

        Applies to resource types:

        - replicationgroup
        - cluster
        - globalreplicationgroup

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8d2e46c406981553f6202d9c2a0c57682506c349a423430c76836a64c918ef7d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticache", jsii.invoke(self, "ifSnapshotRetentionLimit", [value, operator]))

    @jsii.member(jsii_name="ifTransitEncryptionEnabled")
    def if_transit_encryption_enabled(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the TransitEncryptionEnabled parameter present in the request.

        For replication group creations, default value 'false' is used as key if parameter is not present

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateReplicationGroup()
        - .toModifyReplicationGroup()

        Applies to resource types:

        - replicationgroup
        - globalreplicationgroup

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4ca1c948d725f0cdb3de0ca3d6c2a153da78667885821d95d5c88a685a3751d5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Elasticache", jsii.invoke(self, "ifTransitEncryptionEnabled", [value]))

    @jsii.member(jsii_name="ifUserAuthenticationMode")
    def if_user_authentication_mode(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticache":
        '''(experimental) Filters access by the UserAuthenticationMode parameter in the request.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/IAM.ConditionKeys.html#IAM.SpecifyingConditions

        Applies to actions:

        - .toCreateUser()
        - .toModifyUser()

        Applies to resource types:

        - user

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__95ff0d21e285d7835b82983d5598c1b6f00d55696a89b2fe5bd99af2339698da)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticache", jsii.invoke(self, "ifUserAuthenticationMode", [value, operator]))

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        cache_cluster_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticache":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/WhatIs.Components.html#WhatIs.Components.Clusters

        :param cache_cluster_id: - Identifier for the cacheClusterId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAuthTokenEnabled() - .ifCacheNodeType() - .ifCacheParameterGroupName() - .ifEngineType() - .ifEngineVersion() - .ifMultiAZEnabled() - .ifSnapshotRetentionLimit()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ef98cfa0e99d7d44468de87236d179fd82762556ffff69c44ec17932182f93e6)
            check_type(argname="argument cache_cluster_id", value=cache_cluster_id, expected_type=type_hints["cache_cluster_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticache", jsii.invoke(self, "onCluster", [cache_cluster_id, account, region, partition]))

    @jsii.member(jsii_name="onGlobalreplicationgroup")
    def on_globalreplicationgroup(
        self,
        global_replication_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticache":
        '''(experimental) Adds a resource of type globalreplicationgroup to the statement.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Redis-Global-Datastore.html

        :param global_replication_group_id: - Identifier for the globalReplicationGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAtRestEncryptionEnabled() - .ifAuthTokenEnabled() - .ifAutomaticFailoverEnabled() - .ifCacheNodeType() - .ifCacheParameterGroupName() - .ifClusterModeEnabled() - .ifEngineType() - .ifEngineVersion() - .ifKmsKeyId() - .ifMultiAZEnabled() - .ifNumNodeGroups() - .ifReplicasPerNodeGroup() - .ifSnapshotRetentionLimit() - .ifTransitEncryptionEnabled()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bdbe263a12e3079fe7c2c55245e5b4a75171f58f790ec4c755a2c083a9b45a0d)
            check_type(argname="argument global_replication_group_id", value=global_replication_group_id, expected_type=type_hints["global_replication_group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticache", jsii.invoke(self, "onGlobalreplicationgroup", [global_replication_group_id, account, partition]))

    @jsii.member(jsii_name="onParametergroup")
    def on_parametergroup(
        self,
        cache_parameter_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticache":
        '''(experimental) Adds a resource of type parametergroup to the statement.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/WhatIs.Components.html#WhatIs.Components.ParameterGroups

        :param cache_parameter_group_name: - Identifier for the cacheParameterGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifCacheParameterGroupName()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d3f938e759ff7eaf8dffa50e0c414d7b95adec8eea85d5c1432a2c96dd314ff2)
            check_type(argname="argument cache_parameter_group_name", value=cache_parameter_group_name, expected_type=type_hints["cache_parameter_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticache", jsii.invoke(self, "onParametergroup", [cache_parameter_group_name, account, region, partition]))

    @jsii.member(jsii_name="onReplicationgroup")
    def on_replicationgroup(
        self,
        replication_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticache":
        '''(experimental) Adds a resource of type replicationgroup to the statement.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/WhatIs.Components.html#WhatIs.Components.ReplicationGroups

        :param replication_group_id: - Identifier for the replicationGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifAtRestEncryptionEnabled() - .ifAuthTokenEnabled() - .ifAutomaticFailoverEnabled() - .ifCacheNodeType() - .ifCacheParameterGroupName() - .ifClusterModeEnabled() - .ifEngineType() - .ifEngineVersion() - .ifKmsKeyId() - .ifMultiAZEnabled() - .ifNumNodeGroups() - .ifReplicasPerNodeGroup() - .ifSnapshotRetentionLimit() - .ifTransitEncryptionEnabled()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__338ae2c57930eabe239c1c3b112c6f98103d2904eff62f21e3c09cecf4cb2518)
            check_type(argname="argument replication_group_id", value=replication_group_id, expected_type=type_hints["replication_group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticache", jsii.invoke(self, "onReplicationgroup", [replication_group_id, account, region, partition]))

    @jsii.member(jsii_name="onReservedInstance")
    def on_reserved_instance(
        self,
        reserved_cache_node_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticache":
        '''(experimental) Adds a resource of type reserved-instance to the statement.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/reserved-nodes.html

        :param reserved_cache_node_id: - Identifier for the reservedCacheNodeId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e8fdade38e065bd8f25b65ba59d2cba42098ffe2c1d028fcc23061ffcc538d3a)
            check_type(argname="argument reserved_cache_node_id", value=reserved_cache_node_id, expected_type=type_hints["reserved_cache_node_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticache", jsii.invoke(self, "onReservedInstance", [reserved_cache_node_id, account, region, partition]))

    @jsii.member(jsii_name="onSecuritygroup")
    def on_securitygroup(
        self,
        cache_security_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticache":
        '''(experimental) Adds a resource of type securitygroup to the statement.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/WhatIs.Components.html#WhatIs.Components.SecurityGroups

        :param cache_security_group_name: - Identifier for the cacheSecurityGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__87fe33e86e28bf040b33b21e7ab5b90188b844160eeb9be5fca6443863c8dab0)
            check_type(argname="argument cache_security_group_name", value=cache_security_group_name, expected_type=type_hints["cache_security_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticache", jsii.invoke(self, "onSecuritygroup", [cache_security_group_name, account, region, partition]))

    @jsii.member(jsii_name="onSnapshot")
    def on_snapshot(
        self,
        snapshot_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticache":
        '''(experimental) Adds a resource of type snapshot to the statement.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/WhatIs.Components.html#WhatIs.Components.Snapshots

        :param snapshot_name: - Identifier for the snapshotName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifKmsKeyId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__da67243006a73238503c188a45c5fd2c5c751ac5a1344b9f021a1059fb9e04ef)
            check_type(argname="argument snapshot_name", value=snapshot_name, expected_type=type_hints["snapshot_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticache", jsii.invoke(self, "onSnapshot", [snapshot_name, account, region, partition]))

    @jsii.member(jsii_name="onSubnetgroup")
    def on_subnetgroup(
        self,
        cache_subnet_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticache":
        '''(experimental) Adds a resource of type subnetgroup to the statement.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/WhatIs.Components.html#WhatIs.Components.SubnetGroups

        :param cache_subnet_group_name: - Identifier for the cacheSubnetGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e51bb42f541f4ccd8d8c7db621366e71f3e6f78e2cbc1bb0263c5f1bb02e9840)
            check_type(argname="argument cache_subnet_group_name", value=cache_subnet_group_name, expected_type=type_hints["cache_subnet_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticache", jsii.invoke(self, "onSubnetgroup", [cache_subnet_group_name, account, region, partition]))

    @jsii.member(jsii_name="onUser")
    def on_user(
        self,
        user_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticache":
        '''(experimental) Adds a resource of type user to the statement.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.RBAC.html

        :param user_id: - Identifier for the userId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifUserAuthenticationMode()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__57c38e8b639f95ebc01a9815b00456545b3120e299fd6d1eaf7abccb65eaef4f)
            check_type(argname="argument user_id", value=user_id, expected_type=type_hints["user_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticache", jsii.invoke(self, "onUser", [user_id, account, region, partition]))

    @jsii.member(jsii_name="onUsergroup")
    def on_usergroup(
        self,
        user_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticache":
        '''(experimental) Adds a resource of type usergroup to the statement.

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Clusters.RBAC.html

        :param user_group_id: - Identifier for the userGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c24546c62dd7f930e29bec3a4330713ec6b3b0bb64d15a88ebf596618d17bdb9)
            check_type(argname="argument user_group_id", value=user_group_id, expected_type=type_hints["user_group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticache", jsii.invoke(self, "onUsergroup", [user_group_id, account, region, partition]))

    @jsii.member(jsii_name="toAddTagsToResource")
    def to_add_tags_to_resource(self) -> "Elasticache":
        '''(experimental) Grants permission to add tags to an ElastiCache resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_AddTagsToResource.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toAddTagsToResource", []))

    @jsii.member(jsii_name="toAuthorizeCacheSecurityGroupIngress")
    def to_authorize_cache_security_group_ingress(self) -> "Elasticache":
        '''(experimental) Grants permission to authorize an EC2 security group on a ElastiCache security group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:AuthorizeSecurityGroupIngress

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_AuthorizeCacheSecurityGroupIngress.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toAuthorizeCacheSecurityGroupIngress", []))

    @jsii.member(jsii_name="toBatchApplyUpdateAction")
    def to_batch_apply_update_action(self) -> "Elasticache":
        '''(experimental) Grants permission to apply ElastiCache service updates to sets of clusters and replication groups.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs
        - s3:GetObject

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_BatchApplyUpdateAction.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toBatchApplyUpdateAction", []))

    @jsii.member(jsii_name="toBatchStopUpdateAction")
    def to_batch_stop_update_action(self) -> "Elasticache":
        '''(experimental) Grants permission to stop ElastiCache service updates from being executed on a set of clusters.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_BatchStopUpdateAction.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toBatchStopUpdateAction", []))

    @jsii.member(jsii_name="toCompleteMigration")
    def to_complete_migration(self) -> "Elasticache":
        '''(experimental) Grants permission to complete an online migration of data from hosted Redis on Amazon EC2 to ElastiCache.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CompleteMigration.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCompleteMigration", []))

    @jsii.member(jsii_name="toConnect")
    def to_connect(self) -> "Elasticache":
        '''(experimental) Allows an IAM user or role to connect as a specified ElastiCache user to a node in a replication group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/auth-iam.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toConnect", []))

    @jsii.member(jsii_name="toCopySnapshot")
    def to_copy_snapshot(self) -> "Elasticache":
        '''(experimental) Grants permission to make a copy of an existing snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifKmsKeyId()

        Dependent actions:

        - elasticache:AddTagsToResource
        - s3:DeleteObject
        - s3:GetBucketAcl
        - s3:PutObject

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CopySnapshot.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCopySnapshot", []))

    @jsii.member(jsii_name="toCreateCacheCluster")
    def to_create_cache_cluster(self) -> "Elasticache":
        '''(experimental) Grants permission to create a cache cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs
        - elasticache:AddTagsToResource
        - s3:GetObject

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateCacheCluster.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCreateCacheCluster", []))

    @jsii.member(jsii_name="toCreateCacheParameterGroup")
    def to_create_cache_parameter_group(self) -> "Elasticache":
        '''(experimental) Grants permission to create a parameter group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifCacheParameterGroupName()

        Dependent actions:

        - elasticache:AddTagsToResource

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateCacheParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCreateCacheParameterGroup", []))

    @jsii.member(jsii_name="toCreateCacheSecurityGroup")
    def to_create_cache_security_group(self) -> "Elasticache":
        '''(experimental) Grants permission to create a cache security group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - elasticache:AddTagsToResource

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateCacheSecurityGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCreateCacheSecurityGroup", []))

    @jsii.member(jsii_name="toCreateCacheSubnetGroup")
    def to_create_cache_subnet_group(self) -> "Elasticache":
        '''(experimental) Grants permission to create a cache subnet group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - elasticache:AddTagsToResource

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateCacheSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCreateCacheSubnetGroup", []))

    @jsii.member(jsii_name="toCreateGlobalReplicationGroup")
    def to_create_global_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to create a global replication group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateGlobalReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCreateGlobalReplicationGroup", []))

    @jsii.member(jsii_name="toCreateReplicationGroup")
    def to_create_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to create a replication group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs
        - elasticache:AddTagsToResource
        - s3:GetObject

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCreateReplicationGroup", []))

    @jsii.member(jsii_name="toCreateSnapshot")
    def to_create_snapshot(self) -> "Elasticache":
        '''(experimental) Grants permission to create a copy of an entire Redis cluster at a specific moment in time.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - elasticache:AddTagsToResource
        - s3:DeleteObject
        - s3:GetBucketAcl
        - s3:PutObject

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCreateSnapshot", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Elasticache":
        '''(experimental) Grants permission to create a user for Redis. Users are supported from Redis 6.0 onwards.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifUserAuthenticationMode()

        Dependent actions:

        - elasticache:AddTagsToResource

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateUser.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toCreateUserGroup")
    def to_create_user_group(self) -> "Elasticache":
        '''(experimental) Grants permission to create a user group for Redis. Groups are supported from Redis 6.0 onwards.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - elasticache:AddTagsToResource

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateUserGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toCreateUserGroup", []))

    @jsii.member(jsii_name="toDecreaseNodeGroupsInGlobalReplicationGroup")
    def to_decrease_node_groups_in_global_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to decrease the number of node groups in global replication groups.

        Access Level: Write

        Possible conditions:

        - .ifNumNodeGroups()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DecreaseNodeGroupsInGlobalReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDecreaseNodeGroupsInGlobalReplicationGroup", []))

    @jsii.member(jsii_name="toDecreaseReplicaCount")
    def to_decrease_replica_count(self) -> "Elasticache":
        '''(experimental) Grants permission to decrease the number of replicas in a Redis (cluster mode disabled) replication group or the number of replica nodes in one or more node groups (shards) of a Redis (cluster mode enabled) replication group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifReplicasPerNodeGroup()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DecreaseReplicaCount.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDecreaseReplicaCount", []))

    @jsii.member(jsii_name="toDeleteCacheCluster")
    def to_delete_cache_cluster(self) -> "Elasticache":
        '''(experimental) Grants permission to delete a previously provisioned cluster.

        Access Level: Write

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DeleteCacheCluster.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDeleteCacheCluster", []))

    @jsii.member(jsii_name="toDeleteCacheParameterGroup")
    def to_delete_cache_parameter_group(self) -> "Elasticache":
        '''(experimental) Grants permission to delete the specified cache parameter group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifCacheParameterGroupName()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DeleteCacheParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDeleteCacheParameterGroup", []))

    @jsii.member(jsii_name="toDeleteCacheSecurityGroup")
    def to_delete_cache_security_group(self) -> "Elasticache":
        '''(experimental) Grants permission to delete a cache security group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DeleteCacheSecurityGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDeleteCacheSecurityGroup", []))

    @jsii.member(jsii_name="toDeleteCacheSubnetGroup")
    def to_delete_cache_subnet_group(self) -> "Elasticache":
        '''(experimental) Grants permission to delete a cache subnet group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DeleteCacheSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDeleteCacheSubnetGroup", []))

    @jsii.member(jsii_name="toDeleteGlobalReplicationGroup")
    def to_delete_global_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to delete an existing global replication group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DeleteGlobalReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDeleteGlobalReplicationGroup", []))

    @jsii.member(jsii_name="toDeleteReplicationGroup")
    def to_delete_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to delete an existing replication group.

        Access Level: Write

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DeleteReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDeleteReplicationGroup", []))

    @jsii.member(jsii_name="toDeleteSnapshot")
    def to_delete_snapshot(self) -> "Elasticache":
        '''(experimental) Grants permission to delete an existing snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DeleteSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDeleteSnapshot", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "Elasticache":
        '''(experimental) Grants permission to delete an existing user and thus remove it from all user groups and replication groups where it was assigned.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDeleteUserGroup")
    def to_delete_user_group(self) -> "Elasticache":
        '''(experimental) Grants permission to delete an existing user group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DeleteUserGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDeleteUserGroup", []))

    @jsii.member(jsii_name="toDescribeCacheClusters")
    def to_describe_cache_clusters(self) -> "Elasticache":
        '''(experimental) Grants permission to list information about provisioned cache clusters.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeCacheClusters.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeCacheClusters", []))

    @jsii.member(jsii_name="toDescribeCacheEngineVersions")
    def to_describe_cache_engine_versions(self) -> "Elasticache":
        '''(experimental) Grants permission to list available cache engines and their versions.

        Access Level: List

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeCacheEngineVersions.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeCacheEngineVersions", []))

    @jsii.member(jsii_name="toDescribeCacheParameterGroups")
    def to_describe_cache_parameter_groups(self) -> "Elasticache":
        '''(experimental) Grants permission to list cache parameter group descriptions.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeCacheParameterGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeCacheParameterGroups", []))

    @jsii.member(jsii_name="toDescribeCacheParameters")
    def to_describe_cache_parameters(self) -> "Elasticache":
        '''(experimental) Grants permission to retrieve the detailed parameter list for a particular cache parameter group.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeCacheParameters.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeCacheParameters", []))

    @jsii.member(jsii_name="toDescribeCacheSecurityGroups")
    def to_describe_cache_security_groups(self) -> "Elasticache":
        '''(experimental) Grants permission to list cache security group descriptions.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeCacheSecurityGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeCacheSecurityGroups", []))

    @jsii.member(jsii_name="toDescribeCacheSubnetGroups")
    def to_describe_cache_subnet_groups(self) -> "Elasticache":
        '''(experimental) Grants permission to list cache subnet group descriptions.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeCacheSubnetGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeCacheSubnetGroups", []))

    @jsii.member(jsii_name="toDescribeEngineDefaultParameters")
    def to_describe_engine_default_parameters(self) -> "Elasticache":
        '''(experimental) Grants permission to retrieve the default engine and system parameter information for the specified cache engine.

        Access Level: List

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeEngineDefaultParameters.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeEngineDefaultParameters", []))

    @jsii.member(jsii_name="toDescribeEvents")
    def to_describe_events(self) -> "Elasticache":
        '''(experimental) Grants permission to list events related to clusters, cache security groups, and cache parameter groups.

        Access Level: List

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeEvents.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeEvents", []))

    @jsii.member(jsii_name="toDescribeGlobalReplicationGroups")
    def to_describe_global_replication_groups(self) -> "Elasticache":
        '''(experimental) Grants permission to list information about global replication groups.

        Access Level: List

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeGlobalReplicationGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeGlobalReplicationGroups", []))

    @jsii.member(jsii_name="toDescribeReplicationGroups")
    def to_describe_replication_groups(self) -> "Elasticache":
        '''(experimental) Grants permission to list information about provisioned replication groups.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeReplicationGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeReplicationGroups", []))

    @jsii.member(jsii_name="toDescribeReservedCacheNodes")
    def to_describe_reserved_cache_nodes(self) -> "Elasticache":
        '''(experimental) Grants permission to list information about purchased reserved cache nodes.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeReservedCacheNodes.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeReservedCacheNodes", []))

    @jsii.member(jsii_name="toDescribeReservedCacheNodesOfferings")
    def to_describe_reserved_cache_nodes_offerings(self) -> "Elasticache":
        '''(experimental) Grants permission to list available reserved cache node offerings.

        Access Level: List

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeReservedCacheNodesOfferings.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeReservedCacheNodesOfferings", []))

    @jsii.member(jsii_name="toDescribeServiceUpdates")
    def to_describe_service_updates(self) -> "Elasticache":
        '''(experimental) Grants permission to list details of the service updates.

        Access Level: List

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeServiceUpdates.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeServiceUpdates", []))

    @jsii.member(jsii_name="toDescribeSnapshots")
    def to_describe_snapshots(self) -> "Elasticache":
        '''(experimental) Grants permission to list information about cluster or replication group snapshots.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeSnapshots", []))

    @jsii.member(jsii_name="toDescribeUpdateActions")
    def to_describe_update_actions(self) -> "Elasticache":
        '''(experimental) Grants permission to list details of the update actions for a set of clusters or replication groups.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeUpdateActions.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeUpdateActions", []))

    @jsii.member(jsii_name="toDescribeUserGroups")
    def to_describe_user_groups(self) -> "Elasticache":
        '''(experimental) Grants permission to list information about Redis user groups.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeUserGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeUserGroups", []))

    @jsii.member(jsii_name="toDescribeUsers")
    def to_describe_users(self) -> "Elasticache":
        '''(experimental) Grants permission to list information about Redis users.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeUsers.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDescribeUsers", []))

    @jsii.member(jsii_name="toDisassociateGlobalReplicationGroup")
    def to_disassociate_global_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to remove a secondary replication group from the global replication group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DisassociateGlobalReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toDisassociateGlobalReplicationGroup", []))

    @jsii.member(jsii_name="toFailoverGlobalReplicationGroup")
    def to_failover_global_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to failover the primary region to a selected secondary region of a global replication group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_FailoverGlobalReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toFailoverGlobalReplicationGroup", []))

    @jsii.member(jsii_name="toIncreaseNodeGroupsInGlobalReplicationGroup")
    def to_increase_node_groups_in_global_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to increase the number of node groups in a global replication group.

        Access Level: Write

        Possible conditions:

        - .ifNumNodeGroups()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_IncreaseNodeGroupsInGlobalReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toIncreaseNodeGroupsInGlobalReplicationGroup", []))

    @jsii.member(jsii_name="toIncreaseReplicaCount")
    def to_increase_replica_count(self) -> "Elasticache":
        '''(experimental) Grants permission to increase the number of replicas in a Redis (cluster mode disabled) replication group or the number of replica nodes in one or more node groups (shards) of a Redis (cluster mode enabled) replication group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifReplicasPerNodeGroup()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_IncreaseReplicaCount.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toIncreaseReplicaCount", []))

    @jsii.member(jsii_name="toListAllowedNodeTypeModifications")
    def to_list_allowed_node_type_modifications(self) -> "Elasticache":
        '''(experimental) Grants permission to list available node type that can be used to scale a particular Redis cluster or replication group.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ListAllowedNodeTypeModifications.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toListAllowedNodeTypeModifications", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Elasticache":
        '''(experimental) Grants permission to list tags for an ElastiCache resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toModifyCacheCluster")
    def to_modify_cache_cluster(self) -> "Elasticache":
        '''(experimental) Grants permission to modify settings for a cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyCacheCluster.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toModifyCacheCluster", []))

    @jsii.member(jsii_name="toModifyCacheParameterGroup")
    def to_modify_cache_parameter_group(self) -> "Elasticache":
        '''(experimental) Grants permission to modify parameters of a cache parameter group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifCacheParameterGroupName()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyCacheParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toModifyCacheParameterGroup", []))

    @jsii.member(jsii_name="toModifyCacheSubnetGroup")
    def to_modify_cache_subnet_group(self) -> "Elasticache":
        '''(experimental) Grants permission to modify an existing cache subnet group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyCacheSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toModifyCacheSubnetGroup", []))

    @jsii.member(jsii_name="toModifyGlobalReplicationGroup")
    def to_modify_global_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to modify settings for a global replication group.

        Access Level: Write

        Possible conditions:

        - .ifCacheNodeType()
        - .ifEngineVersion()
        - .ifAutomaticFailoverEnabled()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyGlobalReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toModifyGlobalReplicationGroup", []))

    @jsii.member(jsii_name="toModifyReplicationGroup")
    def to_modify_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to modify the settings for a replication group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toModifyReplicationGroup", []))

    @jsii.member(jsii_name="toModifyReplicationGroupShardConfiguration")
    def to_modify_replication_group_shard_configuration(self) -> "Elasticache":
        '''(experimental) Grants permission to add shards, remove shards, or rebalance the keyspaces among existing shards of a replication group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifNumNodeGroups()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyReplicationGroupShardConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toModifyReplicationGroupShardConfiguration", []))

    @jsii.member(jsii_name="toModifyUser")
    def to_modify_user(self) -> "Elasticache":
        '''(experimental) Grants permission to change Redis user password(s) and/or access string.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifUserAuthenticationMode()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyUser.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toModifyUser", []))

    @jsii.member(jsii_name="toModifyUserGroup")
    def to_modify_user_group(self) -> "Elasticache":
        '''(experimental) Grants permission to change list of users that belong to the user group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyUserGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toModifyUserGroup", []))

    @jsii.member(jsii_name="toPurchaseReservedCacheNodesOffering")
    def to_purchase_reserved_cache_nodes_offering(self) -> "Elasticache":
        '''(experimental) Grants permission to purchase a reserved cache node offering.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - elasticache:AddTagsToResource

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_PurchaseReservedCacheNodesOffering.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toPurchaseReservedCacheNodesOffering", []))

    @jsii.member(jsii_name="toRebalanceSlotsInGlobalReplicationGroup")
    def to_rebalance_slots_in_global_replication_group(self) -> "Elasticache":
        '''(experimental) Grants permission to perform a key space rebalance operation to redistribute slots and ensure uniform key distribution across existing shards in a global replication group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_RebalanceSlotsInGlobalReplicationGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toRebalanceSlotsInGlobalReplicationGroup", []))

    @jsii.member(jsii_name="toRebootCacheCluster")
    def to_reboot_cache_cluster(self) -> "Elasticache":
        '''(experimental) Grants permission to reboot some, or all, of the cache nodes within a provisioned cache cluster or replication group (cluster mode disabled).

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_RebootCacheCluster.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toRebootCacheCluster", []))

    @jsii.member(jsii_name="toRemoveTagsFromResource")
    def to_remove_tags_from_resource(self) -> "Elasticache":
        '''(experimental) Grants permission to remove tags from a ElastiCache resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_RemoveTagsFromResource.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toRemoveTagsFromResource", []))

    @jsii.member(jsii_name="toResetCacheParameterGroup")
    def to_reset_cache_parameter_group(self) -> "Elasticache":
        '''(experimental) Grants permission to modify parameters of a cache parameter group back to their default values.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifCacheParameterGroupName()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ResetCacheParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toResetCacheParameterGroup", []))

    @jsii.member(jsii_name="toRevokeCacheSecurityGroupIngress")
    def to_revoke_cache_security_group_ingress(self) -> "Elasticache":
        '''(experimental) Grants permission to remove an EC2 security group ingress from a ElastiCache security group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_RevokeCacheSecurityGroupIngress.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toRevokeCacheSecurityGroupIngress", []))

    @jsii.member(jsii_name="toStartMigration")
    def to_start_migration(self) -> "Elasticache":
        '''(experimental) Grants permission to start a migration of data from hosted Redis on Amazon EC2 to ElastiCache for Redis.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_StartMigration.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toStartMigration", []))

    @jsii.member(jsii_name="toTestFailover")
    def to_test_failover(self) -> "Elasticache":
        '''(experimental) Grants permission to test automatic failover on a specified node group in a replication group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_TestFailover.html

        :stability: experimental
        '''
        return typing.cast("Elasticache", jsii.invoke(self, "toTestFailover", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cac398e44d72262d1f0168db967bcc1d2afb1e5e79fabb6d91698350c5d5e605)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e25a3c3680e4644f94e13c81eb3f5ce2273210a16a138ff3024a905d4a940d53)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Elasticbeanstalk(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Elasticbeanstalk",
):
    '''(experimental) Statement provider for service `elasticbeanstalk <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticbeanstalk.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elasticbeanstalk <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticbeanstalk.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__333ebf52a0fc99cc9ff19875d68a73e1a01eaf0158c251a598a61184c742cd45)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifFromApplication")
    def if_from_application(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Filters access by an application as a dependency or a constraint on an input parameter.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.actions.html#AWSHowTo.iam.policies.conditions

        Applies to actions:

        - .toCreateConfigurationTemplate()
        - .toUpdateConfigurationTemplate()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d9e1e732b30bead90f3a0a80cb8bdf88d46db44ce1ef78969a3886e44b36bf6c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "ifFromApplication", [value, operator]))

    @jsii.member(jsii_name="ifFromApplicationVersion")
    def if_from_application_version(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Filters access by an application version as a dependency or a constraint on an input parameter.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.actions.html#AWSHowTo.iam.policies.conditions

        Applies to actions:

        - .toCreateConfigurationTemplate()
        - .toCreateEnvironment()
        - .toUpdateConfigurationTemplate()
        - .toUpdateEnvironment()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__650c45bade4bcc9bbc5a0956b6157653d2626fc1033ae45e5f03a37eaf5a6d27)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "ifFromApplicationVersion", [value, operator]))

    @jsii.member(jsii_name="ifFromConfigurationTemplate")
    def if_from_configuration_template(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Filters access by a configuration template as a dependency or a constraint on an input parameter.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.actions.html#AWSHowTo.iam.policies.conditions

        Applies to actions:

        - .toCreateConfigurationTemplate()
        - .toCreateEnvironment()
        - .toUpdateConfigurationTemplate()
        - .toUpdateEnvironment()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8f7b645c97c1a786dcaddd6290fd160cbb14cd25668e6e03ab9b2b27564d79e4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "ifFromConfigurationTemplate", [value, operator]))

    @jsii.member(jsii_name="ifFromEnvironment")
    def if_from_environment(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Filters access by an environment as a dependency or a constraint on an input parameter.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.actions.html#AWSHowTo.iam.policies.conditions

        Applies to actions:

        - .toCreateConfigurationTemplate()
        - .toSwapEnvironmentCNAMEs()
        - .toUpdateConfigurationTemplate()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__775ed65a986c4d6110f99c4a57322b6f2880651a34ed078b14493d308edc76cd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "ifFromEnvironment", [value, operator]))

    @jsii.member(jsii_name="ifFromPlatform")
    def if_from_platform(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Filters access by a platform as a dependency or a constraint on an input parameter.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.actions.html#AWSHowTo.iam.policies.conditions

        Applies to actions:

        - .toCreateConfigurationTemplate()
        - .toCreateEnvironment()
        - .toUpdateConfigurationTemplate()
        - .toUpdateEnvironment()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0426d0b9aacd55f9023de5a0e39fd943b0976b920a262c4f4bac26af63d3e386)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "ifFromPlatform", [value, operator]))

    @jsii.member(jsii_name="ifFromSolutionStack")
    def if_from_solution_stack(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Filters access by a solution stack as a dependency or a constraint on an input parameter.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.actions.html#AWSHowTo.iam.policies.conditions

        Applies to actions:

        - .toCreateConfigurationTemplate()
        - .toCreateEnvironment()
        - .toUpdateConfigurationTemplate()
        - .toUpdateEnvironment()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__16b7169b53d054594985032420a1cb9825133f949f978ec0ec6a7d0b7dbc8b5c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "ifFromSolutionStack", [value, operator]))

    @jsii.member(jsii_name="ifInApplication")
    def if_in_application(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Filters access by the application that contains the resource that the action operates on.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.actions.html#AWSHowTo.iam.policies.conditions

        Applies to actions:

        - .toAbortEnvironmentUpdate()
        - .toApplyEnvironmentManagedAction()
        - .toComposeEnvironments()
        - .toCreateApplicationVersion()
        - .toCreateConfigurationTemplate()
        - .toCreateEnvironment()
        - .toDeleteApplicationVersion()
        - .toDeleteConfigurationTemplate()
        - .toDeleteEnvironmentConfiguration()
        - .toDescribeApplicationVersions()
        - .toDescribeConfigurationOptions()
        - .toDescribeConfigurationSettings()
        - .toDescribeEnvironmentManagedActionHistory()
        - .toDescribeEnvironmentManagedActions()
        - .toDescribeEnvironmentResources()
        - .toDescribeEnvironments()
        - .toDescribeEvents()
        - .toRebuildEnvironment()
        - .toRequestEnvironmentInfo()
        - .toRestartAppServer()
        - .toRetrieveEnvironmentInfo()
        - .toSwapEnvironmentCNAMEs()
        - .toTerminateEnvironment()
        - .toUpdateApplicationVersion()
        - .toUpdateConfigurationTemplate()
        - .toUpdateEnvironment()
        - .toValidateConfigurationSettings()

        Applies to resource types:

        - applicationversion
        - configurationtemplate
        - environment

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b4c6b9bc28457d7fc78332b7fe9668704d30a5f4b6ef9646ef8d41a29c5dc0ca)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "ifInApplication", [value, operator]))

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        application_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Adds a resource of type application to the statement.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.arn.html

        :param application_name: - Identifier for the applicationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8a42dbdc009fe76d4b76d2a21964795d36ccfa96c02b2f22db468d227906498b)
            check_type(argname="argument application_name", value=application_name, expected_type=type_hints["application_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "onApplication", [application_name, account, region, partition]))

    @jsii.member(jsii_name="onApplicationversion")
    def on_applicationversion(
        self,
        application_name: builtins.str,
        version_label: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Adds a resource of type applicationversion to the statement.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.arn.html

        :param application_name: - Identifier for the applicationName.
        :param version_label: - Identifier for the versionLabel.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifInApplication()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e94f11224ff7c33285919efe5be4bfcfbc8cfb3c32f8df3f2dbc4febfb91b7e1)
            check_type(argname="argument application_name", value=application_name, expected_type=type_hints["application_name"])
            check_type(argname="argument version_label", value=version_label, expected_type=type_hints["version_label"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "onApplicationversion", [application_name, version_label, account, region, partition]))

    @jsii.member(jsii_name="onConfigurationtemplate")
    def on_configurationtemplate(
        self,
        application_name: builtins.str,
        template_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Adds a resource of type configurationtemplate to the statement.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.arn.html

        :param application_name: - Identifier for the applicationName.
        :param template_name: - Identifier for the templateName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifInApplication()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ffe3a4e84e2a4acb13fc47e913cd001d607154cb0add52bcd47003799a9f0c3e)
            check_type(argname="argument application_name", value=application_name, expected_type=type_hints["application_name"])
            check_type(argname="argument template_name", value=template_name, expected_type=type_hints["template_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "onConfigurationtemplate", [application_name, template_name, account, region, partition]))

    @jsii.member(jsii_name="onEnvironment")
    def on_environment(
        self,
        application_name: builtins.str,
        environment_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Adds a resource of type environment to the statement.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.arn.html

        :param application_name: - Identifier for the applicationName.
        :param environment_name: - Identifier for the environmentName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifInApplication()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__afdb6e564492a4803c876d2bdb6da9da6fc3bb02d15d1dfe67deedcd61be285e)
            check_type(argname="argument application_name", value=application_name, expected_type=type_hints["application_name"])
            check_type(argname="argument environment_name", value=environment_name, expected_type=type_hints["environment_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "onEnvironment", [application_name, environment_name, account, region, partition]))

    @jsii.member(jsii_name="onPlatform")
    def on_platform(
        self,
        platform_name_with_version: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Adds a resource of type platform to the statement.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.arn.html

        :param platform_name_with_version: - Identifier for the platformNameWithVersion.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__38fb427ccd9a66584437ff691baf402230d5ec686ca27211566f46c0ba09cdf3)
            check_type(argname="argument platform_name_with_version", value=platform_name_with_version, expected_type=type_hints["platform_name_with_version"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "onPlatform", [platform_name_with_version, region, partition]))

    @jsii.member(jsii_name="onSolutionstack")
    def on_solutionstack(
        self,
        solution_stack_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticbeanstalk":
        '''(experimental) Adds a resource of type solutionstack to the statement.

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.policies.arn.html

        :param solution_stack_name: - Identifier for the solutionStackName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__775008d4e6a5c01e9fb4e0b2fb9146ca874cf13491ad5f3783989437016a7cdd)
            check_type(argname="argument solution_stack_name", value=solution_stack_name, expected_type=type_hints["solution_stack_name"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "onSolutionstack", [solution_stack_name, region, partition]))

    @jsii.member(jsii_name="toAbortEnvironmentUpdate")
    def to_abort_environment_update(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to cancel in-progress environment configuration update or application version deployment.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_AbortEnvironmentUpdate.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toAbortEnvironmentUpdate", []))

    @jsii.member(jsii_name="toAddTags")
    def to_add_tags(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to add tags to an Elastic Beanstalk resource and to update tag values.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_UpdateTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toAddTags", []))

    @jsii.member(jsii_name="toApplyEnvironmentManagedAction")
    def to_apply_environment_managed_action(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to apply a scheduled managed action immediately.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_ApplyEnvironmentManagedAction.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toApplyEnvironmentManagedAction", []))

    @jsii.member(jsii_name="toAssociateEnvironmentOperationsRole")
    def to_associate_environment_operations_role(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to associate an operations role with an environment.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_AssociateEnvironmentOperationsRole.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toAssociateEnvironmentOperationsRole", []))

    @jsii.member(jsii_name="toCheckDNSAvailability")
    def to_check_dns_availability(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to check CNAME availability.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_CheckDNSAvailability.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toCheckDNSAvailability", []))

    @jsii.member(jsii_name="toComposeEnvironments")
    def to_compose_environments(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to create or update a group of environments, each running a separate component of a single application.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_ComposeEnvironments.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toComposeEnvironments", []))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to create a new application.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toCreateApplicationVersion")
    def to_create_application_version(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to create an application version for an application.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_CreateApplicationVersion.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toCreateApplicationVersion", []))

    @jsii.member(jsii_name="toCreateConfigurationTemplate")
    def to_create_configuration_template(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to create a configuration template.

        Access Level: Write

        Possible conditions:

        - .ifFromApplication()
        - .ifFromApplicationVersion()
        - .ifFromConfigurationTemplate()
        - .ifFromEnvironment()
        - .ifFromSolutionStack()
        - .ifFromPlatform()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_CreateConfigurationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toCreateConfigurationTemplate", []))

    @jsii.member(jsii_name="toCreateEnvironment")
    def to_create_environment(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to launch an environment for an application.

        Access Level: Write

        Possible conditions:

        - .ifFromApplicationVersion()
        - .ifFromConfigurationTemplate()
        - .ifFromSolutionStack()
        - .ifFromPlatform()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_CreateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toCreateEnvironment", []))

    @jsii.member(jsii_name="toCreatePlatformVersion")
    def to_create_platform_version(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to create a new version of a custom platform.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_CreatePlatformVersion.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toCreatePlatformVersion", []))

    @jsii.member(jsii_name="toCreateStorageLocation")
    def to_create_storage_location(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to create the Amazon S3 storage location for the account.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_CreateStorageLocation.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toCreateStorageLocation", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to delete an application along with all associated versions and configurations.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toDeleteApplicationVersion")
    def to_delete_application_version(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to delete an application version from an application.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DeleteApplicationVersion.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDeleteApplicationVersion", []))

    @jsii.member(jsii_name="toDeleteConfigurationTemplate")
    def to_delete_configuration_template(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to delete a configuration template.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DeleteConfigurationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDeleteConfigurationTemplate", []))

    @jsii.member(jsii_name="toDeleteEnvironmentConfiguration")
    def to_delete_environment_configuration(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to delete the draft configuration associated with the running environment.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DeleteEnvironmentConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDeleteEnvironmentConfiguration", []))

    @jsii.member(jsii_name="toDeletePlatformVersion")
    def to_delete_platform_version(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to delete a version of a custom platform.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DeletePlatformVersion.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDeletePlatformVersion", []))

    @jsii.member(jsii_name="toDescribeAccountAttributes")
    def to_describe_account_attributes(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a list of account attributes, including resource quotas.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeAccountAttributes.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeAccountAttributes", []))

    @jsii.member(jsii_name="toDescribeApplications")
    def to_describe_applications(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve the descriptions of existing applications.

        Access Level: List

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeApplications.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeApplications", []))

    @jsii.member(jsii_name="toDescribeApplicationVersions")
    def to_describe_application_versions(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a list of application versions stored in an AWS Elastic Beanstalk storage bucket.

        Access Level: List

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeApplicationVersions.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeApplicationVersions", []))

    @jsii.member(jsii_name="toDescribeConfigurationOptions")
    def to_describe_configuration_options(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve descriptions of environment configuration options.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeConfigurationOptions.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeConfigurationOptions", []))

    @jsii.member(jsii_name="toDescribeConfigurationSettings")
    def to_describe_configuration_settings(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a description of the settings for a configuration set.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeConfigurationSettings.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeConfigurationSettings", []))

    @jsii.member(jsii_name="toDescribeEnvironmentHealth")
    def to_describe_environment_health(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve information about the overall health of an environment.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeEnvironmentHealth.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeEnvironmentHealth", []))

    @jsii.member(jsii_name="toDescribeEnvironmentManagedActionHistory")
    def to_describe_environment_managed_action_history(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a list of an environment's completed and failed managed actions.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeEnvironmentManagedActionHistory.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeEnvironmentManagedActionHistory", []))

    @jsii.member(jsii_name="toDescribeEnvironmentManagedActions")
    def to_describe_environment_managed_actions(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a list of an environment's upcoming and in-progress managed actions.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeEnvironmentManagedActions.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeEnvironmentManagedActions", []))

    @jsii.member(jsii_name="toDescribeEnvironmentResources")
    def to_describe_environment_resources(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a list of AWS resources for an environment.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeEnvironmentResources.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeEnvironmentResources", []))

    @jsii.member(jsii_name="toDescribeEnvironments")
    def to_describe_environments(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve descriptions for existing environments.

        Access Level: List

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeEnvironments.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeEnvironments", []))

    @jsii.member(jsii_name="toDescribeEvents")
    def to_describe_events(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a list of event descriptions matching a set of criteria.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeEvents.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeEvents", []))

    @jsii.member(jsii_name="toDescribeInstancesHealth")
    def to_describe_instances_health(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve more detailed information about the health of environment instances.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribeInstancesHealth.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribeInstancesHealth", []))

    @jsii.member(jsii_name="toDescribePlatformVersion")
    def to_describe_platform_version(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a description of a platform version.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DescribePlatformVersion.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDescribePlatformVersion", []))

    @jsii.member(jsii_name="toDisassociateEnvironmentOperationsRole")
    def to_disassociate_environment_operations_role(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to disassociate an operations role with an environment.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_DisassociateEnvironmentOperationsRole.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toDisassociateEnvironmentOperationsRole", []))

    @jsii.member(jsii_name="toListAvailableSolutionStacks")
    def to_list_available_solution_stacks(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a list of the available solution stack names.

        Access Level: List

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_ListAvailableSolutionStacks.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toListAvailableSolutionStacks", []))

    @jsii.member(jsii_name="toListPlatformBranches")
    def to_list_platform_branches(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a list of the available platform branches.

        Access Level: List

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_ListPlatformBranches.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toListPlatformBranches", []))

    @jsii.member(jsii_name="toListPlatformVersions")
    def to_list_platform_versions(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a list of the available platforms.

        Access Level: List

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_ListPlatformVersions.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toListPlatformVersions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve a list of tags of an Elastic Beanstalk resource.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutInstanceStatistics")
    def to_put_instance_statistics(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to submit instance statistics for enhanced health.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/health-enhanced.html#health-enhanced-authz

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toPutInstanceStatistics", []))

    @jsii.member(jsii_name="toRebuildEnvironment")
    def to_rebuild_environment(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to delete and recreate all of the AWS resources for an environment and to force a restart.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_RebuildEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toRebuildEnvironment", []))

    @jsii.member(jsii_name="toRemoveTags")
    def to_remove_tags(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to remove tags from an Elastic Beanstalk resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_UpdateTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toRemoveTags", []))

    @jsii.member(jsii_name="toRequestEnvironmentInfo")
    def to_request_environment_info(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to initiate a request to compile information of the deployed environment.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_RequestEnvironmentInfo.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toRequestEnvironmentInfo", []))

    @jsii.member(jsii_name="toRestartAppServer")
    def to_restart_app_server(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to request an environment to restart the application container server running on each Amazon EC2 instance.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_RestartAppServer.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toRestartAppServer", []))

    @jsii.member(jsii_name="toRetrieveEnvironmentInfo")
    def to_retrieve_environment_info(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to retrieve the compiled information from a RequestEnvironmentInfo request.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_RetrieveEnvironmentInfo.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toRetrieveEnvironmentInfo", []))

    @jsii.member(jsii_name="toSwapEnvironmentCNAMEs")
    def to_swap_environment_cnam_es(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to swap the CNAMEs of two environments.

        Access Level: Write

        Possible conditions:

        - .ifFromEnvironment()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_SwapEnvironmentCNAMEs.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toSwapEnvironmentCNAMEs", []))

    @jsii.member(jsii_name="toTerminateEnvironment")
    def to_terminate_environment(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to terminate an environment.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_TerminateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toTerminateEnvironment", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to update an application with specified properties.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toUpdateApplication", []))

    @jsii.member(jsii_name="toUpdateApplicationResourceLifecycle")
    def to_update_application_resource_lifecycle(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to update the application version lifecycle policy associated with the application.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_UpdateApplicationResourceLifecycle.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toUpdateApplicationResourceLifecycle", []))

    @jsii.member(jsii_name="toUpdateApplicationVersion")
    def to_update_application_version(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to update an application version with specified properties.

        Access Level: Write

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_UpdateApplicationVersion.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toUpdateApplicationVersion", []))

    @jsii.member(jsii_name="toUpdateConfigurationTemplate")
    def to_update_configuration_template(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to update a configuration template with specified properties or configuration option values.

        Access Level: Write

        Possible conditions:

        - .ifFromApplication()
        - .ifFromApplicationVersion()
        - .ifFromConfigurationTemplate()
        - .ifFromEnvironment()
        - .ifFromSolutionStack()
        - .ifFromPlatform()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_UpdateConfigurationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toUpdateConfigurationTemplate", []))

    @jsii.member(jsii_name="toUpdateEnvironment")
    def to_update_environment(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to update an environment.

        Access Level: Write

        Possible conditions:

        - .ifFromApplicationVersion()
        - .ifFromConfigurationTemplate()
        - .ifFromSolutionStack()
        - .ifFromPlatform()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_UpdateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toUpdateEnvironment", []))

    @jsii.member(jsii_name="toUpdateTagsForResource")
    def to_update_tags_for_resource(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to add tags to an Elastic Beanstalk resource, remove tags, and to update tag values.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_UpdateTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toUpdateTagsForResource", []))

    @jsii.member(jsii_name="toValidateConfigurationSettings")
    def to_validate_configuration_settings(self) -> "Elasticbeanstalk":
        '''(experimental) Grants permission to check the validity of a set of configuration settings for a configuration template or an environment.

        Access Level: Read

        https://docs.aws.amazon.com/elasticbeanstalk/latest/api/API_ValidateConfigurationSettings.html

        :stability: experimental
        '''
        return typing.cast("Elasticbeanstalk", jsii.invoke(self, "toValidateConfigurationSettings", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6e50d148e2cebc81da8044ff8eb6aa6a746718c6e448117b5fdafc14b57f5507)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2f1ef070555ca6e15ac2f0b1bc00a792a4ad6efedb56791ae52691fb2a7860ed)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Elasticfilesystem(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Elasticfilesystem",
):
    '''(experimental) Statement provider for service `elasticfilesystem <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticfilesystem.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elasticfilesystem <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticfilesystem.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5d087ac0ce737ad257f9a588a74fa1d32fed335955d05655ce22380ab752aa16)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAccessedViaMountTarget")
    def if_accessed_via_mount_target(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Elasticfilesystem":
        '''(experimental) Filters access by whether the file system is accessed via mount targets.

        https://docs.aws.amazon.com/efs/latest/ug/mounting-fs.html

        Applies to actions:

        - .toClientMount()
        - .toClientRootAccess()
        - .toClientWrite()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__87b9d701ee3bb362aec489f0cb88bc1652c4a07df93cceb2067521259277e03f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "ifAccessedViaMountTarget", [value]))

    @jsii.member(jsii_name="ifAccessPointArn")
    def if_access_point_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticfilesystem":
        '''(experimental) Filters access by the ARN of the access point used to mount the file system.

        https://docs.aws.amazon.com/efs/latest/ug/efs-access-points.html

        Applies to actions:

        - .toClientMount()
        - .toClientRootAccess()
        - .toClientWrite()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9265d745cb187145036557188f0b3e766deaf36c239283601c340cf9d9c364c8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "ifAccessPointArn", [value, operator]))

    @jsii.member(jsii_name="ifEncrypted")
    def if_encrypted(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Elasticfilesystem":
        '''(experimental) Filters access by whether users can create only encrypted or unencrypted file systems.

        https://docs.aws.amazon.com/efs/latest/ug/encryption.html

        Applies to actions:

        - .toCreateFileSystem()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7cbad4a961ef0ac214a21d4011fca0031160112c16101b4cb800cb2f811476b8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "ifEncrypted", [value]))

    @jsii.member(jsii_name="onAccessPoint")
    def on_access_point(
        self,
        access_point_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticfilesystem":
        '''(experimental) Adds a resource of type access-point to the statement.

        https://docs.aws.amazon.com/efs/latest/ug/access-control-overview.html#access-control-resources

        :param access_point_id: - Identifier for the accessPointId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f69360b5bab9e5e738c673d1c5961bd91253f9c7b54fc1cde5c609e36870e662)
            check_type(argname="argument access_point_id", value=access_point_id, expected_type=type_hints["access_point_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "onAccessPoint", [access_point_id, account, region, partition]))

    @jsii.member(jsii_name="onFileSystem")
    def on_file_system(
        self,
        file_system_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticfilesystem":
        '''(experimental) Adds a resource of type file-system to the statement.

        https://docs.aws.amazon.com/efs/latest/ug/access-control-overview.html#access-control-resources

        :param file_system_id: - Identifier for the fileSystemId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__22221b0e8f92c5dceab3b67af39bf52f246f2d1cfca524462fbea3bd93b4895f)
            check_type(argname="argument file_system_id", value=file_system_id, expected_type=type_hints["file_system_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "onFileSystem", [file_system_id, account, region, partition]))

    @jsii.member(jsii_name="toBackup")
    def to_backup(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to start a backup job for an existing file system.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/efs-backup-solutions.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toBackup", []))

    @jsii.member(jsii_name="toClientMount")
    def to_client_mount(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to allow an NFS client read-access to a file system.

        Access Level: Read

        Possible conditions:

        - .ifAccessPointArn()
        - .ifAccessedViaMountTarget()

        https://docs.aws.amazon.com/efs/latest/ug/efs-client-authorization.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toClientMount", []))

    @jsii.member(jsii_name="toClientRootAccess")
    def to_client_root_access(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to allow an NFS client root-access to a file system.

        Access Level: Write

        Possible conditions:

        - .ifAccessPointArn()
        - .ifAccessedViaMountTarget()

        https://docs.aws.amazon.com/efs/latest/ug/efs-client-authorization.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toClientRootAccess", []))

    @jsii.member(jsii_name="toClientWrite")
    def to_client_write(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to allow an NFS client write-access to a file system.

        Access Level: Write

        Possible conditions:

        - .ifAccessPointArn()
        - .ifAccessedViaMountTarget()

        https://docs.aws.amazon.com/efs/latest/ug/efs-client-authorization.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toClientWrite", []))

    @jsii.member(jsii_name="toCreateAccessPoint")
    def to_create_access_point(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to create an access point for the specified file system.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/efs/latest/ug/API_CreateAccessPoint.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toCreateAccessPoint", []))

    @jsii.member(jsii_name="toCreateFileSystem")
    def to_create_file_system(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to create a new, empty file system.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifEncrypted()

        https://docs.aws.amazon.com/efs/latest/ug/API_CreateFileSystem.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toCreateFileSystem", []))

    @jsii.member(jsii_name="toCreateMountTarget")
    def to_create_mount_target(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to create a mount target for a file system.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_CreateMountTarget.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toCreateMountTarget", []))

    @jsii.member(jsii_name="toCreateReplicationConfiguration")
    def to_create_replication_configuration(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to create a new replication configuration.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_CreateReplicationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toCreateReplicationConfiguration", []))

    @jsii.member(jsii_name="toCreateTags")
    def to_create_tags(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to create or overwrite tags associated with a file system; deprecated, see TagResource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/efs/latest/ug/API_CreateTags.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toCreateTags", []))

    @jsii.member(jsii_name="toDeleteAccessPoint")
    def to_delete_access_point(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to delete the specified access point.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_DeleteAccessPoint.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDeleteAccessPoint", []))

    @jsii.member(jsii_name="toDeleteFileSystem")
    def to_delete_file_system(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to delete a file system, permanently severing access to its contents.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_DeleteFileSystem.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDeleteFileSystem", []))

    @jsii.member(jsii_name="toDeleteFileSystemPolicy")
    def to_delete_file_system_policy(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to delete the resource-level policy for a file system.

        Access Level: Permissions management

        https://docs.aws.amazon.com/efs/latest/ug/API_DeleteFileSystemPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDeleteFileSystemPolicy", []))

    @jsii.member(jsii_name="toDeleteMountTarget")
    def to_delete_mount_target(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to delete the specified mount target.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_DeleteMountTarget.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDeleteMountTarget", []))

    @jsii.member(jsii_name="toDeleteReplicationConfiguration")
    def to_delete_replication_configuration(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to delete a replication configuration.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_DeleteReplicationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDeleteReplicationConfiguration", []))

    @jsii.member(jsii_name="toDeleteTags")
    def to_delete_tags(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to delete the specified tags from a file system; deprecated, see UntagResource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/efs/latest/ug/API_DeleteTags.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDeleteTags", []))

    @jsii.member(jsii_name="toDescribeAccessPoints")
    def to_describe_access_points(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to view the descriptions of Amazon EFS access points.

        Access Level: List

        https://docs.aws.amazon.com/efs/latest/ug/API_DescribeAccessPoints.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDescribeAccessPoints", []))

    @jsii.member(jsii_name="toDescribeAccountPreferences")
    def to_describe_account_preferences(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to view the account preferences in effect for an account.

        Access Level: List

        https://docs.aws.amazon.com/efs/latest/ug/API_DescribeAccountPreferences.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDescribeAccountPreferences", []))

    @jsii.member(jsii_name="toDescribeBackupPolicy")
    def to_describe_backup_policy(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to view the BackupPolicy object for an Amazon EFS file system.

        Access Level: Read

        https://docs.aws.amazon.com/efs/latest/ug/API_DescribeBackupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDescribeBackupPolicy", []))

    @jsii.member(jsii_name="toDescribeFileSystemPolicy")
    def to_describe_file_system_policy(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to view the resource-level policy for an Amazon EFS file system.

        Access Level: Read

        https://docs.aws.amazon.com/efs/latest/ug/API_DescribeFileSystemPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDescribeFileSystemPolicy", []))

    @jsii.member(jsii_name="toDescribeFileSystems")
    def to_describe_file_systems(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to view the description of an Amazon EFS file system specified by file system CreationToken or FileSystemId;

        or to view the description of all file systems owned by the caller's AWS account in the AWS region of the endpoint that is being called

        Access Level: List

        https://docs.aws.amazon.com/efs/latest/ug/API_DescribeFileSystems.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDescribeFileSystems", []))

    @jsii.member(jsii_name="toDescribeLifecycleConfiguration")
    def to_describe_lifecycle_configuration(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to view the LifecycleConfiguration object for an Amazon EFS file system.

        Access Level: Read

        https://docs.aws.amazon.com/efs/latest/ug/API_DescribeLifecycleConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDescribeLifecycleConfiguration", []))

    @jsii.member(jsii_name="toDescribeMountTargets")
    def to_describe_mount_targets(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to view the descriptions of all mount targets, or a specific mount target, for a file system.

        Access Level: Read

        https://docs.aws.amazon.com/efs/latest/ug/API_DescribeMountTargets.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDescribeMountTargets", []))

    @jsii.member(jsii_name="toDescribeMountTargetSecurityGroups")
    def to_describe_mount_target_security_groups(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to view the security groups in effect for a mount target.

        Access Level: Read

        https://docs.aws.amazon.com/efs/latest/ug/API_DescribeMountTargetSecurityGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDescribeMountTargetSecurityGroups", []))

    @jsii.member(jsii_name="toDescribeReplicationConfigurations")
    def to_describe_replication_configurations(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to view the description of an Amazon EFS replication configuration specified by FileSystemId;

        or to view the description of all replication configurations owned by the caller's AWS account in the AWS region of the endpoint that is being called

        Access Level: List

        https://docs.aws.amazon.com/efs/latest/ug/API_DescribeReplicationConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDescribeReplicationConfigurations", []))

    @jsii.member(jsii_name="toDescribeTags")
    def to_describe_tags(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to view the tags associated with a file system.

        Access Level: Read

        https://docs.aws.amazon.com/efs/latest/ug/API_DescribeTags.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toDescribeTags", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to view the tags associated with the specified Amazon EFS resource.

        Access Level: Read

        https://docs.aws.amazon.com/efs/latest/ug/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toModifyMountTargetSecurityGroups")
    def to_modify_mount_target_security_groups(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to modify the set of security groups in effect for a mount target.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_ModifyMountTargetSecurityGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toModifyMountTargetSecurityGroups", []))

    @jsii.member(jsii_name="toPutAccountPreferences")
    def to_put_account_preferences(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to set the account preferences of an account.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_PutAccountPreferences.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toPutAccountPreferences", []))

    @jsii.member(jsii_name="toPutBackupPolicy")
    def to_put_backup_policy(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to enable or disable automatic backups with AWS Backup by creating a new BackupPolicy object.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_PutBackupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toPutBackupPolicy", []))

    @jsii.member(jsii_name="toPutFileSystemPolicy")
    def to_put_file_system_policy(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to apply a resource-level policy that defines the actions allowed or denied from given actors for the specified file system.

        Access Level: Permissions management

        https://docs.aws.amazon.com/efs/latest/ug/API_PutFileSystemPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toPutFileSystemPolicy", []))

    @jsii.member(jsii_name="toPutLifecycleConfiguration")
    def to_put_lifecycle_configuration(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to enable lifecycle management by creating a new LifecycleConfiguration object.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_PutLifecycleConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toPutLifecycleConfiguration", []))

    @jsii.member(jsii_name="toRestore")
    def to_restore(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to start a restore job for a backup of a file system.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/efs-backup-solutions.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toRestore", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to create or overwrite tags associated with the specified Amazon EFS resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/efs/latest/ug/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to delete the specified tags from an Amazon EFS resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/efs/latest/ug/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateFileSystem")
    def to_update_file_system(self) -> "Elasticfilesystem":
        '''(experimental) Grants permission to update the throughput mode or the amount of provisioned throughput of an existing file system.

        Access Level: Write

        https://docs.aws.amazon.com/efs/latest/ug/API_UpdateFileSystem.html

        :stability: experimental
        '''
        return typing.cast("Elasticfilesystem", jsii.invoke(self, "toUpdateFileSystem", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bedca6aa4a7da682a52baaf321fa70822f53d5e926da5f2a2e4f4f3d492cd84f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__da5c81bf3f316b47e5f3c661eb6920fbe10a16ca50dfccca5ed54a1ad85ad4d8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Elasticloadbalancing(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Elasticloadbalancing",
):
    '''(experimental) Statement provider for service `elasticloadbalancing <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticloadbalancing.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elasticloadbalancing <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselasticloadbalancing.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d407ee39326578bd1341d87e57900cb6c2a11b186e8aa856ef544c12d08b38cb)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticloadbalancing":
        '''(experimental) Filters access by the preface string for a tag key and value pair that are attached to a resource.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag

        Applies to resource types:

        - loadbalancer

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7d5f1b479f8a599bca2c4d04e17c7abf5d5b643f82f789b25dc1594897a893ce)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifResourceTagExists")
    def if_resource_tag_exists(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticloadbalancing":
        '''(experimental) Filters access by the preface string for a tag key and value pair that are attached to a resource.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__250c118d4f1b50e74d0739fe3140cc56639942a53cc3589fbd7b94c161b80f5b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "ifResourceTagExists", [value, operator]))

    @jsii.member(jsii_name="onLoadbalancer")
    def on_loadbalancer(
        self,
        load_balancer_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticloadbalancing":
        '''(experimental) Adds a resource of type loadbalancer to the statement.

        https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/what-is-load-balancing.html

        :param load_balancer_name: - Identifier for the loadBalancerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__33950b300669c27514f0b4ed09f8937e4aa3dad520f469bce71ce1802fd42cc6)
            check_type(argname="argument load_balancer_name", value=load_balancer_name, expected_type=type_hints["load_balancer_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "onLoadbalancer", [load_balancer_name, account, region, partition]))

    @jsii.member(jsii_name="toAddTags")
    def to_add_tags(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to add the specified tags to the specified load balancer.

        Each load balancer can have a maximum of 10 tags

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_AddTags.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toAddTags", []))

    @jsii.member(jsii_name="toApplySecurityGroupsToLoadBalancer")
    def to_apply_security_groups_to_load_balancer(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to associate one or more security groups with your load balancer in a virtual private cloud (VPC).

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_ApplySecurityGroupsToLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toApplySecurityGroupsToLoadBalancer", []))

    @jsii.member(jsii_name="toAttachLoadBalancerToSubnets")
    def to_attach_load_balancer_to_subnets(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to add one or more subnets to the set of configured subnets for the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_AttachLoadBalancerToSubnets.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toAttachLoadBalancerToSubnets", []))

    @jsii.member(jsii_name="toConfigureHealthCheck")
    def to_configure_health_check(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to specify the health check settings to use when evaluating the health state of your back-end instances.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_ConfigureHealthCheck.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toConfigureHealthCheck", []))

    @jsii.member(jsii_name="toCreateAppCookieStickinessPolicy")
    def to_create_app_cookie_stickiness_policy(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to generate a stickiness policy with sticky session lifetimes that follow that of an application-generated cookie.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_CreateAppCookieStickinessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toCreateAppCookieStickinessPolicy", []))

    @jsii.member(jsii_name="toCreateLBCookieStickinessPolicy")
    def to_create_lb_cookie_stickiness_policy(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to generate a stickiness policy with sticky session lifetimes controlled by the lifetime of the browser (user-agent) or a specified expiration period.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_CreateLBCookieStickinessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toCreateLBCookieStickinessPolicy", []))

    @jsii.member(jsii_name="toCreateLoadBalancer")
    def to_create_load_balancer(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to create a load balancer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_CreateLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toCreateLoadBalancer", []))

    @jsii.member(jsii_name="toCreateLoadBalancerListeners")
    def to_create_load_balancer_listeners(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to create one or more listeners for the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_CreateLoadBalancerListeners.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toCreateLoadBalancerListeners", []))

    @jsii.member(jsii_name="toCreateLoadBalancerPolicy")
    def to_create_load_balancer_policy(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to create a policy with the specified attributes for the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_CreateLoadBalancerPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toCreateLoadBalancerPolicy", []))

    @jsii.member(jsii_name="toDeleteLoadBalancer")
    def to_delete_load_balancer(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to delete the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DeleteLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDeleteLoadBalancer", []))

    @jsii.member(jsii_name="toDeleteLoadBalancerListeners")
    def to_delete_load_balancer_listeners(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to delete the specified listeners from the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DeleteLoadBalancerListeners.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDeleteLoadBalancerListeners", []))

    @jsii.member(jsii_name="toDeleteLoadBalancerPolicy")
    def to_delete_load_balancer_policy(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to delete the specified policy from the specified load balancer.

        This policy must not be enabled for any listeners

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DeleteLoadBalancerPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDeleteLoadBalancerPolicy", []))

    @jsii.member(jsii_name="toDeregisterInstancesFromLoadBalancer")
    def to_deregister_instances_from_load_balancer(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to deregister the specified instances from the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DeregisterInstancesFromLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDeregisterInstancesFromLoadBalancer", []))

    @jsii.member(jsii_name="toDescribeInstanceHealth")
    def to_describe_instance_health(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to describe the state of the specified instances with respect to the specified load balancer.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeInstanceHealth.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDescribeInstanceHealth", []))

    @jsii.member(jsii_name="toDescribeLoadBalancerAttributes")
    def to_describe_load_balancer_attributes(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to describe the attributes for the specified load balancer.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeLoadBalancerAttributes.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDescribeLoadBalancerAttributes", []))

    @jsii.member(jsii_name="toDescribeLoadBalancerPolicies")
    def to_describe_load_balancer_policies(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to describe the specified policies.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeLoadBalancerPolicies.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDescribeLoadBalancerPolicies", []))

    @jsii.member(jsii_name="toDescribeLoadBalancerPolicyTypes")
    def to_describe_load_balancer_policy_types(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to describe the specified load balancer policy types.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeLoadBalancerPolicyTypes.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDescribeLoadBalancerPolicyTypes", []))

    @jsii.member(jsii_name="toDescribeLoadBalancers")
    def to_describe_load_balancers(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to describe the specified the load balancers.

        If no load balancers are specified, the call describes all of your load balancers

        Access Level: List

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeLoadBalancers.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDescribeLoadBalancers", []))

    @jsii.member(jsii_name="toDescribeTags")
    def to_describe_tags(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to describe the tags associated with the specified load balancers.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeTags.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDescribeTags", []))

    @jsii.member(jsii_name="toDetachLoadBalancerFromSubnets")
    def to_detach_load_balancer_from_subnets(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to remove the specified subnets from the set of configured subnets for the load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DetachLoadBalancerFromSubnets.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDetachLoadBalancerFromSubnets", []))

    @jsii.member(jsii_name="toDisableAvailabilityZonesForLoadBalancer")
    def to_disable_availability_zones_for_load_balancer(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to remove the specified Availability Zones from the set of Availability Zones for the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DisableAvailabilityZonesForLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toDisableAvailabilityZonesForLoadBalancer", []))

    @jsii.member(jsii_name="toEnableAvailabilityZonesForLoadBalancer")
    def to_enable_availability_zones_for_load_balancer(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to add the specified Availability Zones to the set of Availability Zones for the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_EnableAvailabilityZonesForLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toEnableAvailabilityZonesForLoadBalancer", []))

    @jsii.member(jsii_name="toModifyLoadBalancerAttributes")
    def to_modify_load_balancer_attributes(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to modify the attributes of the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_ModifyLoadBalancerAttributes.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toModifyLoadBalancerAttributes", []))

    @jsii.member(jsii_name="toRegisterInstancesWithLoadBalancer")
    def to_register_instances_with_load_balancer(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to add the specified instances to the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_RegisterInstancesWithLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toRegisterInstancesWithLoadBalancer", []))

    @jsii.member(jsii_name="toRemoveTags")
    def to_remove_tags(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to remove one or more tags from the specified load balancer.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_RemoveTags.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toRemoveTags", []))

    @jsii.member(jsii_name="toSetLoadBalancerListenerSSLCertificate")
    def to_set_load_balancer_listener_ssl_certificate(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to set the certificate that terminates the specified listener's SSL connections.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_SetLoadBalancerListenerSSLCertificate.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toSetLoadBalancerListenerSSLCertificate", []))

    @jsii.member(jsii_name="toSetLoadBalancerPoliciesForBackendServer")
    def to_set_load_balancer_policies_for_backend_server(
        self,
    ) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to replace the set of policies associated with the specified port on which the back-end server is listening with a new set of policies.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_SetLoadBalancerPoliciesForBackendServer.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toSetLoadBalancerPoliciesForBackendServer", []))

    @jsii.member(jsii_name="toSetLoadBalancerPoliciesOfListener")
    def to_set_load_balancer_policies_of_listener(self) -> "Elasticloadbalancing":
        '''(experimental) Grants permission to replace the current set of policies for the specified load balancer port with the specified set of policies.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_SetLoadBalancerPoliciesOfListener.html

        :stability: experimental
        '''
        return typing.cast("Elasticloadbalancing", jsii.invoke(self, "toSetLoadBalancerPoliciesOfListener", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5c573343f751a5e8ad33bd0db893acd25a6a2a190ff523d70d720cdd0a669dcb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__93aceb50f2d09107e70e955274be06ab9f12e8c7dc32efb4fd48841a0968f246)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class ElasticloadbalancingV2(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ElasticloadbalancingV2",
):
    '''(experimental) Statement provider for service `elasticloadbalancing-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_elasticloadbalancingv2.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elasticloadbalancing-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_elasticloadbalancingv2.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cf5695cba8a0488026652f0a88282fc37b06b0fe4707e08e82dc6fbb108eb08f)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "ElasticloadbalancingV2":
        '''(experimental) A tag key and value pair.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag

        Applies to resource types:

        - listener/app
        - listener-rule/app
        - listener/net
        - listener-rule/net
        - loadbalancer/app/
        - loadbalancer/net/
        - targetgroup

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e2d95bd5bb3e285709cdc29901501fa68d68fa46dd6aaeea608079c172775ecc)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onListenerApp")
    def on_listener_app(
        self,
        load_balancer_name: builtins.str,
        load_balancer_id: builtins.str,
        listener_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ElasticloadbalancingV2":
        '''(experimental) Adds a resource of type listener/app to the statement.

        https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html

        :param load_balancer_name: - Identifier for the loadBalancerName.
        :param load_balancer_id: - Identifier for the loadBalancerId.
        :param listener_id: - Identifier for the listenerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__575716f5fd1e8afda89c67391d6087d78b53ed3ba873e24f904e961d9409dd51)
            check_type(argname="argument load_balancer_name", value=load_balancer_name, expected_type=type_hints["load_balancer_name"])
            check_type(argname="argument load_balancer_id", value=load_balancer_id, expected_type=type_hints["load_balancer_id"])
            check_type(argname="argument listener_id", value=listener_id, expected_type=type_hints["listener_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "onListenerApp", [load_balancer_name, load_balancer_id, listener_id, account, region, partition]))

    @jsii.member(jsii_name="onListenerNet")
    def on_listener_net(
        self,
        load_balancer_name: builtins.str,
        load_balancer_id: builtins.str,
        listener_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ElasticloadbalancingV2":
        '''(experimental) Adds a resource of type listener/net to the statement.

        https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html

        :param load_balancer_name: - Identifier for the loadBalancerName.
        :param load_balancer_id: - Identifier for the loadBalancerId.
        :param listener_id: - Identifier for the listenerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1e99c579c8863c95a6fb4cc3e59f745e47c6e63e3c5e728aaa3a645c43ff9391)
            check_type(argname="argument load_balancer_name", value=load_balancer_name, expected_type=type_hints["load_balancer_name"])
            check_type(argname="argument load_balancer_id", value=load_balancer_id, expected_type=type_hints["load_balancer_id"])
            check_type(argname="argument listener_id", value=listener_id, expected_type=type_hints["listener_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "onListenerNet", [load_balancer_name, load_balancer_id, listener_id, account, region, partition]))

    @jsii.member(jsii_name="onListenerRuleApp")
    def on_listener_rule_app(
        self,
        load_balancer_name: builtins.str,
        load_balancer_id: builtins.str,
        listener_id: builtins.str,
        listener_rule_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ElasticloadbalancingV2":
        '''(experimental) Adds a resource of type listener-rule/app to the statement.

        https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-update-rules.html

        :param load_balancer_name: - Identifier for the loadBalancerName.
        :param load_balancer_id: - Identifier for the loadBalancerId.
        :param listener_id: - Identifier for the listenerId.
        :param listener_rule_id: - Identifier for the listenerRuleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__981f91fcf143ae5aee09bc5370faf3c7e7d83c4589faf56fd31f2d9822537d11)
            check_type(argname="argument load_balancer_name", value=load_balancer_name, expected_type=type_hints["load_balancer_name"])
            check_type(argname="argument load_balancer_id", value=load_balancer_id, expected_type=type_hints["load_balancer_id"])
            check_type(argname="argument listener_id", value=listener_id, expected_type=type_hints["listener_id"])
            check_type(argname="argument listener_rule_id", value=listener_rule_id, expected_type=type_hints["listener_rule_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "onListenerRuleApp", [load_balancer_name, load_balancer_id, listener_id, listener_rule_id, account, region, partition]))

    @jsii.member(jsii_name="onListenerRuleNet")
    def on_listener_rule_net(
        self,
        load_balancer_name: builtins.str,
        load_balancer_id: builtins.str,
        listener_id: builtins.str,
        listener_rule_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ElasticloadbalancingV2":
        '''(experimental) Adds a resource of type listener-rule/net to the statement.

        https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-update-rules.html

        :param load_balancer_name: - Identifier for the loadBalancerName.
        :param load_balancer_id: - Identifier for the loadBalancerId.
        :param listener_id: - Identifier for the listenerId.
        :param listener_rule_id: - Identifier for the listenerRuleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a76acbefec54f9f510d7008439c23cb3cfdf46c53a38885897a2e2a5b82ca50c)
            check_type(argname="argument load_balancer_name", value=load_balancer_name, expected_type=type_hints["load_balancer_name"])
            check_type(argname="argument load_balancer_id", value=load_balancer_id, expected_type=type_hints["load_balancer_id"])
            check_type(argname="argument listener_id", value=listener_id, expected_type=type_hints["listener_id"])
            check_type(argname="argument listener_rule_id", value=listener_rule_id, expected_type=type_hints["listener_rule_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "onListenerRuleNet", [load_balancer_name, load_balancer_id, listener_id, listener_rule_id, account, region, partition]))

    @jsii.member(jsii_name="onLoadbalancerApp")
    def on_loadbalancer_app(
        self,
        load_balancer_name: builtins.str,
        load_balancer_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ElasticloadbalancingV2":
        '''(experimental) Adds a resource of type loadbalancer/app/ to the statement.

        https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html#application-load-balancer-overview

        :param load_balancer_name: - Identifier for the loadBalancerName.
        :param load_balancer_id: - Identifier for the loadBalancerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bb946903996a52fc3bf2e0214e40cfd48f4614109946b337e834b7f74b0aff5a)
            check_type(argname="argument load_balancer_name", value=load_balancer_name, expected_type=type_hints["load_balancer_name"])
            check_type(argname="argument load_balancer_id", value=load_balancer_id, expected_type=type_hints["load_balancer_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "onLoadbalancerApp", [load_balancer_name, load_balancer_id, account, region, partition]))

    @jsii.member(jsii_name="onLoadbalancerNet")
    def on_loadbalancer_net(
        self,
        load_balancer_name: builtins.str,
        load_balancer_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ElasticloadbalancingV2":
        '''(experimental) Adds a resource of type loadbalancer/net/ to the statement.

        https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html#network-load-balancer-overview

        :param load_balancer_name: - Identifier for the loadBalancerName.
        :param load_balancer_id: - Identifier for the loadBalancerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__427e811350217c65084b4b5a7d984869dc23140c58e865a30124c7f6b53a6235)
            check_type(argname="argument load_balancer_name", value=load_balancer_name, expected_type=type_hints["load_balancer_name"])
            check_type(argname="argument load_balancer_id", value=load_balancer_id, expected_type=type_hints["load_balancer_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "onLoadbalancerNet", [load_balancer_name, load_balancer_id, account, region, partition]))

    @jsii.member(jsii_name="onTargetgroup")
    def on_targetgroup(
        self,
        target_group_name: builtins.str,
        target_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ElasticloadbalancingV2":
        '''(experimental) Adds a resource of type targetgroup to the statement.

        https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html

        :param target_group_name: - Identifier for the targetGroupName.
        :param target_group_id: - Identifier for the targetGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__063640d45dea853ed296bbbfd8c418fac9d74e83f9e5a0fa5b47443d3b68d69d)
            check_type(argname="argument target_group_name", value=target_group_name, expected_type=type_hints["target_group_name"])
            check_type(argname="argument target_group_id", value=target_group_id, expected_type=type_hints["target_group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "onTargetgroup", [target_group_name, target_group_id, account, region, partition]))

    @jsii.member(jsii_name="toAddListenerCertificates")
    def to_add_listener_certificates(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to add the specified certificates to the specified secure listener.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_AddListenerCertificates.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toAddListenerCertificates", []))

    @jsii.member(jsii_name="toAddTags")
    def to_add_tags(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to add the specified tags to the specified load balancer.

        Each load balancer can have a maximum of 10 tags

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_AddTags.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toAddTags", []))

    @jsii.member(jsii_name="toCreateListener")
    def to_create_listener(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to create a listener for the specified Application Load Balancer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_CreateListener.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toCreateListener", []))

    @jsii.member(jsii_name="toCreateLoadBalancer")
    def to_create_load_balancer(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to create a load balancer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_CreateLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toCreateLoadBalancer", []))

    @jsii.member(jsii_name="toCreateRule")
    def to_create_rule(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to create a rule for the specified listener.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_CreateRule.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toCreateRule", []))

    @jsii.member(jsii_name="toCreateTargetGroup")
    def to_create_target_group(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to create a target group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_CreateTargetGroup.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toCreateTargetGroup", []))

    @jsii.member(jsii_name="toDeleteListener")
    def to_delete_listener(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to delete the specified listener.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DeleteListener.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDeleteListener", []))

    @jsii.member(jsii_name="toDeleteLoadBalancer")
    def to_delete_load_balancer(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to delete the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DeleteLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDeleteLoadBalancer", []))

    @jsii.member(jsii_name="toDeleteRule")
    def to_delete_rule(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to delete the specified rule.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DeleteRule.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDeleteRule", []))

    @jsii.member(jsii_name="toDeleteTargetGroup")
    def to_delete_target_group(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to delete the specified target group.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DeleteTargetGroup.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDeleteTargetGroup", []))

    @jsii.member(jsii_name="toDeregisterTargets")
    def to_deregister_targets(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to deregister the specified targets from the specified target group.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DeregisterTargets.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDeregisterTargets", []))

    @jsii.member(jsii_name="toDescribeAccountLimits")
    def to_describe_account_limits(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to describe the Elastic Load Balancing resource limits for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeAccountLimits.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeAccountLimits", []))

    @jsii.member(jsii_name="toDescribeListenerCertificates")
    def to_describe_listener_certificates(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to describe the certificates for the specified secure listener.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeListenerCertificates.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeListenerCertificates", []))

    @jsii.member(jsii_name="toDescribeListeners")
    def to_describe_listeners(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to describe the specified listeners or the listeners for the specified Application Load Balancer.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeListeners.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeListeners", []))

    @jsii.member(jsii_name="toDescribeLoadBalancerAttributes")
    def to_describe_load_balancer_attributes(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to describe the attributes for the specified load balancer.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeLoadBalancerAttributes.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeLoadBalancerAttributes", []))

    @jsii.member(jsii_name="toDescribeLoadBalancers")
    def to_describe_load_balancers(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to describe the specified the load balancers.

        If no load balancers are specified, the call describes all of your load balancers

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeLoadBalancers.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeLoadBalancers", []))

    @jsii.member(jsii_name="toDescribeRules")
    def to_describe_rules(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to describe the specified rules or the rules for the specified listener.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeRules.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeRules", []))

    @jsii.member(jsii_name="toDescribeSSLPolicies")
    def to_describe_ssl_policies(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to describe the specified policies or all policies used for SSL negotiation.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeSSLPolicies.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeSSLPolicies", []))

    @jsii.member(jsii_name="toDescribeTags")
    def to_describe_tags(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to describe the tags associated with the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeTags.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeTags", []))

    @jsii.member(jsii_name="toDescribeTargetGroupAttributes")
    def to_describe_target_group_attributes(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to describe the attributes for the specified target group.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeTargetGroupAttributes.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeTargetGroupAttributes", []))

    @jsii.member(jsii_name="toDescribeTargetGroups")
    def to_describe_target_groups(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to describe the specified target groups or all of your target groups.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeTargetGroups.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeTargetGroups", []))

    @jsii.member(jsii_name="toDescribeTargetHealth")
    def to_describe_target_health(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to describe the health of the specified targets or all of your targets.

        Access Level: Read

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeTargetHealth.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toDescribeTargetHealth", []))

    @jsii.member(jsii_name="toModifyListener")
    def to_modify_listener(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to modify the specified properties of the specified listener.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_ModifyListener.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toModifyListener", []))

    @jsii.member(jsii_name="toModifyLoadBalancerAttributes")
    def to_modify_load_balancer_attributes(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to modify the attributes of the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_ModifyLoadBalancerAttributes.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toModifyLoadBalancerAttributes", []))

    @jsii.member(jsii_name="toModifyRule")
    def to_modify_rule(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to modify the specified rule.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_ModifyRule.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toModifyRule", []))

    @jsii.member(jsii_name="toModifyTargetGroup")
    def to_modify_target_group(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to modify the health checks used when evaluating the health state of the targets in the specified target group.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_ModifyTargetGroup.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toModifyTargetGroup", []))

    @jsii.member(jsii_name="toModifyTargetGroupAttributes")
    def to_modify_target_group_attributes(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to modify the specified attributes of the specified target group.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_ModifyTargetGroupAttributes.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toModifyTargetGroupAttributes", []))

    @jsii.member(jsii_name="toRegisterTargets")
    def to_register_targets(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to register the specified targets with the specified target group.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_RegisterTargets.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toRegisterTargets", []))

    @jsii.member(jsii_name="toRemoveListenerCertificates")
    def to_remove_listener_certificates(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to remove the specified certificates of the specified secure listener.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_RemoveListenerCertificates.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toRemoveListenerCertificates", []))

    @jsii.member(jsii_name="toRemoveTags")
    def to_remove_tags(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to remove one or more tags from the specified load balancer.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_RemoveTags.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toRemoveTags", []))

    @jsii.member(jsii_name="toSetIpAddressType")
    def to_set_ip_address_type(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to set the type of IP addresses used by the subnets of the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_SetIpAddressType.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toSetIpAddressType", []))

    @jsii.member(jsii_name="toSetRulePriorities")
    def to_set_rule_priorities(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to set the priorities of the specified rules.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_SetRulePriorities.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toSetRulePriorities", []))

    @jsii.member(jsii_name="toSetSecurityGroups")
    def to_set_security_groups(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to associate the specified security groups with the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_SetSecurityGroups.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toSetSecurityGroups", []))

    @jsii.member(jsii_name="toSetSubnets")
    def to_set_subnets(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to enable the Availability Zone for the specified subnets for the specified load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_SetSubnets.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toSetSubnets", []))

    @jsii.member(jsii_name="toSetWebAcl")
    def to_set_web_acl(self) -> "ElasticloadbalancingV2":
        '''(experimental) Grants permission to give WebAcl permission to WAF.

        Access Level: Write

        https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_SetWebAcl.html

        :stability: experimental
        '''
        return typing.cast("ElasticloadbalancingV2", jsii.invoke(self, "toSetWebAcl", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3e67594125f183a811a67ee638a66bf28ca0d1168bc921fcf83c203bbac52a97)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3c1e8433128694d47656d0571092e2606849bfb442c47ba7111b893436342328)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Elasticmapreduce(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Elasticmapreduce",
):
    '''(experimental) Statement provider for service `elasticmapreduce <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticmapreduce.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elasticmapreduce <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticmapreduce.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d15d6e5534ff8dacf89b86959f63f4723df3e8081f324792adafe616ce33a48d)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifExecutionRoleArn")
    def if_execution_role_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticmapreduce":
        '''(experimental) Filters access by whether the execution role ARN is provided with the action.

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-plan-access-iam.html#emr-security

        Applies to actions:

        - .toAddJobFlowSteps()
        - .toGetClusterSessionCredentials()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__87b8483c5e08e3aca74db2c41bca8aeee1619492f8dd5d7cdedd6c6a38df5e88)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "ifExecutionRoleArn", [value, operator]))

    @jsii.member(jsii_name="ifRequestTag")
    def if_request_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticmapreduce":
        '''(experimental) Filters access by whether the tag and value pair is provided with the action.

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-plan-access-iam.html#emr-fine-grained-cluster-access

        Applies to actions:

        - .toAddTags()
        - .toCreateEditor()
        - .toCreateStudio()
        - .toRunJobFlow()
        - .toStartNotebookExecution()

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b7452b741ecdde6d845458569ff61b20294b765094b037f890c59572a7153caf)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "ifRequestTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Elasticmapreduce":
        '''(experimental) Filters access by the tag and value pair associated with an Amazon EMR resource.

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-plan-access-iam.html#emr-fine-grained-cluster-access

        Applies to resource types:

        - cluster
        - editor
        - notebook-execution
        - studio

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4613c0ffe89fc7fb5902f0a7855116d9fe66f01d635f60e88eab38f08d02a0fb)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        cluster_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticmapreduce":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-overview.html

        :param cluster_id: - Identifier for the clusterId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1f250c71bd61c2ef7d93c92779451b77326a05becd0b12cad0682b5692a83027)
            check_type(argname="argument cluster_id", value=cluster_id, expected_type=type_hints["cluster_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "onCluster", [cluster_id, account, region, partition]))

    @jsii.member(jsii_name="onEditor")
    def on_editor(
        self,
        editor_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticmapreduce":
        '''(experimental) Adds a resource of type editor to the statement.

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks.html

        :param editor_id: - Identifier for the editorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__755b076597791aa9c03c3c215794e145753c09d97ee2d290bda3f8a31d48d201)
            check_type(argname="argument editor_id", value=editor_id, expected_type=type_hints["editor_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "onEditor", [editor_id, account, region, partition]))

    @jsii.member(jsii_name="onNotebookExecution")
    def on_notebook_execution(
        self,
        notebook_execution_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticmapreduce":
        '''(experimental) Adds a resource of type notebook-execution to the statement.

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks-headless.html

        :param notebook_execution_id: - Identifier for the notebookExecutionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0a7f012e1de313dc2930bf33519bf9664af8af7d9cd2536d1f3b120e37d83394)
            check_type(argname="argument notebook_execution_id", value=notebook_execution_id, expected_type=type_hints["notebook_execution_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "onNotebookExecution", [notebook_execution_id, account, region, partition]))

    @jsii.member(jsii_name="onStudio")
    def on_studio(
        self,
        studio_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elasticmapreduce":
        '''(experimental) Adds a resource of type studio to the statement.

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio.html

        :param studio_id: - Identifier for the studioId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__64c79dbe25fd5e591305531a536a2c3d41d0463a2de3a4d501deae4515d16951)
            check_type(argname="argument studio_id", value=studio_id, expected_type=type_hints["studio_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "onStudio", [studio_id, account, region, partition]))

    @jsii.member(jsii_name="toAddInstanceFleet")
    def to_add_instance_fleet(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to add an instance fleet to a running cluster.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_AddInstanceFleet.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toAddInstanceFleet", []))

    @jsii.member(jsii_name="toAddInstanceGroups")
    def to_add_instance_groups(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to add instance groups to a running cluster.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_AddInstanceGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toAddInstanceGroups", []))

    @jsii.member(jsii_name="toAddJobFlowSteps")
    def to_add_job_flow_steps(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to add new steps to a running cluster.

        Access Level: Write

        Possible conditions:

        - .ifExecutionRoleArn()

        https://docs.aws.amazon.com/emr/latest/APIReference/API_AddJobFlowSteps.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toAddJobFlowSteps", []))

    @jsii.member(jsii_name="toAddTags")
    def to_add_tags(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to add tags to an Amazon EMR resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRequestTag()

        https://docs.aws.amazon.com/emr/latest/APIReference/API_AddTags.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toAddTags", []))

    @jsii.member(jsii_name="toAttachEditor")
    def to_attach_editor(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to attach an EMR notebook to a compute engine.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks-working-with.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toAttachEditor", []))

    @jsii.member(jsii_name="toCancelSteps")
    def to_cancel_steps(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to cancel a pending step or steps in a running cluster.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_CancelSteps.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toCancelSteps", []))

    @jsii.member(jsii_name="toCreateEditor")
    def to_create_editor(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to create an EMR notebook.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRequestTag()

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks-create.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toCreateEditor", []))

    @jsii.member(jsii_name="toCreatePersistentAppUI")
    def to_create_persistent_app_ui(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to create a persistent application history server.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio-debug.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toCreatePersistentAppUI", []))

    @jsii.member(jsii_name="toCreateRepository")
    def to_create_repository(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to create an EMR notebook repository.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks.html#emr-managed-notebooks-editor

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toCreateRepository", []))

    @jsii.member(jsii_name="toCreateSecurityConfiguration")
    def to_create_security_configuration(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to create a security configuration.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_CreateSecurityConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toCreateSecurityConfiguration", []))

    @jsii.member(jsii_name="toCreateStudio")
    def to_create_studio(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to create an EMR Studio.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRequestTag()

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toCreateStudio", []))

    @jsii.member(jsii_name="toCreateStudioPresignedUrl")
    def to_create_studio_presigned_url(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to launch an EMR Studio using IAM authentication mode.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toCreateStudioPresignedUrl", []))

    @jsii.member(jsii_name="toCreateStudioSessionMapping")
    def to_create_studio_session_mapping(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to create an EMR Studio session mapping.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toCreateStudioSessionMapping", []))

    @jsii.member(jsii_name="toDeleteEditor")
    def to_delete_editor(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to delete an EMR notebook.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks.html#emr-managed-notebooks-deleting

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDeleteEditor", []))

    @jsii.member(jsii_name="toDeleteRepository")
    def to_delete_repository(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to delete an EMR notebook repository.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks.html#emr-managed-notebooks-editor

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDeleteRepository", []))

    @jsii.member(jsii_name="toDeleteSecurityConfiguration")
    def to_delete_security_configuration(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to delete a security configuration.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_DeleteSecurityConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDeleteSecurityConfiguration", []))

    @jsii.member(jsii_name="toDeleteStudio")
    def to_delete_studio(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to delete an EMR Studio.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDeleteStudio", []))

    @jsii.member(jsii_name="toDeleteStudioSessionMapping")
    def to_delete_studio_session_mapping(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to delete an EMR Studio session mapping.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDeleteStudioSessionMapping", []))

    @jsii.member(jsii_name="toDeleteWorkspaceAccess")
    def to_delete_workspace_access(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to block an identity from opening a collaborative workspace.

        Access Level: Permissions management

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks-working-with.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDeleteWorkspaceAccess", []))

    @jsii.member(jsii_name="toDescribeCluster")
    def to_describe_cluster(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to get details about a cluster, including status, hardware and software configuration, VPC settings, and so on.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_DescribeCluster.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDescribeCluster", []))

    @jsii.member(jsii_name="toDescribeEditor")
    def to_describe_editor(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to view information about a notebook, including status, user, role, tags, location, and more.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks-working-with.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDescribeEditor", []))

    @jsii.member(jsii_name="toDescribeJobFlows")
    def to_describe_job_flows(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to describe details of clusters (job flows).

        This API is deprecated and will eventually be removed. We recommend you use ListClusters, DescribeCluster, ListSteps, ListInstanceGroups and ListBootstrapActions instead

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_DescribeJobFlows.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDescribeJobFlows", []))

    @jsii.member(jsii_name="toDescribeNotebookExecution")
    def to_describe_notebook_execution(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to view information about a notebook execution.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks-headless.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDescribeNotebookExecution", []))

    @jsii.member(jsii_name="toDescribePersistentAppUI")
    def to_describe_persistent_app_ui(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to describe a persistent application history server.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio-debug.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDescribePersistentAppUI", []))

    @jsii.member(jsii_name="toDescribeReleaseLabel")
    def to_describe_release_label(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to view information about an EMR release, such as which applications are supported.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_DescribeReleaseLabel.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDescribeReleaseLabel", []))

    @jsii.member(jsii_name="toDescribeRepository")
    def to_describe_repository(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to describe an EMR notebook repository.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks.html#emr-managed-notebooks-editor

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDescribeRepository", []))

    @jsii.member(jsii_name="toDescribeSecurityConfiguration")
    def to_describe_security_configuration(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to get details of a security configuration.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_DescribeSecurityConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDescribeSecurityConfiguration", []))

    @jsii.member(jsii_name="toDescribeStep")
    def to_describe_step(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to get details about a cluster step.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_DescribeStep.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDescribeStep", []))

    @jsii.member(jsii_name="toDescribeStudio")
    def to_describe_studio(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to view information about an EMR Studio.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDescribeStudio", []))

    @jsii.member(jsii_name="toDetachEditor")
    def to_detach_editor(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to detach an EMR notebook from a compute engine.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks-working-with.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toDetachEditor", []))

    @jsii.member(jsii_name="toGetAutoTerminationPolicy")
    def to_get_auto_termination_policy(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to retrieve the auto-termination policy associated with a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_GetAutoTerminationPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toGetAutoTerminationPolicy", []))

    @jsii.member(jsii_name="toGetBlockPublicAccessConfiguration")
    def to_get_block_public_access_configuration(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to retrieve the EMR block public access configuration for the AWS account in the Region.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_GetBlockPublicAccessConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toGetBlockPublicAccessConfiguration", []))

    @jsii.member(jsii_name="toGetClusterSessionCredentials")
    def to_get_cluster_session_credentials(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to retrieve HTTP basic credentials associated with a given execution IAM Role for a fine-grained access control enabled EMR Cluster.

        Access Level: Write

        Possible conditions:

        - .ifExecutionRoleArn()

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-steps-runtime-roles.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toGetClusterSessionCredentials", []))

    @jsii.member(jsii_name="toGetManagedScalingPolicy")
    def to_get_managed_scaling_policy(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to retrieve the managed scaling policy associated with a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_GetManagedScalingPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toGetManagedScalingPolicy", []))

    @jsii.member(jsii_name="toGetOnClusterAppUIPresignedURL")
    def to_get_on_cluster_app_ui_presigned_url(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to get a presigned URL for an application history server running on the cluster.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio-debug.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toGetOnClusterAppUIPresignedURL", []))

    @jsii.member(jsii_name="toGetPersistentAppUIPresignedURL")
    def to_get_persistent_app_ui_presigned_url(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to get a presigned URL for a persistent application history server.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio-debug.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toGetPersistentAppUIPresignedURL", []))

    @jsii.member(jsii_name="toGetStudioSessionMapping")
    def to_get_studio_session_mapping(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to view information about an EMR Studio session mapping.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toGetStudioSessionMapping", []))

    @jsii.member(jsii_name="toLinkRepository")
    def to_link_repository(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to link an EMR notebook repository to EMR notebooks.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks.html#emr-managed-notebooks-editor

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toLinkRepository", []))

    @jsii.member(jsii_name="toListBootstrapActions")
    def to_list_bootstrap_actions(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to get details about the bootstrap actions associated with a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ListBootstrapActions.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListBootstrapActions", []))

    @jsii.member(jsii_name="toListClusters")
    def to_list_clusters(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to get the status of accessible clusters.

        Access Level: List

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ListClusters.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListClusters", []))

    @jsii.member(jsii_name="toListEditors")
    def to_list_editors(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to list summary information for accessible EMR notebooks.

        Access Level: List

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks-working-with.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListEditors", []))

    @jsii.member(jsii_name="toListInstanceFleets")
    def to_list_instance_fleets(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to get details of instance fleets in a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ListInstanceFleets.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListInstanceFleets", []))

    @jsii.member(jsii_name="toListInstanceGroups")
    def to_list_instance_groups(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to get details of instance groups in a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ListInstanceGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListInstanceGroups", []))

    @jsii.member(jsii_name="toListInstances")
    def to_list_instances(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to get details about the Amazon EC2 instances in a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ListInstances.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListInstances", []))

    @jsii.member(jsii_name="toListNotebookExecutions")
    def to_list_notebook_executions(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to list summary information for notebook executions.

        Access Level: List

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks-headless.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListNotebookExecutions", []))

    @jsii.member(jsii_name="toListReleaseLabels")
    def to_list_release_labels(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to list and filter the available EMR releases in the current region.

        Access Level: List

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ListReleaseLabels.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListReleaseLabels", []))

    @jsii.member(jsii_name="toListRepositories")
    def to_list_repositories(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to list existing EMR notebook repositories.

        Access Level: List

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks.html#emr-managed-notebooks-editor

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListRepositories", []))

    @jsii.member(jsii_name="toListSecurityConfigurations")
    def to_list_security_configurations(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to list available security configurations in this account by name, along with creation dates and times.

        Access Level: List

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ListSecurityConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListSecurityConfigurations", []))

    @jsii.member(jsii_name="toListSteps")
    def to_list_steps(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to list steps associated with a cluster.

        Access Level: Read

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ListSteps.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListSteps", []))

    @jsii.member(jsii_name="toListStudios")
    def to_list_studios(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to list summary information about EMR Studios.

        Access Level: List

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListStudios", []))

    @jsii.member(jsii_name="toListStudioSessionMappings")
    def to_list_studio_session_mappings(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to list summary information about EMR Studio session mappings.

        Access Level: List

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListStudioSessionMappings", []))

    @jsii.member(jsii_name="toListWorkspaceAccessIdentities")
    def to_list_workspace_access_identities(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to list identities that are granted access to a workspace.

        Access Level: List

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks-working-with.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toListWorkspaceAccessIdentities", []))

    @jsii.member(jsii_name="toModifyCluster")
    def to_modify_cluster(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to change cluster settings such as number of steps that can be executed concurrently for a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ModifyCluster.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toModifyCluster", []))

    @jsii.member(jsii_name="toModifyInstanceFleet")
    def to_modify_instance_fleet(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to change the target On-Demand and target Spot capacities for a instance fleet.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ModifyInstanceFleet.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toModifyInstanceFleet", []))

    @jsii.member(jsii_name="toModifyInstanceGroups")
    def to_modify_instance_groups(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to change the number and configuration of EC2 instances for an instance group.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_ModifyInstanceGroups.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toModifyInstanceGroups", []))

    @jsii.member(jsii_name="toOpenEditorInConsole")
    def to_open_editor_in_console(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to launch the Jupyter notebook editor for an EMR notebook from within the console.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks.html#emr-managed-notebooks-editor

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toOpenEditorInConsole", []))

    @jsii.member(jsii_name="toPutAutoScalingPolicy")
    def to_put_auto_scaling_policy(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to create or update an automatic scaling policy for a core instance group or task instance group.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_PutAutoScalingPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toPutAutoScalingPolicy", []))

    @jsii.member(jsii_name="toPutAutoTerminationPolicy")
    def to_put_auto_termination_policy(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to create or update the auto-termination policy associated with a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_PutAutoTerminationPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toPutAutoTerminationPolicy", []))

    @jsii.member(jsii_name="toPutBlockPublicAccessConfiguration")
    def to_put_block_public_access_configuration(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to create or update the EMR block public access configuration for the AWS account in the Region.

        Access Level: Permissions management

        https://docs.aws.amazon.com/emr/latest/APIReference/API_PutBlockPublicAccessConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toPutBlockPublicAccessConfiguration", []))

    @jsii.member(jsii_name="toPutManagedScalingPolicy")
    def to_put_managed_scaling_policy(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to create or update the managed scaling policy associated with a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_PutManagedScalingPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toPutManagedScalingPolicy", []))

    @jsii.member(jsii_name="toPutWorkspaceAccess")
    def to_put_workspace_access(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to allow an identity to open a collaborative workspace.

        Access Level: Permissions management

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks-working-with.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toPutWorkspaceAccess", []))

    @jsii.member(jsii_name="toRemoveAutoScalingPolicy")
    def to_remove_auto_scaling_policy(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to remove an automatic scaling policy from an instance group.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_RemoveAutoScalingPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toRemoveAutoScalingPolicy", []))

    @jsii.member(jsii_name="toRemoveAutoTerminationPolicy")
    def to_remove_auto_termination_policy(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to remove the auto-termination policy associated with a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_RemoveAutoTerminationPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toRemoveAutoTerminationPolicy", []))

    @jsii.member(jsii_name="toRemoveManagedScalingPolicy")
    def to_remove_managed_scaling_policy(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to remove the managed scaling policy associated with a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_RemoveManagedScalingPolicy.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toRemoveManagedScalingPolicy", []))

    @jsii.member(jsii_name="toRemoveTags")
    def to_remove_tags(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to remove tags from an Amazon EMR resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/emr/latest/APIReference/API_RemoveTags.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toRemoveTags", []))

    @jsii.member(jsii_name="toRunJobFlow")
    def to_run_job_flow(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to create and launch a cluster (job flow).

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRequestTag()

        https://docs.aws.amazon.com/emr/latest/APIReference/API_RunJobFlow.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toRunJobFlow", []))

    @jsii.member(jsii_name="toSetTerminationProtection")
    def to_set_termination_protection(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to add and remove termination protection for a cluster.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_SetTerminationProtection.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toSetTerminationProtection", []))

    @jsii.member(jsii_name="toSetVisibleToAllUsers")
    def to_set_visible_to_all_users(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to set whether all AWS Identity and Access Management (IAM) users in the AWS account can view a cluster.

        This API is deprecated and your cluster may be visible to all users in your account. To restrict cluster access using an IAM policy, see AWS Identity and Access Management for Amazon EMR (https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-plan-access-iam.html)

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_SetVisibleToAllUsers.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toSetVisibleToAllUsers", []))

    @jsii.member(jsii_name="toStartEditor")
    def to_start_editor(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to start an EMR notebook.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks-working-with.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toStartEditor", []))

    @jsii.member(jsii_name="toStartNotebookExecution")
    def to_start_notebook_execution(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to start an EMR notebook execution.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifRequestTag()

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks-headless.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toStartNotebookExecution", []))

    @jsii.member(jsii_name="toStopEditor")
    def to_stop_editor(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to shut down an EMR notebook.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toStopEditor", []))

    @jsii.member(jsii_name="toStopNotebookExecution")
    def to_stop_notebook_execution(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to stop notebook execution.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks-headless.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toStopNotebookExecution", []))

    @jsii.member(jsii_name="toTerminateJobFlows")
    def to_terminate_job_flows(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to terminate a cluster (job flow).

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/APIReference/API_TerminateJobFlows.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toTerminateJobFlows", []))

    @jsii.member(jsii_name="toUnlinkRepository")
    def to_unlink_repository(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to unlink an EMR notebook repository from EMR notebooks.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks.html#emr-managed-notebooks-editor

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toUnlinkRepository", []))

    @jsii.member(jsii_name="toUpdateEditor")
    def to_update_editor(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to update an EMR notebook.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks-working-with.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toUpdateEditor", []))

    @jsii.member(jsii_name="toUpdateRepository")
    def to_update_repository(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to update an EMR notebook repository.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-notebooks.html#emr-managed-notebooks-editor

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toUpdateRepository", []))

    @jsii.member(jsii_name="toUpdateStudio")
    def to_update_studio(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to update information about an EMR Studio.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toUpdateStudio", []))

    @jsii.member(jsii_name="toUpdateStudioSessionMapping")
    def to_update_studio_session_mapping(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to update an EMR Studio session mapping.

        Access Level: Write

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toUpdateStudioSessionMapping", []))

    @jsii.member(jsii_name="toViewEventsFromAllClustersInConsole")
    def to_view_events_from_all_clusters_in_console(self) -> "Elasticmapreduce":
        '''(experimental) Grants permission to use the EMR console to view events from all clusters.

        Access Level: List

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticmapreduce.html

        :stability: experimental
        '''
        return typing.cast("Elasticmapreduce", jsii.invoke(self, "toViewEventsFromAllClustersInConsole", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fa59a397cdd59b8f1be8b0ab64b2a5572e779fd20544052088763dc920a8ce68)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e5693035d649df2f92443ed5b4c9f3f3930cf85cfcc00c4435f8c9fb01acee05)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Elastictranscoder(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Elastictranscoder",
):
    '''(experimental) Statement provider for service `elastictranscoder <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelastictranscoder.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elastictranscoder <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelastictranscoder.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__64d632f8154c2b034c9b792c9e01461ac9a6b2b6e067dd2d193f4e4c8173af67)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onJob")
    def on_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elastictranscoder":
        '''(experimental) Adds a resource of type job to the statement.

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/operations-jobs.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__416d7812dd428ca0751249d3b199da5f3fd7a341000ae6a5791924431a06b93f)
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elastictranscoder", jsii.invoke(self, "onJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onPipeline")
    def on_pipeline(
        self,
        pipeline_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elastictranscoder":
        '''(experimental) Adds a resource of type pipeline to the statement.

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/operations-pipelines.html

        :param pipeline_id: - Identifier for the pipelineId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bcf7693f46edd2beaa51c8ed260b50eb4ca1bae4f2895fd32a746be1e60f0d46)
            check_type(argname="argument pipeline_id", value=pipeline_id, expected_type=type_hints["pipeline_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elastictranscoder", jsii.invoke(self, "onPipeline", [pipeline_id, account, region, partition]))

    @jsii.member(jsii_name="onPreset")
    def on_preset(
        self,
        preset_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Elastictranscoder":
        '''(experimental) Adds a resource of type preset to the statement.

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/operations-presets.html

        :param preset_id: - Identifier for the presetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__082fe7bbb3a48135ef3581480582635ee30eb7f8207b557d00978c4191d84a4a)
            check_type(argname="argument preset_id", value=preset_id, expected_type=type_hints["preset_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Elastictranscoder", jsii.invoke(self, "onPreset", [preset_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelJob")
    def to_cancel_job(self) -> "Elastictranscoder":
        '''(experimental) Cancel a job that Elastic Transcoder has not begun to process.

        Access Level: Write

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/cancel-job.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toCancelJob", []))

    @jsii.member(jsii_name="toCreateJob")
    def to_create_job(self) -> "Elastictranscoder":
        '''(experimental) Create a job.

        Access Level: Write

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/create-job.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toCreateJob", []))

    @jsii.member(jsii_name="toCreatePipeline")
    def to_create_pipeline(self) -> "Elastictranscoder":
        '''(experimental) Create a pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/create-pipeline.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toCreatePipeline", []))

    @jsii.member(jsii_name="toCreatePreset")
    def to_create_preset(self) -> "Elastictranscoder":
        '''(experimental) Create a preset.

        Access Level: Write

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/create-preset.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toCreatePreset", []))

    @jsii.member(jsii_name="toDeletePipeline")
    def to_delete_pipeline(self) -> "Elastictranscoder":
        '''(experimental) Delete a pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/delete-pipeline.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toDeletePipeline", []))

    @jsii.member(jsii_name="toDeletePreset")
    def to_delete_preset(self) -> "Elastictranscoder":
        '''(experimental) Delete a preset.

        Access Level: Write

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/delete-preset.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toDeletePreset", []))

    @jsii.member(jsii_name="toListJobsByPipeline")
    def to_list_jobs_by_pipeline(self) -> "Elastictranscoder":
        '''(experimental) Get a list of the jobs that you assigned to a pipeline.

        Access Level: List

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/list-jobs-by-pipeline.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toListJobsByPipeline", []))

    @jsii.member(jsii_name="toListJobsByStatus")
    def to_list_jobs_by_status(self) -> "Elastictranscoder":
        '''(experimental) Get information about all of the jobs associated with the current AWS account that have a specified status.

        Access Level: List

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/list-jobs-by-status.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toListJobsByStatus", []))

    @jsii.member(jsii_name="toListPipelines")
    def to_list_pipelines(self) -> "Elastictranscoder":
        '''(experimental) Get a list of the pipelines associated with the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/list-pipelines.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toListPipelines", []))

    @jsii.member(jsii_name="toListPresets")
    def to_list_presets(self) -> "Elastictranscoder":
        '''(experimental) Get a list of all presets associated with the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/list-presets.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toListPresets", []))

    @jsii.member(jsii_name="toReadJob")
    def to_read_job(self) -> "Elastictranscoder":
        '''(experimental) Get detailed information about a job.

        Access Level: Read

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/get-job.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toReadJob", []))

    @jsii.member(jsii_name="toReadPipeline")
    def to_read_pipeline(self) -> "Elastictranscoder":
        '''(experimental) Get detailed information about a pipeline.

        Access Level: Read

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/get-pipeline.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toReadPipeline", []))

    @jsii.member(jsii_name="toReadPreset")
    def to_read_preset(self) -> "Elastictranscoder":
        '''(experimental) Get detailed information about a preset.

        Access Level: Read

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/get-preset.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toReadPreset", []))

    @jsii.member(jsii_name="toTestRole")
    def to_test_role(self) -> "Elastictranscoder":
        '''(experimental) Test the settings for a pipeline to ensure that Elastic Transcoder can create and process jobs.

        Access Level: Write

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/test-pipeline-role.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toTestRole", []))

    @jsii.member(jsii_name="toUpdatePipeline")
    def to_update_pipeline(self) -> "Elastictranscoder":
        '''(experimental) Update settings for a pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/update-pipeline.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toUpdatePipeline", []))

    @jsii.member(jsii_name="toUpdatePipelineNotifications")
    def to_update_pipeline_notifications(self) -> "Elastictranscoder":
        '''(experimental) Update only Amazon Simple Notification Service (Amazon SNS) notifications for a pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/update-pipeline-notifications.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toUpdatePipelineNotifications", []))

    @jsii.member(jsii_name="toUpdatePipelineStatus")
    def to_update_pipeline_status(self) -> "Elastictranscoder":
        '''(experimental) Pause or reactivate a pipeline, so the pipeline stops or restarts processing jobs, update the status for the pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/elastictranscoder/latest/developerguide/update-pipeline-status.html

        :stability: experimental
        '''
        return typing.cast("Elastictranscoder", jsii.invoke(self, "toUpdatePipelineStatus", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bd0c0886cbf3975ecb68ae744f1158a5717215164de5a96a0c6ee71a7beef9cf)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fe289ca11c38698ecf0a405f120749e258802520882c6bbe30f014933e185058)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class ElementalActivations(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ElementalActivations",
):
    '''(experimental) Statement provider for service `elemental-activations <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalappliancesandsoftwareactivationservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elemental-activations <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalappliancesandsoftwareactivationservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d785c4c44d4fd9a3666e50abae4be606476f284867e620dcea6fb9db02212f04)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onActivation")
    def on_activation(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ElementalActivations":
        '''(experimental) Adds a resource of type activation to the statement.

        https://docs.aws.amazon.com/elemental-appliances-software/

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6dbd370779eb0380712b7a1ca6d5fe1c5d85e6f89e99a625633935b38c35547c)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ElementalActivations", jsii.invoke(self, "onActivation", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCompleteAccountRegistration")
    def to_complete_account_registration(self) -> "ElementalActivations":
        '''(experimental) Grants permission to complete the process of registering customer account for AWS Elemental Appliances and Software Purchases.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software/

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "toCompleteAccountRegistration", []))

    @jsii.member(jsii_name="toCompleteFileUpload")
    def to_complete_file_upload(self) -> "ElementalActivations":
        '''(experimental) Grants permission to complete the process of uploading a Software file for AWS Elemental Appliances and Software Purchases.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software/

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "toCompleteFileUpload", []))

    @jsii.member(jsii_name="toDownloadSoftware")
    def to_download_software(self) -> "ElementalActivations":
        '''(experimental) Grants permission to download the Software files for AWS Elemental Appliances and Software Purchases.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software/

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "toDownloadSoftware", []))

    @jsii.member(jsii_name="toGenerateLicenses")
    def to_generate_licenses(self) -> "ElementalActivations":
        '''(experimental) Grants permission to generate Software Licenses for AWS Elemental Appliances and Software Purchases.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software/

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "toGenerateLicenses", []))

    @jsii.member(jsii_name="toGetActivation")
    def to_get_activation(self) -> "ElementalActivations":
        '''(experimental) Grants permission to describe an activation.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software/

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "toGetActivation", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "ElementalActivations":
        '''(experimental) Grants permission to list tags for an AWS Elemental Activations resource.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software/

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartAccountRegistration")
    def to_start_account_registration(self) -> "ElementalActivations":
        '''(experimental) Grants permission to start the process of registering customer account for AWS Elemental Appliances and Software Purchases.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software/

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "toStartAccountRegistration", []))

    @jsii.member(jsii_name="toStartFileUpload")
    def to_start_file_upload(self) -> "ElementalActivations":
        '''(experimental) Grants permission to start the process of uploading a Software file for AWS Elemental Appliances and Software Purchases.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software/

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "toStartFileUpload", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "ElementalActivations":
        '''(experimental) Grants permission to add a tag for an AWS Elemental Activations resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/elemental-appliances-software/

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "ElementalActivations":
        '''(experimental) Grants permission to remove a tag from an AWS Elemental Activations resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/elemental-appliances-software/

        :stability: experimental
        '''
        return typing.cast("ElementalActivations", jsii.invoke(self, "toUntagResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f06a952cfe374c98379e4beffcefa2c1e948675ca79dbe2f418746329b1e0909)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6de89261f66c2a40b983876d54bd24d92c095fb510dfb22405a620ca7d680c60)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class ElementalAppliancesSoftware(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ElementalAppliancesSoftware",
):
    '''(experimental) Statement provider for service `elemental-appliances-software <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalappliancesandsoftware.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elemental-appliances-software <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalappliancesandsoftware.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9f95a72d4a975f20ee683ee0ade6e6c72e0b6e65d579aaf6f0e7c5732b073949)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onQuote")
    def on_quote(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ElementalAppliancesSoftware":
        '''(experimental) Adds a resource of type quote to the statement.

        https://docs.aws.amazon.com/elemental-appliances-software

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5476bfab27ceed847228a1d5edca136bb990b0426d5d4dcbd292af12e780d939)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "onQuote", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCompleteUpload")
    def to_complete_upload(self) -> "ElementalAppliancesSoftware":
        '''(experimental) Grants permission to complete an upload of an attachment for a quote or order.

        Access Level: Write

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toCompleteUpload", []))

    @jsii.member(jsii_name="toCreateOrderV1")
    def to_create_order_v1(self) -> "ElementalAppliancesSoftware":
        '''(experimental) Grants permission to create an order.

        Access Level: Write

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toCreateOrderV1", []))

    @jsii.member(jsii_name="toCreateQuote")
    def to_create_quote(self) -> "ElementalAppliancesSoftware":
        '''(experimental) Grants permission to create a quote.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toCreateQuote", []))

    @jsii.member(jsii_name="toGetAvsCorrectAddress")
    def to_get_avs_correct_address(self) -> "ElementalAppliancesSoftware":
        '''(experimental) Grants permission to validate an address.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toGetAvsCorrectAddress", []))

    @jsii.member(jsii_name="toGetBillingAddresses")
    def to_get_billing_addresses(self) -> "ElementalAppliancesSoftware":
        '''(experimental) Grants permission to list the billing addresses in the user account.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toGetBillingAddresses", []))

    @jsii.member(jsii_name="toGetDeliveryAddressesV2")
    def to_get_delivery_addresses_v2(self) -> "ElementalAppliancesSoftware":
        '''(experimental) Grants permission to list the delivery addresses in the user account.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toGetDeliveryAddressesV2", []))

    @jsii.member(jsii_name="toGetOrder")
    def to_get_order(self) -> "ElementalAppliancesSoftware":
        '''(experimental) Grants permission to describe an order.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toGetOrder", []))

    @jsii.member(jsii_name="toGetOrdersV2")
    def to_get_orders_v2(self) -> "ElementalAppliancesSoftware":
        '''(experimental) Grants permission to list the orders in the user account.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toGetOrdersV2", []))

    @jsii.member(jsii_name="toGetQuote")
    def to_get_quote(self) -> "ElementalAppliancesSoftware":
        '''(experimental) Grants permission to describe a quote.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toGetQuote", []))

    @jsii.member(jsii_name="toGetTaxes")
    def to_get_taxes(self) -> "ElementalAppliancesSoftware":
        '''(experimental) Grants permission to calculate taxes for an order.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toGetTaxes", []))

    @jsii.member(jsii_name="toListQuotes")
    def to_list_quotes(self) -> "ElementalAppliancesSoftware":
        '''(experimental) Grants permission to list the quotes in the user account.

        Access Level: List

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toListQuotes", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "ElementalAppliancesSoftware":
        '''(experimental) Grants permission to lists tags for an AWS Elemental Appliances and Software resource.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartUpload")
    def to_start_upload(self) -> "ElementalAppliancesSoftware":
        '''(experimental) Grants permission to start an upload of an attachment for a quote or order.

        Access Level: Write

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toStartUpload", []))

    @jsii.member(jsii_name="toSubmitOrderV1")
    def to_submit_order_v1(self) -> "ElementalAppliancesSoftware":
        '''(experimental) Grants permission to submit an order.

        Access Level: Write

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toSubmitOrderV1", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "ElementalAppliancesSoftware":
        '''(experimental) Grants permission to tag an AWS Elemental Appliances and Software resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "ElementalAppliancesSoftware":
        '''(experimental) Grants permission to remove a tag from an AWS Elemental Appliances and Software resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateQuote")
    def to_update_quote(self) -> "ElementalAppliancesSoftware":
        '''(experimental) Grants permission to modify a quote.

        Access Level: Write

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalAppliancesSoftware", jsii.invoke(self, "toUpdateQuote", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e73d1242f94c0b9ee73af3f1ce90c8f9dc06dc518ce86df82c2abcde24f615ee)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cf76c146514a4f900735b787bba48502a60521da29d87a6106fcd36b9fa9b4a0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class ElementalSupportCases(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ElementalSupportCases",
):
    '''(experimental) Statement provider for service `elemental-support-cases <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalsupportcases.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elemental-support-cases <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalsupportcases.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ade7cd7340e2af85180d12e58f0cf5297ab90d8910c4509a57c368be1f27e66e)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toCheckCasePermission")
    def to_check_case_permission(self) -> "ElementalSupportCases":
        '''(experimental) Grants permission to verify whether the caller has the permissions to perform support case operations.

        Access Level: Write

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalSupportCases", jsii.invoke(self, "toCheckCasePermission", []))

    @jsii.member(jsii_name="toCreateCase")
    def to_create_case(self) -> "ElementalSupportCases":
        '''(experimental) Grants permission to create a support case.

        Access Level: Write

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalSupportCases", jsii.invoke(self, "toCreateCase", []))

    @jsii.member(jsii_name="toGetCase")
    def to_get_case(self) -> "ElementalSupportCases":
        '''(experimental) Grants permission to describe a support case in your account.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalSupportCases", jsii.invoke(self, "toGetCase", []))

    @jsii.member(jsii_name="toGetCases")
    def to_get_cases(self) -> "ElementalSupportCases":
        '''(experimental) Grants permission to list the support cases in your account.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalSupportCases", jsii.invoke(self, "toGetCases", []))

    @jsii.member(jsii_name="toUpdateCase")
    def to_update_case(self) -> "ElementalSupportCases":
        '''(experimental) Grants permission to update a support case.

        Access Level: Write

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalSupportCases", jsii.invoke(self, "toUpdateCase", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7cf0ae3a0bf2008672cd386a9178065ce7e99e698a27cbae780491cfec9986b5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6d7ac67385a2c79b9d0ededd847a022f1c954ae03400bb45d978a4d6e6b3c3c5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class ElementalSupportContent(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ElementalSupportContent",
):
    '''(experimental) Statement provider for service `elemental-support-content <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalsupportcontent.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `elemental-support-content <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalsupportcontent.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f3c449ce921b4742fe806cbf0bfe14408266a536fb68e92c22f9e91243ac6b62)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toQuery")
    def to_query(self) -> "ElementalSupportContent":
        '''(experimental) Grants permission to search support content.

        Access Level: Read

        https://docs.aws.amazon.com/elemental-appliances-software

        :stability: experimental
        '''
        return typing.cast("ElementalSupportContent", jsii.invoke(self, "toQuery", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__48c22cd7e0a70d4ee8b2b22883d3469d11f1f3cbfcbb2a5a4903d33525d97f1b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f74f0092bd1369629dca74fa2285be24cbea8e2e4c1bd49f22247c775a7806d4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class EmrContainers(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.EmrContainers",
):
    '''(experimental) Statement provider for service `emr-containers <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonemroneksemrcontainers.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `emr-containers <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonemroneksemrcontainers.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9bfd485bcdfe1bdf23765352220563acd594d4d3889338349485678f2096472c)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifExecutionRoleArn")
    def if_execution_role_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "EmrContainers":
        '''(experimental) Filters access by the execution role arn present in the request.

        https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/iam-execution-role.html

        Applies to actions:

        - .toCreateManagedEndpoint()
        - .toStartJobRun()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7ce77578777c9cf4c739efe62f3a6bd160e5f3ae67082cedf901a753f6f599aa)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("EmrContainers", jsii.invoke(self, "ifExecutionRoleArn", [value, operator]))

    @jsii.member(jsii_name="ifJobTemplateArn")
    def if_job_template_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "EmrContainers":
        '''(experimental) Filters access by the job template arn present in the request.

        https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/iam-job-template.html

        Applies to actions:

        - .toStartJobRun()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b1344a770c75c9602f4b3ec2c2f8fca1d1e3a0350d4edb6a115e8da266d68067)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("EmrContainers", jsii.invoke(self, "ifJobTemplateArn", [value, operator]))

    @jsii.member(jsii_name="onJobRun")
    def on_job_run(
        self,
        virtual_cluster_id: builtins.str,
        job_run_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "EmrContainers":
        '''(experimental) Adds a resource of type jobRun to the statement.

        https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/job-runs.html

        :param virtual_cluster_id: - Identifier for the virtualClusterId.
        :param job_run_id: - Identifier for the jobRunId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b909e392c0b74f7cc661a14bcc40e70901ccef5e5a1734472223912bbab8d404)
            check_type(argname="argument virtual_cluster_id", value=virtual_cluster_id, expected_type=type_hints["virtual_cluster_id"])
            check_type(argname="argument job_run_id", value=job_run_id, expected_type=type_hints["job_run_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("EmrContainers", jsii.invoke(self, "onJobRun", [virtual_cluster_id, job_run_id, account, region, partition]))

    @jsii.member(jsii_name="onJobTemplate")
    def on_job_template(
        self,
        job_template_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "EmrContainers":
        '''(experimental) Adds a resource of type jobTemplate to the statement.

        https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/job-templates.html

        :param job_template_id: - Identifier for the jobTemplateId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__debeca2898a85c3e39a3781ef502fdddcf1e7f6489692e06b8b1582791072b1f)
            check_type(argname="argument job_template_id", value=job_template_id, expected_type=type_hints["job_template_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("EmrContainers", jsii.invoke(self, "onJobTemplate", [job_template_id, account, region, partition]))

    @jsii.member(jsii_name="onManagedEndpoint")
    def on_managed_endpoint(
        self,
        virtual_cluster_id: builtins.str,
        endpoint_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "EmrContainers":
        '''(experimental) Adds a resource of type managedEndpoint to the statement.

        https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio-create-eks-cluster.html#emr-studio-create-managed-endpoint

        :param virtual_cluster_id: - Identifier for the virtualClusterId.
        :param endpoint_id: - Identifier for the endpointId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c5e06faf923b15fddd6063cfcba0c9a048c03b7089c533080f3177d50ca1938f)
            check_type(argname="argument virtual_cluster_id", value=virtual_cluster_id, expected_type=type_hints["virtual_cluster_id"])
            check_type(argname="argument endpoint_id", value=endpoint_id, expected_type=type_hints["endpoint_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("EmrContainers", jsii.invoke(self, "onManagedEndpoint", [virtual_cluster_id, endpoint_id, account, region, partition]))

    @jsii.member(jsii_name="onVirtualCluster")
    def on_virtual_cluster(
        self,
        virtual_cluster_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "EmrContainers":
        '''(experimental) Adds a resource of type virtualCluster to the statement.

        https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/virtual-cluster.html

        :param virtual_cluster_id: - Identifier for the virtualClusterId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__be6331f9d1e2eade1b7bf633e05e1c310f4ad6174ebc479131b8a6de071c371d)
            check_type(argname="argument virtual_cluster_id", value=virtual_cluster_id, expected_type=type_hints["virtual_cluster_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("EmrContainers", jsii.invoke(self, "onVirtualCluster", [virtual_cluster_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelJobRun")
    def to_cancel_job_run(self) -> "EmrContainers":
        '''(experimental) Grants permission to cancel a job run.

        Access Level: Write

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_CancelJobRun.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toCancelJobRun", []))

    @jsii.member(jsii_name="toCreateJobTemplate")
    def to_create_job_template(self) -> "EmrContainers":
        '''(experimental) Grants permission to create a job template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_CreateJobTemplate.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toCreateJobTemplate", []))

    @jsii.member(jsii_name="toCreateManagedEndpoint")
    def to_create_managed_endpoint(self) -> "EmrContainers":
        '''(experimental) Grants permission to create a managed endpoint.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifExecutionRoleArn()

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_CreateManagedEndpoint.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toCreateManagedEndpoint", []))

    @jsii.member(jsii_name="toCreateVirtualCluster")
    def to_create_virtual_cluster(self) -> "EmrContainers":
        '''(experimental) Grants permission to create a virtual cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_CreateVirtualCluster.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toCreateVirtualCluster", []))

    @jsii.member(jsii_name="toDeleteJobTemplate")
    def to_delete_job_template(self) -> "EmrContainers":
        '''(experimental) Grants permission to delete a job template.

        Access Level: Write

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_DeleteJobTemplate.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toDeleteJobTemplate", []))

    @jsii.member(jsii_name="toDeleteManagedEndpoint")
    def to_delete_managed_endpoint(self) -> "EmrContainers":
        '''(experimental) Grants permission to delete a managed endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_DeleteManagedEndpoint.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toDeleteManagedEndpoint", []))

    @jsii.member(jsii_name="toDeleteVirtualCluster")
    def to_delete_virtual_cluster(self) -> "EmrContainers":
        '''(experimental) Grants permission to delete a virtual cluster.

        Access Level: Write

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_DeleteVirtualCluster.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toDeleteVirtualCluster", []))

    @jsii.member(jsii_name="toDescribeJobRun")
    def to_describe_job_run(self) -> "EmrContainers":
        '''(experimental) Grants permission to describe a job run.

        Access Level: Read

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_DescribeJobRun.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toDescribeJobRun", []))

    @jsii.member(jsii_name="toDescribeJobTemplate")
    def to_describe_job_template(self) -> "EmrContainers":
        '''(experimental) Grants permission to describe a job template.

        Access Level: Read

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_DescribeJobTemplate.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toDescribeJobTemplate", []))

    @jsii.member(jsii_name="toDescribeManagedEndpoint")
    def to_describe_managed_endpoint(self) -> "EmrContainers":
        '''(experimental) Grants permission to describe a managed endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_DescribeManagedEndpoint.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toDescribeManagedEndpoint", []))

    @jsii.member(jsii_name="toDescribeVirtualCluster")
    def to_describe_virtual_cluster(self) -> "EmrContainers":
        '''(experimental) Grants permission to describe a virtual cluster.

        Access Level: Read

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_DescribeVirtualCluster.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toDescribeVirtualCluster", []))

    @jsii.member(jsii_name="toListJobRuns")
    def to_list_job_runs(self) -> "EmrContainers":
        '''(experimental) Grants permission to list job runs associated with a virtual cluster.

        Access Level: List

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_ListJobRuns.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toListJobRuns", []))

    @jsii.member(jsii_name="toListJobTemplates")
    def to_list_job_templates(self) -> "EmrContainers":
        '''(experimental) Grants permission to list job templates.

        Access Level: List

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_ListJobTemplates.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toListJobTemplates", []))

    @jsii.member(jsii_name="toListManagedEndpoints")
    def to_list_managed_endpoints(self) -> "EmrContainers":
        '''(experimental) Grants permission to list managed endpoints associated with a virtual cluster.

        Access Level: List

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_ListManagedEndpoints.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toListManagedEndpoints", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "EmrContainers":
        '''(experimental) Grants permission to list tags for the specified resource.

        Access Level: List

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListVirtualClusters")
    def to_list_virtual_clusters(self) -> "EmrContainers":
        '''(experimental) Grants permission to list virtual clusters.

        Access Level: List

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_ListVirtualClusters.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toListVirtualClusters", []))

    @jsii.member(jsii_name="toStartJobRun")
    def to_start_job_run(self) -> "EmrContainers":
        '''(experimental) Grants permission to start a job run.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifExecutionRoleArn()
        - .ifJobTemplateArn()

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_StartJobRun.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toStartJobRun", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "EmrContainers":
        '''(experimental) Grants permission to tag the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "EmrContainers":
        '''(experimental) Grants permission to untag the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/emr-on-eks/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("EmrContainers", jsii.invoke(self, "toUntagResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2f6dfd1a52708695d8126016cee71faf73571b01ba889c8434646813b62f8412)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6f354ae27b8cfdb67428d2a1905f38cc70fd4b318678dfdae12ebc8b3e62a29f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class EmrServerless(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.EmrServerless",
):
    '''(experimental) Statement provider for service `emr-serverless <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonemrserverless.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `emr-serverless <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonemrserverless.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__56869c4694039bd42eaad567e11f41c27f98b26f319651fcf005f4ae73efc4c5)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        application_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "EmrServerless":
        '''(experimental) Adds a resource of type application to the statement.

        https://docs.aws.amazon.com/emr/latest/EMR-Serverless-UserGuide/emr-serverless.html

        :param application_id: - Identifier for the applicationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1b71a9c32375e22d88b466b09db33b01354c45f142608023a9e823278f51527e)
            check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("EmrServerless", jsii.invoke(self, "onApplication", [application_id, account, region, partition]))

    @jsii.member(jsii_name="onJobRun")
    def on_job_run(
        self,
        application_id: builtins.str,
        job_run_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "EmrServerless":
        '''(experimental) Adds a resource of type jobRun to the statement.

        https://docs.aws.amazon.com/emr/latest/EMR-Serverless-UserGuide/emr-serverless.html

        :param application_id: - Identifier for the applicationId.
        :param job_run_id: - Identifier for the jobRunId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5d9508ab610f4ee8f7ba990aa3534f83c214c2acc4bbff8d8b3e30aff2f9e083)
            check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
            check_type(argname="argument job_run_id", value=job_run_id, expected_type=type_hints["job_run_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("EmrServerless", jsii.invoke(self, "onJobRun", [application_id, job_run_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelJobRun")
    def to_cancel_job_run(self) -> "EmrServerless":
        '''(experimental) Grants permission to cancel a job run.

        Access Level: Write

        https://docs.aws.amazon.com/emr-serverless/latest/APIReference/API_CancelJobRun.html

        :stability: experimental
        '''
        return typing.cast("EmrServerless", jsii.invoke(self, "toCancelJobRun", []))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "EmrServerless":
        '''(experimental) Grants permission to create an Application.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/emr-serverless/latest/APIReference/API_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("EmrServerless", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "EmrServerless":
        '''(experimental) Grants permission to delete an application.

        Access Level: Write

        https://docs.aws.amazon.com/emr-serverless/latest/APIReference/API_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("EmrServerless", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toGetApplication")
    def to_get_application(self) -> "EmrServerless":
        '''(experimental) Grants permission to get application.

        Access Level: Read

        https://docs.aws.amazon.com/emr-serverless/latest/APIReference/API_GetApplication.html

        :stability: experimental
        '''
        return typing.cast("EmrServerless", jsii.invoke(self, "toGetApplication", []))

    @jsii.member(jsii_name="toGetDashboardForJobRun")
    def to_get_dashboard_for_job_run(self) -> "EmrServerless":
        '''(experimental) Grants permission to get job run dashboard.

        Access Level: Read

        https://docs.aws.amazon.com/emr-serverless/latest/APIReference/API_GetDashboardForJobRun.html

        :stability: experimental
        '''
        return typing.cast("EmrServerless", jsii.invoke(self, "toGetDashboardForJobRun", []))

    @jsii.member(jsii_name="toGetJobRun")
    def to_get_job_run(self) -> "EmrServerless":
        '''(experimental) Grants permission to get a job run.

        Access Level: Read

        https://docs.aws.amazon.com/emr-serverless/latest/APIReference/API_GetJobRun.html

        :stability: experimental
        '''
        return typing.cast("EmrServerless", jsii.invoke(self, "toGetJobRun", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "EmrServerless":
        '''(experimental) Grants permission to list applications.

        Access Level: List

        https://docs.aws.amazon.com/emr-serverless/latest/APIReference/API_ListApplications.html

        :stability: experimental
        '''
        return typing.cast("EmrServerless", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListJobRuns")
    def to_list_job_runs(self) -> "EmrServerless":
        '''(experimental) Grants permission to list job runs associated with an application.

        Access Level: List

        https://docs.aws.amazon.com/emr-serverless/latest/APIReference/API_ListJobRuns.html

        :stability: experimental
        '''
        return typing.cast("EmrServerless", jsii.invoke(self, "toListJobRuns", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "EmrServerless":
        '''(experimental) Grants permission to list tags for the specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/emr-serverless/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("EmrServerless", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartApplication")
    def to_start_application(self) -> "EmrServerless":
        '''(experimental) Grants permission to Start an application.

        Access Level: Write

        https://docs.aws.amazon.com/emr-serverless/latest/APIReference/API_StartApplication.html

        :stability: experimental
        '''
        return typing.cast("EmrServerless", jsii.invoke(self, "toStartApplication", []))

    @jsii.member(jsii_name="toStartJobRun")
    def to_start_job_run(self) -> "EmrServerless":
        '''(experimental) Grants permission to start a job run.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/emr-serverless/latest/APIReference/API_StartJobRun.html

        :stability: experimental
        '''
        return typing.cast("EmrServerless", jsii.invoke(self, "toStartJobRun", []))

    @jsii.member(jsii_name="toStopApplication")
    def to_stop_application(self) -> "EmrServerless":
        '''(experimental) Grants permission to Stop an application.

        Access Level: Write

        https://docs.aws.amazon.com/emr-serverless/latest/APIReference/API_StopApplication.html

        :stability: experimental
        '''
        return typing.cast("EmrServerless", jsii.invoke(self, "toStopApplication", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "EmrServerless":
        '''(experimental) Grants permission to tag the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/emr-serverless/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("EmrServerless", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "EmrServerless":
        '''(experimental) Grants permission to untag the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/emr-serverless/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("EmrServerless", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "EmrServerless":
        '''(experimental) Grants permission to Update an application.

        Access Level: Write

        https://docs.aws.amazon.com/emr-serverless/latest/APIReference/API_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("EmrServerless", jsii.invoke(self, "toUpdateApplication", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__20a0f64713e2c012c9b538422c62bc5e20efe1c3f275edc486ce914d4d46ff2c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d169fbbd470a9bba5c4eb14c3162ea065cf6a233ea73f8eceb0bbd42e3426545)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Es(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Es"):
    '''(experimental) Statement provider for service `es <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonopensearchservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `es <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonopensearchservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b3076f5f081ef4c496dec6069430b0b5a1bd1a42d2c4f9e7425f182d7df25c53)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDomain")
    def on_domain(
        self,
        domain_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Es":
        '''(experimental) Adds a resource of type domain to the statement.

        https://docs.aws.amazon.com/opensearch-service/latest/developerguide/ac.html

        :param domain_name: - Identifier for the domainName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__672083ad4849bc2d5d4316bec54ff6c652afab322eef8bc00bc939e54b2f7f91)
            check_type(argname="argument domain_name", value=domain_name, expected_type=type_hints["domain_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Es", jsii.invoke(self, "onDomain", [domain_name, account, region, partition]))

    @jsii.member(jsii_name="onEsRole")
    def on_es_role(
        self,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Es":
        '''(experimental) Adds a resource of type es_role to the statement.

        https://docs.aws.amazon.com/opensearch-service/latest/developerguide/slr.html

        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__477f228acd23a4d0a8b07dee09e63615355e2ea7873c94eb64bfe750f432caff)
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Es", jsii.invoke(self, "onEsRole", [account, partition]))

    @jsii.member(jsii_name="onOpensearchserviceRole")
    def on_opensearchservice_role(
        self,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Es":
        '''(experimental) Adds a resource of type opensearchservice_role to the statement.

        https://docs.aws.amazon.com/opensearch-service/latest/developerguide/slr.html

        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f929f6bcfe3502601182d56454ad2294596746bb1cb56e2291f35fc1cc801cb8)
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Es", jsii.invoke(self, "onOpensearchserviceRole", [account, partition]))

    @jsii.member(jsii_name="toAcceptInboundConnection")
    def to_accept_inbound_connection(self) -> "Es":
        '''(experimental) Grants permission to the destination domain owner to accept an inbound cross-cluster search connection request.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_AcceptInboundConnection.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toAcceptInboundConnection", []))

    @jsii.member(jsii_name="toAcceptInboundCrossClusterSearchConnection")
    def to_accept_inbound_cross_cluster_search_connection(self) -> "Es":
        '''(experimental) Grants permission to the destination domain owner to accept an inbound cross-cluster search connection request.

        This permission is deprecated. Use AcceptInboundConnection instead

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_AcceptInboundConnection.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toAcceptInboundCrossClusterSearchConnection", []))

    @jsii.member(jsii_name="toAddTags")
    def to_add_tags(self) -> "Es":
        '''(experimental) Grants permission to attach resource tags to an OpenSearch Service domain.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_AddTags.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toAddTags", []))

    @jsii.member(jsii_name="toAssociatePackage")
    def to_associate_package(self) -> "Es":
        '''(experimental) Grants permission to associate a package with an OpenSearch Service domain.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_AssociatePackage.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toAssociatePackage", []))

    @jsii.member(jsii_name="toAuthorizeVpcEndpointAccess")
    def to_authorize_vpc_endpoint_access(self) -> "Es":
        '''(experimental) Grants permission to provide access to an Amazon OpenSearch Service domain through the use of an interface VPC endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_AuthorizeVpcEndpointAccess.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toAuthorizeVpcEndpointAccess", []))

    @jsii.member(jsii_name="toCancelElasticsearchServiceSoftwareUpdate")
    def to_cancel_elasticsearch_service_software_update(self) -> "Es":
        '''(experimental) Grants permission to cancel a service software update of a domain. This permission is deprecated. Use CancelServiceSoftwareUpdate instead.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_CancelServiceSoftwareUpdate.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toCancelElasticsearchServiceSoftwareUpdate", []))

    @jsii.member(jsii_name="toCancelServiceSoftwareUpdate")
    def to_cancel_service_software_update(self) -> "Es":
        '''(experimental) Grants permission to cancel a service software update of a domain.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_CancelServiceSoftwareUpdate.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toCancelServiceSoftwareUpdate", []))

    @jsii.member(jsii_name="toCreateDomain")
    def to_create_domain(self) -> "Es":
        '''(experimental) Grants permission to create an Amazon OpenSearch Service domain.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_CreateDomain.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toCreateDomain", []))

    @jsii.member(jsii_name="toCreateElasticsearchDomain")
    def to_create_elasticsearch_domain(self) -> "Es":
        '''(experimental) Grants permission to create an OpenSearch Service domain. This permission is deprecated. Use CreateDomain instead.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_CreateDomain.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toCreateElasticsearchDomain", []))

    @jsii.member(jsii_name="toCreateElasticsearchServiceRole")
    def to_create_elasticsearch_service_role(self) -> "Es":
        '''(experimental) Grants permission to create the service-linked role required for OpenSearch Service domains that use VPC access.

        This permission is deprecated. OpenSearch Service creates the service-linked role for you

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toCreateElasticsearchServiceRole", []))

    @jsii.member(jsii_name="toCreateOutboundConnection")
    def to_create_outbound_connection(self) -> "Es":
        '''(experimental) Grants permission to create a new cross-cluster search connection from a source domain to a destination domain.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_CreateOutboundConnection.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toCreateOutboundConnection", []))

    @jsii.member(jsii_name="toCreateOutboundCrossClusterSearchConnection")
    def to_create_outbound_cross_cluster_search_connection(self) -> "Es":
        '''(experimental) Grants permission to create a new cross-cluster search connection from a source domain to a destination domain.

        This permission is deprecated. Use CreateOutboundConnection instead

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_CreateOutboundConnection.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toCreateOutboundCrossClusterSearchConnection", []))

    @jsii.member(jsii_name="toCreatePackage")
    def to_create_package(self) -> "Es":
        '''(experimental) Grants permission to add a package for use with OpenSearch Service domains.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_CreatePackage.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toCreatePackage", []))

    @jsii.member(jsii_name="toCreateServiceRole")
    def to_create_service_role(self) -> "Es":
        '''(experimental) Grants permission to create the service-linked role required for Amazon OpenSearch Service domains that use VPC access.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toCreateServiceRole", []))

    @jsii.member(jsii_name="toCreateVpcEndpoint")
    def to_create_vpc_endpoint(self) -> "Es":
        '''(experimental) Grants permission to create an Amazon OpenSearch Service-managed VPC endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_CreateVpcEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toCreateVpcEndpoint", []))

    @jsii.member(jsii_name="toDeleteDomain")
    def to_delete_domain(self) -> "Es":
        '''(experimental) Grants permission to delete an Amazon OpenSearch Service domain and all of its data.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DeleteDomain.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDeleteDomain", []))

    @jsii.member(jsii_name="toDeleteElasticsearchDomain")
    def to_delete_elasticsearch_domain(self) -> "Es":
        '''(experimental) Grants permission to delete an OpenSearch Service domain and all of its data.

        This permission is deprecated. Use DeleteDomain instead

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DeleteDomain.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDeleteElasticsearchDomain", []))

    @jsii.member(jsii_name="toDeleteElasticsearchServiceRole")
    def to_delete_elasticsearch_service_role(self) -> "Es":
        '''(experimental) Grants permission to delete the service-linked role required for OpenSearch Service domains that use VPC access.

        This permission is deprecated. Use the IAM API to delete service-linked roles

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_Welcome.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDeleteElasticsearchServiceRole", []))

    @jsii.member(jsii_name="toDeleteInboundConnection")
    def to_delete_inbound_connection(self) -> "Es":
        '''(experimental) Grants permission to the destination domain owner to delete an existing inbound cross-cluster search connection.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DeleteInboundConnection.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDeleteInboundConnection", []))

    @jsii.member(jsii_name="toDeleteInboundCrossClusterSearchConnection")
    def to_delete_inbound_cross_cluster_search_connection(self) -> "Es":
        '''(experimental) Grants permission to the destination domain owner to delete an existing inbound cross-cluster search connection.

        This permission is deprecated. Use DeleteInboundConnection instead

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DeleteInboundConnection.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDeleteInboundCrossClusterSearchConnection", []))

    @jsii.member(jsii_name="toDeleteOutboundConnection")
    def to_delete_outbound_connection(self) -> "Es":
        '''(experimental) Grants permission to the source domain owner to delete an existing outbound cross-cluster search connection.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DeleteOutboundConnection.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDeleteOutboundConnection", []))

    @jsii.member(jsii_name="toDeleteOutboundCrossClusterSearchConnection")
    def to_delete_outbound_cross_cluster_search_connection(self) -> "Es":
        '''(experimental) Grants permission to the source domain owner to delete an existing outbound cross-cluster search connection.

        This permission is deprecated. Use DeleteOutboundConnection instead

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DeleteOutboundConnection.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDeleteOutboundCrossClusterSearchConnection", []))

    @jsii.member(jsii_name="toDeletePackage")
    def to_delete_package(self) -> "Es":
        '''(experimental) Grants permission to delete a package from OpenSearch Service. The package cannot be associated with any domains.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DeletePackage.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDeletePackage", []))

    @jsii.member(jsii_name="toDeleteVpcEndpoint")
    def to_delete_vpc_endpoint(self) -> "Es":
        '''(experimental) Grants permission to delete an Amazon OpenSearch Service-managed interface VPC endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DeleteVpcEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDeleteVpcEndpoint", []))

    @jsii.member(jsii_name="toDescribeDomain")
    def to_describe_domain(self) -> "Es":
        '''(experimental) Grants permission to view a description of the domain configuration for the specified OpenSearch Service domain, including the domain ID, service endpoint, and ARN.

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribeDomain.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeDomain", []))

    @jsii.member(jsii_name="toDescribeDomainAutoTunes")
    def to_describe_domain_auto_tunes(self) -> "Es":
        '''(experimental) Grants permission to view the Auto-Tune configuration of the domain for the specified OpenSearch Service domain, including the Auto-Tune state and maintenance schedules.

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribeDomainAutoTunes.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeDomainAutoTunes", []))

    @jsii.member(jsii_name="toDescribeDomainChangeProgress")
    def to_describe_domain_change_progress(self) -> "Es":
        '''(experimental) Grants permission to view detail stage progress of an OpenSearch Service domain.

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribeDomainChangeProgress.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeDomainChangeProgress", []))

    @jsii.member(jsii_name="toDescribeDomainConfig")
    def to_describe_domain_config(self) -> "Es":
        '''(experimental) Grants permission to view a description of the configuration options and status of an OpenSearch Service domain.

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribeDomainConfig.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeDomainConfig", []))

    @jsii.member(jsii_name="toDescribeDomains")
    def to_describe_domains(self) -> "Es":
        '''(experimental) Grants permission to view a description of the domain configuration for up to five specified OpenSearch Service domains.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribeDomains.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeDomains", []))

    @jsii.member(jsii_name="toDescribeDryRunProgress")
    def to_describe_dry_run_progress(self) -> "Es":
        '''(experimental) Grants permission to describe the status of a pre-update validation check on an OpenSearch Service domain.

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribeDryRunProgress.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeDryRunProgress", []))

    @jsii.member(jsii_name="toDescribeElasticsearchDomain")
    def to_describe_elasticsearch_domain(self) -> "Es":
        '''(experimental) Grants permission to view a description of the domain configuration for the specified OpenSearch Service domain, including the domain ID, service endpoint, and ARN.

        This permission is deprecated. Use DescribeDomain instead

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribeDomain.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeElasticsearchDomain", []))

    @jsii.member(jsii_name="toDescribeElasticsearchDomainConfig")
    def to_describe_elasticsearch_domain_config(self) -> "Es":
        '''(experimental) Grants permission to view a description of the configuration and status of an OpenSearch Service domain.

        This permission is deprecated. Use DescribeDomainConfig instead

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribeDomainConfig.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeElasticsearchDomainConfig", []))

    @jsii.member(jsii_name="toDescribeElasticsearchDomains")
    def to_describe_elasticsearch_domains(self) -> "Es":
        '''(experimental) Grants permission to view a description of the domain configuration for up to five specified Amazon OpenSearch domains.

        This permission is deprecated. Use DescribeDomains instead

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribeDomains.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeElasticsearchDomains", []))

    @jsii.member(jsii_name="toDescribeElasticsearchInstanceTypeLimits")
    def to_describe_elasticsearch_instance_type_limits(self) -> "Es":
        '''(experimental) Grants permission to view the instance count, storage, and master node limits for a given OpenSearch version and instance type.

        This permission is deprecated. Use DescribeInstanceTypeLimits instead

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribeInstanceTypeLimits.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeElasticsearchInstanceTypeLimits", []))

    @jsii.member(jsii_name="toDescribeInboundConnections")
    def to_describe_inbound_connections(self) -> "Es":
        '''(experimental) Grants permission to list all the inbound cross-cluster search connections for a destination domain.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribeInboundConnections.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeInboundConnections", []))

    @jsii.member(jsii_name="toDescribeInboundCrossClusterSearchConnections")
    def to_describe_inbound_cross_cluster_search_connections(self) -> "Es":
        '''(experimental) Grants permission to list all the inbound cross-cluster search connections for a destination domain.

        This permission is deprecated. Use DescribeInboundConnections instead

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribeInboundConnections.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeInboundCrossClusterSearchConnections", []))

    @jsii.member(jsii_name="toDescribeInstanceTypeLimits")
    def to_describe_instance_type_limits(self) -> "Es":
        '''(experimental) Grants permission to view the instance count, storage, and master node limits for a given engine version and instance type.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribeInstanceTypeLimits.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeInstanceTypeLimits", []))

    @jsii.member(jsii_name="toDescribeOutboundConnections")
    def to_describe_outbound_connections(self) -> "Es":
        '''(experimental) Grants permission to list all the outbound cross-cluster search connections for a source domain.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribeOutboundConnections.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeOutboundConnections", []))

    @jsii.member(jsii_name="toDescribeOutboundCrossClusterSearchConnections")
    def to_describe_outbound_cross_cluster_search_connections(self) -> "Es":
        '''(experimental) Grants permission to list all the outbound cross-cluster search connections for a source domain.

        This permission is deprecated. Use DescribeOutboundConnections instead

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribeOutboundConnections.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeOutboundCrossClusterSearchConnections", []))

    @jsii.member(jsii_name="toDescribePackages")
    def to_describe_packages(self) -> "Es":
        '''(experimental) Grants permission to describe all packages available to OpenSearch Service domains.

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribePackages.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribePackages", []))

    @jsii.member(jsii_name="toDescribeReservedElasticsearchInstanceOfferings")
    def to_describe_reserved_elasticsearch_instance_offerings(self) -> "Es":
        '''(experimental) Grants permission to fetch Reserved Instance offerings for Amazon OpenSearch Service. This permission is deprecated. Use DescribeReservedInstanceOfferings instead.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribeReservedInstanceOfferings.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeReservedElasticsearchInstanceOfferings", []))

    @jsii.member(jsii_name="toDescribeReservedElasticsearchInstances")
    def to_describe_reserved_elasticsearch_instances(self) -> "Es":
        '''(experimental) Grants permission to fetch OpenSearch Service Reserved Instances that have already been purchased.

        This permission is deprecated. Use DescribeReservedInstances instead

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribeReservedInstances.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeReservedElasticsearchInstances", []))

    @jsii.member(jsii_name="toDescribeReservedInstanceOfferings")
    def to_describe_reserved_instance_offerings(self) -> "Es":
        '''(experimental) Grants permission to fetch Reserved Instance offerings for OpenSearch Service.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribeReservedInstanceOfferings.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeReservedInstanceOfferings", []))

    @jsii.member(jsii_name="toDescribeReservedInstances")
    def to_describe_reserved_instances(self) -> "Es":
        '''(experimental) Grants permission to fetch OpenSearch Service Reserved Instances that have already been purchased.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribeReservedInstances.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeReservedInstances", []))

    @jsii.member(jsii_name="toDescribeVpcEndpoints")
    def to_describe_vpc_endpoints(self) -> "Es":
        '''(experimental) Grants permission to describe one or more Amazon OpenSearch Service-managed VPC endpoints.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DescribeVpcEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDescribeVpcEndpoints", []))

    @jsii.member(jsii_name="toDissociatePackage")
    def to_dissociate_package(self) -> "Es":
        '''(experimental) Grants permission to disassociate a package from the specified OpenSearch Service domain.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_DissociatePackage.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toDissociatePackage", []))

    @jsii.member(jsii_name="toESCrossClusterGet")
    def to_es_cross_cluster_get(self) -> "Es":
        '''(experimental) Grants permission to send cross-cluster requests to a destination domain.

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toESCrossClusterGet", []))

    @jsii.member(jsii_name="toESHttpDelete")
    def to_es_http_delete(self) -> "Es":
        '''(experimental) Grants permission to send HTTP DELETE requests to the OpenSearch APIs.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toESHttpDelete", []))

    @jsii.member(jsii_name="toESHttpGet")
    def to_es_http_get(self) -> "Es":
        '''(experimental) Grants permission to send HTTP GET requests to the OpenSearch APIs.

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toESHttpGet", []))

    @jsii.member(jsii_name="toESHttpHead")
    def to_es_http_head(self) -> "Es":
        '''(experimental) Grants permission to send HTTP HEAD requests to the OpenSearch APIs.

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toESHttpHead", []))

    @jsii.member(jsii_name="toESHttpPatch")
    def to_es_http_patch(self) -> "Es":
        '''(experimental) Grants permission to send HTTP PATCH requests to the OpenSearch APIs.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toESHttpPatch", []))

    @jsii.member(jsii_name="toESHttpPost")
    def to_es_http_post(self) -> "Es":
        '''(experimental) Grants permission to send HTTP POST requests to the OpenSearch APIs.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toESHttpPost", []))

    @jsii.member(jsii_name="toESHttpPut")
    def to_es_http_put(self) -> "Es":
        '''(experimental) Grants permission to send HTTP PUT requests to the OpenSearch APIs.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/Welcome.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toESHttpPut", []))

    @jsii.member(jsii_name="toGetCompatibleElasticsearchVersions")
    def to_get_compatible_elasticsearch_versions(self) -> "Es":
        '''(experimental) Grants permission to fetch a list of compatible OpenSearch and Elasticsearch versions to which an OpenSearch Service domain can be upgraded.

        This permission is deprecated. Use GetCompatibleVersions instead

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_GetCompatibleVersions.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toGetCompatibleElasticsearchVersions", []))

    @jsii.member(jsii_name="toGetCompatibleVersions")
    def to_get_compatible_versions(self) -> "Es":
        '''(experimental) Grants permission to fetch list of compatible engine versions to which an OpenSearch Service domain can be upgraded.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_GetCompatibleVersions.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toGetCompatibleVersions", []))

    @jsii.member(jsii_name="toGetPackageVersionHistory")
    def to_get_package_version_history(self) -> "Es":
        '''(experimental) Grants permission to fetch the version history for a package.

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_GetPackageVersionHistory.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toGetPackageVersionHistory", []))

    @jsii.member(jsii_name="toGetUpgradeHistory")
    def to_get_upgrade_history(self) -> "Es":
        '''(experimental) Grants permission to fetch the upgrade history of a given OpenSearch Service domain.

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_GetUpgradeHistory.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toGetUpgradeHistory", []))

    @jsii.member(jsii_name="toGetUpgradeStatus")
    def to_get_upgrade_status(self) -> "Es":
        '''(experimental) Grants permission to fetch the upgrade status of a given OpenSearch Service domain.

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_GetUpgradeStatus.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toGetUpgradeStatus", []))

    @jsii.member(jsii_name="toListDomainNames")
    def to_list_domain_names(self) -> "Es":
        '''(experimental) Grants permission to display the names of all OpenSearch Service domains that the current user owns.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_ListDomainNames.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toListDomainNames", []))

    @jsii.member(jsii_name="toListDomainsForPackage")
    def to_list_domains_for_package(self) -> "Es":
        '''(experimental) Grants permission to list all OpenSearch Service domains that a package is associated with.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_ListDomainsForPackage.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toListDomainsForPackage", []))

    @jsii.member(jsii_name="toListElasticsearchInstanceTypeDetails")
    def to_list_elasticsearch_instance_type_details(self) -> "Es":
        '''(experimental) Grants permission to list all instance types and available features for a given OpenSearch version.

        This permission is deprecated. Use ListInstanceTypeDetails instead

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_ListInstanceTypeDetails.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toListElasticsearchInstanceTypeDetails", []))

    @jsii.member(jsii_name="toListElasticsearchInstanceTypes")
    def to_list_elasticsearch_instance_types(self) -> "Es":
        '''(experimental) Grants permission to list all EC2 instance types that are supported for a given OpenSearch version.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_ListInstanceTypeDetails.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toListElasticsearchInstanceTypes", []))

    @jsii.member(jsii_name="toListElasticsearchVersions")
    def to_list_elasticsearch_versions(self) -> "Es":
        '''(experimental) Grants permission to list all supported OpenSearch versions on Amazon OpenSearch Service. This permission is deprecated. Use ListVersions instead.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_ListVersions.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toListElasticsearchVersions", []))

    @jsii.member(jsii_name="toListInstanceTypeDetails")
    def to_list_instance_type_details(self) -> "Es":
        '''(experimental) Grants permission to list all instance types and available features for a given OpenSearch or Elasticsearch version.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_ListInstanceTypeDetails.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toListInstanceTypeDetails", []))

    @jsii.member(jsii_name="toListPackagesForDomain")
    def to_list_packages_for_domain(self) -> "Es":
        '''(experimental) Grants permission to list all packages associated with the OpenSearch Service domain.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_ListPackagesForDomain.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toListPackagesForDomain", []))

    @jsii.member(jsii_name="toListScheduledActions")
    def to_list_scheduled_actions(self) -> "Es":
        '''(experimental) Grants permission to retrieve a list of configuration changes that are scheduled for a OpenSearch Service domain.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_ListScheduledActions.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toListScheduledActions", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Es":
        '''(experimental) Grants permission to display all resource tags for an OpenSearch Service domain.

        Access Level: Read

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_ListTags.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toListVersions")
    def to_list_versions(self) -> "Es":
        '''(experimental) Grants permission to list all supported OpenSearch and Elasticsearch versions in Amazon OpenSearch Service.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_ListVersions.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toListVersions", []))

    @jsii.member(jsii_name="toListVpcEndpointAccess")
    def to_list_vpc_endpoint_access(self) -> "Es":
        '''(experimental) Grants permission to retrieve information about each AWS principal that is allowed to access a given Amazon OpenSearch Service domain through the use of an interface VPC endpoint.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_ListVpcEndpointAccess.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toListVpcEndpointAccess", []))

    @jsii.member(jsii_name="toListVpcEndpoints")
    def to_list_vpc_endpoints(self) -> "Es":
        '''(experimental) Grants permission to retrieve all Amazon OpenSearch Service-managed VPC endpoints in the current AWS account and Region.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_ListVpcEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toListVpcEndpoints", []))

    @jsii.member(jsii_name="toListVpcEndpointsForDomain")
    def to_list_vpc_endpoints_for_domain(self) -> "Es":
        '''(experimental) Grants permission to retrieve all Amazon OpenSearch Service-managed VPC endpoints associated with a particular domain.

        Access Level: List

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_ListVpcEndpointsForDomain.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toListVpcEndpointsForDomain", []))

    @jsii.member(jsii_name="toPurchaseReservedElasticsearchInstanceOffering")
    def to_purchase_reserved_elasticsearch_instance_offering(self) -> "Es":
        '''(experimental) Grants permission to purchase OpenSearch Service Reserved Instances. This permission is deprecated. Use PurchaseReservedInstanceOffering instead.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_PurchaseReservedInstanceOffering.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toPurchaseReservedElasticsearchInstanceOffering", []))

    @jsii.member(jsii_name="toPurchaseReservedInstanceOffering")
    def to_purchase_reserved_instance_offering(self) -> "Es":
        '''(experimental) Grants permission to purchase OpenSearch reserved instances.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_PurchaseReservedInstanceOffering.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toPurchaseReservedInstanceOffering", []))

    @jsii.member(jsii_name="toRejectInboundConnection")
    def to_reject_inbound_connection(self) -> "Es":
        '''(experimental) Grants permission to the destination domain owner to reject an inbound cross-cluster search connection request.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_RejectInboundConnection.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toRejectInboundConnection", []))

    @jsii.member(jsii_name="toRejectInboundCrossClusterSearchConnection")
    def to_reject_inbound_cross_cluster_search_connection(self) -> "Es":
        '''(experimental) Grants permission to the destination domain owner to reject an inbound cross-cluster search connection request.

        This permission is deprecated. Use RejectInboundConnection instead

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_RejectInboundConnection.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toRejectInboundCrossClusterSearchConnection", []))

    @jsii.member(jsii_name="toRemoveTags")
    def to_remove_tags(self) -> "Es":
        '''(experimental) Grants permission to remove resource tags from an OpenSearch Service domain.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_RemoveTags.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toRemoveTags", []))

    @jsii.member(jsii_name="toRevokeVpcEndpointAccess")
    def to_revoke_vpc_endpoint_access(self) -> "Es":
        '''(experimental) Grants permission to revoke access to an Amazon OpenSearch Service domain that was provided through an interface VPC endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_RevokeVpcEndpointAccess.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toRevokeVpcEndpointAccess", []))

    @jsii.member(jsii_name="toStartElasticsearchServiceSoftwareUpdate")
    def to_start_elasticsearch_service_software_update(self) -> "Es":
        '''(experimental) Grants permission to start a service software update of a domain. This permission is deprecated. Use StartServiceSoftwareUpdate instead.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_StartServiceSoftwareUpdate.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toStartElasticsearchServiceSoftwareUpdate", []))

    @jsii.member(jsii_name="toStartServiceSoftwareUpdate")
    def to_start_service_software_update(self) -> "Es":
        '''(experimental) Grants permission to start a service software update of a domain.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_StartServiceSoftwareUpdate.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toStartServiceSoftwareUpdate", []))

    @jsii.member(jsii_name="toUpdateDomainConfig")
    def to_update_domain_config(self) -> "Es":
        '''(experimental) Grants permission to modify the configuration of an OpenSearch Service domain, such as the instance type or number of instances.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_UpdateDomainConfig.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toUpdateDomainConfig", []))

    @jsii.member(jsii_name="toUpdateElasticsearchDomainConfig")
    def to_update_elasticsearch_domain_config(self) -> "Es":
        '''(experimental) Grants permission to modify the configuration of an OpenSearch Service domain, such as the instance type or number of instances.

        This permission is deprecated. Use UpdateDomainConfig instead

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_UpdateDomainConfig.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toUpdateElasticsearchDomainConfig", []))

    @jsii.member(jsii_name="toUpdatePackage")
    def to_update_package(self) -> "Es":
        '''(experimental) Grants permission to update a package for use with OpenSearch Service domains.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_UpdatePackage.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toUpdatePackage", []))

    @jsii.member(jsii_name="toUpdateScheduledAction")
    def to_update_scheduled_action(self) -> "Es":
        '''(experimental) Grants permission to reschedule a planned OpenSearch Service domain configuration change for a later time.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_UpdateScheduledAction.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toUpdateScheduledAction", []))

    @jsii.member(jsii_name="toUpdateVpcEndpoint")
    def to_update_vpc_endpoint(self) -> "Es":
        '''(experimental) Grants permission to modify an Amazon OpenSearch Service-managed interface VPC endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_UpdateVpcEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toUpdateVpcEndpoint", []))

    @jsii.member(jsii_name="toUpgradeDomain")
    def to_upgrade_domain(self) -> "Es":
        '''(experimental) Grants permission to initiate upgrade of an OpenSearch Service domain to a given version.

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_UpgradeDomain.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toUpgradeDomain", []))

    @jsii.member(jsii_name="toUpgradeElasticsearchDomain")
    def to_upgrade_elasticsearch_domain(self) -> "Es":
        '''(experimental) Grants permission to initiate upgrade of an OpenSearch Service domain to a specified version.

        This permission is deprecated. Use UpgradeDomain instead

        Access Level: Write

        https://docs.aws.amazon.com/opensearch-service/latest/APIReference/API_UpgradeDomain.html

        :stability: experimental
        '''
        return typing.cast("Es", jsii.invoke(self, "toUpgradeElasticsearchDomain", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__62c7cd6837df52b7fbbb491b639c2fce08545bb937efdb76399911c268ea500b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__62c569dfb3576284438b94ebefd72d5bb57cff11da8bb85551cbf3660a973a98)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Events(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Events"):
    '''(experimental) Statement provider for service `events <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoneventbridge.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `events <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoneventbridge.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0234133958471404a00e67da50d0a0335a15f11f7512afcc4395373719108aa7)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifCreatorAccount")
    def if_creator_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Events":
        '''(experimental) Filters access by the account the rule was created in to rule actions.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/policy-keys-eventbridge.html#events-creator-account

        Applies to actions:

        - .toDeleteRule()
        - .toDescribeRule()
        - .toDisableRule()
        - .toEnableRule()
        - .toListTagsForResource()
        - .toListTargetsByRule()
        - .toPutRule()
        - .toPutTargets()
        - .toRemoveTargets()
        - .toTagResource()
        - .toUntagResource()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__54bf35abcc36e66a6e429dff9611d0716d1330b42c7626071008ddcde3fe6734)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Events", jsii.invoke(self, "ifCreatorAccount", [value, operator]))

    @jsii.member(jsii_name="ifDetailEventTypeCode")
    def if_detail_event_type_code(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Events":
        '''(experimental) Filters access by the literal string for the detail.eventTypeCode field of the event to PutRule actions.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/policy-keys-eventbridge.html#limit-rule-by-type-code

        Applies to actions:

        - .toPutRule()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__38c2b2c89e06bb117d393cc90522dd8a6ee7ee3100963ea2f4f6a6e553a87adf)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Events", jsii.invoke(self, "ifDetailEventTypeCode", [value, operator]))

    @jsii.member(jsii_name="ifDetailService")
    def if_detail_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Events":
        '''(experimental) Filters access by the literal string for the detail.service field of the event to PutRule actions.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/policy-keys-eventbridge.html#limit-rule-by-service

        Applies to actions:

        - .toPutRule()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e9cdea83090109a7cf333710b142862dbe4fe077ad69b74e1c64c887578545f7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Events", jsii.invoke(self, "ifDetailService", [value, operator]))

    @jsii.member(jsii_name="ifDetailType")
    def if_detail_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Events":
        '''(experimental) Filters access by the literal string of the detail-type of the event to PutEvents and PutRule actions.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/policy-keys-eventbridge.html#events-pattern-detail-type

        Applies to actions:

        - .toPutEvents()
        - .toPutRule()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cc0a983da27886648ffc94d0953cde70f771009887b4ee1f5711ef8076a8bf96)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Events", jsii.invoke(self, "ifDetailType", [value, operator]))

    @jsii.member(jsii_name="ifDetailUserIdentityPrincipalId")
    def if_detail_user_identity_principal_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Events":
        '''(experimental) Filters access by the literal string for the detail.useridentity.principalid field of the event to PutRule actions.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/policy-keys-eventbridge.html#consume-specific-events

        Applies to actions:

        - .toPutRule()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ab26cecc790113a2513525808fe664ffdb5613170c2c9785acb2240ddaaf6168)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Events", jsii.invoke(self, "ifDetailUserIdentityPrincipalId", [value, operator]))

    @jsii.member(jsii_name="ifEventBusArn")
    def if_event_bus_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Events":
        '''(experimental) Filters access by the ARN of the event buses that can be associated with an endpoint to CreateEndpoint and UpdateEndpoint actions.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/policy-keys-eventbridge.html#limiting-access-to-event-buses

        Applies to actions:

        - .toCreateEndpoint()
        - .toUpdateEndpoint()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d8af966ab092ed1ab5ca1e697285b9f638c8202b925afdb5052b46545b23d65e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Events", jsii.invoke(self, "ifEventBusArn", [value, operator]))

    @jsii.member(jsii_name="ifEventBusInvocation")
    def if_event_bus_invocation(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Events":
        '''(experimental) Filters access by whether the event was generated via API or cross-account bus invocation to PutEvents actions.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/policy-keys-eventbridge.html#events-bus-invocation

        Applies to actions:

        - .toPutEvents()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6b73c79b96f05084dbeca7b7160ed8abf3dcb88ed49d020cb3e85429c8673495)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Events", jsii.invoke(self, "ifEventBusInvocation", [value, operator]))

    @jsii.member(jsii_name="ifManagedBy")
    def if_managed_by(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Events":
        '''(experimental) Filters access by AWS services.

        If a rule is created by an AWS service on your behalf, the value is the principal name of the service that created the rule

        https://docs.aws.amazon.com/eventbridge/latest/userguide/policy-keys-eventbridge.html

        Applies to actions:

        - .toDeleteRule()
        - .toDisableRule()
        - .toEnableRule()
        - .toPutRule()
        - .toPutTargets()
        - .toRemoveTargets()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a2f060d3d07a82cb6537056ed0a52974652d1e38b68e32472c64725e43bac94f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Events", jsii.invoke(self, "ifManagedBy", [value, operator]))

    @jsii.member(jsii_name="ifSource")
    def if_source(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Events":
        '''(experimental) Filters access by the AWS service or AWS partner event source that generated the event to PutEvents and PutRule actions.

        Matches the literal string of the source field of the event

        https://docs.aws.amazon.com/eventbridge/latest/userguide/policy-keys-eventbridge.html#events-limit-access-control

        Applies to actions:

        - .toPutEvents()
        - .toPutRule()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__01ee41ff3eeb89a2e473a58a7aa7e115b4834083aa773ac14824b5da3853f9ee)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Events", jsii.invoke(self, "ifSource", [value, operator]))

    @jsii.member(jsii_name="ifTargetArn")
    def if_target_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Events":
        '''(experimental) Filters access by the ARN of a target that can be put to a rule to PutTargets actions.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/policy-keys-eventbridge.html#limiting-access-to-targets

        Applies to actions:

        - .toPutTargets()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__88db65c8a375c07a35991ac609ba63e356c0847959c5e90fa2f67b873c0b392a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Events", jsii.invoke(self, "ifTargetArn", [value, operator]))

    @jsii.member(jsii_name="onApiDestination")
    def on_api_destination(
        self,
        api_destination_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Events":
        '''(experimental) Adds a resource of type api-destination to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-manage-iam-access.html#eventbridge-arn-format

        :param api_destination_name: - Identifier for the apiDestinationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__504cf69f99fef33047d5bd0453b73e474cdcfb2d174eee525f540e53be181faa)
            check_type(argname="argument api_destination_name", value=api_destination_name, expected_type=type_hints["api_destination_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Events", jsii.invoke(self, "onApiDestination", [api_destination_name, account, region, partition]))

    @jsii.member(jsii_name="onArchive")
    def on_archive(
        self,
        archive_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Events":
        '''(experimental) Adds a resource of type archive to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-manage-iam-access.html#eventbridge-arn-format

        :param archive_name: - Identifier for the archiveName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__57bb3d66852f306684baa93895588b2ab02d19679fc1c78859821cb0e9fc4b44)
            check_type(argname="argument archive_name", value=archive_name, expected_type=type_hints["archive_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Events", jsii.invoke(self, "onArchive", [archive_name, account, region, partition]))

    @jsii.member(jsii_name="onConnection")
    def on_connection(
        self,
        connection_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Events":
        '''(experimental) Adds a resource of type connection to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-manage-iam-access.html#eventbridge-arn-format

        :param connection_name: - Identifier for the connectionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__31293697cf1cc789c403250030073d8b97da223c8637f94ecc41cf82eb78b9e9)
            check_type(argname="argument connection_name", value=connection_name, expected_type=type_hints["connection_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Events", jsii.invoke(self, "onConnection", [connection_name, account, region, partition]))

    @jsii.member(jsii_name="onEndpoint")
    def on_endpoint(
        self,
        endpoint_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Events":
        '''(experimental) Adds a resource of type endpoint to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-manage-iam-access.html#eventbridge-arn-format

        :param endpoint_name: - Identifier for the endpointName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e86ff491ab070fe0ef19a66d6927e32e53a70dfd2353720ef9889d6be031a9e4)
            check_type(argname="argument endpoint_name", value=endpoint_name, expected_type=type_hints["endpoint_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Events", jsii.invoke(self, "onEndpoint", [endpoint_name, account, region, partition]))

    @jsii.member(jsii_name="onEventBus")
    def on_event_bus(
        self,
        event_bus_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Events":
        '''(experimental) Adds a resource of type event-bus to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-manage-iam-access.html#eventbridge-arn-format

        :param event_bus_name: - Identifier for the eventBusName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c3383eb8db83b406a4a2fc500c56b10b04e9fb3ea4aaf64d943f1c7f4060c581)
            check_type(argname="argument event_bus_name", value=event_bus_name, expected_type=type_hints["event_bus_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Events", jsii.invoke(self, "onEventBus", [event_bus_name, account, region, partition]))

    @jsii.member(jsii_name="onEventSource")
    def on_event_source(
        self,
        event_source_name: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Events":
        '''(experimental) Adds a resource of type event-source to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-manage-iam-access.html#eventbridge-arn-format

        :param event_source_name: - Identifier for the eventSourceName.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__86b41be4294d05a554cebbffe6cfb8dd1d43870e72f9ac901a20ed47943e011a)
            check_type(argname="argument event_source_name", value=event_source_name, expected_type=type_hints["event_source_name"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Events", jsii.invoke(self, "onEventSource", [event_source_name, region, partition]))

    @jsii.member(jsii_name="onReplay")
    def on_replay(
        self,
        replay_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Events":
        '''(experimental) Adds a resource of type replay to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-manage-iam-access.html#eventbridge-arn-format

        :param replay_name: - Identifier for the replayName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9daedf41411ac983570d662da664044a49a72c3ab2cac673082213c64cfbf346)
            check_type(argname="argument replay_name", value=replay_name, expected_type=type_hints["replay_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Events", jsii.invoke(self, "onReplay", [replay_name, account, region, partition]))

    @jsii.member(jsii_name="onRuleOnCustomEventBus")
    def on_rule_on_custom_event_bus(
        self,
        event_bus_name: builtins.str,
        rule_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Events":
        '''(experimental) Adds a resource of type rule-on-custom-event-bus to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-manage-iam-access.html#eventbridge-arn-format

        :param event_bus_name: - Identifier for the eventBusName.
        :param rule_name: - Identifier for the ruleName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__be98a24dfb2f20dc9d56f0948e8b416299520241b72f70deb07edb3f46cecd84)
            check_type(argname="argument event_bus_name", value=event_bus_name, expected_type=type_hints["event_bus_name"])
            check_type(argname="argument rule_name", value=rule_name, expected_type=type_hints["rule_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Events", jsii.invoke(self, "onRuleOnCustomEventBus", [event_bus_name, rule_name, account, region, partition]))

    @jsii.member(jsii_name="onRuleOnDefaultEventBus")
    def on_rule_on_default_event_bus(
        self,
        rule_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Events":
        '''(experimental) Adds a resource of type rule-on-default-event-bus to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-manage-iam-access.html#eventbridge-arn-format

        :param rule_name: - Identifier for the ruleName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__92017c3aee38c1fef0324212d432787f2942527abe80c187c4d3693e7a191f9f)
            check_type(argname="argument rule_name", value=rule_name, expected_type=type_hints["rule_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Events", jsii.invoke(self, "onRuleOnDefaultEventBus", [rule_name, account, region, partition]))

    @jsii.member(jsii_name="toActivateEventSource")
    def to_activate_event_source(self) -> "Events":
        '''(experimental) Grants permission to activate partner event sources.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ActivateEventSource.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toActivateEventSource", []))

    @jsii.member(jsii_name="toCancelReplay")
    def to_cancel_replay(self) -> "Events":
        '''(experimental) Grants permission to cancel a replay.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_CancelReplay.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toCancelReplay", []))

    @jsii.member(jsii_name="toCreateApiDestination")
    def to_create_api_destination(self) -> "Events":
        '''(experimental) Grants permission to create a new api destination.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_CreateApiDestination.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toCreateApiDestination", []))

    @jsii.member(jsii_name="toCreateArchive")
    def to_create_archive(self) -> "Events":
        '''(experimental) Grants permission to create a new archive.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_CreateArchive.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toCreateArchive", []))

    @jsii.member(jsii_name="toCreateConnection")
    def to_create_connection(self) -> "Events":
        '''(experimental) Grants permission to create a new connection.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_CreateConnection.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toCreateConnection", []))

    @jsii.member(jsii_name="toCreateEndpoint")
    def to_create_endpoint(self) -> "Events":
        '''(experimental) Grants permission to create an endpoint.

        Access Level: Write

        Possible conditions:

        - .ifEventBusArn()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_CreateEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toCreateEndpoint", []))

    @jsii.member(jsii_name="toCreateEventBus")
    def to_create_event_bus(self) -> "Events":
        '''(experimental) Grants permission to create event buses.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_CreateEventBus.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toCreateEventBus", []))

    @jsii.member(jsii_name="toCreatePartnerEventSource")
    def to_create_partner_event_source(self) -> "Events":
        '''(experimental) Grants permission to create partner event sources.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_CreatePartnerEventSource.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toCreatePartnerEventSource", []))

    @jsii.member(jsii_name="toDeactivateEventSource")
    def to_deactivate_event_source(self) -> "Events":
        '''(experimental) Grants permission to deactivate event sources.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeactivateEventSource.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDeactivateEventSource", []))

    @jsii.member(jsii_name="toDeauthorizeConnection")
    def to_deauthorize_connection(self) -> "Events":
        '''(experimental) Grants permission to deauthorize a connection, deleting its stored authorization secrets.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeauthorizeConnection.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDeauthorizeConnection", []))

    @jsii.member(jsii_name="toDeleteApiDestination")
    def to_delete_api_destination(self) -> "Events":
        '''(experimental) Grants permission to delete an api destination.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeleteApiDestination.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDeleteApiDestination", []))

    @jsii.member(jsii_name="toDeleteArchive")
    def to_delete_archive(self) -> "Events":
        '''(experimental) Grants permission to delete an archive.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeleteArchive.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDeleteArchive", []))

    @jsii.member(jsii_name="toDeleteConnection")
    def to_delete_connection(self) -> "Events":
        '''(experimental) Grants permission to delete a connection.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeleteConnection.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDeleteConnection", []))

    @jsii.member(jsii_name="toDeleteEndpoint")
    def to_delete_endpoint(self) -> "Events":
        '''(experimental) Grants permission to delete an endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeleteEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDeleteEndpoint", []))

    @jsii.member(jsii_name="toDeleteEventBus")
    def to_delete_event_bus(self) -> "Events":
        '''(experimental) Grants permission to delete event buses.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeletePartnerEventSource.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDeleteEventBus", []))

    @jsii.member(jsii_name="toDeletePartnerEventSource")
    def to_delete_partner_event_source(self) -> "Events":
        '''(experimental) Grants permission to delete partner event sources.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeletePartnerEventSource.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDeletePartnerEventSource", []))

    @jsii.member(jsii_name="toDeleteRule")
    def to_delete_rule(self) -> "Events":
        '''(experimental) Grants permission to delete rules.

        Access Level: Write

        Possible conditions:

        - .ifCreatorAccount()
        - .ifManagedBy()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeleteRule.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDeleteRule", []))

    @jsii.member(jsii_name="toDescribeApiDestination")
    def to_describe_api_destination(self) -> "Events":
        '''(experimental) Grants permission to retrieve details about an api destination.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeApiDestination.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDescribeApiDestination", []))

    @jsii.member(jsii_name="toDescribeArchive")
    def to_describe_archive(self) -> "Events":
        '''(experimental) Grants permission to retrieve details about an archive.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeArchive.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDescribeArchive", []))

    @jsii.member(jsii_name="toDescribeConnection")
    def to_describe_connection(self) -> "Events":
        '''(experimental) Grants permission to retrieve details about a conection.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeConnection.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDescribeConnection", []))

    @jsii.member(jsii_name="toDescribeEndpoint")
    def to_describe_endpoint(self) -> "Events":
        '''(experimental) Grants permission to retrieve details about an endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDescribeEndpoint", []))

    @jsii.member(jsii_name="toDescribeEventBus")
    def to_describe_event_bus(self) -> "Events":
        '''(experimental) Grants permission to retrieve details about event buses.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeEventBus.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDescribeEventBus", []))

    @jsii.member(jsii_name="toDescribeEventSource")
    def to_describe_event_source(self) -> "Events":
        '''(experimental) Grants permission to retrieve details about event sources.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeEventSource.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDescribeEventSource", []))

    @jsii.member(jsii_name="toDescribePartnerEventSource")
    def to_describe_partner_event_source(self) -> "Events":
        '''(experimental) Grants permission to retrieve details about partner event sources.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribePartnerEventSource.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDescribePartnerEventSource", []))

    @jsii.member(jsii_name="toDescribeReplay")
    def to_describe_replay(self) -> "Events":
        '''(experimental) Grants permission to retrieve the details of a replay.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeReplay.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDescribeReplay", []))

    @jsii.member(jsii_name="toDescribeRule")
    def to_describe_rule(self) -> "Events":
        '''(experimental) Grants permission to retrieve details about rules.

        Access Level: Read

        Possible conditions:

        - .ifCreatorAccount()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeRule.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDescribeRule", []))

    @jsii.member(jsii_name="toDisableRule")
    def to_disable_rule(self) -> "Events":
        '''(experimental) Grants permission to disable rules.

        Access Level: Write

        Possible conditions:

        - .ifCreatorAccount()
        - .ifManagedBy()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DisableRule.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toDisableRule", []))

    @jsii.member(jsii_name="toEnableRule")
    def to_enable_rule(self) -> "Events":
        '''(experimental) Grants permission to enable rules.

        Access Level: Write

        Possible conditions:

        - .ifCreatorAccount()
        - .ifManagedBy()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_EnableRule.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toEnableRule", []))

    @jsii.member(jsii_name="toInvokeApiDestination")
    def to_invoke_api_destination(self) -> "Events":
        '''(experimental) Grants permission to invoke an api destination.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/userguide/iam-identity-based-access-control-eventbridge.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toInvokeApiDestination", []))

    @jsii.member(jsii_name="toListApiDestinations")
    def to_list_api_destinations(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list of api destinations.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListApiDestinations.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListApiDestinations", []))

    @jsii.member(jsii_name="toListArchives")
    def to_list_archives(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list of archives.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListArchives.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListArchives", []))

    @jsii.member(jsii_name="toListConnections")
    def to_list_connections(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list of connections.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListConnections.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListConnections", []))

    @jsii.member(jsii_name="toListEndpoints")
    def to_list_endpoints(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list of endpoints.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListEndpoints", []))

    @jsii.member(jsii_name="toListEventBuses")
    def to_list_event_buses(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list of the event buses in your account.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListEventBuses.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListEventBuses", []))

    @jsii.member(jsii_name="toListEventSources")
    def to_list_event_sources(self) -> "Events":
        '''(experimental) Grants permission to to retrieve a list of event sources shared with this account.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListEventSources.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListEventSources", []))

    @jsii.member(jsii_name="toListPartnerEventSourceAccounts")
    def to_list_partner_event_source_accounts(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list of AWS account IDs associated with an event source.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListPartnerEventSourceAccounts.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListPartnerEventSourceAccounts", []))

    @jsii.member(jsii_name="toListPartnerEventSources")
    def to_list_partner_event_sources(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list partner event sources.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListPartnerEventSources.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListPartnerEventSources", []))

    @jsii.member(jsii_name="toListReplays")
    def to_list_replays(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list of replays.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListReplays.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListReplays", []))

    @jsii.member(jsii_name="toListRuleNamesByTarget")
    def to_list_rule_names_by_target(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list of the names of the rules associated with a target.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListRuleNamesByTarget.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListRuleNamesByTarget", []))

    @jsii.member(jsii_name="toListRules")
    def to_list_rules(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list of the Amazon EventBridge rules in the account.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListRules.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListRules", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list of tags associated with an Amazon EventBridge resource.

        Access Level: List

        Possible conditions:

        - .ifCreatorAccount()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTargetsByRule")
    def to_list_targets_by_rule(self) -> "Events":
        '''(experimental) Grants permission to retrieve a list of targets defined for a rule.

        Access Level: List

        Possible conditions:

        - .ifCreatorAccount()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_ListTargetsByRule.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toListTargetsByRule", []))

    @jsii.member(jsii_name="toPutEvents")
    def to_put_events(self) -> "Events":
        '''(experimental) Grants permission to send custom events to Amazon EventBridge.

        Access Level: Write

        Possible conditions:

        - .ifDetailType()
        - .ifSource()
        - .ifEventBusInvocation()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutEvents.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toPutEvents", []))

    @jsii.member(jsii_name="toPutPartnerEvents")
    def to_put_partner_events(self) -> "Events":
        '''(experimental) Grants permission to sends custom events to Amazon EventBridge.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutPartnerEvents.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toPutPartnerEvents", []))

    @jsii.member(jsii_name="toPutPermission")
    def to_put_permission(self) -> "Events":
        '''(experimental) Grants permission to use the PutPermission action to grants permission to another AWS account to put events to your default event bus.

        Access Level: Permissions management

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutPermission.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toPutPermission", []))

    @jsii.member(jsii_name="toPutRule")
    def to_put_rule(self) -> "Events":
        '''(experimental) Grants permission to create or updates rules.

        Access Level: Write

        Possible conditions:

        - .ifDetailUserIdentityPrincipalId()
        - .ifDetailType()
        - .ifSource()
        - .ifDetailService()
        - .ifDetailEventTypeCode()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifCreatorAccount()
        - .ifManagedBy()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutRule.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toPutRule", []))

    @jsii.member(jsii_name="toPutTargets")
    def to_put_targets(self) -> "Events":
        '''(experimental) Grants permission to add targets to a rule.

        Access Level: Write

        Possible conditions:

        - .ifTargetArn()
        - .ifCreatorAccount()
        - .ifManagedBy()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutTargets.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toPutTargets", []))

    @jsii.member(jsii_name="toRemovePermission")
    def to_remove_permission(self) -> "Events":
        '''(experimental) Grants permission to revoke the permission of another AWS account to put events to your default event bus.

        Access Level: Permissions management

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_RemovePermission.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toRemovePermission", []))

    @jsii.member(jsii_name="toRemoveTargets")
    def to_remove_targets(self) -> "Events":
        '''(experimental) Grants permission to removes targets from a rule.

        Access Level: Write

        Possible conditions:

        - .ifCreatorAccount()
        - .ifManagedBy()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_RemoveTargets.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toRemoveTargets", []))

    @jsii.member(jsii_name="toStartReplay")
    def to_start_replay(self) -> "Events":
        '''(experimental) Grants permission to start a replay of an archive.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_StartReplay.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toStartReplay", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Events":
        '''(experimental) Grants permission to add a tag to an Amazon EventBridge resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifCreatorAccount()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestEventPattern")
    def to_test_event_pattern(self) -> "Events":
        '''(experimental) Grants permission to test whether an event pattern matches the provided event.

        Access Level: Read

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_TestEventPattern.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toTestEventPattern", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Events":
        '''(experimental) Grants permission to remove a tag from an Amazon EventBridge resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifCreatorAccount()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApiDestination")
    def to_update_api_destination(self) -> "Events":
        '''(experimental) Grants permission to update an api destination.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_UpdateApiDestination.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toUpdateApiDestination", []))

    @jsii.member(jsii_name="toUpdateArchive")
    def to_update_archive(self) -> "Events":
        '''(experimental) Grants permission to update an archive.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_UpdateArchive.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toUpdateArchive", []))

    @jsii.member(jsii_name="toUpdateConnection")
    def to_update_connection(self) -> "Events":
        '''(experimental) Grants permission to update a connection.

        Access Level: Write

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_UpdateConnection.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toUpdateConnection", []))

    @jsii.member(jsii_name="toUpdateEndpoint")
    def to_update_endpoint(self) -> "Events":
        '''(experimental) Grants permission to update an endpoint.

        Access Level: Write

        Possible conditions:

        - .ifEventBusArn()

        https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_UpdateEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Events", jsii.invoke(self, "toUpdateEndpoint", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__763b27f7e96ab8d45aacbd7f8a0ff6d6f0381821fde90b5092bdec1e8be0ecf3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0a8a94a98e75d3e77b9b802ed7ee9268e5963d6caeb8b9a42969ce565243002a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Evidently(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Evidently",
):
    '''(experimental) Statement provider for service `evidently <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchevidently.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `evidently <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchevidently.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__15b75d06a15e25891523e9b0895e32217b29dbc48fdf9958fd759468d66e37f9)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onExperiment")
    def on_experiment(
        self,
        project_name: builtins.str,
        experiment_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Evidently":
        '''(experimental) Adds a resource of type Experiment to the statement.

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_Experiment.html

        :param project_name: - Identifier for the projectName.
        :param experiment_name: - Identifier for the experimentName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f2a1268b72a19fa20d50479e0c3362887ae31387d66eb34ae9eb90096764d3b0)
            check_type(argname="argument project_name", value=project_name, expected_type=type_hints["project_name"])
            check_type(argname="argument experiment_name", value=experiment_name, expected_type=type_hints["experiment_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Evidently", jsii.invoke(self, "onExperiment", [project_name, experiment_name, account, region, partition]))

    @jsii.member(jsii_name="onFeature")
    def on_feature(
        self,
        project_name: builtins.str,
        feature_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Evidently":
        '''(experimental) Adds a resource of type Feature to the statement.

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_Feature.html

        :param project_name: - Identifier for the projectName.
        :param feature_name: - Identifier for the featureName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b2f775e9a4e50734bebf9c8ec159036e555a711ce3f49d449578d72ee76dfed3)
            check_type(argname="argument project_name", value=project_name, expected_type=type_hints["project_name"])
            check_type(argname="argument feature_name", value=feature_name, expected_type=type_hints["feature_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Evidently", jsii.invoke(self, "onFeature", [project_name, feature_name, account, region, partition]))

    @jsii.member(jsii_name="onLaunch")
    def on_launch(
        self,
        project_name: builtins.str,
        launch_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Evidently":
        '''(experimental) Adds a resource of type Launch to the statement.

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_Launch.html

        :param project_name: - Identifier for the projectName.
        :param launch_name: - Identifier for the launchName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b08588ec1f897d27da1a58b50efdeb6fe03fd422e299be34b43a600423ecebc0)
            check_type(argname="argument project_name", value=project_name, expected_type=type_hints["project_name"])
            check_type(argname="argument launch_name", value=launch_name, expected_type=type_hints["launch_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Evidently", jsii.invoke(self, "onLaunch", [project_name, launch_name, account, region, partition]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Evidently":
        '''(experimental) Adds a resource of type Project to the statement.

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_Project.html

        :param project_name: - Identifier for the projectName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a1848273313397c0afc3a354a06b18a097e635ba97014c3f575680597e873169)
            check_type(argname="argument project_name", value=project_name, expected_type=type_hints["project_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Evidently", jsii.invoke(self, "onProject", [project_name, account, region, partition]))

    @jsii.member(jsii_name="onSegment")
    def on_segment(
        self,
        segment_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Evidently":
        '''(experimental) Adds a resource of type Segment to the statement.

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_Segment.html

        :param segment_name: - Identifier for the segmentName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4d1754aa467519ee7ab24df98260b12e764fa150bc44fbfc005d7c74598ca948)
            check_type(argname="argument segment_name", value=segment_name, expected_type=type_hints["segment_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Evidently", jsii.invoke(self, "onSegment", [segment_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchEvaluateFeature")
    def to_batch_evaluate_feature(self) -> "Evidently":
        '''(experimental) Grants permission to send a batched evaluate feature request.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_BatchEvaluateFeature.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toBatchEvaluateFeature", []))

    @jsii.member(jsii_name="toCreateExperiment")
    def to_create_experiment(self) -> "Evidently":
        '''(experimental) Grants permission to create an experiment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_CreateExperiment.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toCreateExperiment", []))

    @jsii.member(jsii_name="toCreateFeature")
    def to_create_feature(self) -> "Evidently":
        '''(experimental) Grants permission to create a feature.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_CreateFeature.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toCreateFeature", []))

    @jsii.member(jsii_name="toCreateLaunch")
    def to_create_launch(self) -> "Evidently":
        '''(experimental) Grants permission to create a launch.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_CreateLaunch.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toCreateLaunch", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Evidently":
        '''(experimental) Grants permission to create a project.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - iam:GetRole

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_CreateProject.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toCreateSegment")
    def to_create_segment(self) -> "Evidently":
        '''(experimental) Grants permission to create a segment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_CreateSegment.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toCreateSegment", []))

    @jsii.member(jsii_name="toDeleteExperiment")
    def to_delete_experiment(self) -> "Evidently":
        '''(experimental) Grants permission to delete an experiment.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_DeleteExperiment.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toDeleteExperiment", []))

    @jsii.member(jsii_name="toDeleteFeature")
    def to_delete_feature(self) -> "Evidently":
        '''(experimental) Grants permission to delete a feature.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_DeleteFeature.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toDeleteFeature", []))

    @jsii.member(jsii_name="toDeleteLaunch")
    def to_delete_launch(self) -> "Evidently":
        '''(experimental) Grants permission to delete a launch.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_DeleteLaunch.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toDeleteLaunch", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Evidently":
        '''(experimental) Grants permission to delete a project.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_DeleteProject.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDeleteSegment")
    def to_delete_segment(self) -> "Evidently":
        '''(experimental) Grants permission to delete a segment.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_DeleteSegment.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toDeleteSegment", []))

    @jsii.member(jsii_name="toEvaluateFeature")
    def to_evaluate_feature(self) -> "Evidently":
        '''(experimental) Grants permission to send an evaluate feature request.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_EvaluateFeature.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toEvaluateFeature", []))

    @jsii.member(jsii_name="toGetExperiment")
    def to_get_experiment(self) -> "Evidently":
        '''(experimental) Grants permission to get experiment details.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_GetExperiment.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toGetExperiment", []))

    @jsii.member(jsii_name="toGetExperimentResults")
    def to_get_experiment_results(self) -> "Evidently":
        '''(experimental) Grants permission to get experiment result.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_GetExperimentResults.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toGetExperimentResults", []))

    @jsii.member(jsii_name="toGetFeature")
    def to_get_feature(self) -> "Evidently":
        '''(experimental) Grants permission to get feature details.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_GetFeature.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toGetFeature", []))

    @jsii.member(jsii_name="toGetLaunch")
    def to_get_launch(self) -> "Evidently":
        '''(experimental) Grants permission to get launch details.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_GetLaunch.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toGetLaunch", []))

    @jsii.member(jsii_name="toGetProject")
    def to_get_project(self) -> "Evidently":
        '''(experimental) Grants permission to get project details.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_GetProject.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toGetProject", []))

    @jsii.member(jsii_name="toGetSegment")
    def to_get_segment(self) -> "Evidently":
        '''(experimental) Grants permission to get segment details.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_GetSegment.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toGetSegment", []))

    @jsii.member(jsii_name="toListExperiments")
    def to_list_experiments(self) -> "Evidently":
        '''(experimental) Grants permission to list experiments.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_ListExperiments.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toListExperiments", []))

    @jsii.member(jsii_name="toListFeatures")
    def to_list_features(self) -> "Evidently":
        '''(experimental) Grants permission to list features.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_ListFeatures.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toListFeatures", []))

    @jsii.member(jsii_name="toListLaunches")
    def to_list_launches(self) -> "Evidently":
        '''(experimental) Grants permission to list launches.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_ListLaunches.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toListLaunches", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Evidently":
        '''(experimental) Grants permission to list projects.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_ListProjects.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListSegmentReferences")
    def to_list_segment_references(self) -> "Evidently":
        '''(experimental) Grants permission to list resources referencing a segment.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_ListSegmentReferences.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toListSegmentReferences", []))

    @jsii.member(jsii_name="toListSegments")
    def to_list_segments(self) -> "Evidently":
        '''(experimental) Grants permission to list segments.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_ListSegments.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toListSegments", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Evidently":
        '''(experimental) Grants permission to list tags for resources.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutProjectEvents")
    def to_put_project_events(self) -> "Evidently":
        '''(experimental) Grants permission to send performance events.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_PutProjectEvents.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toPutProjectEvents", []))

    @jsii.member(jsii_name="toStartExperiment")
    def to_start_experiment(self) -> "Evidently":
        '''(experimental) Grants permission to start an experiment.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_StartExperiment.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toStartExperiment", []))

    @jsii.member(jsii_name="toStartLaunch")
    def to_start_launch(self) -> "Evidently":
        '''(experimental) Grants permission to start a launch.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_StartLaunch.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toStartLaunch", []))

    @jsii.member(jsii_name="toStopExperiment")
    def to_stop_experiment(self) -> "Evidently":
        '''(experimental) Grants permission to stop an experiment.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_StopExperiment.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toStopExperiment", []))

    @jsii.member(jsii_name="toStopLaunch")
    def to_stop_launch(self) -> "Evidently":
        '''(experimental) Grants permission to stop a launch.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_StopLaunch.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toStopLaunch", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Evidently":
        '''(experimental) Grants permission to tag resources.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestSegmentPattern")
    def to_test_segment_pattern(self) -> "Evidently":
        '''(experimental) Grants permission to test a segment pattern.

        Access Level: Read

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_TestSegmentPattern.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toTestSegmentPattern", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Evidently":
        '''(experimental) Grants permission to untag resources.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateExperiment")
    def to_update_experiment(self) -> "Evidently":
        '''(experimental) Grants permission to update experiment.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_UpdateExperiment.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toUpdateExperiment", []))

    @jsii.member(jsii_name="toUpdateFeature")
    def to_update_feature(self) -> "Evidently":
        '''(experimental) Grants permission to update feature.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_UpdateFeature.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toUpdateFeature", []))

    @jsii.member(jsii_name="toUpdateLaunch")
    def to_update_launch(self) -> "Evidently":
        '''(experimental) Grants permission to update a launch.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_UpdateLaunch.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toUpdateLaunch", []))

    @jsii.member(jsii_name="toUpdateProject")
    def to_update_project(self) -> "Evidently":
        '''(experimental) Grants permission to update project.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - iam:GetRole

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_UpdateProject.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toUpdateProject", []))

    @jsii.member(jsii_name="toUpdateProjectDataDelivery")
    def to_update_project_data_delivery(self) -> "Evidently":
        '''(experimental) Grants permission to update project data delivery.

        Access Level: Write

        https://docs.aws.amazon.com/cloudwatchevidently/latest/APIReference/API_UpdateProjectDataDelivery.html

        :stability: experimental
        '''
        return typing.cast("Evidently", jsii.invoke(self, "toUpdateProjectDataDelivery", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__048de854b7cf4a63b7e9966d7438492402370540c88a439ab9d3162e9f33773b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__522d7b07325724ae2930b3fd5a59decda11d140fd4031748cc179da7ab80c6ea)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class ExecuteApi(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.ExecuteApi",
):
    '''(experimental) Statement provider for service `execute-api <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonapigateway.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `execute-api <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonapigateway.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__055283809827ec9bbcb33db5c0ce3741424a7ca4358e990e9308e7a1803736c4)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onExecuteApiGeneral")
    def on_execute_api_general(
        self,
        api_id: builtins.str,
        stage: builtins.str,
        method: builtins.str,
        api_specific_resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "ExecuteApi":
        '''(experimental) Adds a resource of type execute-api-general to the statement.

        :param api_id: - Identifier for the apiId.
        :param stage: - Identifier for the stage.
        :param method: - Identifier for the method.
        :param api_specific_resource_path: - Identifier for the apiSpecificResourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8e9d9e978b60fc666b955514b0803cff3eeb9d4667d672d2f89556470218fc2e)
            check_type(argname="argument api_id", value=api_id, expected_type=type_hints["api_id"])
            check_type(argname="argument stage", value=stage, expected_type=type_hints["stage"])
            check_type(argname="argument method", value=method, expected_type=type_hints["method"])
            check_type(argname="argument api_specific_resource_path", value=api_specific_resource_path, expected_type=type_hints["api_specific_resource_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("ExecuteApi", jsii.invoke(self, "onExecuteApiGeneral", [api_id, stage, method, api_specific_resource_path, account, region, partition]))

    @jsii.member(jsii_name="toInvalidateCache")
    def to_invalidate_cache(self) -> "ExecuteApi":
        '''(experimental) Used to invalidate API cache upon a client request.

        Access Level: Write

        https://docs.aws.amazon.com/apigateway/api-reference/api-gateway-caching.html

        :stability: experimental
        '''
        return typing.cast("ExecuteApi", jsii.invoke(self, "toInvalidateCache", []))

    @jsii.member(jsii_name="toInvoke")
    def to_invoke(self) -> "ExecuteApi":
        '''(experimental) Used to invoke an API upon a client request.

        Access Level: Write

        https://docs.aws.amazon.com/apigateway/api-reference/how-to-call-api.html

        :stability: experimental
        '''
        return typing.cast("ExecuteApi", jsii.invoke(self, "toInvoke", []))

    @jsii.member(jsii_name="toManageConnections")
    def to_manage_connections(self) -> "ExecuteApi":
        '''(experimental) ManageConnections controls access to the @connections API.

        Access Level: Write

        https://docs.aws.amazon.com/apigateway/api-reference/apigateway-websocket-control-access-iam.html

        :stability: experimental
        '''
        return typing.cast("ExecuteApi", jsii.invoke(self, "toManageConnections", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__180b3ab7980254ca0455ea60d9e746d17d5b64922ef2a70047a0368aff165856)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2a8e6ce742182a48a046d13580dd2649a06483d028fb3ce01356cc9455c86a7e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Finspace(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Finspace",
):
    '''(experimental) Statement provider for service `finspace <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfinspace.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `finspace <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfinspace.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e3141f53f4e2670814f18bea65f32fb909042c63b37dc5074f4d642ce196e657)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onEnvironment")
    def on_environment(
        self,
        environment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Finspace":
        '''(experimental) Adds a resource of type environment to the statement.

        https://docs.aws.amazon.com/finspace/latest/userguide/finspace-example-policies.html

        :param environment_id: - Identifier for the environmentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c5992d6afe1fda5c036254cbcf2519f3b18abd03cec8df6b6ee05be76fbd90db)
            check_type(argname="argument environment_id", value=environment_id, expected_type=type_hints["environment_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Finspace", jsii.invoke(self, "onEnvironment", [environment_id, account, region, partition]))

    @jsii.member(jsii_name="onUser")
    def on_user(
        self,
        user_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Finspace":
        '''(experimental) Adds a resource of type user to the statement.

        https://docs.aws.amazon.com/finspace/latest/userguide/finspace-example-policies.html

        :param user_id: - Identifier for the userId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9eff410e029ca4bf7b7db3a89e1fcd0703bfebed7774eb1e1a7b239082f8c7ae)
            check_type(argname="argument user_id", value=user_id, expected_type=type_hints["user_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Finspace", jsii.invoke(self, "onUser", [user_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateEnvironment")
    def to_create_environment(self) -> "Finspace":
        '''(experimental) Grants permission to create a FinSpace environment.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/finspace/latest/management-api/API_CreateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Finspace", jsii.invoke(self, "toCreateEnvironment", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Finspace":
        '''(experimental) Grants permission to create a FinSpace user.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/finspace/latest/userguide/finspace-what-is.html

        :stability: experimental
        '''
        return typing.cast("Finspace", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toDeleteEnvironment")
    def to_delete_environment(self) -> "Finspace":
        '''(experimental) Grants permission to delete a FinSpace environment.

        Access Level: Write

        https://docs.aws.amazon.com/finspace/latest/management-api/API_DeleteEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Finspace", jsii.invoke(self, "toDeleteEnvironment", []))

    @jsii.member(jsii_name="toGetEnvironment")
    def to_get_environment(self) -> "Finspace":
        '''(experimental) Grants permission to describe a FinSpace environment.

        Access Level: Read

        https://docs.aws.amazon.com/finspace/latest/management-api/API_GetEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Finspace", jsii.invoke(self, "toGetEnvironment", []))

    @jsii.member(jsii_name="toGetLoadSampleDataSetGroupIntoEnvironmentStatus")
    def to_get_load_sample_data_set_group_into_environment_status(self) -> "Finspace":
        '''(experimental) Grants permission to request status of the loading of sample data bundle.

        Access Level: Read

        https://docs.aws.amazon.com/finspace/latest/userguide/finspace-what-is.html

        :stability: experimental
        '''
        return typing.cast("Finspace", jsii.invoke(self, "toGetLoadSampleDataSetGroupIntoEnvironmentStatus", []))

    @jsii.member(jsii_name="toGetUser")
    def to_get_user(self) -> "Finspace":
        '''(experimental) Grants permission to describe a FinSpace user.

        Access Level: Read

        https://docs.aws.amazon.com/finspace/latest/userguide/finspace-what-is.html

        :stability: experimental
        '''
        return typing.cast("Finspace", jsii.invoke(self, "toGetUser", []))

    @jsii.member(jsii_name="toListEnvironments")
    def to_list_environments(self) -> "Finspace":
        '''(experimental) Grants permission to list FinSpace environments in the AWS account.

        Access Level: List

        https://docs.aws.amazon.com/finspace/latest/management-api/API_ListEnvironments.html

        :stability: experimental
        '''
        return typing.cast("Finspace", jsii.invoke(self, "toListEnvironments", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Finspace":
        '''(experimental) Grants permission to return a list of tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/finspace/latest/management-api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Finspace", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListUsers")
    def to_list_users(self) -> "Finspace":
        '''(experimental) Grants permission to list FinSpace users in an environment.

        Access Level: List

        https://docs.aws.amazon.com/finspace/latest/userguide/finspace-what-is.html

        :stability: experimental
        '''
        return typing.cast("Finspace", jsii.invoke(self, "toListUsers", []))

    @jsii.member(jsii_name="toLoadSampleDataSetGroupIntoEnvironment")
    def to_load_sample_data_set_group_into_environment(self) -> "Finspace":
        '''(experimental) Grants permission to load sample data bundle into your FinSpace environment.

        Access Level: Write

        https://docs.aws.amazon.com/finspace/latest/userguide/finspace-what-is.html

        :stability: experimental
        '''
        return typing.cast("Finspace", jsii.invoke(self, "toLoadSampleDataSetGroupIntoEnvironment", []))

    @jsii.member(jsii_name="toResetUserPassword")
    def to_reset_user_password(self) -> "Finspace":
        '''(experimental) Grants permission to reset the password for a FinSpace user.

        Access Level: Write

        https://docs.aws.amazon.com/finspace/latest/userguide/finspace-what-is.html

        :stability: experimental
        '''
        return typing.cast("Finspace", jsii.invoke(self, "toResetUserPassword", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Finspace":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/finspace/latest/management-api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Finspace", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Finspace":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/finspace/latest/management-api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Finspace", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateEnvironment")
    def to_update_environment(self) -> "Finspace":
        '''(experimental) Grants permission to update a FinSpace environment.

        Access Level: Write

        https://docs.aws.amazon.com/finspace/latest/management-api/API_UpdateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("Finspace", jsii.invoke(self, "toUpdateEnvironment", []))

    @jsii.member(jsii_name="toUpdateUser")
    def to_update_user(self) -> "Finspace":
        '''(experimental) Grants permission to update a FinSpace user.

        Access Level: Write

        https://docs.aws.amazon.com/finspace/latest/userguide/finspace-what-is.html

        :stability: experimental
        '''
        return typing.cast("Finspace", jsii.invoke(self, "toUpdateUser", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c05254bb1ae3ec3d2ba6a07beb898d07333a0bcbef6329c706b442966c25fe39)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c22a9cb8e755d2c081c25f3629f6c9ad341ec01e5fe0113d7828b04ddff35d8b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class FinspaceApi(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.FinspaceApi",
):
    '''(experimental) Statement provider for service `finspace-api <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfinspaceapi.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `finspace-api <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfinspaceapi.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1bbdf94eb65dcaca41126308e7cfa2339a73230dbeebaa6cf3855d5bef9b8c7f)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onCredential")
    def on_credential(
        self,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "FinspaceApi":
        '''(experimental) Adds a resource of type credential to the statement.

        https://docs.aws.amazon.com/finspace/latest/userguide/finspace-example-policies.html

        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1bed8238c7f33e60c633812d5069cc3cb226d11c3ca59c0b5acb57f142d40608)
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("FinspaceApi", jsii.invoke(self, "onCredential", [account, region, partition]))

    @jsii.member(jsii_name="toGetProgrammaticAccessCredentials")
    def to_get_programmatic_access_credentials(self) -> "FinspaceApi":
        '''(experimental) Grants permission to retrieve FinSpace programmatic access credentials.

        Access Level: Read

        https://docs.aws.amazon.com/finspace/latest/data-api/API_GetProgrammaticAccessCredentials.html

        :stability: experimental
        '''
        return typing.cast("FinspaceApi", jsii.invoke(self, "toGetProgrammaticAccessCredentials", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__58103f9d2e8ad29484e6daca5b651219115fc1611e9a11643e773415fbd6631c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a626ebd8f74ad461bbd0700e05761ceb99b271b06b0d3c22586e0ad0ee785a92)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Firehose(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Firehose",
):
    '''(experimental) Statement provider for service `firehose <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesisfirehose.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `firehose <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesisfirehose.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4793a6f509edb17ecaf65f05cdd093c9491b858379e44a7c15288dd1a62980d6)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDeliverystream")
    def on_deliverystream(
        self,
        delivery_stream_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Firehose":
        '''(experimental) Adds a resource of type deliverystream to the statement.

        https://docs.aws.amazon.com/firehose/latest/dev/basic-create.html

        :param delivery_stream_name: - Identifier for the deliveryStreamName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bbca5e8adc846d90ef9663f1bbd1e2176188db0b987fee7c3d257d13707253b1)
            check_type(argname="argument delivery_stream_name", value=delivery_stream_name, expected_type=type_hints["delivery_stream_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Firehose", jsii.invoke(self, "onDeliverystream", [delivery_stream_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateDeliveryStream")
    def to_create_delivery_stream(self) -> "Firehose":
        '''(experimental) Grants permission to create a delivery stream.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_CreateDeliveryStream.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toCreateDeliveryStream", []))

    @jsii.member(jsii_name="toDeleteDeliveryStream")
    def to_delete_delivery_stream(self) -> "Firehose":
        '''(experimental) Grants permission to delete a delivery stream and its data.

        Access Level: Write

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_DeleteDeliveryStream.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toDeleteDeliveryStream", []))

    @jsii.member(jsii_name="toDescribeDeliveryStream")
    def to_describe_delivery_stream(self) -> "Firehose":
        '''(experimental) Grants permission to describe the specified delivery stream and gets the status.

        Access Level: Read

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_DescribeDeliveryStream.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toDescribeDeliveryStream", []))

    @jsii.member(jsii_name="toListDeliveryStreams")
    def to_list_delivery_streams(self) -> "Firehose":
        '''(experimental) Grants permission to list your delivery streams.

        Access Level: List

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_ListDeliveryStreams.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toListDeliveryStreams", []))

    @jsii.member(jsii_name="toListTagsForDeliveryStream")
    def to_list_tags_for_delivery_stream(self) -> "Firehose":
        '''(experimental) Grants permission to list the tags for the specified delivery stream.

        Access Level: List

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_ListTagsForDeliveryStream.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toListTagsForDeliveryStream", []))

    @jsii.member(jsii_name="toPutRecord")
    def to_put_record(self) -> "Firehose":
        '''(experimental) Grants permission to write a single data record into an Amazon Kinesis Firehose delivery stream.

        Access Level: Write

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_PutRecord.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toPutRecord", []))

    @jsii.member(jsii_name="toPutRecordBatch")
    def to_put_record_batch(self) -> "Firehose":
        '''(experimental) Grants permission to write multiple data records into a delivery stream in a single call, which can achieve higher throughput per producer than when writing single records.

        Access Level: Write

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_PutRecordBatch.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toPutRecordBatch", []))

    @jsii.member(jsii_name="toStartDeliveryStreamEncryption")
    def to_start_delivery_stream_encryption(self) -> "Firehose":
        '''(experimental) Grants permission to enable server-side encryption (SSE) for the delivery stream.

        Access Level: Write

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_StartDeliveryStreamEncryption.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toStartDeliveryStreamEncryption", []))

    @jsii.member(jsii_name="toStopDeliveryStreamEncryption")
    def to_stop_delivery_stream_encryption(self) -> "Firehose":
        '''(experimental) Grants permission to disable the specified destination of the specified delivery stream.

        Access Level: Write

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_StopDeliveryStreamEncryption.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toStopDeliveryStreamEncryption", []))

    @jsii.member(jsii_name="toTagDeliveryStream")
    def to_tag_delivery_stream(self) -> "Firehose":
        '''(experimental) Grants permission to add or update tags for the specified delivery stream.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_TagDeliveryStream.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toTagDeliveryStream", []))

    @jsii.member(jsii_name="toUntagDeliveryStream")
    def to_untag_delivery_stream(self) -> "Firehose":
        '''(experimental) Grants permission to remove tags from the specified delivery stream.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_UntagDeliveryStream.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toUntagDeliveryStream", []))

    @jsii.member(jsii_name="toUpdateDestination")
    def to_update_destination(self) -> "Firehose":
        '''(experimental) Grants permission to update the specified destination of the specified delivery stream.

        Access Level: Write

        https://docs.aws.amazon.com/firehose/latest/APIReference/API_UpdateDestination.html

        :stability: experimental
        '''
        return typing.cast("Firehose", jsii.invoke(self, "toUpdateDestination", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b3251c7baa9b2dd0f544631fef8a177bbe2114334bc3421328f354dd12933ce5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7a2857c4e0f0a88c90ff518ebb76c009672cd8e5c351fc68a93f89ef4281b7a5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Fis(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Fis"):
    '''(experimental) Statement provider for service `fis <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsfaultinjectionsimulator.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `fis <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsfaultinjectionsimulator.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5c2a89fe66af6403c7bcfd272e7d3a1774916f15f694e63566c614e243064652)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifOperations")
    def if_operations(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Fis":
        '''(experimental) Filters access by the list of operations on the AWS service that is being affected by the AWS FIS action.

        https://docs.aws.amazon.com/fis/latest/userguide/security_iam_service-with-iam.html

        Applies to actions:

        - .toInjectApiInternalError()
        - .toInjectApiThrottleError()
        - .toInjectApiUnavailableError()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6f36dbd817c98e79cdc4c7b2175e9c594d2a0be923196e2f67087b8b7ab5ceb3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Fis", jsii.invoke(self, "ifOperations", [value, operator]))

    @jsii.member(jsii_name="ifPercentage")
    def if_percentage(
        self,
        value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Fis":
        '''(experimental) Filters access by the percentage of calls being affected by the AWS FIS action.

        https://docs.aws.amazon.com/fis/latest/userguide/security_iam_service-with-iam.html

        Applies to actions:

        - .toInjectApiInternalError()
        - .toInjectApiThrottleError()
        - .toInjectApiUnavailableError()

        :param value: The value(s) to check.
        :param operator: Works with `numeric operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Numeric>`_. **Default:** ``NumericEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5751e30650bc56da03c635665769c03790f80003c9d613b486286a34ded936da)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Fis", jsii.invoke(self, "ifPercentage", [value, operator]))

    @jsii.member(jsii_name="ifService")
    def if_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Fis":
        '''(experimental) Filters access by the AWS service that is being affected by the AWS FIS action.

        https://docs.aws.amazon.com/fis/latest/userguide/security_iam_service-with-iam.html

        Applies to actions:

        - .toInjectApiInternalError()
        - .toInjectApiThrottleError()
        - .toInjectApiUnavailableError()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3362892eaaab1c244ee1599b02c32d124e4903a1ffda4f509099e7a8a10b25f4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Fis", jsii.invoke(self, "ifService", [value, operator]))

    @jsii.member(jsii_name="ifTargets")
    def if_targets(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Fis":
        '''(experimental) Filters access by the list of resource ARNs being targeted by the AWS FIS action.

        https://docs.aws.amazon.com/fis/latest/userguide/security_iam_service-with-iam.html

        Applies to actions:

        - .toInjectApiInternalError()
        - .toInjectApiThrottleError()
        - .toInjectApiUnavailableError()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1199b9a534afabaa1c7d0884b140adeeac0757ac11a051a66dca5dfdb4a079f4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Fis", jsii.invoke(self, "ifTargets", [value, operator]))

    @jsii.member(jsii_name="onAction")
    def on_action(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fis":
        '''(experimental) Adds a resource of type action to the statement.

        https://docs.aws.amazon.com/fis/latest/userguide/actions.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__36d949c366d8a5003524ff5e7397f40a690a4bfa6c58b9f87a64eef276c3d765)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Fis", jsii.invoke(self, "onAction", [id, account, region, partition]))

    @jsii.member(jsii_name="onExperiment")
    def on_experiment(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fis":
        '''(experimental) Adds a resource of type experiment to the statement.

        https://docs.aws.amazon.com/fis/latest/userguide/experiments.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e2da0642497cdfc2573e484b686a22c0e3f50ab28b5e571fb02ebec10ffc40c4)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Fis", jsii.invoke(self, "onExperiment", [id, account, region, partition]))

    @jsii.member(jsii_name="onExperimentTemplate")
    def on_experiment_template(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fis":
        '''(experimental) Adds a resource of type experiment-template to the statement.

        https://docs.aws.amazon.com/fis/latest/userguide/working-with-templates.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bec3232c42d95310f08bd9725b134f9f2a87d4c2adadef9d1d75dcd8edc189e2)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Fis", jsii.invoke(self, "onExperimentTemplate", [id, account, region, partition]))

    @jsii.member(jsii_name="toCreateExperimentTemplate")
    def to_create_experiment_template(self) -> "Fis":
        '''(experimental) Grants permission to create an AWS FIS experiment template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fis/latest/APIReference/API_CreateExperimentTemplate.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toCreateExperimentTemplate", []))

    @jsii.member(jsii_name="toDeleteExperimentTemplate")
    def to_delete_experiment_template(self) -> "Fis":
        '''(experimental) Grants permission to delete the AWS FIS experiment template.

        Access Level: Write

        https://docs.aws.amazon.com/fis/latest/APIReference/API_DeleteExperimentTemplate.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toDeleteExperimentTemplate", []))

    @jsii.member(jsii_name="toGetAction")
    def to_get_action(self) -> "Fis":
        '''(experimental) Grants permission to retrieve an AWS FIS action.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/fis/latest/APIReference/API_GetAction.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toGetAction", []))

    @jsii.member(jsii_name="toGetExperiment")
    def to_get_experiment(self) -> "Fis":
        '''(experimental) Grants permission to retrieve an AWS FIS experiment.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/fis/latest/APIReference/API_GetExperiment.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toGetExperiment", []))

    @jsii.member(jsii_name="toGetExperimentTemplate")
    def to_get_experiment_template(self) -> "Fis":
        '''(experimental) Grants permission to retrieve an AWS FIS Experiment Template.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/fis/latest/APIReference/API_GetExperimentTemplate.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toGetExperimentTemplate", []))

    @jsii.member(jsii_name="toGetTargetResourceType")
    def to_get_target_resource_type(self) -> "Fis":
        '''(experimental) Grants permission to get information about the specified resource type.

        Access Level: Read

        https://docs.aws.amazon.com/fis/latest/APIReference/API_GetTargetResourceType.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toGetTargetResourceType", []))

    @jsii.member(jsii_name="toInjectApiInternalError")
    def to_inject_api_internal_error(self) -> "Fis":
        '''(experimental) Grants permission to inject an API internal error on the provided AWS service from an FIS Experiment.

        Access Level: Write

        Possible conditions:

        - .ifService()
        - .ifOperations()
        - .ifPercentage()
        - .ifTargets()

        https://docs.aws.amazon.com/fis/latest/userguide/fis-actions-reference.html#fis-actions-reference-fis

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toInjectApiInternalError", []))

    @jsii.member(jsii_name="toInjectApiThrottleError")
    def to_inject_api_throttle_error(self) -> "Fis":
        '''(experimental) Grants permission to inject an API throttle error on the provided AWS service from an FIS Experiment.

        Access Level: Write

        Possible conditions:

        - .ifService()
        - .ifOperations()
        - .ifPercentage()
        - .ifTargets()

        https://docs.aws.amazon.com/fis/latest/userguide/fis-actions-reference.html#fis-actions-reference-fis

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toInjectApiThrottleError", []))

    @jsii.member(jsii_name="toInjectApiUnavailableError")
    def to_inject_api_unavailable_error(self) -> "Fis":
        '''(experimental) Grants permission to inject an API unavailable error on the provided AWS service from an FIS Experiment.

        Access Level: Write

        Possible conditions:

        - .ifService()
        - .ifOperations()
        - .ifPercentage()
        - .ifTargets()

        https://docs.aws.amazon.com/fis/latest/userguide/fis-actions-reference.html#fis-actions-reference-fis

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toInjectApiUnavailableError", []))

    @jsii.member(jsii_name="toListActions")
    def to_list_actions(self) -> "Fis":
        '''(experimental) Grants permission to list all available AWS FIS actions.

        Access Level: List

        https://docs.aws.amazon.com/fis/latest/APIReference/API_ListActions.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toListActions", []))

    @jsii.member(jsii_name="toListExperiments")
    def to_list_experiments(self) -> "Fis":
        '''(experimental) Grants permission to list all available AWS FIS experiments.

        Access Level: List

        https://docs.aws.amazon.com/fis/latest/APIReference/API_ListExperiments.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toListExperiments", []))

    @jsii.member(jsii_name="toListExperimentTemplates")
    def to_list_experiment_templates(self) -> "Fis":
        '''(experimental) Grants permission to list all available AWS FIS experiment templates.

        Access Level: List

        https://docs.aws.amazon.com/fis/latest/APIReference/API_ListExperimentTemplates.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toListExperimentTemplates", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Fis":
        '''(experimental) Grants permission to list the tags for an AWS FIS resource.

        Access Level: Read

        https://docs.aws.amazon.com/fis/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTargetResourceTypes")
    def to_list_target_resource_types(self) -> "Fis":
        '''(experimental) Grants permission to list the resource types.

        Access Level: List

        https://docs.aws.amazon.com/fis/latest/APIReference/API_ListTargetResourceTypes.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toListTargetResourceTypes", []))

    @jsii.member(jsii_name="toStartExperiment")
    def to_start_experiment(self) -> "Fis":
        '''(experimental) Grants permission to run an AWS FIS experiment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/fis/latest/APIReference/API_StartExperiment.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toStartExperiment", []))

    @jsii.member(jsii_name="toStopExperiment")
    def to_stop_experiment(self) -> "Fis":
        '''(experimental) Grants permission to stop an AWS FIS experiment.

        Access Level: Write

        https://docs.aws.amazon.com/fis/latest/APIReference/API_StopExperiment.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toStopExperiment", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Fis":
        '''(experimental) Grants permission to tag AWS FIS resources.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/fis/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Fis":
        '''(experimental) Grants permission to untag AWS FIS resources.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/fis/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateExperimentTemplate")
    def to_update_experiment_template(self) -> "Fis":
        '''(experimental) Grants permission to update the specified AWS FIS experiment template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fis/latest/APIReference/API_UpdateExperimentTemplate.html

        :stability: experimental
        '''
        return typing.cast("Fis", jsii.invoke(self, "toUpdateExperimentTemplate", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1508525bc962989db82508bc2401b3273df5d8ca7df7803248b69ddba344efd0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6c607b51374f1b353b8715f6ca9b74e28d507ed723398dd598235f9dd8f2f337)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Fms(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Fms"):
    '''(experimental) Statement provider for service `fms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsfirewallmanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `fms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsfirewallmanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c0b0dd1c62b7edf67563b08fc24868d3d3fd4085aba16cfcc7688e60f4e3bbf4)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onApplicationsList")
    def on_applications_list(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fms":
        '''(experimental) Adds a resource of type applications-list to the statement.

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_AppsListData.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__433e4ee3cf7f88ac69a2f6cf20688d3d56a0668cd10ceae544b66d963ed1c567)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Fms", jsii.invoke(self, "onApplicationsList", [id, account, region, partition]))

    @jsii.member(jsii_name="onPolicy")
    def on_policy(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fms":
        '''(experimental) Adds a resource of type policy to the statement.

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_Policy.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__06348f3f6d190f5ade6fcaa8941f7ed30e6d0c5b676465a43ba0d377a08cdd0a)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Fms", jsii.invoke(self, "onPolicy", [id, account, region, partition]))

    @jsii.member(jsii_name="onProtocolsList")
    def on_protocols_list(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fms":
        '''(experimental) Adds a resource of type protocols-list to the statement.

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_ProtocolsListData.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ad17ef696a7dec66e0a970cd733f56fe5296333e4f1b0c891004b6ac34e377d2)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Fms", jsii.invoke(self, "onProtocolsList", [id, account, region, partition]))

    @jsii.member(jsii_name="onResourceSet")
    def on_resource_set(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fms":
        '''(experimental) Adds a resource of type resource-set to the statement.

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_ResourceSet.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a5c7fb27e82d16399d1eeac33f6af33c09d495d870f22088613d5b0d42c8dcaf)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Fms", jsii.invoke(self, "onResourceSet", [id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateAdminAccount")
    def to_associate_admin_account(self) -> "Fms":
        '''(experimental) Grants permission to set the AWS Firewall Manager administrator account and enables the service in all organization accounts.

        Access Level: Write

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_AssociateAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toAssociateAdminAccount", []))

    @jsii.member(jsii_name="toAssociateThirdPartyFirewall")
    def to_associate_third_party_firewall(self) -> "Fms":
        '''(experimental) Grants permission to set the Firewall Manager administrator as a tenant administrator of a third-party firewall service.

        Access Level: Write

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_AssociateThirdPartyFirewall.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toAssociateThirdPartyFirewall", []))

    @jsii.member(jsii_name="toBatchAssociateResource")
    def to_batch_associate_resource(self) -> "Fms":
        '''(experimental) Grants permission to associate resources to an AWS Firewall Manager resource set.

        Access Level: Write

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_BatchAssociateResource.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toBatchAssociateResource", []))

    @jsii.member(jsii_name="toBatchDisassociateResource")
    def to_batch_disassociate_resource(self) -> "Fms":
        '''(experimental) Grants permission to disassociate resources from an AWS Firewall Manager resource set.

        Access Level: Write

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_BatchDisassociateResource.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toBatchDisassociateResource", []))

    @jsii.member(jsii_name="toDeleteAppsList")
    def to_delete_apps_list(self) -> "Fms":
        '''(experimental) Grants permission to permanently deletes an AWS Firewall Manager applications list.

        Access Level: Write

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_DeleteAppsList.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toDeleteAppsList", []))

    @jsii.member(jsii_name="toDeleteNotificationChannel")
    def to_delete_notification_channel(self) -> "Fms":
        '''(experimental) Grants permission to delete an AWS Firewall Manager association with the IAM role and the Amazon Simple Notification Service (SNS) topic that is used to notify the FM administrator about major FM events and errors across the organization.

        Access Level: Write

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_DeleteNotificationChannel.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toDeleteNotificationChannel", []))

    @jsii.member(jsii_name="toDeletePolicy")
    def to_delete_policy(self) -> "Fms":
        '''(experimental) Grants permission to permanently delete an AWS Firewall Manager policy.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_DeletePolicy.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toDeletePolicy", []))

    @jsii.member(jsii_name="toDeleteProtocolsList")
    def to_delete_protocols_list(self) -> "Fms":
        '''(experimental) Grants permission to permanently deletes an AWS Firewall Manager protocols list.

        Access Level: Write

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_DeleteProtocolsList.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toDeleteProtocolsList", []))

    @jsii.member(jsii_name="toDeleteResourceSet")
    def to_delete_resource_set(self) -> "Fms":
        '''(experimental) Grants permission to permanently delete an AWS Firewall Manager resource set.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_DeleteResourceSet.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toDeleteResourceSet", []))

    @jsii.member(jsii_name="toDisassociateAdminAccount")
    def to_disassociate_admin_account(self) -> "Fms":
        '''(experimental) Grants permission to disassociate the account that has been set as the AWS Firewall Manager administrator account and and disables the service in all organization accounts.

        Access Level: Write

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_DisassociateAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toDisassociateAdminAccount", []))

    @jsii.member(jsii_name="toDisassociateThirdPartyFirewall")
    def to_disassociate_third_party_firewall(self) -> "Fms":
        '''(experimental) Grants permission to disassociate a Firewall Manager administrator from a third-party firewall tenant.

        Access Level: Write

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_DisassociateThirdPartyFirewall.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toDisassociateThirdPartyFirewall", []))

    @jsii.member(jsii_name="toGetAdminAccount")
    def to_get_admin_account(self) -> "Fms":
        '''(experimental) Grants permission to return the AWS Organizations account that is associated with AWS Firewall Manager as the AWS Firewall Manager administrator.

        Access Level: Read

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_GetAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toGetAdminAccount", []))

    @jsii.member(jsii_name="toGetAppsList")
    def to_get_apps_list(self) -> "Fms":
        '''(experimental) Grants permission to return information about the specified AWS Firewall Manager applications list.

        Access Level: Read

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_GetAppsList.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toGetAppsList", []))

    @jsii.member(jsii_name="toGetComplianceDetail")
    def to_get_compliance_detail(self) -> "Fms":
        '''(experimental) Grants permission to retrieve detailed compliance information about the specified member account.

        Details include resources that are in and out of compliance with the specified policy

        Access Level: Read

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_GetComplianceDetail.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toGetComplianceDetail", []))

    @jsii.member(jsii_name="toGetNotificationChannel")
    def to_get_notification_channel(self) -> "Fms":
        '''(experimental) Grants permission to retrieve information about the Amazon Simple Notification Service (SNS) topic that is used to record AWS Firewall Manager SNS logs.

        Access Level: Read

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_GetNotificationChannel.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toGetNotificationChannel", []))

    @jsii.member(jsii_name="toGetPolicy")
    def to_get_policy(self) -> "Fms":
        '''(experimental) Grants permission to retrieve information about the specified AWS Firewall Manager policy.

        Access Level: Read

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_GetPolicy.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toGetPolicy", []))

    @jsii.member(jsii_name="toGetProtectionStatus")
    def to_get_protection_status(self) -> "Fms":
        '''(experimental) Grants permission to retrieve policy-level attack summary information in the event of a potential DDoS attack.

        Access Level: Read

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_GetProtectionStatus.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toGetProtectionStatus", []))

    @jsii.member(jsii_name="toGetProtocolsList")
    def to_get_protocols_list(self) -> "Fms":
        '''(experimental) Grants permission to return information about the specified AWS Firewall Manager protocols list.

        Access Level: Read

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_GetProtocolsList.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toGetProtocolsList", []))

    @jsii.member(jsii_name="toGetResourceSet")
    def to_get_resource_set(self) -> "Fms":
        '''(experimental) Grants permission to retrieve information about the specified AWS Firewall Manager resource set.

        Access Level: Read

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_GetResourceSet.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toGetResourceSet", []))

    @jsii.member(jsii_name="toGetThirdPartyFirewallAssociationStatus")
    def to_get_third_party_firewall_association_status(self) -> "Fms":
        '''(experimental) Grants permission to retrieve the onboarding status of a Firewall Manager administrator account to third-party firewall vendor tenant.

        Access Level: Read

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_GetThirdPartyFirewallAssociationStatus.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toGetThirdPartyFirewallAssociationStatus", []))

    @jsii.member(jsii_name="toGetViolationDetails")
    def to_get_violation_details(self) -> "Fms":
        '''(experimental) Grants permission to retrieve violations for a resource based on the specified AWS Firewall Manager policy and AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_GetViolationDetails.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toGetViolationDetails", []))

    @jsii.member(jsii_name="toListAppsLists")
    def to_list_apps_lists(self) -> "Fms":
        '''(experimental) Grants permission to return an array of AppsListDataSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_ListAppsLists.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toListAppsLists", []))

    @jsii.member(jsii_name="toListComplianceStatus")
    def to_list_compliance_status(self) -> "Fms":
        '''(experimental) Grants permission to retrieve an array of PolicyComplianceStatus objects in the response.

        Use PolicyComplianceStatus to get a summary of which member accounts are protected by the specified policy

        Access Level: List

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_ListComplianceStatus.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toListComplianceStatus", []))

    @jsii.member(jsii_name="toListDiscoveredResources")
    def to_list_discovered_resources(self) -> "Fms":
        '''(experimental) Grants permission to retrieve an array of resources in the organization's accounts that are available to be associated with a resource set.

        Access Level: List

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_ListDiscoveredResources.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toListDiscoveredResources", []))

    @jsii.member(jsii_name="toListMemberAccounts")
    def to_list_member_accounts(self) -> "Fms":
        '''(experimental) Grants permission to retrieve an array of member account ids if the caller is FMS admin account.

        Access Level: List

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_ListMemberAccounts.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toListMemberAccounts", []))

    @jsii.member(jsii_name="toListPolicies")
    def to_list_policies(self) -> "Fms":
        '''(experimental) Grants permission to retrieve an array of PolicySummary objects in the response.

        Access Level: List

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_ListPolicies.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toListPolicies", []))

    @jsii.member(jsii_name="toListProtocolsLists")
    def to_list_protocols_lists(self) -> "Fms":
        '''(experimental) Grants permission to return an array of ProtocolsListDataSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_ListProtocolsLists.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toListProtocolsLists", []))

    @jsii.member(jsii_name="toListResourceSetResources")
    def to_list_resource_set_resources(self) -> "Fms":
        '''(experimental) Grants permission to retrieve an array of resources that are currently associated to a resource set.

        Access Level: List

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_ListResourceSetResources.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toListResourceSetResources", []))

    @jsii.member(jsii_name="toListResourceSets")
    def to_list_resource_sets(self) -> "Fms":
        '''(experimental) Grants permission to retrieve an array of ResourceSetSummary objects.

        Access Level: List

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_ListResourceSets.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toListResourceSets", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Fms":
        '''(experimental) Grants permission to list Tags for a given resource.

        Access Level: Read

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListThirdPartyFirewallFirewallPolicies")
    def to_list_third_party_firewall_firewall_policies(self) -> "Fms":
        '''(experimental) Grants permission to retrieve a list of all of the third-party firewall policies that are associated with the third-party firewall administrator's account.

        Access Level: List

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_ListThirdPartyFirewallFirewallPolicies.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toListThirdPartyFirewallFirewallPolicies", []))

    @jsii.member(jsii_name="toPutAppsList")
    def to_put_apps_list(self) -> "Fms":
        '''(experimental) Grants permission to create an AWS Firewall Manager applications list.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_PutAppsList.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toPutAppsList", []))

    @jsii.member(jsii_name="toPutNotificationChannel")
    def to_put_notification_channel(self) -> "Fms":
        '''(experimental) Grants permission to designate the IAM role and Amazon Simple Notification Service (SNS) topic that AWS Firewall Manager (FM) could use to notify the FM administrator about major FM events and errors across the organization.

        Access Level: Write

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_PutNotificationChannel.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toPutNotificationChannel", []))

    @jsii.member(jsii_name="toPutPolicy")
    def to_put_policy(self) -> "Fms":
        '''(experimental) Grants permission to create an AWS Firewall Manager policy.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_PutPolicy.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toPutPolicy", []))

    @jsii.member(jsii_name="toPutProtocolsList")
    def to_put_protocols_list(self) -> "Fms":
        '''(experimental) Grants permission to creates an AWS Firewall Manager protocols list.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_PutProtocolsList.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toPutProtocolsList", []))

    @jsii.member(jsii_name="toPutResourceSet")
    def to_put_resource_set(self) -> "Fms":
        '''(experimental) Grants permission to create an AWS Firewall Manager resource set.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_PutResourceSet.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toPutResourceSet", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Fms":
        '''(experimental) Grants permission to add a Tag to a given resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Fms":
        '''(experimental) Grants permission to remove a Tag from a given resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Fms", jsii.invoke(self, "toUntagResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__aaa2cb56a6d04f19ff9720ae141e8cffbf0ee1ae3030aea5467c7edb53312198)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1c85a3b0836cf602d2829bff5bfbcef3d7ac1d257c971197b5903d9f6f419a57)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Forecast(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Forecast",
):
    '''(experimental) Statement provider for service `forecast <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonforecast.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `forecast <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonforecast.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__31abb8af6ff80fc74e79721da36abb2beeccee4f662a48af8e00c8451b9573c5)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAlgorithm")
    def on_algorithm(
        self,
        resource_id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type algorithm to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/aws-forecast-choosing-recipes.html

        :param resource_id: - Identifier for the resourceId.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b38313b44742b444c5bba98c7889fcb44802558b10d3f5c29c83d4009f5bb9bc)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Forecast", jsii.invoke(self, "onAlgorithm", [resource_id, partition]))

    @jsii.member(jsii_name="onDataset")
    def on_dataset(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type dataset to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateDataset.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__41212f0e591dff4d50e2c7482a1bb0a468ca944e8b1e0f4e04eea0c00600bab6)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Forecast", jsii.invoke(self, "onDataset", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onDatasetGroup")
    def on_dataset_group(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type datasetGroup to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateDatasetGroup.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__323abb3ae7e193d790005610c342f3502b18ef4e59dd19218a4782fa48bd76f6)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Forecast", jsii.invoke(self, "onDatasetGroup", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onDatasetImportJob")
    def on_dataset_import_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type datasetImportJob to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateDatasetImportJob.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c79ddc641f305467d073778610a25444478704c6fbfe9209fdc21de2d51fc165)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Forecast", jsii.invoke(self, "onDatasetImportJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onEndpoint")
    def on_endpoint(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type endpoint to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/what-is-forecast.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5c57ab6ed390cb1326b734ab71d78a9f009f1a0d2318ca3185b8786d412125dc)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Forecast", jsii.invoke(self, "onEndpoint", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onExplainability")
    def on_explainability(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type explainability to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateExplainability.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0049249649ada9099cda0c904c1b591dc57d7b0bf9e534a7c3de66bb94f5fb18)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Forecast", jsii.invoke(self, "onExplainability", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onExplainabilityExport")
    def on_explainability_export(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type explainabilityExport to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateExplainabilityExport.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f394abc780d2b1d9498e2c55e43a4889e1754c44f5856fb2ca9a41963e6e649c)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Forecast", jsii.invoke(self, "onExplainabilityExport", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onForecast")
    def on_forecast(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type forecast to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateForecast.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4d450fe3279711e791a554ebbff5823f7a39001b1a10feab88636dcd725e21da)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Forecast", jsii.invoke(self, "onForecast", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onForecastExport")
    def on_forecast_export(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type forecastExport to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateForecastExportJob.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fe341f3a057061725e2c5afa39f7fb4731eafe2079257ef9fb37c851e9871be8)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Forecast", jsii.invoke(self, "onForecastExport", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onMonitor")
    def on_monitor(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type monitor to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateMonitor.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ece8ddb4b9795738297afc88070a89c51c3a84eb3e36c4427f90809976781d58)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Forecast", jsii.invoke(self, "onMonitor", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onPredictor")
    def on_predictor(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type predictor to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreatePredictor.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3abedaf81f4d751bcc94ce04227ce98589a7078513673d14254b661c94b29b06)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Forecast", jsii.invoke(self, "onPredictor", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onPredictorBacktestExportJob")
    def on_predictor_backtest_export_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type predictorBacktestExportJob to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreatePredictorBacktestExportJob.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b98b4142dbb146a454163f904e50bf2a5f24c753e516d17b45e0000b93feb843)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Forecast", jsii.invoke(self, "onPredictorBacktestExportJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onWhatIfAnalysis")
    def on_what_if_analysis(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type whatIfAnalysis to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateWhatIfAnalysis.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f7a1260297177926928cad61df155ddd61eab072c1c290f644d60de4c4e596f5)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Forecast", jsii.invoke(self, "onWhatIfAnalysis", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onWhatIfForecast")
    def on_what_if_forecast(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type whatIfForecast to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateWhatIfForecast.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6408cbe1ad7f7c563c9387859ca00b493e5edd0e423a39fb09c50b9d47a19c50)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Forecast", jsii.invoke(self, "onWhatIfForecast", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onWhatIfForecastExport")
    def on_what_if_forecast_export(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Forecast":
        '''(experimental) Adds a resource of type whatIfForecastExport to the statement.

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateWhatIfForecastExport.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eaac8500cf9041bfbde100cc6e0ea3e5a66487ca0415578199e68407cbec4b6b)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Forecast", jsii.invoke(self, "onWhatIfForecastExport", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateAutoPredictor")
    def to_create_auto_predictor(self) -> "Forecast":
        '''(experimental) Grants permission to create an auto predictor.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateAutoPredictor.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreateAutoPredictor", []))

    @jsii.member(jsii_name="toCreateDataset")
    def to_create_dataset(self) -> "Forecast":
        '''(experimental) Grants permission to create a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateDataset.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreateDataset", []))

    @jsii.member(jsii_name="toCreateDatasetGroup")
    def to_create_dataset_group(self) -> "Forecast":
        '''(experimental) Grants permission to create a dataset group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateDatasetGroup.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreateDatasetGroup", []))

    @jsii.member(jsii_name="toCreateDatasetImportJob")
    def to_create_dataset_import_job(self) -> "Forecast":
        '''(experimental) Grants permission to create a dataset import job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateDatasetImportJob.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreateDatasetImportJob", []))

    @jsii.member(jsii_name="toCreateExplainability")
    def to_create_explainability(self) -> "Forecast":
        '''(experimental) Grants permission to create an explainability.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateExplainability.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreateExplainability", []))

    @jsii.member(jsii_name="toCreateExplainabilityExport")
    def to_create_explainability_export(self) -> "Forecast":
        '''(experimental) Grants permission to create an explainability export using an explainability resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateExplainabilityExport.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreateExplainabilityExport", []))

    @jsii.member(jsii_name="toCreateForecast")
    def to_create_forecast(self) -> "Forecast":
        '''(experimental) Grants permission to create a forecast.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateForecast.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreateForecast", []))

    @jsii.member(jsii_name="toCreateForecastEndpoint")
    def to_create_forecast_endpoint(self) -> "Forecast":
        '''(experimental) Grants permission to create an endpoint using a Predictor resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/what-is-forecast.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreateForecastEndpoint", []))

    @jsii.member(jsii_name="toCreateForecastExportJob")
    def to_create_forecast_export_job(self) -> "Forecast":
        '''(experimental) Grants permission to create a forecast export job using a forecast resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateForecastExportJob.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreateForecastExportJob", []))

    @jsii.member(jsii_name="toCreateMonitor")
    def to_create_monitor(self) -> "Forecast":
        '''(experimental) Grants permission to create an monitor using a Predictor resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateMonitor.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreateMonitor", []))

    @jsii.member(jsii_name="toCreatePredictor")
    def to_create_predictor(self) -> "Forecast":
        '''(experimental) Grants permission to create a predictor.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreatePredictor.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreatePredictor", []))

    @jsii.member(jsii_name="toCreatePredictorBacktestExportJob")
    def to_create_predictor_backtest_export_job(self) -> "Forecast":
        '''(experimental) Grants permission to create a predictor backtest export job using a predictor.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreatePredictorBacktestExportJob.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreatePredictorBacktestExportJob", []))

    @jsii.member(jsii_name="toCreateWhatIfAnalysis")
    def to_create_what_if_analysis(self) -> "Forecast":
        '''(experimental) Grants permission to create a what-if analysis.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateWhatIfAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreateWhatIfAnalysis", []))

    @jsii.member(jsii_name="toCreateWhatIfForecast")
    def to_create_what_if_forecast(self) -> "Forecast":
        '''(experimental) Grants permission to create a what-if forecast.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateWhatIfForecast.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreateWhatIfForecast", []))

    @jsii.member(jsii_name="toCreateWhatIfForecastExport")
    def to_create_what_if_forecast_export(self) -> "Forecast":
        '''(experimental) Grants permission to create a what-if forecast export using what-if forecast resources.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_CreateWhatIfForecastExport.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toCreateWhatIfForecastExport", []))

    @jsii.member(jsii_name="toDeleteDataset")
    def to_delete_dataset(self) -> "Forecast":
        '''(experimental) Grants permission to delete a dataset.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeleteDataset.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeleteDataset", []))

    @jsii.member(jsii_name="toDeleteDatasetGroup")
    def to_delete_dataset_group(self) -> "Forecast":
        '''(experimental) Grants permission to delete a dataset group.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeleteDatasetGroup.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeleteDatasetGroup", []))

    @jsii.member(jsii_name="toDeleteDatasetImportJob")
    def to_delete_dataset_import_job(self) -> "Forecast":
        '''(experimental) Grants permission to delete a dataset import job.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeleteDatasetImportJob.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeleteDatasetImportJob", []))

    @jsii.member(jsii_name="toDeleteExplainability")
    def to_delete_explainability(self) -> "Forecast":
        '''(experimental) Grants permission to delete an explainability.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeleteExplainability.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeleteExplainability", []))

    @jsii.member(jsii_name="toDeleteExplainabilityExport")
    def to_delete_explainability_export(self) -> "Forecast":
        '''(experimental) Grants permission to delete an explainability export.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeleteExplainabilityExport.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeleteExplainabilityExport", []))

    @jsii.member(jsii_name="toDeleteForecast")
    def to_delete_forecast(self) -> "Forecast":
        '''(experimental) Grants permission to delete a forecast.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeleteForecast.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeleteForecast", []))

    @jsii.member(jsii_name="toDeleteForecastEndpoint")
    def to_delete_forecast_endpoint(self) -> "Forecast":
        '''(experimental) Grants permission to delete an endpoint resource.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/what-is-forecast.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeleteForecastEndpoint", []))

    @jsii.member(jsii_name="toDeleteForecastExportJob")
    def to_delete_forecast_export_job(self) -> "Forecast":
        '''(experimental) Grants permission to delete a forecast export job.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeleteForecastExportJob.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeleteForecastExportJob", []))

    @jsii.member(jsii_name="toDeleteMonitor")
    def to_delete_monitor(self) -> "Forecast":
        '''(experimental) Grants permission to delete a monitor resource.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeleteMonitor.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeleteMonitor", []))

    @jsii.member(jsii_name="toDeletePredictor")
    def to_delete_predictor(self) -> "Forecast":
        '''(experimental) Grants permission to delete a predictor.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeletePredictor.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeletePredictor", []))

    @jsii.member(jsii_name="toDeletePredictorBacktestExportJob")
    def to_delete_predictor_backtest_export_job(self) -> "Forecast":
        '''(experimental) Grants permission to delete a predictor backtest export job.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeletePredictorBacktestExportJob.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeletePredictorBacktestExportJob", []))

    @jsii.member(jsii_name="toDeleteResourceTree")
    def to_delete_resource_tree(self) -> "Forecast":
        '''(experimental) Grants permission to delete a resource and its child resources.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeleteResourceTree.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeleteResourceTree", []))

    @jsii.member(jsii_name="toDeleteWhatIfAnalysis")
    def to_delete_what_if_analysis(self) -> "Forecast":
        '''(experimental) Grants permission to delete a what-if analysis.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeleteWhatIfAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeleteWhatIfAnalysis", []))

    @jsii.member(jsii_name="toDeleteWhatIfForecast")
    def to_delete_what_if_forecast(self) -> "Forecast":
        '''(experimental) Grants permission to delete a what-if forecast.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeleteWhatIfForecast.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeleteWhatIfForecast", []))

    @jsii.member(jsii_name="toDeleteWhatIfForecastExport")
    def to_delete_what_if_forecast_export(self) -> "Forecast":
        '''(experimental) Grants permission to delete a what-if forecast export.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_DeleteWhatIfForecastExport.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDeleteWhatIfForecastExport", []))

    @jsii.member(jsii_name="toDescribeAutoPredictor")
    def to_describe_auto_predictor(self) -> "Forecast":
        '''(experimental) Grants permission to describe an auto predictor.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribeAutoPredictor.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribeAutoPredictor", []))

    @jsii.member(jsii_name="toDescribeDataset")
    def to_describe_dataset(self) -> "Forecast":
        '''(experimental) Grants permission to describe a dataset.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribeDataset.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribeDataset", []))

    @jsii.member(jsii_name="toDescribeDatasetGroup")
    def to_describe_dataset_group(self) -> "Forecast":
        '''(experimental) Grants permission to describe a dataset group.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribeDatasetGroup.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribeDatasetGroup", []))

    @jsii.member(jsii_name="toDescribeDatasetImportJob")
    def to_describe_dataset_import_job(self) -> "Forecast":
        '''(experimental) Grants permission to describe a dataset import job.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribeDatasetImportJob.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribeDatasetImportJob", []))

    @jsii.member(jsii_name="toDescribeExplainability")
    def to_describe_explainability(self) -> "Forecast":
        '''(experimental) Grants permission to describe an explainability.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribeExplainability.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribeExplainability", []))

    @jsii.member(jsii_name="toDescribeExplainabilityExport")
    def to_describe_explainability_export(self) -> "Forecast":
        '''(experimental) Grants permission to describe an explainability export.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribeExplainabilityExport.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribeExplainabilityExport", []))

    @jsii.member(jsii_name="toDescribeForecast")
    def to_describe_forecast(self) -> "Forecast":
        '''(experimental) Grants permission to describe a forecast.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribeForecast.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribeForecast", []))

    @jsii.member(jsii_name="toDescribeForecastEndpoint")
    def to_describe_forecast_endpoint(self) -> "Forecast":
        '''(experimental) Grants permission to describe an endpoint resource.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/what-is-forecast.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribeForecastEndpoint", []))

    @jsii.member(jsii_name="toDescribeForecastExportJob")
    def to_describe_forecast_export_job(self) -> "Forecast":
        '''(experimental) Grants permission to describe a forecast export job.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribeForecastExportJob.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribeForecastExportJob", []))

    @jsii.member(jsii_name="toDescribeMonitor")
    def to_describe_monitor(self) -> "Forecast":
        '''(experimental) Grants permission to describe an monitor resource.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribeMonitor.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribeMonitor", []))

    @jsii.member(jsii_name="toDescribePredictor")
    def to_describe_predictor(self) -> "Forecast":
        '''(experimental) Grants permission to describe a predictor.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribePredictor.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribePredictor", []))

    @jsii.member(jsii_name="toDescribePredictorBacktestExportJob")
    def to_describe_predictor_backtest_export_job(self) -> "Forecast":
        '''(experimental) Grants permission to describe a predictor backtest export job.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribePredictorBacktestExportJob.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribePredictorBacktestExportJob", []))

    @jsii.member(jsii_name="toDescribeWhatIfAnalysis")
    def to_describe_what_if_analysis(self) -> "Forecast":
        '''(experimental) Grants permission to describe a what-if analysis.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribeWhatIfAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribeWhatIfAnalysis", []))

    @jsii.member(jsii_name="toDescribeWhatIfForecast")
    def to_describe_what_if_forecast(self) -> "Forecast":
        '''(experimental) Grants permission to describe a what-if forecast.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribeWhatIfForecast.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribeWhatIfForecast", []))

    @jsii.member(jsii_name="toDescribeWhatIfForecastExport")
    def to_describe_what_if_forecast_export(self) -> "Forecast":
        '''(experimental) Grants permission to describe a what-if forecast export.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_DescribeWhatIfForecastExport.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toDescribeWhatIfForecastExport", []))

    @jsii.member(jsii_name="toGetAccuracyMetrics")
    def to_get_accuracy_metrics(self) -> "Forecast":
        '''(experimental) Grants permission to get the Accuracy Metrics for a predictor.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_GetAccuracyMetrics.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toGetAccuracyMetrics", []))

    @jsii.member(jsii_name="toGetRecentForecastContext")
    def to_get_recent_forecast_context(self) -> "Forecast":
        '''(experimental) Grants permission to get the forecast context of a timeseries for an endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/what-is-forecast.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toGetRecentForecastContext", []))

    @jsii.member(jsii_name="toInvokeForecastEndpoint")
    def to_invoke_forecast_endpoint(self) -> "Forecast":
        '''(experimental) Grants permission to invoke the endpoint to get forecast for a timeseries.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/what-is-forecast.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toInvokeForecastEndpoint", []))

    @jsii.member(jsii_name="toListDatasetGroups")
    def to_list_dataset_groups(self) -> "Forecast":
        '''(experimental) Grants permission to list all the dataset groups.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListDatasetGroups.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListDatasetGroups", []))

    @jsii.member(jsii_name="toListDatasetImportJobs")
    def to_list_dataset_import_jobs(self) -> "Forecast":
        '''(experimental) Grants permission to list all the dataset import jobs.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListDatasetImportJobs.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListDatasetImportJobs", []))

    @jsii.member(jsii_name="toListDatasets")
    def to_list_datasets(self) -> "Forecast":
        '''(experimental) Grants permission to list all the datasets.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListDatasets.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListDatasets", []))

    @jsii.member(jsii_name="toListExplainabilities")
    def to_list_explainabilities(self) -> "Forecast":
        '''(experimental) Grants permission to list all the explainabilities.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListExplainabilities.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListExplainabilities", []))

    @jsii.member(jsii_name="toListExplainabilityExports")
    def to_list_explainability_exports(self) -> "Forecast":
        '''(experimental) Grants permission to list all the explainability exports.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListExplainabilityExports.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListExplainabilityExports", []))

    @jsii.member(jsii_name="toListForecastExportJobs")
    def to_list_forecast_export_jobs(self) -> "Forecast":
        '''(experimental) Grants permission to list all the forecast export jobs.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListForecastExportJobs.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListForecastExportJobs", []))

    @jsii.member(jsii_name="toListForecasts")
    def to_list_forecasts(self) -> "Forecast":
        '''(experimental) Grants permission to list all the forecasts.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListForecasts.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListForecasts", []))

    @jsii.member(jsii_name="toListMonitorEvaluations")
    def to_list_monitor_evaluations(self) -> "Forecast":
        '''(experimental) Grants permission to list all the monitor evaluation result for a monitor.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListMonitorEvaluations.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListMonitorEvaluations", []))

    @jsii.member(jsii_name="toListMonitors")
    def to_list_monitors(self) -> "Forecast":
        '''(experimental) Grants permission to list all the monitor resources.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListMonitors.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListMonitors", []))

    @jsii.member(jsii_name="toListPredictorBacktestExportJobs")
    def to_list_predictor_backtest_export_jobs(self) -> "Forecast":
        '''(experimental) Grants permission to list all the predictor backtest export jobs.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListPredictorBacktestExportJobs.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListPredictorBacktestExportJobs", []))

    @jsii.member(jsii_name="toListPredictors")
    def to_list_predictors(self) -> "Forecast":
        '''(experimental) Grants permission to list all the predictors.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListPredictors.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListPredictors", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Forecast":
        '''(experimental) Grants permission to list the tags for an Amazon Forecast resource.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWhatIfAnalyses")
    def to_list_what_if_analyses(self) -> "Forecast":
        '''(experimental) Grants permission to list all the what-if analyses.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListWhatIfAnalyses.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListWhatIfAnalyses", []))

    @jsii.member(jsii_name="toListWhatIfForecastExports")
    def to_list_what_if_forecast_exports(self) -> "Forecast":
        '''(experimental) Grants permission to list all the what-if forecast exports.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListWhatIfForecastExports.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListWhatIfForecastExports", []))

    @jsii.member(jsii_name="toListWhatIfForecasts")
    def to_list_what_if_forecasts(self) -> "Forecast":
        '''(experimental) Grants permission to list all the what-if forecasts.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_ListWhatIfForecasts.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toListWhatIfForecasts", []))

    @jsii.member(jsii_name="toQueryForecast")
    def to_query_forecast(self) -> "Forecast":
        '''(experimental) Grants permission to retrieve a forecast for a single item.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_forecastquery_QueryForecast.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toQueryForecast", []))

    @jsii.member(jsii_name="toQueryWhatIfForecast")
    def to_query_what_if_forecast(self) -> "Forecast":
        '''(experimental) Grants permission to retrieve a what-if forecast for a single item.

        Access Level: Read

        https://docs.aws.amazon.com/forecast/latest/dg/API_forecastquery_QueryWhatIfForecast.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toQueryWhatIfForecast", []))

    @jsii.member(jsii_name="toResumeResource")
    def to_resume_resource(self) -> "Forecast":
        '''(experimental) Grants permission to resume Amazon Forecast resource jobs.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_ResumeResource.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toResumeResource", []))

    @jsii.member(jsii_name="toStopResource")
    def to_stop_resource(self) -> "Forecast":
        '''(experimental) Grants permission to stop Amazon Forecast resource jobs.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_StopResource.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toStopResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Forecast":
        '''(experimental) Grants permission to associate the specified tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Forecast":
        '''(experimental) Grants permission to delete the specified tags for a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/forecast/latest/dg/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDatasetGroup")
    def to_update_dataset_group(self) -> "Forecast":
        '''(experimental) Grants permission to update a dataset group.

        Access Level: Write

        https://docs.aws.amazon.com/forecast/latest/dg/API_UpdateDatasetGroup.html

        :stability: experimental
        '''
        return typing.cast("Forecast", jsii.invoke(self, "toUpdateDatasetGroup", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ab929d48e5c4098950d27e7c13c2d0b93a752d17cdb880594ea1f830849479c7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d2dfbb61b2bb1585e695f9f5cedd96c7b1ee91bd51fd9c73b8bb55f476a673fc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Frauddetector(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Frauddetector",
):
    '''(experimental) Statement provider for service `frauddetector <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `frauddetector <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__df18d3d4bdf9891629a0ed91fe265b9d84d724cc198d822c13808f59752b7c48)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onBatchImport")
    def on_batch_import(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type batch-import to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4f2cabb17c3787144346019fa5d6245307ae98030096c200a73cb1b9871985f3)
            check_type(argname="argument resource_path", value=resource_path, expected_type=type_hints["resource_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Frauddetector", jsii.invoke(self, "onBatchImport", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onBatchPrediction")
    def on_batch_prediction(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type batch-prediction to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__27cfdbd2eb71649d02f74664ae467767275e7cd06150985a2c8aee8dd0923082)
            check_type(argname="argument resource_path", value=resource_path, expected_type=type_hints["resource_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Frauddetector", jsii.invoke(self, "onBatchPrediction", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onDetector")
    def on_detector(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type detector to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__818681785fd5b5234678a47e70e3cafea53717ccf2d3bb31ed32529f99400ceb)
            check_type(argname="argument resource_path", value=resource_path, expected_type=type_hints["resource_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Frauddetector", jsii.invoke(self, "onDetector", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onDetectorVersion")
    def on_detector_version(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type detector-version to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7c6bdfc304efc4e1a1eafc63052a2c7016b2373ae3cf1ef32da23d0f3d463a32)
            check_type(argname="argument resource_path", value=resource_path, expected_type=type_hints["resource_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Frauddetector", jsii.invoke(self, "onDetectorVersion", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onEntityType")
    def on_entity_type(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type entity-type to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9477aeef6b73769fcc3a3d91a08a5814dec26d4c52c1dff03bd24d914ae79a44)
            check_type(argname="argument resource_path", value=resource_path, expected_type=type_hints["resource_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Frauddetector", jsii.invoke(self, "onEntityType", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onEventType")
    def on_event_type(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type event-type to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__46d75a4d44135e2c582a11763db484538940cc96a682b8c866870b0ef3d12e56)
            check_type(argname="argument resource_path", value=resource_path, expected_type=type_hints["resource_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Frauddetector", jsii.invoke(self, "onEventType", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onExternalModel")
    def on_external_model(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type external-model to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bc5ad6afe214a983108f40e0d6bfbb648be01dd6bbe27eabe97c19b93f8214f8)
            check_type(argname="argument resource_path", value=resource_path, expected_type=type_hints["resource_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Frauddetector", jsii.invoke(self, "onExternalModel", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onLabel")
    def on_label(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type label to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__867702bc7ab6a5b7480d25d2f5e49d12544c5e211955a219b187c229a6a70458)
            check_type(argname="argument resource_path", value=resource_path, expected_type=type_hints["resource_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Frauddetector", jsii.invoke(self, "onLabel", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onList")
    def on_list(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type list to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8895057821b5c04108ca4c245aab33a8eb685cc5cd73f4ca82469b1b0573b149)
            check_type(argname="argument resource_path", value=resource_path, expected_type=type_hints["resource_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Frauddetector", jsii.invoke(self, "onList", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onModel")
    def on_model(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type model to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0d3f5e48b96d4d12fd95f48ce29a5c908cdd1d095e6bcb32aa39f4bc6c728dc4)
            check_type(argname="argument resource_path", value=resource_path, expected_type=type_hints["resource_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Frauddetector", jsii.invoke(self, "onModel", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onModelVersion")
    def on_model_version(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type model-version to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e2ffe7bbe5d304e14b24ad7a27078e20b0c436018eddaa5d2209958774dbbb92)
            check_type(argname="argument resource_path", value=resource_path, expected_type=type_hints["resource_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Frauddetector", jsii.invoke(self, "onModelVersion", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onOutcome")
    def on_outcome(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type outcome to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__96cab6ecad0c8fd5bb2c0ca3a27dfba1fbbdc79ea97af643b8b026a92fa70151)
            check_type(argname="argument resource_path", value=resource_path, expected_type=type_hints["resource_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Frauddetector", jsii.invoke(self, "onOutcome", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onRule")
    def on_rule(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type rule to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__21ea759dbbf27d96fa16dcbc8d91d628dfe2c75c51910d6ae0e5f195d102a202)
            check_type(argname="argument resource_path", value=resource_path, expected_type=type_hints["resource_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Frauddetector", jsii.invoke(self, "onRule", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="onVariable")
    def on_variable(
        self,
        resource_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Frauddetector":
        '''(experimental) Adds a resource of type variable to the statement.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfrauddetector.html#amazonfrauddetector-resources-for-iam-policies

        :param resource_path: - Identifier for the resourcePath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5b92b444cc41afa9af1c0a60d2959070f45064c97689e46fe5d3620b08dcbf9a)
            check_type(argname="argument resource_path", value=resource_path, expected_type=type_hints["resource_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Frauddetector", jsii.invoke(self, "onVariable", [resource_path, account, region, partition]))

    @jsii.member(jsii_name="toBatchCreateVariable")
    def to_batch_create_variable(self) -> "Frauddetector":
        '''(experimental) Grants permission to create a batch of variables.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_BatchCreateVariable.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toBatchCreateVariable", []))

    @jsii.member(jsii_name="toBatchGetVariable")
    def to_batch_get_variable(self) -> "Frauddetector":
        '''(experimental) Grants permission to get a batch of variables.

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_BatchGetVariable.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toBatchGetVariable", []))

    @jsii.member(jsii_name="toCancelBatchImportJob")
    def to_cancel_batch_import_job(self) -> "Frauddetector":
        '''(experimental) Grants permission to cancel the specified batch import job.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_CancelBatchImportJob.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toCancelBatchImportJob", []))

    @jsii.member(jsii_name="toCancelBatchPredictionJob")
    def to_cancel_batch_prediction_job(self) -> "Frauddetector":
        '''(experimental) Grants permission to cancel the specified batch prediction job.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_CancelBatchPredictionJob.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toCancelBatchPredictionJob", []))

    @jsii.member(jsii_name="toCreateBatchImportJob")
    def to_create_batch_import_job(self) -> "Frauddetector":
        '''(experimental) Grants permission to create a batch import job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_CreateBatchImportJob.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toCreateBatchImportJob", []))

    @jsii.member(jsii_name="toCreateBatchPredictionJob")
    def to_create_batch_prediction_job(self) -> "Frauddetector":
        '''(experimental) Grants permission to create a batch prediction job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_CreateBatchPredictionJob.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toCreateBatchPredictionJob", []))

    @jsii.member(jsii_name="toCreateDetectorVersion")
    def to_create_detector_version(self) -> "Frauddetector":
        '''(experimental) Grants permission to create a detector version. The detector version starts in a DRAFT status.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_CreateDetectorVersion.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toCreateDetectorVersion", []))

    @jsii.member(jsii_name="toCreateList")
    def to_create_list(self) -> "Frauddetector":
        '''(experimental) Grants permission to create a list.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_CreateList.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toCreateList", []))

    @jsii.member(jsii_name="toCreateModel")
    def to_create_model(self) -> "Frauddetector":
        '''(experimental) Grants permission to create a model using the specified model type.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_CreateModel.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toCreateModel", []))

    @jsii.member(jsii_name="toCreateModelVersion")
    def to_create_model_version(self) -> "Frauddetector":
        '''(experimental) Grants permission to create a version of the model using the specified model type and model id.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_CreateModelVersion.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toCreateModelVersion", []))

    @jsii.member(jsii_name="toCreateRule")
    def to_create_rule(self) -> "Frauddetector":
        '''(experimental) Grants permission to create a rule for use with the specified detector.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_CreateRule.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toCreateRule", []))

    @jsii.member(jsii_name="toCreateVariable")
    def to_create_variable(self) -> "Frauddetector":
        '''(experimental) Grants permission to create a variable.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_CreateVariable.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toCreateVariable", []))

    @jsii.member(jsii_name="toDeleteBatchImportJob")
    def to_delete_batch_import_job(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete a batch import job.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteBatchImportJob.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteBatchImportJob", []))

    @jsii.member(jsii_name="toDeleteBatchPredictionJob")
    def to_delete_batch_prediction_job(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete a batch prediction job.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteBatchPredictionJob.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteBatchPredictionJob", []))

    @jsii.member(jsii_name="toDeleteDetector")
    def to_delete_detector(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete the detector.

        Before deleting a detector, you must first delete all detector versions and rule versions associated with the detector

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteDetector.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteDetector", []))

    @jsii.member(jsii_name="toDeleteDetectorVersion")
    def to_delete_detector_version(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete the detector version. You cannot delete detector versions that are in ACTIVE status.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteDetectorVersion.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteDetectorVersion", []))

    @jsii.member(jsii_name="toDeleteEntityType")
    def to_delete_entity_type(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete an entity type.

        You cannot delete an entity type that is included in an event type

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteEntityType.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteEntityType", []))

    @jsii.member(jsii_name="toDeleteEvent")
    def to_delete_event(self) -> "Frauddetector":
        '''(experimental) Grants permission to deletes the specified event.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteEvent.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteEvent", []))

    @jsii.member(jsii_name="toDeleteEventsByEventType")
    def to_delete_events_by_event_type(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete events for the specified event type.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteEventsByEventType.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteEventsByEventType", []))

    @jsii.member(jsii_name="toDeleteEventType")
    def to_delete_event_type(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete an event type.

        You cannot delete an event type that is used in a detector or a model

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteEventType.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteEventType", []))

    @jsii.member(jsii_name="toDeleteExternalModel")
    def to_delete_external_model(self) -> "Frauddetector":
        '''(experimental) Grants permission to remove a SageMaker model from Amazon Fraud Detector.

        You can remove an Amazon SageMaker model if it is not associated with a detector version

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteExternalModel.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteExternalModel", []))

    @jsii.member(jsii_name="toDeleteLabel")
    def to_delete_label(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete a label.

        You cannot delete labels that are included in an event type in Amazon Fraud Detector. You cannot delete a label assigned to an event ID. You must first delete the relevant event ID

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteLabel.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteLabel", []))

    @jsii.member(jsii_name="toDeleteList")
    def to_delete_list(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete a list.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteList.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteList", []))

    @jsii.member(jsii_name="toDeleteModel")
    def to_delete_model(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete a model.

        You can delete models and model versions in Amazon Fraud Detector, provided that they are not associated with a detector version

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteModel.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteModel", []))

    @jsii.member(jsii_name="toDeleteModelVersion")
    def to_delete_model_version(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete a model version.

        You can delete models and model versions in Amazon Fraud Detector, provided that they are not associated with a detector version

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteModelVersion.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteModelVersion", []))

    @jsii.member(jsii_name="toDeleteOutcome")
    def to_delete_outcome(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete an outcome. You cannot delete an outcome that is used in a rule version.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteOutcome.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteOutcome", []))

    @jsii.member(jsii_name="toDeleteRule")
    def to_delete_rule(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete the rule.

        You cannot delete a rule if it is used by an ACTIVE or INACTIVE detector version

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteRule.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteRule", []))

    @jsii.member(jsii_name="toDeleteVariable")
    def to_delete_variable(self) -> "Frauddetector":
        '''(experimental) Grants permission to delete a variable.

        You cannot delete variables that are included in an event type in Amazon Fraud Detector

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DeleteVariable.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDeleteVariable", []))

    @jsii.member(jsii_name="toDescribeDetector")
    def to_describe_detector(self) -> "Frauddetector":
        '''(experimental) Grants permission to get all versions for a specified detector.

        Access Level: Read

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DescribeDetector.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDescribeDetector", []))

    @jsii.member(jsii_name="toDescribeModelVersions")
    def to_describe_model_versions(self) -> "Frauddetector":
        '''(experimental) Grants permission to get all of the model versions for the specified model type or for the specified model type and model ID.

        You can also get details for a single, specified model version

        Access Level: Read

        https://docs.aws.amazon.com/frauddetector/latest/api/API_DescribeModelVersions.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toDescribeModelVersions", []))

    @jsii.member(jsii_name="toGetBatchImportJobs")
    def to_get_batch_import_jobs(self) -> "Frauddetector":
        '''(experimental) Grants permission to get all batch import jobs or a specific job if you specify a job ID.

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetBatchImportJobs.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetBatchImportJobs", []))

    @jsii.member(jsii_name="toGetBatchImportJobValidationReport")
    def to_get_batch_import_job_validation_report(self) -> "Frauddetector":
        '''(experimental) Grants permission to get the data validation report of a specific batch import job.

        Access Level: Read

        https://docs.aws.amazon.com/frauddetector/latest/ug/prepare-storage-event-data.html#smart-data-validation

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetBatchImportJobValidationReport", []))

    @jsii.member(jsii_name="toGetBatchPredictionJobs")
    def to_get_batch_prediction_jobs(self) -> "Frauddetector":
        '''(experimental) Grants permission to get all batch prediction jobs or a specific job if you specify a job ID.

        This is a paginated API. If you provide a null maxResults, this action retrieves a maximum of 50 records per page. If you provide a maxResults, the value must be between 1 and 50. To get the next page results, provide the pagination token from the GetBatchPredictionJobsResponse as part of your request. A null pagination token fetches the records from the beginning

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetBatchPredictionJobs.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetBatchPredictionJobs", []))

    @jsii.member(jsii_name="toGetDeleteEventsByEventTypeStatus")
    def to_get_delete_events_by_event_type_status(self) -> "Frauddetector":
        '''(experimental) Grants permission to get a specific event type DeleteEventsByEventType API execution status.

        Access Level: Read

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetDeleteEventsByEventTypeStatus.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetDeleteEventsByEventTypeStatus", []))

    @jsii.member(jsii_name="toGetDetectors")
    def to_get_detectors(self) -> "Frauddetector":
        '''(experimental) Grants permission to get all detectors or a single detector if a detectorId is specified.

        This is a paginated API. If you provide a null maxResults, this action retrieves a maximum of 10 records per page. If you provide a maxResults, the value must be between 5 and 10. To get the next page results, provide the pagination token from the GetDetectorsResponse as part of your request. A null pagination token fetches the records from the beginning

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetDetectors.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetDetectors", []))

    @jsii.member(jsii_name="toGetDetectorVersion")
    def to_get_detector_version(self) -> "Frauddetector":
        '''(experimental) Grants permission to get a particular detector version.

        Access Level: Read

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetDetectorVersion.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetDetectorVersion", []))

    @jsii.member(jsii_name="toGetEntityTypes")
    def to_get_entity_types(self) -> "Frauddetector":
        '''(experimental) Grants permission to get all entity types or a specific entity type if a name is specified.

        This is a paginated API. If you provide a null maxResults, this action retrieves a maximum of 10 records per page. If you provide a maxResults, the value must be between 5 and 10. To get the next page results, provide the pagination token from the GetEntityTypesResponse as part of your request. A null pagination token fetches the records from the beginning

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetEntityTypes.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetEntityTypes", []))

    @jsii.member(jsii_name="toGetEvent")
    def to_get_event(self) -> "Frauddetector":
        '''(experimental) Grants permission to get the details of the specified event.

        Access Level: Read

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetEvent.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetEvent", []))

    @jsii.member(jsii_name="toGetEventPrediction")
    def to_get_event_prediction(self) -> "Frauddetector":
        '''(experimental) Grants permission to evaluate an event against a detector version.

        If a version ID is not provided, the detector’s (ACTIVE) version is used

        Access Level: Read

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetEventPrediction.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetEventPrediction", []))

    @jsii.member(jsii_name="toGetEventPredictionMetadata")
    def to_get_event_prediction_metadata(self) -> "Frauddetector":
        '''(experimental) Grants permission to get more details of a particular prediction.

        Access Level: Read

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetEventPredictionMetadata.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetEventPredictionMetadata", []))

    @jsii.member(jsii_name="toGetEventTypes")
    def to_get_event_types(self) -> "Frauddetector":
        '''(experimental) Grants permission to get all event types or a specific event type if name is provided.

        This is a paginated API. If you provide a null maxResults, this action retrieves a maximum of 10 records per page. If you provide a maxResults, the value must be between 5 and 10. To get the next page results, provide the pagination token from the GetEventTypesResponse as part of your request. A null pagination token fetches the records from the beginning

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetEventTypes.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetEventTypes", []))

    @jsii.member(jsii_name="toGetExternalModels")
    def to_get_external_models(self) -> "Frauddetector":
        '''(experimental) Grants permission to get the details for one or more Amazon SageMaker models that have been imported into the service.

        This is a paginated API. If you provide a null maxResults, this actions retrieves a maximum of 10 records per page. If you provide a maxResults, the value must be between 5 and 10. To get the next page results, provide the pagination token from the GetExternalModelsResult as part of your request. A null pagination token fetches the records from the beginning

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetExternalModels.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetExternalModels", []))

    @jsii.member(jsii_name="toGetKMSEncryptionKey")
    def to_get_kms_encryption_key(self) -> "Frauddetector":
        '''(experimental) Grants permission to get the encryption key if a Key Management Service (KMS) customer master key (CMK) has been specified to be used to encrypt content in Amazon Fraud Detector.

        Access Level: Read

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetKMSEncryptionKey.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetKMSEncryptionKey", []))

    @jsii.member(jsii_name="toGetLabels")
    def to_get_labels(self) -> "Frauddetector":
        '''(experimental) Grants permission to get all labels or a specific label if name is provided.

        This is a paginated API. If you provide a null maxResults, this action retrieves a maximum of 50 records per page. If you provide a maxResults, the value must be between 10 and 50. To get the next page results, provide the pagination token from the GetGetLabelsResponse as part of your request. A null pagination token fetches the records from the beginning

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetLabels.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetLabels", []))

    @jsii.member(jsii_name="toGetListElements")
    def to_get_list_elements(self) -> "Frauddetector":
        '''(experimental) Grants permission to get elements of a list.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetListElements.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetListElements", []))

    @jsii.member(jsii_name="toGetListsMetadata")
    def to_get_lists_metadata(self) -> "Frauddetector":
        '''(experimental) Grants permission to get metadata about lists.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetListsMetadata.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetListsMetadata", []))

    @jsii.member(jsii_name="toGetModels")
    def to_get_models(self) -> "Frauddetector":
        '''(experimental) Grants permission to get one or more models.

        Gets all models for the AWS account if no model type and no model id provided. Gets all models for the AWS account and model type, if the model type is specified but model id is not provided. Gets a specific model if (model type, model id) tuple is specified

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetModels.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetModels", []))

    @jsii.member(jsii_name="toGetModelVersion")
    def to_get_model_version(self) -> "Frauddetector":
        '''(experimental) Grants permission to get the details of the specified model version.

        Access Level: Read

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetModelVersion.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetModelVersion", []))

    @jsii.member(jsii_name="toGetOutcomes")
    def to_get_outcomes(self) -> "Frauddetector":
        '''(experimental) Grants permission to get one or more outcomes.

        This is a paginated API. If you provide a null maxResults, this actions retrieves a maximum of 100 records per page. If you provide a maxResults, the value must be between 50 and 100. To get the next page results, provide the pagination token from the GetOutcomesResult as part of your request. A null pagination token fetches the records from the beginning

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetOutcomes.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetOutcomes", []))

    @jsii.member(jsii_name="toGetRules")
    def to_get_rules(self) -> "Frauddetector":
        '''(experimental) Grants permission to get all rules for a detector (paginated) if ruleId and ruleVersion are not specified.

        Gets all rules for the detector and the ruleId if present (paginated). Gets a specific rule if both the ruleId and the ruleVersion are specified

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetRules.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetRules", []))

    @jsii.member(jsii_name="toGetVariables")
    def to_get_variables(self) -> "Frauddetector":
        '''(experimental) Grants permission to get all of the variables or the specific variable.

        This is a paginated API. Providing null maxSizePerPage results in retrieving maximum of 100 records per page. If you provide maxSizePerPage the value must be between 50 and 100. To get the next page result, a provide a pagination token from GetVariablesResult as part of your request. Null pagination token fetches the records from the beginning

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_GetVariables.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toGetVariables", []))

    @jsii.member(jsii_name="toListEventPredictions")
    def to_list_event_predictions(self) -> "Frauddetector":
        '''(experimental) Grants permission to get a list of past predictions.

        Access Level: List

        https://docs.aws.amazon.com/frauddetector/latest/api/API_ListEventPredictions.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toListEventPredictions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Frauddetector":
        '''(experimental) Grants permission to list all tags associated with the resource.

        This is a paginated API. To get the next page results, provide the pagination token from the response as part of your request. A null pagination token fetches the records from the beginning

        Access Level: Read

        https://docs.aws.amazon.com/frauddetector/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutDetector")
    def to_put_detector(self) -> "Frauddetector":
        '''(experimental) Grants permission to create or update a detector.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_PutDetector.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toPutDetector", []))

    @jsii.member(jsii_name="toPutEntityType")
    def to_put_entity_type(self) -> "Frauddetector":
        '''(experimental) Grants permission to create or update an entity type.

        An entity represents who is performing the event. As part of a fraud prediction, you pass the entity ID to indicate the specific entity who performed the event. An entity type classifies the entity. Example classifications include customer, merchant, or account

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_PutEntityType.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toPutEntityType", []))

    @jsii.member(jsii_name="toPutEventType")
    def to_put_event_type(self) -> "Frauddetector":
        '''(experimental) Grants permission to create or update an event type.

        An event is a business activity that is evaluated for fraud risk. With Amazon Fraud Detector, you generate fraud predictions for events. An event type defines the structure for an event sent to Amazon Fraud Detector. This includes the variables sent as part of the event, the entity performing the event (such as a customer), and the labels that classify the event. Example event types include online payment transactions, account registrations, and authentications

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_PutEventType.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toPutEventType", []))

    @jsii.member(jsii_name="toPutExternalModel")
    def to_put_external_model(self) -> "Frauddetector":
        '''(experimental) Grants permission to create or update an Amazon SageMaker model endpoint.

        You can also use this action to update the configuration of the model endpoint, including the IAM role and/or the mapped variables

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_PutExternalModel.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toPutExternalModel", []))

    @jsii.member(jsii_name="toPutKMSEncryptionKey")
    def to_put_kms_encryption_key(self) -> "Frauddetector":
        '''(experimental) Grants permission to specify the Key Management Service (KMS) customer master key (CMK) to be used to encrypt content in Amazon Fraud Detector.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_PutKMSEncryptionKey.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toPutKMSEncryptionKey", []))

    @jsii.member(jsii_name="toPutLabel")
    def to_put_label(self) -> "Frauddetector":
        '''(experimental) Grants permission to create or update label.

        A label classifies an event as fraudulent or legitimate. Labels are associated with event types and used to train supervised machine learning models in Amazon Fraud Detector

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_PutLabel.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toPutLabel", []))

    @jsii.member(jsii_name="toPutOutcome")
    def to_put_outcome(self) -> "Frauddetector":
        '''(experimental) Grants permission to create or update an outcome.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_PutOutcome.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toPutOutcome", []))

    @jsii.member(jsii_name="toSendEvent")
    def to_send_event(self) -> "Frauddetector":
        '''(experimental) Grants permission to send event.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_SendEvent.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toSendEvent", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Frauddetector":
        '''(experimental) Grants permission to assign tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Frauddetector":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDetectorVersion")
    def to_update_detector_version(self) -> "Frauddetector":
        '''(experimental) Grants permission to update a detector version.

        The detector version attributes that you can update include models, external model endpoints, rules, rule execution mode, and description. You can only update a DRAFT detector version

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UpdateDetectorVersion.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUpdateDetectorVersion", []))

    @jsii.member(jsii_name="toUpdateDetectorVersionMetadata")
    def to_update_detector_version_metadata(self) -> "Frauddetector":
        '''(experimental) Grants permission to update the detector version's description.

        You can update the metadata for any detector version (DRAFT, ACTIVE, or INACTIVE)

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UpdateDetectorVersionMetadata.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUpdateDetectorVersionMetadata", []))

    @jsii.member(jsii_name="toUpdateDetectorVersionStatus")
    def to_update_detector_version_status(self) -> "Frauddetector":
        '''(experimental) Grants permission to update the detector version’s status.

        You can perform the following promotions or demotions using UpdateDetectorVersionStatus: DRAFT to ACTIVE, ACTIVE to INACTIVE, and INACTIVE to ACTIVE

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UpdateDetectorVersionStatus.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUpdateDetectorVersionStatus", []))

    @jsii.member(jsii_name="toUpdateEventLabel")
    def to_update_event_label(self) -> "Frauddetector":
        '''(experimental) Grants permission to update an existing event record's label value.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UpdateEventLabel.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUpdateEventLabel", []))

    @jsii.member(jsii_name="toUpdateList")
    def to_update_list(self) -> "Frauddetector":
        '''(experimental) Grants permission to update a list.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UpdateList.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUpdateList", []))

    @jsii.member(jsii_name="toUpdateModel")
    def to_update_model(self) -> "Frauddetector":
        '''(experimental) Grants permission to update a model. You can update the description attribute using this action.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UpdateModel.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUpdateModel", []))

    @jsii.member(jsii_name="toUpdateModelVersion")
    def to_update_model_version(self) -> "Frauddetector":
        '''(experimental) Grants permission to update a model version.

        Updating a model version retrains an existing model version using updated training data and produces a new minor version of the model. You can update the training data set location and data access role attributes using this action. This action creates and trains a new minor version of the model, for example version 1.01, 1.02, 1.03

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UpdateModelVersion.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUpdateModelVersion", []))

    @jsii.member(jsii_name="toUpdateModelVersionStatus")
    def to_update_model_version_status(self) -> "Frauddetector":
        '''(experimental) Grants permission to update the status of a model version.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UpdateModelVersionStatus.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUpdateModelVersionStatus", []))

    @jsii.member(jsii_name="toUpdateRuleMetadata")
    def to_update_rule_metadata(self) -> "Frauddetector":
        '''(experimental) Grants permission to update a rule's metadata. The description attribute can be updated.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UpdateRuleMetadata.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUpdateRuleMetadata", []))

    @jsii.member(jsii_name="toUpdateRuleVersion")
    def to_update_rule_version(self) -> "Frauddetector":
        '''(experimental) Grants permission to update a rule version resulting in a new rule version.

        Updates a rule version resulting in a new rule version (version 1, 2, 3 ...)

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UpdateRuleVersion.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUpdateRuleVersion", []))

    @jsii.member(jsii_name="toUpdateVariable")
    def to_update_variable(self) -> "Frauddetector":
        '''(experimental) Grants permission to update a variable.

        Access Level: Write

        https://docs.aws.amazon.com/frauddetector/latest/api/API_UpdateVariable.html

        :stability: experimental
        '''
        return typing.cast("Frauddetector", jsii.invoke(self, "toUpdateVariable", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b0e541c97bc8cd01f830948f8806be2ef9076b690b2c84e0b4f08138c84b46d3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__be1001806813a31f0e2f2576dc93974b454ca623f39d84753e664c58a6c31c9f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Freertos(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Freertos",
):
    '''(experimental) Statement provider for service `freertos <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfreertos.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `freertos <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfreertos.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ba4b62c1ae5199d66a8a4bb8e3fa46c1c79d6beb20b4a0aed61bcab85604cccb)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onConfiguration")
    def on_configuration(
        self,
        configuration_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Freertos":
        '''(experimental) Adds a resource of type configuration to the statement.

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :param configuration_name: - Identifier for the configurationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5ae166b8227e68b0da05011b2f14198c710a3ff688f322927e5e7110ac86df1f)
            check_type(argname="argument configuration_name", value=configuration_name, expected_type=type_hints["configuration_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Freertos", jsii.invoke(self, "onConfiguration", [configuration_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateSoftwareConfiguration")
    def to_create_software_configuration(self) -> "Freertos":
        '''(experimental) Creates a software configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toCreateSoftwareConfiguration", []))

    @jsii.member(jsii_name="toDeleteSoftwareConfiguration")
    def to_delete_software_configuration(self) -> "Freertos":
        '''(experimental) Deletes the software configuration.

        Access Level: Write

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toDeleteSoftwareConfiguration", []))

    @jsii.member(jsii_name="toDescribeHardwarePlatform")
    def to_describe_hardware_platform(self) -> "Freertos":
        '''(experimental) Describes the hardware platform.

        Access Level: Read

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toDescribeHardwarePlatform", []))

    @jsii.member(jsii_name="toDescribeSoftwareConfiguration")
    def to_describe_software_configuration(self) -> "Freertos":
        '''(experimental) Describes the software configuration.

        Access Level: Read

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toDescribeSoftwareConfiguration", []))

    @jsii.member(jsii_name="toGetSoftwareURL")
    def to_get_software_url(self) -> "Freertos":
        '''(experimental) Get the URL for Amazon FreeRTOS software download.

        Access Level: Read

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toGetSoftwareURL", []))

    @jsii.member(jsii_name="toGetSoftwareURLForConfiguration")
    def to_get_software_url_for_configuration(self) -> "Freertos":
        '''(experimental) Get the URL for Amazon FreeRTOS software download based on the configuration.

        Access Level: Read

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toGetSoftwareURLForConfiguration", []))

    @jsii.member(jsii_name="toListFreeRTOSVersions")
    def to_list_free_rtos_versions(self) -> "Freertos":
        '''(experimental) Lists versions of AmazonFreeRTOS.

        Access Level: List

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toListFreeRTOSVersions", []))

    @jsii.member(jsii_name="toListHardwarePlatforms")
    def to_list_hardware_platforms(self) -> "Freertos":
        '''(experimental) Lists the hardware platforms.

        Access Level: List

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toListHardwarePlatforms", []))

    @jsii.member(jsii_name="toListHardwareVendors")
    def to_list_hardware_vendors(self) -> "Freertos":
        '''(experimental) Lists the hardware vendors.

        Access Level: List

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toListHardwareVendors", []))

    @jsii.member(jsii_name="toListSoftwareConfigurations")
    def to_list_software_configurations(self) -> "Freertos":
        '''(experimental) Lists the software configurations.

        Access Level: List

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toListSoftwareConfigurations", []))

    @jsii.member(jsii_name="toUpdateSoftwareConfiguration")
    def to_update_software_configuration(self) -> "Freertos":
        '''(experimental) Updates the software configuration.

        Access Level: Write

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ocw.html

        :stability: experimental
        '''
        return typing.cast("Freertos", jsii.invoke(self, "toUpdateSoftwareConfiguration", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9f219487dbc827ef764b910fd1be1ee78bafe32ff734bd4b147001b966d7cc35)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e56bef0618547138d03f2cdc7ea28e7e4324779f3c9f400bed7017ffd57a17a8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Freetier(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Freetier",
):
    '''(experimental) Statement provider for service `freetier <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsfreetier.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `freetier <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsfreetier.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c187c0b5f333f208d06532b0aa00834f040a9417b6020615e601e894ecbaf737)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toGetFreeTierAlertPreference")
    def to_get_free_tier_alert_preference(self) -> "Freetier":
        '''(experimental) Allow or deny IAM users permission to get free tier alert preference (email address).

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/tracking-free-tier-usage.html

        :stability: experimental
        '''
        return typing.cast("Freetier", jsii.invoke(self, "toGetFreeTierAlertPreference", []))

    @jsii.member(jsii_name="toGetFreeTierUsage")
    def to_get_free_tier_usage(self) -> "Freetier":
        '''(experimental) Allow or deny IAM users permission to get free tier usage limits and MTD usage status.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/tracking-free-tier-usage.html

        :stability: experimental
        '''
        return typing.cast("Freetier", jsii.invoke(self, "toGetFreeTierUsage", []))

    @jsii.member(jsii_name="toPutFreeTierAlertPreference")
    def to_put_free_tier_alert_preference(self) -> "Freetier":
        '''(experimental) Allow or deny IAM users permission to set free tier alert preference (email address).

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/tracking-free-tier-usage.html

        :stability: experimental
        '''
        return typing.cast("Freetier", jsii.invoke(self, "toPutFreeTierAlertPreference", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__42280714c048a7cbd4ffd7157448cbfa457116a49d6eacce3c189f9ce437c029)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4ff2d595727b4272179e45023b36e95d60bd6e52dbf45525b71f166c6b77c46f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Fsx(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Fsx"):
    '''(experimental) Statement provider for service `fsx <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfsx.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `fsx <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfsx.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5787895e756e98a223776f5b5dfda535097c6437e4219922ad1fced39f8f5c6f)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifIsBackupCopyDestination")
    def if_is_backup_copy_destination(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Fsx":
        '''(experimental) Filters access by whether the backup is a destination backup for a CopyBackup operation.

        https://docs.aws.amazon.com/fsx/latest/WindowsGuide/access-control-manage-access-intro.htmlAPI_CopyBackup.html

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c74ca9510291f7b2da506a4d419f04dc64260f06863454bd93cc130041c02840)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Fsx", jsii.invoke(self, "ifIsBackupCopyDestination", [value]))

    @jsii.member(jsii_name="ifIsBackupCopySource")
    def if_is_backup_copy_source(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Fsx":
        '''(experimental) Filters access by whether the backup is a source backup for a CopyBackup operation.

        https://docs.aws.amazon.com/fsx/latest/WindowsGuide/access-control-manage-access-intro.htmlAPI_CopyBackup.html

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9710d3f7005bd6945f0042908f74b362b38712984c04fca80f2df9129c1d6397)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Fsx", jsii.invoke(self, "ifIsBackupCopySource", [value]))

    @jsii.member(jsii_name="ifNfsDataRepositoryAuthenticationEnabled")
    def if_nfs_data_repository_authentication_enabled(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Fsx":
        '''(experimental) Filters access by NFS data repositories which support authentication.

        https://docs.aws.amazon.com/fsx/latest/WindowsGuide/access-control-manage-access-intro.htmlAPI_CreateFileCache.html

        Applies to actions:

        - .toCreateFileCache()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b4836b3c561a7f1089e5e2666e38761186352b8272c0a6875c95661e5affba28)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Fsx", jsii.invoke(self, "ifNfsDataRepositoryAuthenticationEnabled", [value, operator]))

    @jsii.member(jsii_name="ifNfsDataRepositoryEncryptionInTransitEnabled")
    def if_nfs_data_repository_encryption_in_transit_enabled(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Fsx":
        '''(experimental) Filters access by NFS data repositories which support encryption-in-transit.

        https://docs.aws.amazon.com/fsx/latest/WindowsGuide/access-control-manage-access-intro.htmlAPI_CreateFileCache.html

        Applies to actions:

        - .toCreateFileCache()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3751023a7c8b59a3867c391cec447fd5ab0764dcdced92d490ff8e91c9cf0c2e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Fsx", jsii.invoke(self, "ifNfsDataRepositoryEncryptionInTransitEnabled", [value, operator]))

    @jsii.member(jsii_name="ifParentVolumeId")
    def if_parent_volume_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Fsx":
        '''(experimental) Filters access by the containing parent volume for mutating volume operations.

        https://docs.aws.amazon.com/fsx/latest/WindowsGuide/access-control-manage-access-intro.htmlAPI_CreateVolume.html

        Applies to actions:

        - .toCreateVolume()
        - .toDeleteVolume()
        - .toUpdateVolume()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__521ccb3d72fe676d45179758d9659ee83d815c0e7a1f4d9aa80c56e362807731)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Fsx", jsii.invoke(self, "ifParentVolumeId", [value, operator]))

    @jsii.member(jsii_name="ifStorageVirtualMachineId")
    def if_storage_virtual_machine_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Fsx":
        '''(experimental) Filters access by the containing storage virtual machine for a volume for mutating volume operations.

        https://docs.aws.amazon.com/fsx/latest/WindowsGuide/access-control-manage-access-intro.htmlAPI_CreateVolume.html

        Applies to actions:

        - .toCreateVolume()
        - .toCreateVolumeFromBackup()
        - .toDeleteVolume()
        - .toUpdateVolume()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6c8fcc4fd69ddbd8ef7ac98c6cba6e89d02da40373089c5a0e1b43f5502ffa2a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Fsx", jsii.invoke(self, "ifStorageVirtualMachineId", [value, operator]))

    @jsii.member(jsii_name="onAssociation")
    def on_association(
        self,
        file_system_id_or_file_cache_id: builtins.str,
        data_repository_association_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fsx":
        '''(experimental) Adds a resource of type association to the statement.

        https://docs.aws.amazon.com/fsx/latest/LustreGuide/access-control-overview.html#access-control-resources

        :param file_system_id_or_file_cache_id: - Identifier for the fileSystemIdOrFileCacheId.
        :param data_repository_association_id: - Identifier for the dataRepositoryAssociationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c0eda96bf143de9f90884a90ee7a999f9bd9ce530a853ef1c1f186a97d7033b9)
            check_type(argname="argument file_system_id_or_file_cache_id", value=file_system_id_or_file_cache_id, expected_type=type_hints["file_system_id_or_file_cache_id"])
            check_type(argname="argument data_repository_association_id", value=data_repository_association_id, expected_type=type_hints["data_repository_association_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Fsx", jsii.invoke(self, "onAssociation", [file_system_id_or_file_cache_id, data_repository_association_id, account, region, partition]))

    @jsii.member(jsii_name="onBackup")
    def on_backup(
        self,
        backup_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fsx":
        '''(experimental) Adds a resource of type backup to the statement.

        https://docs.aws.amazon.com/fsx/latest/WindowsGuide/access-control-overview.html#access-control-resources

        :param backup_id: - Identifier for the backupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__02f5736683ad5719c5c67bd2a0d9c328f956271746bce4d967ec3b5db5f93c11)
            check_type(argname="argument backup_id", value=backup_id, expected_type=type_hints["backup_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Fsx", jsii.invoke(self, "onBackup", [backup_id, account, region, partition]))

    @jsii.member(jsii_name="onFileCache")
    def on_file_cache(
        self,
        file_cache_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fsx":
        '''(experimental) Adds a resource of type file-cache to the statement.

        https://docs.aws.amazon.com/fsx/latest/FileCacheGuide/security-iam.html

        :param file_cache_id: - Identifier for the fileCacheId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b11a29a4f8377a08f9599c7cf186f28c848b690b15c5046ee2b1756c32d7fbba)
            check_type(argname="argument file_cache_id", value=file_cache_id, expected_type=type_hints["file_cache_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Fsx", jsii.invoke(self, "onFileCache", [file_cache_id, account, region, partition]))

    @jsii.member(jsii_name="onFileSystem")
    def on_file_system(
        self,
        file_system_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fsx":
        '''(experimental) Adds a resource of type file-system to the statement.

        https://docs.aws.amazon.com/fsx/latest/WindowsGuide/access-control-overview.html#access-control-resources

        :param file_system_id: - Identifier for the fileSystemId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__48e8aac2af820972cb3a1438d591a581774c048b40a6676ead0e1e68f022b1f7)
            check_type(argname="argument file_system_id", value=file_system_id, expected_type=type_hints["file_system_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Fsx", jsii.invoke(self, "onFileSystem", [file_system_id, account, region, partition]))

    @jsii.member(jsii_name="onSnapshot")
    def on_snapshot(
        self,
        volume_id: builtins.str,
        snapshot_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fsx":
        '''(experimental) Adds a resource of type snapshot to the statement.

        https://docs.aws.amazon.com/fsx/latest/OpenFsGuide/access-control-overview.html#access-control-resources

        :param volume_id: - Identifier for the volumeId.
        :param snapshot_id: - Identifier for the snapshotId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5b6ea9d4cc2d08134ecb4720090e2be646a6d5cb32961a642c18f144cc3d27c2)
            check_type(argname="argument volume_id", value=volume_id, expected_type=type_hints["volume_id"])
            check_type(argname="argument snapshot_id", value=snapshot_id, expected_type=type_hints["snapshot_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Fsx", jsii.invoke(self, "onSnapshot", [volume_id, snapshot_id, account, region, partition]))

    @jsii.member(jsii_name="onStorageVirtualMachine")
    def on_storage_virtual_machine(
        self,
        file_system_id: builtins.str,
        storage_virtual_machine_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fsx":
        '''(experimental) Adds a resource of type storage-virtual-machine to the statement.

        https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/security-iam.html

        :param file_system_id: - Identifier for the fileSystemId.
        :param storage_virtual_machine_id: - Identifier for the storageVirtualMachineId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__29f8c9b5e552dff5ef92bd47d3c76f0c6043934f24c62b1103858d82bed2e011)
            check_type(argname="argument file_system_id", value=file_system_id, expected_type=type_hints["file_system_id"])
            check_type(argname="argument storage_virtual_machine_id", value=storage_virtual_machine_id, expected_type=type_hints["storage_virtual_machine_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Fsx", jsii.invoke(self, "onStorageVirtualMachine", [file_system_id, storage_virtual_machine_id, account, region, partition]))

    @jsii.member(jsii_name="onTask")
    def on_task(
        self,
        task_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fsx":
        '''(experimental) Adds a resource of type task to the statement.

        https://docs.aws.amazon.com/fsx/latest/LustreGuide/access-control-overview.html#access-control-resources

        :param task_id: - Identifier for the taskId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e4f7a07baaf4294668b444cafb296d38ed457bb091370137dba331f34dbd02ce)
            check_type(argname="argument task_id", value=task_id, expected_type=type_hints["task_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Fsx", jsii.invoke(self, "onTask", [task_id, account, region, partition]))

    @jsii.member(jsii_name="onVolume")
    def on_volume(
        self,
        file_system_id: builtins.str,
        volume_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Fsx":
        '''(experimental) Adds a resource of type volume to the statement.

        https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/security-iam.html

        :param file_system_id: - Identifier for the fileSystemId.
        :param volume_id: - Identifier for the volumeId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__26e96f906d3ebf180757816147ea33059f03d1928992972a9724a10606cbb423)
            check_type(argname="argument file_system_id", value=file_system_id, expected_type=type_hints["file_system_id"])
            check_type(argname="argument volume_id", value=volume_id, expected_type=type_hints["volume_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Fsx", jsii.invoke(self, "onVolume", [file_system_id, volume_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateFileGateway")
    def to_associate_file_gateway(self) -> "Fsx":
        '''(experimental) Grants permission to associate a File Gateway instance with an Amazon FSx for Windows File Server file system.

        Access Level: Write

        https://docs.aws.amazon.com/filegateway/latest/filefsxw/what-is-file-fsxw.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toAssociateFileGateway", []))

    @jsii.member(jsii_name="toAssociateFileSystemAliases")
    def to_associate_file_system_aliases(self) -> "Fsx":
        '''(experimental) Grants permission to associate DNS aliases with an Amazon FSx for Windows File Server file system.

        Access Level: Write

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_AssociateFileSystemAliases.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toAssociateFileSystemAliases", []))

    @jsii.member(jsii_name="toCancelDataRepositoryTask")
    def to_cancel_data_repository_task(self) -> "Fsx":
        '''(experimental) Grants permission to cancel a data repository task.

        Access Level: Write

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_CancelDataRepositoryTask.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toCancelDataRepositoryTask", []))

    @jsii.member(jsii_name="toCopyBackup")
    def to_copy_backup(self) -> "Fsx":
        '''(experimental) Grants permission to copy a backup.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - fsx:TagResource

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_CopyBackup.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toCopyBackup", []))

    @jsii.member(jsii_name="toCreateBackup")
    def to_create_backup(self) -> "Fsx":
        '''(experimental) Grants permission to create a new backup of an Amazon FSx file system or an Amazon FSx volume.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - fsx:TagResource

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_CreateBackup.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toCreateBackup", []))

    @jsii.member(jsii_name="toCreateDataRepositoryAssociation")
    def to_create_data_repository_association(self) -> "Fsx":
        '''(experimental) Grants permission to create a new data respository association for an Amazon FSx for Lustre file system.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - fsx:TagResource

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_CreateDataRepositoryAssociation.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toCreateDataRepositoryAssociation", []))

    @jsii.member(jsii_name="toCreateDataRepositoryTask")
    def to_create_data_repository_task(self) -> "Fsx":
        '''(experimental) Grants permission to create a new data respository task for an Amazon FSx for Lustre file system.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - fsx:TagResource

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_CreateDataRepositoryTask.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toCreateDataRepositoryTask", []))

    @jsii.member(jsii_name="toCreateFileCache")
    def to_create_file_cache(self) -> "Fsx":
        '''(experimental) Grants permission to create a new, empty, Amazon file cache.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs
        - fsx:CreateDataRepositoryAssociation
        - fsx:TagResource
        - logs:CreateLogGroup
        - logs:CreateLogStream
        - logs:PutLogEvents
        - s3:ListBucket

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_CreateFileCache.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toCreateFileCache", []))

    @jsii.member(jsii_name="toCreateFileSystem")
    def to_create_file_system(self) -> "Fsx":
        '''(experimental) Grants permission to create a new, empty, Amazon FSx file system.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - fsx:TagResource

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_CreateFileSystem.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toCreateFileSystem", []))

    @jsii.member(jsii_name="toCreateFileSystemFromBackup")
    def to_create_file_system_from_backup(self) -> "Fsx":
        '''(experimental) Grants permission to create a new Amazon FSx file system from an existing backup.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - fsx:TagResource

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_CreateFileSystemFromBackup.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toCreateFileSystemFromBackup", []))

    @jsii.member(jsii_name="toCreateSnapshot")
    def to_create_snapshot(self) -> "Fsx":
        '''(experimental) Grants permission to create a new snapshot on a volume.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - fsx:TagResource

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_CreateSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toCreateSnapshot", []))

    @jsii.member(jsii_name="toCreateStorageVirtualMachine")
    def to_create_storage_virtual_machine(self) -> "Fsx":
        '''(experimental) Grants permission to create a new storage virtual machine in an Amazon FSx for Ontap file system.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - fsx:TagResource

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_CreateStorageVirtualMachine.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toCreateStorageVirtualMachine", []))

    @jsii.member(jsii_name="toCreateVolume")
    def to_create_volume(self) -> "Fsx":
        '''(experimental) Grants permission to create a new volume.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifStorageVirtualMachineId()
        - .ifParentVolumeId()

        Dependent actions:

        - fsx:TagResource

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_CreateVolume.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toCreateVolume", []))

    @jsii.member(jsii_name="toCreateVolumeFromBackup")
    def to_create_volume_from_backup(self) -> "Fsx":
        '''(experimental) Grants permission to create a new volume from backup.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifStorageVirtualMachineId()

        Dependent actions:

        - fsx:TagResource

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_CreateVolumeFromBackup.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toCreateVolumeFromBackup", []))

    @jsii.member(jsii_name="toDeleteBackup")
    def to_delete_backup(self) -> "Fsx":
        '''(experimental) Grants permission to delete a backup, deleting its contents.

        After deletion, the backup no longer exists, and its data is no longer available

        Access Level: Write

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DeleteBackup.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDeleteBackup", []))

    @jsii.member(jsii_name="toDeleteDataRepositoryAssociation")
    def to_delete_data_repository_association(self) -> "Fsx":
        '''(experimental) Grants permission to delete a data repository association.

        Access Level: Write

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DeleteDataRepositoryAssociation.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDeleteDataRepositoryAssociation", []))

    @jsii.member(jsii_name="toDeleteFileCache")
    def to_delete_file_cache(self) -> "Fsx":
        '''(experimental) Grants permission to delete a file cache, deleting its contents.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - fsx:DeleteDataRepositoryAssociation

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DeleteFileCache.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDeleteFileCache", []))

    @jsii.member(jsii_name="toDeleteFileSystem")
    def to_delete_file_system(self) -> "Fsx":
        '''(experimental) Grants permission to delete a file system, deleting its contents and any existing automatic backups of the file system.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - fsx:CreateBackup
        - fsx:TagResource

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DeleteFileSystem.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDeleteFileSystem", []))

    @jsii.member(jsii_name="toDeleteSnapshot")
    def to_delete_snapshot(self) -> "Fsx":
        '''(experimental) Grants permission to delete a snapshot on a volume.

        Access Level: Write

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DeleteSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDeleteSnapshot", []))

    @jsii.member(jsii_name="toDeleteStorageVirtualMachine")
    def to_delete_storage_virtual_machine(self) -> "Fsx":
        '''(experimental) Grants permission to delete a storage virtual machine, deleting its contents.

        Access Level: Write

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DeleteStorageVirtualMachine.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDeleteStorageVirtualMachine", []))

    @jsii.member(jsii_name="toDeleteVolume")
    def to_delete_volume(self) -> "Fsx":
        '''(experimental) Grants permission to delete a volume, deleting its contents and any existing automatic backups of the volume.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifStorageVirtualMachineId()
        - .ifParentVolumeId()

        Dependent actions:

        - fsx:TagResource

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DeleteVolume.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDeleteVolume", []))

    @jsii.member(jsii_name="toDescribeAssociatedFileGateways")
    def to_describe_associated_file_gateways(self) -> "Fsx":
        '''(experimental) Grants permission to describe the File Gateway instances associated with an Amazon FSx for Windows File Server file system.

        Access Level: Read

        https://docs.aws.amazon.com/filegateway/latest/filefsxw/what-is-file-fsxw.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDescribeAssociatedFileGateways", []))

    @jsii.member(jsii_name="toDescribeBackups")
    def to_describe_backups(self) -> "Fsx":
        '''(experimental) Grants permission to return the descriptions of all backups owned by your AWS account in the AWS Region of the endpoint that you're calling.

        Access Level: Read

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DescribeBackups.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDescribeBackups", []))

    @jsii.member(jsii_name="toDescribeDataRepositoryAssociations")
    def to_describe_data_repository_associations(self) -> "Fsx":
        '''(experimental) Grants permission to return the descriptions of all data repository associations owned by your AWS account in the AWS Region of the endpoint that you're calling.

        Access Level: Read

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DescribeDataRepositoryAssociations.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDescribeDataRepositoryAssociations", []))

    @jsii.member(jsii_name="toDescribeDataRepositoryTasks")
    def to_describe_data_repository_tasks(self) -> "Fsx":
        '''(experimental) Grants permission to return the descriptions of all data repository tasks owned by your AWS account in the AWS Region of the endpoint that you're calling.

        Access Level: Read

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DescribeDataRepositoryTasks.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDescribeDataRepositoryTasks", []))

    @jsii.member(jsii_name="toDescribeFileCaches")
    def to_describe_file_caches(self) -> "Fsx":
        '''(experimental) Grants permission to return the descriptions of all file caches owned by your AWS account in the AWS Region of the endpoint that you're calling.

        Access Level: Read

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DescribeFileCaches.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDescribeFileCaches", []))

    @jsii.member(jsii_name="toDescribeFileSystemAliases")
    def to_describe_file_system_aliases(self) -> "Fsx":
        '''(experimental) Grants permission to return the description of all DNS aliases owned by your Amazon FSx for Windows File Server file system.

        Access Level: Read

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DescribeFileSystemAliases.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDescribeFileSystemAliases", []))

    @jsii.member(jsii_name="toDescribeFileSystems")
    def to_describe_file_systems(self) -> "Fsx":
        '''(experimental) Grants permission to return the descriptions of all file systems owned by your AWS account in the AWS Region of the endpoint that you're calling.

        Access Level: Read

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DescribeFileSystems.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDescribeFileSystems", []))

    @jsii.member(jsii_name="toDescribeSnapshots")
    def to_describe_snapshots(self) -> "Fsx":
        '''(experimental) Grants permission to return the descriptions of all snapshots owned by your AWS account in the AWS Region of the endpoint you're calling.

        Access Level: Read

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DescribeSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDescribeSnapshots", []))

    @jsii.member(jsii_name="toDescribeStorageVirtualMachines")
    def to_describe_storage_virtual_machines(self) -> "Fsx":
        '''(experimental) Grants permission to return the descriptions of all storage virtual machines owned by your AWS account in the AWS Region of the endpoint that you're calling.

        Access Level: Read

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DescribeStorageVirtualMachines.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDescribeStorageVirtualMachines", []))

    @jsii.member(jsii_name="toDescribeVolumes")
    def to_describe_volumes(self) -> "Fsx":
        '''(experimental) Grants permission to return the descriptions of all volumes owned by your AWS account in the AWS Region of the endpoint that you're calling.

        Access Level: Read

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DescribeVolumes.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDescribeVolumes", []))

    @jsii.member(jsii_name="toDisassociateFileGateway")
    def to_disassociate_file_gateway(self) -> "Fsx":
        '''(experimental) Grants permission to disassociate a File Gateway instance from an Amazon FSx for Windows File Server file system.

        Access Level: Write

        https://docs.aws.amazon.com/filegateway/latest/filefsxw/what-is-file-fsxw.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDisassociateFileGateway", []))

    @jsii.member(jsii_name="toDisassociateFileSystemAliases")
    def to_disassociate_file_system_aliases(self) -> "Fsx":
        '''(experimental) Grants permission to disassociate file system aliases with an Amazon FSx for Windows File Server file system.

        Access Level: Write

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_DisassociateFileSystemAliases.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toDisassociateFileSystemAliases", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Fsx":
        '''(experimental) Grants permission to list tags for an Amazon FSx resource.

        Access Level: Read

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toManageBackupPrincipalAssociations")
    def to_manage_backup_principal_associations(self) -> "Fsx":
        '''(experimental) Grants permission to manage backup principal associations through AWS Backup.

        Access Level: Permissions management

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_CopyBackup.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toManageBackupPrincipalAssociations", []))

    @jsii.member(jsii_name="toReleaseFileSystemNfsV3Locks")
    def to_release_file_system_nfs_v3_locks(self) -> "Fsx":
        '''(experimental) Grants permission to release file system NFS V3 locks.

        Access Level: Write

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_ReleaseFileSystemNfsV3Locks.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toReleaseFileSystemNfsV3Locks", []))

    @jsii.member(jsii_name="toRestoreVolumeFromSnapshot")
    def to_restore_volume_from_snapshot(self) -> "Fsx":
        '''(experimental) Grants permission to restore volume state from a snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_RestoreVolumeFromSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toRestoreVolumeFromSnapshot", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Fsx":
        '''(experimental) Grants permission to tag an Amazon FSx resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Fsx":
        '''(experimental) Grants permission to remove a tag from an Amazon FSx resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDataRepositoryAssociation")
    def to_update_data_repository_association(self) -> "Fsx":
        '''(experimental) Grants permission to update data repository association configuration.

        Access Level: Write

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_UpdateDataRepositoryAssociation.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toUpdateDataRepositoryAssociation", []))

    @jsii.member(jsii_name="toUpdateFileCache")
    def to_update_file_cache(self) -> "Fsx":
        '''(experimental) Grants permission to update file cache configuration.

        Access Level: Write

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_UpdateFileCache.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toUpdateFileCache", []))

    @jsii.member(jsii_name="toUpdateFileSystem")
    def to_update_file_system(self) -> "Fsx":
        '''(experimental) Grants permission to update file system configuration.

        Access Level: Write

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_UpdateFileSystem.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toUpdateFileSystem", []))

    @jsii.member(jsii_name="toUpdateSnapshot")
    def to_update_snapshot(self) -> "Fsx":
        '''(experimental) Grants permission to update snapshot configuration.

        Access Level: Write

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_UpdateSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toUpdateSnapshot", []))

    @jsii.member(jsii_name="toUpdateStorageVirtualMachine")
    def to_update_storage_virtual_machine(self) -> "Fsx":
        '''(experimental) Grants permission to update storage virtual machine configuration.

        Access Level: Write

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_UpdateStorageVirtualMachine.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toUpdateStorageVirtualMachine", []))

    @jsii.member(jsii_name="toUpdateVolume")
    def to_update_volume(self) -> "Fsx":
        '''(experimental) Grants permission to update volume configuration.

        Access Level: Write

        Possible conditions:

        - .ifStorageVirtualMachineId()
        - .ifParentVolumeId()

        https://docs.aws.amazon.com/fsx/latest/APIReference/API_UpdateVolume.html

        :stability: experimental
        '''
        return typing.cast("Fsx", jsii.invoke(self, "toUpdateVolume", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6b9e896466b67f5fd14c2a10b73a63f8f74a97ef3b20a042325b4ea5afbdd46f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__08e4fec0688ee08b4f00fcd9ab72cbb4f430c35bf179585bc026d560bc1ce136)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Gamelift(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Gamelift",
):
    '''(experimental) Statement provider for service `gamelift <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazongamelift.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `gamelift <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazongamelift.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4713fe6c80322c3f7b21b8f6977869f9c8076a5b04db9301cc3536fcf2177560)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAlias")
    def on_alias(
        self,
        alias_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Gamelift":
        '''(experimental) Adds a resource of type alias to the statement.

        https://docs.aws.amazon.com/gamelift/latest/developerguide/gamelift-console-aliases.html

        :param alias_id: - Identifier for the aliasId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f1031f2131a2225a959b230e3f0ac6d70278d19997b9c3900f691d1bb83ff4c5)
            check_type(argname="argument alias_id", value=alias_id, expected_type=type_hints["alias_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Gamelift", jsii.invoke(self, "onAlias", [alias_id, region, partition]))

    @jsii.member(jsii_name="onBuild")
    def on_build(
        self,
        build_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Gamelift":
        '''(experimental) Adds a resource of type build to the statement.

        https://docs.aws.amazon.com/gamelift/latest/developerguide/gamelift-console-builds.html

        :param build_id: - Identifier for the buildId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__19c64e598a229047dfcf4151635b5f118968c529d5f5dae289c5910e6ad8a6a3)
            check_type(argname="argument build_id", value=build_id, expected_type=type_hints["build_id"])
            check_type(argname="argument account_id", value=account_id, expected_type=type_hints["account_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Gamelift", jsii.invoke(self, "onBuild", [build_id, account_id, region, partition]))

    @jsii.member(jsii_name="onFleet")
    def on_fleet(
        self,
        fleet_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Gamelift":
        '''(experimental) Adds a resource of type fleet to the statement.

        https://docs.aws.amazon.com/gamelift/latest/developerguide/gamelift-console-fleets.html

        :param fleet_id: - Identifier for the fleetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__39f58b773706da5236a4e914c5237695ed2c01e3a35bc3810dac71fd3cc68d83)
            check_type(argname="argument fleet_id", value=fleet_id, expected_type=type_hints["fleet_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Gamelift", jsii.invoke(self, "onFleet", [fleet_id, account, region, partition]))

    @jsii.member(jsii_name="onGameServerGroup")
    def on_game_server_group(
        self,
        game_server_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Gamelift":
        '''(experimental) Adds a resource of type gameServerGroup to the statement.

        https://docs.aws.amazon.com/gamelift/latest/fleetiqguide/gsg-integrate-gameservergroup.html

        :param game_server_group_name: - Identifier for the gameServerGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f895558c8fcd47fdd1a1ba88c4e272d97d7af6c60bffb21c489d44bc443b713f)
            check_type(argname="argument game_server_group_name", value=game_server_group_name, expected_type=type_hints["game_server_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Gamelift", jsii.invoke(self, "onGameServerGroup", [game_server_group_name, account, region, partition]))

    @jsii.member(jsii_name="onGameSessionQueue")
    def on_game_session_queue(
        self,
        game_session_queue_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Gamelift":
        '''(experimental) Adds a resource of type gameSessionQueue to the statement.

        https://docs.aws.amazon.com/gamelift/latest/developerguide/queues-console.html

        :param game_session_queue_name: - Identifier for the gameSessionQueueName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__58233c160defe0d566523f5f01537c8b6ab266511bca50dd49e8d114283392a5)
            check_type(argname="argument game_session_queue_name", value=game_session_queue_name, expected_type=type_hints["game_session_queue_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Gamelift", jsii.invoke(self, "onGameSessionQueue", [game_session_queue_name, account, region, partition]))

    @jsii.member(jsii_name="onLocation")
    def on_location(
        self,
        location_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Gamelift":
        '''(experimental) Adds a resource of type location to the statement.

        https://docs.aws.amazon.com/gamelift/latest/developerguide/locations-console.html

        :param location_id: - Identifier for the locationId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d103ca0efc6fc23e512ceadb1bd805ce81dbb0e68ac4da30b60ed9ca42b419d2)
            check_type(argname="argument location_id", value=location_id, expected_type=type_hints["location_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Gamelift", jsii.invoke(self, "onLocation", [location_id, region, partition]))

    @jsii.member(jsii_name="onMatchmakingConfiguration")
    def on_matchmaking_configuration(
        self,
        matchmaking_configuration_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Gamelift":
        '''(experimental) Adds a resource of type matchmakingConfiguration to the statement.

        https://docs.aws.amazon.com/gamelift/latest/flexmatchguide/match-create-configuration.html

        :param matchmaking_configuration_name: - Identifier for the matchmakingConfigurationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bb88f950b51f13af22f6f649af02ad3c09567ee9efa2762b8b617b82e8ae9a73)
            check_type(argname="argument matchmaking_configuration_name", value=matchmaking_configuration_name, expected_type=type_hints["matchmaking_configuration_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Gamelift", jsii.invoke(self, "onMatchmakingConfiguration", [matchmaking_configuration_name, account, region, partition]))

    @jsii.member(jsii_name="onMatchmakingRuleSet")
    def on_matchmaking_rule_set(
        self,
        matchmaking_rule_set_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Gamelift":
        '''(experimental) Adds a resource of type matchmakingRuleSet to the statement.

        https://docs.aws.amazon.com/gamelift/latest/flexmatchguide/match-rulesets.html

        :param matchmaking_rule_set_name: - Identifier for the matchmakingRuleSetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6a6ce5dd0fa316efb1a6558d2ac4db285c37ace043f25d9e6753f94cd37eb22d)
            check_type(argname="argument matchmaking_rule_set_name", value=matchmaking_rule_set_name, expected_type=type_hints["matchmaking_rule_set_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Gamelift", jsii.invoke(self, "onMatchmakingRuleSet", [matchmaking_rule_set_name, account, region, partition]))

    @jsii.member(jsii_name="onScript")
    def on_script(
        self,
        script_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Gamelift":
        '''(experimental) Adds a resource of type script to the statement.

        https://docs.aws.amazon.com/gamelift/latest/developerguide/gamelift-console-scripts.html

        :param script_id: - Identifier for the scriptId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8bf7bfb166a05796b2ed0958714e7f8cad1c99787dc7aac1dea9a7916926d576)
            check_type(argname="argument script_id", value=script_id, expected_type=type_hints["script_id"])
            check_type(argname="argument account_id", value=account_id, expected_type=type_hints["account_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Gamelift", jsii.invoke(self, "onScript", [script_id, account_id, region, partition]))

    @jsii.member(jsii_name="toAcceptMatch")
    def to_accept_match(self) -> "Gamelift":
        '''(experimental) Grants permission to register player acceptance or rejection of a proposed FlexMatch match.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_AcceptMatch.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toAcceptMatch", []))

    @jsii.member(jsii_name="toClaimGameServer")
    def to_claim_game_server(self) -> "Gamelift":
        '''(experimental) Grants permission to locate and reserve a game server to host a new game session.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ClaimGameServer.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toClaimGameServer", []))

    @jsii.member(jsii_name="toCreateAlias")
    def to_create_alias(self) -> "Gamelift":
        '''(experimental) Grants permission to define a new alias for a fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateAlias.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateAlias", []))

    @jsii.member(jsii_name="toCreateBuild")
    def to_create_build(self) -> "Gamelift":
        '''(experimental) Grants permission to create a new game build using files stored in an Amazon S3 bucket.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateBuild.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateBuild", []))

    @jsii.member(jsii_name="toCreateFleet")
    def to_create_fleet(self) -> "Gamelift":
        '''(experimental) Grants permission to create a new fleet of computing resources to run your game servers.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateFleet.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateFleet", []))

    @jsii.member(jsii_name="toCreateFleetLocations")
    def to_create_fleet_locations(self) -> "Gamelift":
        '''(experimental) Grants permission to specify additional locations for a fleet.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateFleetLocations.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateFleetLocations", []))

    @jsii.member(jsii_name="toCreateGameServerGroup")
    def to_create_game_server_group(self) -> "Gamelift":
        '''(experimental) Grants permission to create a new game server group, set up a corresponding Auto Scaling group, and launche instances to host game servers.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateGameServerGroup.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateGameServerGroup", []))

    @jsii.member(jsii_name="toCreateGameSession")
    def to_create_game_session(self) -> "Gamelift":
        '''(experimental) Grants permission to start a new game session on a specified fleet.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateGameSession.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateGameSession", []))

    @jsii.member(jsii_name="toCreateGameSessionQueue")
    def to_create_game_session_queue(self) -> "Gamelift":
        '''(experimental) Grants permission to set up a new queue for processing game session placement requests.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateGameSessionQueue.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateGameSessionQueue", []))

    @jsii.member(jsii_name="toCreateLocation")
    def to_create_location(self) -> "Gamelift":
        '''(experimental) Grants permission to define a new location for a fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateLocation.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateLocation", []))

    @jsii.member(jsii_name="toCreateMatchmakingConfiguration")
    def to_create_matchmaking_configuration(self) -> "Gamelift":
        '''(experimental) Grants permission to create a new FlexMatch matchmaker.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateMatchmakingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateMatchmakingConfiguration", []))

    @jsii.member(jsii_name="toCreateMatchmakingRuleSet")
    def to_create_matchmaking_rule_set(self) -> "Gamelift":
        '''(experimental) Grants permission to create a new matchmaking rule set for FlexMatch.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateMatchmakingRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateMatchmakingRuleSet", []))

    @jsii.member(jsii_name="toCreatePlayerSession")
    def to_create_player_session(self) -> "Gamelift":
        '''(experimental) Grants permission to reserve an available game session slot for a player.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreatePlayerSession.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreatePlayerSession", []))

    @jsii.member(jsii_name="toCreatePlayerSessions")
    def to_create_player_sessions(self) -> "Gamelift":
        '''(experimental) Grants permission to reserve available game session slots for multiple players.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreatePlayerSessions.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreatePlayerSessions", []))

    @jsii.member(jsii_name="toCreateScript")
    def to_create_script(self) -> "Gamelift":
        '''(experimental) Grants permission to create a new Realtime Servers script.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateScript.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateScript", []))

    @jsii.member(jsii_name="toCreateVpcPeeringAuthorization")
    def to_create_vpc_peering_authorization(self) -> "Gamelift":
        '''(experimental) Grants permission to allow GameLift to create or delete a peering connection between a GameLift fleet VPC and a VPC on another AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateVpcPeeringAuthorization.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateVpcPeeringAuthorization", []))

    @jsii.member(jsii_name="toCreateVpcPeeringConnection")
    def to_create_vpc_peering_connection(self) -> "Gamelift":
        '''(experimental) Grants permission to establish a peering connection between your GameLift fleet VPC and a VPC on another account.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_CreateVpcPeeringConnection.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toCreateVpcPeeringConnection", []))

    @jsii.member(jsii_name="toDeleteAlias")
    def to_delete_alias(self) -> "Gamelift":
        '''(experimental) Grants permission to delete an alias.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteAlias.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteAlias", []))

    @jsii.member(jsii_name="toDeleteBuild")
    def to_delete_build(self) -> "Gamelift":
        '''(experimental) Grants permission to delete a game build.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteBuild.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteBuild", []))

    @jsii.member(jsii_name="toDeleteFleet")
    def to_delete_fleet(self) -> "Gamelift":
        '''(experimental) Grants permission to delete an empty fleet.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteFleet.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteFleet", []))

    @jsii.member(jsii_name="toDeleteFleetLocations")
    def to_delete_fleet_locations(self) -> "Gamelift":
        '''(experimental) Grants permission to delete locations for a fleet.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteFleetLocations.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteFleetLocations", []))

    @jsii.member(jsii_name="toDeleteGameServerGroup")
    def to_delete_game_server_group(self) -> "Gamelift":
        '''(experimental) Grants permission to permanently delete a game server group and terminate FleetIQ activity for the corresponding Auto Scaling group.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteGameServerGroup.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteGameServerGroup", []))

    @jsii.member(jsii_name="toDeleteGameSessionQueue")
    def to_delete_game_session_queue(self) -> "Gamelift":
        '''(experimental) Grants permission to delete an existing game session queue.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteGameSessionQueue.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteGameSessionQueue", []))

    @jsii.member(jsii_name="toDeleteLocation")
    def to_delete_location(self) -> "Gamelift":
        '''(experimental) Grants permission to delete a location.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteLocation.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteLocation", []))

    @jsii.member(jsii_name="toDeleteMatchmakingConfiguration")
    def to_delete_matchmaking_configuration(self) -> "Gamelift":
        '''(experimental) Grants permission to delete an existing FlexMatch matchmaker.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteMatchmakingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteMatchmakingConfiguration", []))

    @jsii.member(jsii_name="toDeleteMatchmakingRuleSet")
    def to_delete_matchmaking_rule_set(self) -> "Gamelift":
        '''(experimental) Grants permission to delete an existing FlexMatch matchmaking rule set.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteMatchmakingRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteMatchmakingRuleSet", []))

    @jsii.member(jsii_name="toDeleteScalingPolicy")
    def to_delete_scaling_policy(self) -> "Gamelift":
        '''(experimental) Grants permission to delete a set of auto-scaling rules.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteScalingPolicy.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteScalingPolicy", []))

    @jsii.member(jsii_name="toDeleteScript")
    def to_delete_script(self) -> "Gamelift":
        '''(experimental) Grants permission to delete a Realtime Servers script.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteScript.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteScript", []))

    @jsii.member(jsii_name="toDeleteVpcPeeringAuthorization")
    def to_delete_vpc_peering_authorization(self) -> "Gamelift":
        '''(experimental) Grants permission to cancel a VPC peering authorization.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteVpcPeeringAuthorization.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteVpcPeeringAuthorization", []))

    @jsii.member(jsii_name="toDeleteVpcPeeringConnection")
    def to_delete_vpc_peering_connection(self) -> "Gamelift":
        '''(experimental) Grants permission to remove a peering connection between VPCs.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeleteVpcPeeringConnection.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeleteVpcPeeringConnection", []))

    @jsii.member(jsii_name="toDeregisterCompute")
    def to_deregister_compute(self) -> "Gamelift":
        '''(experimental) Grants permission to deregister a compute against a fleet.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeregisterCompute.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeregisterCompute", []))

    @jsii.member(jsii_name="toDeregisterGameServer")
    def to_deregister_game_server(self) -> "Gamelift":
        '''(experimental) Grants permission to remove a game server from a game server group.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DeregisterGameServer.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDeregisterGameServer", []))

    @jsii.member(jsii_name="toDescribeAlias")
    def to_describe_alias(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for an alias.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeAlias.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeAlias", []))

    @jsii.member(jsii_name="toDescribeBuild")
    def to_describe_build(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for a game build.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeBuild.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeBuild", []))

    @jsii.member(jsii_name="toDescribeCompute")
    def to_describe_compute(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve general properties of the compute such as ARN, fleet details, SDK endpoints, and location.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeCompute.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeCompute", []))

    @jsii.member(jsii_name="toDescribeEC2InstanceLimits")
    def to_describe_ec2_instance_limits(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve the maximum allowed and current usage for EC2 instance types.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeEC2InstanceLimits.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeEC2InstanceLimits", []))

    @jsii.member(jsii_name="toDescribeFleetAttributes")
    def to_describe_fleet_attributes(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve general properties, including status, for fleets.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeFleetAttributes.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeFleetAttributes", []))

    @jsii.member(jsii_name="toDescribeFleetCapacity")
    def to_describe_fleet_capacity(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve the current capacity setting for fleets.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeFleetCapacity.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeFleetCapacity", []))

    @jsii.member(jsii_name="toDescribeFleetEvents")
    def to_describe_fleet_events(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve entries from a fleet's event log.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeFleetEvents.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeFleetEvents", []))

    @jsii.member(jsii_name="toDescribeFleetLocationAttributes")
    def to_describe_fleet_location_attributes(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve general properties, including statuses, for a fleet's locations.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeFleetLocationAttributes.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeFleetLocationAttributes", []))

    @jsii.member(jsii_name="toDescribeFleetLocationCapacity")
    def to_describe_fleet_location_capacity(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve the current capacity setting for a fleet's location.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeFleetLocationCapacity.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeFleetLocationCapacity", []))

    @jsii.member(jsii_name="toDescribeFleetLocationUtilization")
    def to_describe_fleet_location_utilization(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve utilization statistics for fleet's location.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeFleetLocationUtilization.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeFleetLocationUtilization", []))

    @jsii.member(jsii_name="toDescribeFleetPortSettings")
    def to_describe_fleet_port_settings(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve the inbound connection permissions for a fleet.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeFleetPortSettings.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeFleetPortSettings", []))

    @jsii.member(jsii_name="toDescribeFleetUtilization")
    def to_describe_fleet_utilization(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve utilization statistics for fleets.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeFleetUtilization.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeFleetUtilization", []))

    @jsii.member(jsii_name="toDescribeGameServer")
    def to_describe_game_server(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for a game server.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeGameServer.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeGameServer", []))

    @jsii.member(jsii_name="toDescribeGameServerGroup")
    def to_describe_game_server_group(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for a game server group.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeGameServerGroup.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeGameServerGroup", []))

    @jsii.member(jsii_name="toDescribeGameServerInstances")
    def to_describe_game_server_instances(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve the status of EC2 instances in a game server group.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeGameServerInstances.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeGameServerInstances", []))

    @jsii.member(jsii_name="toDescribeGameSessionDetails")
    def to_describe_game_session_details(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for game sessions in a fleet, including the protection policy.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeGameSessionDetails.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeGameSessionDetails", []))

    @jsii.member(jsii_name="toDescribeGameSessionPlacement")
    def to_describe_game_session_placement(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve details of a game session placement request.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeGameSessionPlacement.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeGameSessionPlacement", []))

    @jsii.member(jsii_name="toDescribeGameSessionQueues")
    def to_describe_game_session_queues(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for game session queues.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeGameSessionQueues.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeGameSessionQueues", []))

    @jsii.member(jsii_name="toDescribeGameSessions")
    def to_describe_game_sessions(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for game sessions in a fleet.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeGameSessions.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeGameSessions", []))

    @jsii.member(jsii_name="toDescribeInstances")
    def to_describe_instances(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve information about instances in a fleet.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeInstances.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeInstances", []))

    @jsii.member(jsii_name="toDescribeMatchmaking")
    def to_describe_matchmaking(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve details of matchmaking tickets.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeMatchmaking.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeMatchmaking", []))

    @jsii.member(jsii_name="toDescribeMatchmakingConfigurations")
    def to_describe_matchmaking_configurations(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for FlexMatch matchmakers.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeMatchmakingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeMatchmakingConfigurations", []))

    @jsii.member(jsii_name="toDescribeMatchmakingRuleSets")
    def to_describe_matchmaking_rule_sets(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for FlexMatch matchmaking rule sets.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeMatchmakingRuleSets.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeMatchmakingRuleSets", []))

    @jsii.member(jsii_name="toDescribePlayerSessions")
    def to_describe_player_sessions(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for player sessions in a game session.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribePlayerSessions.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribePlayerSessions", []))

    @jsii.member(jsii_name="toDescribeRuntimeConfiguration")
    def to_describe_runtime_configuration(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve the current runtime configuration for a fleet.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeRuntimeConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeRuntimeConfiguration", []))

    @jsii.member(jsii_name="toDescribeScalingPolicies")
    def to_describe_scaling_policies(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve all scaling policies that are applied to a fleet.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeScalingPolicies.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeScalingPolicies", []))

    @jsii.member(jsii_name="toDescribeScript")
    def to_describe_script(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for a Realtime Servers script.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeScript.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeScript", []))

    @jsii.member(jsii_name="toDescribeVpcPeeringAuthorizations")
    def to_describe_vpc_peering_authorizations(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve valid VPC peering authorizations.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeVpcPeeringAuthorizations.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeVpcPeeringAuthorizations", []))

    @jsii.member(jsii_name="toDescribeVpcPeeringConnections")
    def to_describe_vpc_peering_connections(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve details on active or pending VPC peering connections.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_DescribeVpcPeeringConnections.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toDescribeVpcPeeringConnections", []))

    @jsii.member(jsii_name="toGetComputeAccess")
    def to_get_compute_access(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve access credentials of the compute.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_GetComputeAccess.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toGetComputeAccess", []))

    @jsii.member(jsii_name="toGetComputeAuthToken")
    def to_get_compute_auth_token(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve an authorization token for a compute and fleet to use in game server processes.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_GetComputeAuthToken.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toGetComputeAuthToken", []))

    @jsii.member(jsii_name="toGetGameSessionLogUrl")
    def to_get_game_session_log_url(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve the location of stored logs for a game session.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_GetGameSessionLogUrl.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toGetGameSessionLogUrl", []))

    @jsii.member(jsii_name="toGetInstanceAccess")
    def to_get_instance_access(self) -> "Gamelift":
        '''(experimental) Grants permission to request remote access to a specified fleet instance.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_GetInstanceAccess.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toGetInstanceAccess", []))

    @jsii.member(jsii_name="toListAliases")
    def to_list_aliases(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve all aliases that are defined in the current Region.

        Access Level: List

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ListAliases.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toListAliases", []))

    @jsii.member(jsii_name="toListBuilds")
    def to_list_builds(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve all game build in the current Region.

        Access Level: List

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ListBuilds.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toListBuilds", []))

    @jsii.member(jsii_name="toListCompute")
    def to_list_compute(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve all compute resources in the current Region.

        Access Level: List

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ListCompute.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toListCompute", []))

    @jsii.member(jsii_name="toListFleets")
    def to_list_fleets(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve a list of fleet IDs for all fleets in the current Region.

        Access Level: List

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ListFleets.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toListFleets", []))

    @jsii.member(jsii_name="toListGameServerGroups")
    def to_list_game_server_groups(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve all game server groups that are defined in the current Region.

        Access Level: List

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ListGameServerGroups.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toListGameServerGroups", []))

    @jsii.member(jsii_name="toListGameServers")
    def to_list_game_servers(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve all game servers that are currently running in a game server group.

        Access Level: List

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ListGameServers.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toListGameServers", []))

    @jsii.member(jsii_name="toListLocations")
    def to_list_locations(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve all locations in this account.

        Access Level: List

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ListLocations.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toListLocations", []))

    @jsii.member(jsii_name="toListScripts")
    def to_list_scripts(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve properties for all Realtime Servers scripts in the current region.

        Access Level: List

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ListScripts.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toListScripts", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve tags for GameLift resources.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutScalingPolicy")
    def to_put_scaling_policy(self) -> "Gamelift":
        '''(experimental) Grants permission to create or update a fleet auto-scaling policy.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_PutScalingPolicy.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toPutScalingPolicy", []))

    @jsii.member(jsii_name="toRegisterCompute")
    def to_register_compute(self) -> "Gamelift":
        '''(experimental) Grants permission to register a compute against a fleet.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_RegisterCompute.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toRegisterCompute", []))

    @jsii.member(jsii_name="toRegisterGameServer")
    def to_register_game_server(self) -> "Gamelift":
        '''(experimental) Grants permission to notify GameLift FleetIQ when a new game server is ready to host gameplay.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_RegisterGameServer.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toRegisterGameServer", []))

    @jsii.member(jsii_name="toRequestUploadCredentials")
    def to_request_upload_credentials(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve fresh upload credentials to use when uploading a new game build.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_RequestUploadCredentials.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toRequestUploadCredentials", []))

    @jsii.member(jsii_name="toResolveAlias")
    def to_resolve_alias(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve the fleet ID associated with an alias.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ResolveAlias.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toResolveAlias", []))

    @jsii.member(jsii_name="toResumeGameServerGroup")
    def to_resume_game_server_group(self) -> "Gamelift":
        '''(experimental) Grants permission to reinstate suspended FleetIQ activity for a game server group.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ResumeGameServerGroup.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toResumeGameServerGroup", []))

    @jsii.member(jsii_name="toSearchGameSessions")
    def to_search_game_sessions(self) -> "Gamelift":
        '''(experimental) Grants permission to retrieve game sessions that match a set of search criteria.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_SearchGameSessions.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toSearchGameSessions", []))

    @jsii.member(jsii_name="toStartFleetActions")
    def to_start_fleet_actions(self) -> "Gamelift":
        '''(experimental) Grants permission to resume auto-scaling activity on a fleet after it was suspended with StopFleetActions().

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_StartFleetActions.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toStartFleetActions", []))

    @jsii.member(jsii_name="toStartGameSessionPlacement")
    def to_start_game_session_placement(self) -> "Gamelift":
        '''(experimental) Grants permission to send a game session placement request to a game session queue.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_StartGameSessionPlacement.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toStartGameSessionPlacement", []))

    @jsii.member(jsii_name="toStartMatchBackfill")
    def to_start_match_backfill(self) -> "Gamelift":
        '''(experimental) Grants permission to request FlexMatch matchmaking to fill available player slots in an existing game session.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_StartMatchBackfill.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toStartMatchBackfill", []))

    @jsii.member(jsii_name="toStartMatchmaking")
    def to_start_matchmaking(self) -> "Gamelift":
        '''(experimental) Grants permission to request FlexMatch matchmaking for one or a group of players and initiate game session placement.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_StartMatchmaking.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toStartMatchmaking", []))

    @jsii.member(jsii_name="toStopFleetActions")
    def to_stop_fleet_actions(self) -> "Gamelift":
        '''(experimental) Grants permission to suspend auto-scaling activity on a fleet.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_StopFleetActions.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toStopFleetActions", []))

    @jsii.member(jsii_name="toStopGameSessionPlacement")
    def to_stop_game_session_placement(self) -> "Gamelift":
        '''(experimental) Grants permission to cancel a game session placement request that is in progress.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_StopGameSessionPlacement.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toStopGameSessionPlacement", []))

    @jsii.member(jsii_name="toStopMatchmaking")
    def to_stop_matchmaking(self) -> "Gamelift":
        '''(experimental) Grants permission to cancel a matchmaking or match backfill request that is in progress.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_StopMatchmaking.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toStopMatchmaking", []))

    @jsii.member(jsii_name="toSuspendGameServerGroup")
    def to_suspend_game_server_group(self) -> "Gamelift":
        '''(experimental) Grants permission to temporarily stop FleetIQ activity for a game server group.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_SuspendGameServerGroup.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toSuspendGameServerGroup", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Gamelift":
        '''(experimental) Grants permission to tag GameLift resources.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Gamelift":
        '''(experimental) Grants permission to untag GameLift resources.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAlias")
    def to_update_alias(self) -> "Gamelift":
        '''(experimental) Grants permission to update the properties of an existing alias.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateAlias.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateAlias", []))

    @jsii.member(jsii_name="toUpdateBuild")
    def to_update_build(self) -> "Gamelift":
        '''(experimental) Grants permission to update an existing build's metadata.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateBuild.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateBuild", []))

    @jsii.member(jsii_name="toUpdateFleetAttributes")
    def to_update_fleet_attributes(self) -> "Gamelift":
        '''(experimental) Grants permission to update the general properties of an existing fleet.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateFleetAttributes.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateFleetAttributes", []))

    @jsii.member(jsii_name="toUpdateFleetCapacity")
    def to_update_fleet_capacity(self) -> "Gamelift":
        '''(experimental) Grants permission to adjust a fleet's capacity settings.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateFleetCapacity.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateFleetCapacity", []))

    @jsii.member(jsii_name="toUpdateFleetPortSettings")
    def to_update_fleet_port_settings(self) -> "Gamelift":
        '''(experimental) Grants permission to adjust a fleet's port settings.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateFleetPortSettings.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateFleetPortSettings", []))

    @jsii.member(jsii_name="toUpdateGameServer")
    def to_update_game_server(self) -> "Gamelift":
        '''(experimental) Grants permission to change game server properties, health status, or utilization status.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateGameServer.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateGameServer", []))

    @jsii.member(jsii_name="toUpdateGameServerGroup")
    def to_update_game_server_group(self) -> "Gamelift":
        '''(experimental) Grants permission to update properties for game server group, including allowed instance types.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateGameServerGroup.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateGameServerGroup", []))

    @jsii.member(jsii_name="toUpdateGameSession")
    def to_update_game_session(self) -> "Gamelift":
        '''(experimental) Grants permission to update the properties of an existing game session.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateGameSession.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateGameSession", []))

    @jsii.member(jsii_name="toUpdateGameSessionQueue")
    def to_update_game_session_queue(self) -> "Gamelift":
        '''(experimental) Grants permission to update properties of an existing game session queue.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateGameSessionQueue.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateGameSessionQueue", []))

    @jsii.member(jsii_name="toUpdateMatchmakingConfiguration")
    def to_update_matchmaking_configuration(self) -> "Gamelift":
        '''(experimental) Grants permission to update properties of an existing FlexMatch matchmaking configuration.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateMatchmakingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateMatchmakingConfiguration", []))

    @jsii.member(jsii_name="toUpdateRuntimeConfiguration")
    def to_update_runtime_configuration(self) -> "Gamelift":
        '''(experimental) Grants permission to update how server processes are configured on instances in an existing fleet.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateRuntimeConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateRuntimeConfiguration", []))

    @jsii.member(jsii_name="toUpdateScript")
    def to_update_script(self) -> "Gamelift":
        '''(experimental) Grants permission to update the metadata and content of an existing Realtime Servers script.

        Access Level: Write

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_UpdateScript.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toUpdateScript", []))

    @jsii.member(jsii_name="toValidateMatchmakingRuleSet")
    def to_validate_matchmaking_rule_set(self) -> "Gamelift":
        '''(experimental) Grants permission to validate the syntax of a FlexMatch matchmaking rule set.

        Access Level: Read

        https://docs.aws.amazon.com/gamelift/latest/apireference/API_ValidateMatchmakingRuleSet.html

        :stability: experimental
        '''
        return typing.cast("Gamelift", jsii.invoke(self, "toValidateMatchmakingRuleSet", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__124008688568ee67a20f8ea6d1d8a6b0a5db5776be9cfd05cfc9c5a46b160e58)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f05de3dbaa74711bc656a8e28d34cdadd70f38e556c66ff03a426cd13c3d279d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Gamesparks(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Gamesparks",
):
    '''(experimental) Statement provider for service `gamesparks <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazongamesparks.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `gamesparks <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazongamesparks.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__917c681c87fa20eb23c44f25e7ec7e3d367e388fed7b70de320b61bc0bdcdf17)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onGame")
    def on_game(
        self,
        game_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Gamesparks":
        '''(experimental) Adds a resource of type game to the statement.

        https://docs.aws.amazon.com/gamesparks/latest/dg/security-iam-service.html#policy-resources

        :param game_id: - Identifier for the gameId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a9b974e55650266b31cefd8e0c6f206488978df0c458c7e3a5cc179ed58f4939)
            check_type(argname="argument game_id", value=game_id, expected_type=type_hints["game_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Gamesparks", jsii.invoke(self, "onGame", [game_id, account, region, partition]))

    @jsii.member(jsii_name="onStage")
    def on_stage(
        self,
        game_id: builtins.str,
        stage_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Gamesparks":
        '''(experimental) Adds a resource of type stage to the statement.

        https://docs.aws.amazon.com/gamesparks/latest/dg/security-iam-service.html#policy-resources

        :param game_id: - Identifier for the gameId.
        :param stage_name: - Identifier for the stageName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d39d5025ee2103658b0feedee8f77bea56067017c8c593731ee3c2661a70e205)
            check_type(argname="argument game_id", value=game_id, expected_type=type_hints["game_id"])
            check_type(argname="argument stage_name", value=stage_name, expected_type=type_hints["stage_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Gamesparks", jsii.invoke(self, "onStage", [game_id, stage_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateGame")
    def to_create_game(self) -> "Gamesparks":
        '''(experimental) Grants permission to create a game.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_CreateGame.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toCreateGame", []))

    @jsii.member(jsii_name="toCreateSnapshot")
    def to_create_snapshot(self) -> "Gamesparks":
        '''(experimental) Grants permission to create a snapshot of a game.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_CreateSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toCreateSnapshot", []))

    @jsii.member(jsii_name="toCreateStage")
    def to_create_stage(self) -> "Gamesparks":
        '''(experimental) Grants permission to create a stage in a game.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_CreateStage.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toCreateStage", []))

    @jsii.member(jsii_name="toDeleteGame")
    def to_delete_game(self) -> "Gamesparks":
        '''(experimental) Grants permission to delete a game.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_DeleteGame.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toDeleteGame", []))

    @jsii.member(jsii_name="toDeleteStage")
    def to_delete_stage(self) -> "Gamesparks":
        '''(experimental) Grants permission to delete a stage from a game.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_DeleteStage.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toDeleteStage", []))

    @jsii.member(jsii_name="toDisconnectPlayer")
    def to_disconnect_player(self) -> "Gamesparks":
        '''(experimental) Grants permission to disconnect a player from the game runtime.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_DisconnectPlayer.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toDisconnectPlayer", []))

    @jsii.member(jsii_name="toExportSnapshot")
    def to_export_snapshot(self) -> "Gamesparks":
        '''(experimental) Grants permission to export a snapshot of the game configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_ExportSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toExportSnapshot", []))

    @jsii.member(jsii_name="toGetExtension")
    def to_get_extension(self) -> "Gamesparks":
        '''(experimental) Grants permission to get details about an extension.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_GetExtension.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toGetExtension", []))

    @jsii.member(jsii_name="toGetExtensionVersion")
    def to_get_extension_version(self) -> "Gamesparks":
        '''(experimental) Grants permission to get details about an extension version.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_GetExtensionVersion.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toGetExtensionVersion", []))

    @jsii.member(jsii_name="toGetGame")
    def to_get_game(self) -> "Gamesparks":
        '''(experimental) Grants permission to get details about a game.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_GetGame.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toGetGame", []))

    @jsii.member(jsii_name="toGetGameConfiguration")
    def to_get_game_configuration(self) -> "Gamesparks":
        '''(experimental) Grants permission to get the configuration for the game.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_GetGameConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toGetGameConfiguration", []))

    @jsii.member(jsii_name="toGetGeneratedCodeJob")
    def to_get_generated_code_job(self) -> "Gamesparks":
        '''(experimental) Grants permission to get details about a job that is generating code for a snapshot.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_GetGeneratedCodeJob.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toGetGeneratedCodeJob", []))

    @jsii.member(jsii_name="toGetPlayerConnectionStatus")
    def to_get_player_connection_status(self) -> "Gamesparks":
        '''(experimental) Grants permission to get the status of a player connection.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_GetPlayerConnectionStatus.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toGetPlayerConnectionStatus", []))

    @jsii.member(jsii_name="toGetSnapshot")
    def to_get_snapshot(self) -> "Gamesparks":
        '''(experimental) Grants permission to get a snapshot of the game.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_GetSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toGetSnapshot", []))

    @jsii.member(jsii_name="toGetStage")
    def to_get_stage(self) -> "Gamesparks":
        '''(experimental) Grants permission to gets information about a stage.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_GetStage.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toGetStage", []))

    @jsii.member(jsii_name="toGetStageDeployment")
    def to_get_stage_deployment(self) -> "Gamesparks":
        '''(experimental) Grants permission to get information about a stage deployment.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_GetStageDeployment.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toGetStageDeployment", []))

    @jsii.member(jsii_name="toImportGameConfiguration")
    def to_import_game_configuration(self) -> "Gamesparks":
        '''(experimental) Grants permission to import a snapshot of a game configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_ImportGameConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toImportGameConfiguration", []))

    @jsii.member(jsii_name="toInvokeBackend")
    def to_invoke_backend(self) -> "Gamesparks":
        '''(experimental) Grants permission to invoke backend services for a specific game.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/dg/security-iam-stage-roles.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toInvokeBackend", []))

    @jsii.member(jsii_name="toListExtensions")
    def to_list_extensions(self) -> "Gamesparks":
        '''(experimental) Grants permission to list the extensions.

        Access Level: List

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_ListExtensions.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toListExtensions", []))

    @jsii.member(jsii_name="toListExtensionVersions")
    def to_list_extension_versions(self) -> "Gamesparks":
        '''(experimental) Grants permission to list the extension versions.

        Access Level: List

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_ListExtensionVersions.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toListExtensionVersions", []))

    @jsii.member(jsii_name="toListGames")
    def to_list_games(self) -> "Gamesparks":
        '''(experimental) Grants permission to list the games.

        Access Level: List

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_ListGames.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toListGames", []))

    @jsii.member(jsii_name="toListGeneratedCodeJobs")
    def to_list_generated_code_jobs(self) -> "Gamesparks":
        '''(experimental) Grants permission to get a list of code generation jobs for a snapshot.

        Access Level: List

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_ListGeneratedCodeJobs.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toListGeneratedCodeJobs", []))

    @jsii.member(jsii_name="toListSnapshots")
    def to_list_snapshots(self) -> "Gamesparks":
        '''(experimental) Grants permission to get a list of snapshot summaries for a game.

        Access Level: List

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_ListSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toListSnapshots", []))

    @jsii.member(jsii_name="toListStageDeployments")
    def to_list_stage_deployments(self) -> "Gamesparks":
        '''(experimental) Grants permission to get a list of stage deployment summaries for a game.

        Access Level: List

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_ListStageDeployments.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toListStageDeployments", []))

    @jsii.member(jsii_name="toListStages")
    def to_list_stages(self) -> "Gamesparks":
        '''(experimental) Grants permission to get a list of stage summaries for a game.

        Access Level: List

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_ListStages.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toListStages", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Gamesparks":
        '''(experimental) Grants permission to list the tags associated with a resource.

        Access Level: Read

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartGeneratedCodeJob")
    def to_start_generated_code_job(self) -> "Gamesparks":
        '''(experimental) Grants permission to start an asynchronous process that generates client code for system-defined and custom messages.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_StartGeneratedCodeJob.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toStartGeneratedCodeJob", []))

    @jsii.member(jsii_name="toStartStageDeployment")
    def to_start_stage_deployment(self) -> "Gamesparks":
        '''(experimental) Grants permission to deploy a snapshot to a stage and creates a new game runtime.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_StartStageDeployment.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toStartStageDeployment", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Gamesparks":
        '''(experimental) Grants permission to adds tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Gamesparks":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateGame")
    def to_update_game(self) -> "Gamesparks":
        '''(experimental) Grants permission to change the metadata of a game.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_UpdateGame.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toUpdateGame", []))

    @jsii.member(jsii_name="toUpdateGameConfiguration")
    def to_update_game_configuration(self) -> "Gamesparks":
        '''(experimental) Grants permission to change the working copy of the game configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_UpdateGameConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toUpdateGameConfiguration", []))

    @jsii.member(jsii_name="toUpdateSnapshot")
    def to_update_snapshot(self) -> "Gamesparks":
        '''(experimental) Grants permission to update the metadata of a snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_UpdateSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toUpdateSnapshot", []))

    @jsii.member(jsii_name="toUpdateStage")
    def to_update_stage(self) -> "Gamesparks":
        '''(experimental) Grants permission to update the metadata of a stage.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/gamesparks/latest/api/svc/API_UpdateStage.html

        :stability: experimental
        '''
        return typing.cast("Gamesparks", jsii.invoke(self, "toUpdateStage", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__672ce2b2ea1f9e33985ab75003639ce97a83857a7e7a8bb041eda9340ec55f57)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__53c73beecc1cba97d49b995f4c6446ebcd61de6bf59fd23e3dd1e19685cdd262)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Geo(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Geo"):
    '''(experimental) Statement provider for service `geo <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlocation.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `geo <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlocation.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f5694b02af1fd0efd6c1d966d3fc98fc4d7f5c9508b1564e952c4823eced23de)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifDeviceIds")
    def if_device_ids(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Geo":
        '''(experimental) Filters access by the presence of device ids in the request.

        https://docs.aws.amazon.com/location/latest/developerguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toBatchDeleteDevicePositionHistory()
        - .toBatchGetDevicePosition()
        - .toBatchUpdateDevicePosition()
        - .toGetDevicePosition()
        - .toGetDevicePositionHistory()

        Applies to resource types:

        - tracker

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__64104150370b867140b78377aa0326a50d856fca3705b8594241ac3cbbca31bb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Geo", jsii.invoke(self, "ifDeviceIds", [value, operator]))

    @jsii.member(jsii_name="ifGeofenceIds")
    def if_geofence_ids(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Geo":
        '''(experimental) Filters access by the presence of geofence ids in the request.

        https://docs.aws.amazon.com/location/latest/developerguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        Applies to actions:

        - .toBatchDeleteGeofence()
        - .toBatchPutGeofence()
        - .toGetGeofence()
        - .toPutGeofence()

        Applies to resource types:

        - geofence-collection

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__05f3894dc45d662ac37fbb148b1ce852d6f73664dbc7b3946fe21dc2c4f9852b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Geo", jsii.invoke(self, "ifGeofenceIds", [value, operator]))

    @jsii.member(jsii_name="onApiKey")
    def on_api_key(
        self,
        key_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Geo":
        '''(experimental) Adds a resource of type api-key to the statement.

        https://docs.aws.amazon.com/location/latest/developerguide/using-apikeys.html

        :param key_name: - Identifier for the keyName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eb18b1d881abfbd0f4666485bbf96ac6d78f070d5340b26325af6168e9c3bc5a)
            check_type(argname="argument key_name", value=key_name, expected_type=type_hints["key_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Geo", jsii.invoke(self, "onApiKey", [key_name, account, region, partition]))

    @jsii.member(jsii_name="onGeofenceCollection")
    def on_geofence_collection(
        self,
        geofence_collection_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Geo":
        '''(experimental) Adds a resource of type geofence-collection to the statement.

        https://docs.aws.amazon.com/location/latest/developerguide/geofence-tracker-concepts.html

        :param geofence_collection_name: - Identifier for the geofenceCollectionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifGeofenceIds()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7d8ee813c6365b497b14621d06f555ed7e33afdbfcf1ed71af2b04654715b06c)
            check_type(argname="argument geofence_collection_name", value=geofence_collection_name, expected_type=type_hints["geofence_collection_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Geo", jsii.invoke(self, "onGeofenceCollection", [geofence_collection_name, account, region, partition]))

    @jsii.member(jsii_name="onMap")
    def on_map(
        self,
        map_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Geo":
        '''(experimental) Adds a resource of type map to the statement.

        https://docs.aws.amazon.com/location/latest/developerguide/map-concepts.html

        :param map_name: - Identifier for the mapName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__066fe45e9f697dbd60d6a782b6aef8c3943f7521cd703084fcbc8b3f222c4c49)
            check_type(argname="argument map_name", value=map_name, expected_type=type_hints["map_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Geo", jsii.invoke(self, "onMap", [map_name, account, region, partition]))

    @jsii.member(jsii_name="onPlaceIndex")
    def on_place_index(
        self,
        index_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Geo":
        '''(experimental) Adds a resource of type place-index to the statement.

        https://docs.aws.amazon.com/location/latest/developerguide/places-concepts.html

        :param index_name: - Identifier for the indexName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__79ce71e37f40fe893d168ee8810e82d934f2082baaedf16c7c33c309ca26e487)
            check_type(argname="argument index_name", value=index_name, expected_type=type_hints["index_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Geo", jsii.invoke(self, "onPlaceIndex", [index_name, account, region, partition]))

    @jsii.member(jsii_name="onRouteCalculator")
    def on_route_calculator(
        self,
        calculator_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Geo":
        '''(experimental) Adds a resource of type route-calculator to the statement.

        https://docs.aws.amazon.com/location/latest/developerguide/route-concepts.html

        :param calculator_name: - Identifier for the calculatorName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8c6d024edae3d4045981af5f62e38b302e7088d010fbd74395280dd3e25c5c26)
            check_type(argname="argument calculator_name", value=calculator_name, expected_type=type_hints["calculator_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Geo", jsii.invoke(self, "onRouteCalculator", [calculator_name, account, region, partition]))

    @jsii.member(jsii_name="onTracker")
    def on_tracker(
        self,
        tracker_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Geo":
        '''(experimental) Adds a resource of type tracker to the statement.

        https://docs.aws.amazon.com/location/latest/developerguide/geofence-tracker-concepts.html

        :param tracker_name: - Identifier for the trackerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifDeviceIds()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__974f7fc4a0868bc401afded64944ca8ceac92297a4b5fbcc1ea5ed1b3ad3736c)
            check_type(argname="argument tracker_name", value=tracker_name, expected_type=type_hints["tracker_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Geo", jsii.invoke(self, "onTracker", [tracker_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateTrackerConsumer")
    def to_associate_tracker_consumer(self) -> "Geo":
        '''(experimental) Grants permission to create an association between a geofence-collection and a tracker resource.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/APIReference/API_AssociateTrackerConsumer.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toAssociateTrackerConsumer", []))

    @jsii.member(jsii_name="toBatchDeleteDevicePositionHistory")
    def to_batch_delete_device_position_history(self) -> "Geo":
        '''(experimental) Grants permission to delete a batch of device position histories from a tracker resource.

        Access Level: Write

        Possible conditions:

        - .ifDeviceIds()

        https://docs.aws.amazon.com/location/latest/APIReference/API_BatchDeleteDevicePositionHistory.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toBatchDeleteDevicePositionHistory", []))

    @jsii.member(jsii_name="toBatchDeleteGeofence")
    def to_batch_delete_geofence(self) -> "Geo":
        '''(experimental) Grants permission to delete a batch of geofences from a geofence collection.

        Access Level: Write

        Possible conditions:

        - .ifGeofenceIds()

        https://docs.aws.amazon.com/location/latest/APIReference/API_BatchDeleteGeofence.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toBatchDeleteGeofence", []))

    @jsii.member(jsii_name="toBatchEvaluateGeofences")
    def to_batch_evaluate_geofences(self) -> "Geo":
        '''(experimental) Grants permission to evaluate device positions against the position of geofences in a given geofence collection.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/APIReference/API_BatchEvaluateGeofences.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toBatchEvaluateGeofences", []))

    @jsii.member(jsii_name="toBatchGetDevicePosition")
    def to_batch_get_device_position(self) -> "Geo":
        '''(experimental) Grants permission to send a batch request to retrieve device positions.

        Access Level: Read

        Possible conditions:

        - .ifDeviceIds()

        https://docs.aws.amazon.com/location/latest/APIReference/API_BatchGetDevicePosition.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toBatchGetDevicePosition", []))

    @jsii.member(jsii_name="toBatchPutGeofence")
    def to_batch_put_geofence(self) -> "Geo":
        '''(experimental) Grants permission to send a batch request for adding geofences into a given geofence collection.

        Access Level: Write

        Possible conditions:

        - .ifGeofenceIds()

        https://docs.aws.amazon.com/location/latest/APIReference/API_BatchPutGeofence.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toBatchPutGeofence", []))

    @jsii.member(jsii_name="toBatchUpdateDevicePosition")
    def to_batch_update_device_position(self) -> "Geo":
        '''(experimental) Grants permission to upload a position update for one or more devices to a tracker resource.

        Access Level: Write

        Possible conditions:

        - .ifDeviceIds()

        https://docs.aws.amazon.com/location/latest/APIReference/API_BatchUpdateDevicePosition.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toBatchUpdateDevicePosition", []))

    @jsii.member(jsii_name="toCalculateRoute")
    def to_calculate_route(self) -> "Geo":
        '''(experimental) Grants permission to calculate routes using a given route calculator resource.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/APIReference/API_CalculateRoute.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toCalculateRoute", []))

    @jsii.member(jsii_name="toCalculateRouteMatrix")
    def to_calculate_route_matrix(self) -> "Geo":
        '''(experimental) Grants permission to calculate a route matrix using a given route calculator resource.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/APIReference/API_CalculateRouteMatrix.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toCalculateRouteMatrix", []))

    @jsii.member(jsii_name="toCreateGeofenceCollection")
    def to_create_geofence_collection(self) -> "Geo":
        '''(experimental) Grants permission to create a geofence-collection.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/location/latest/APIReference/API_CreateGeofenceCollection.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toCreateGeofenceCollection", []))

    @jsii.member(jsii_name="toCreateKey")
    def to_create_key(self) -> "Geo":
        '''(experimental) Grants permission to create an API key resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/location/latest/APIReference/API_CreateKey.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toCreateKey", []))

    @jsii.member(jsii_name="toCreateMap")
    def to_create_map(self) -> "Geo":
        '''(experimental) Grants permission to create a map resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/location/latest/APIReference/API_CreateMap.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toCreateMap", []))

    @jsii.member(jsii_name="toCreatePlaceIndex")
    def to_create_place_index(self) -> "Geo":
        '''(experimental) Grants permission to create a place index resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/location/latest/APIReference/API_CreatePlaceIndex.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toCreatePlaceIndex", []))

    @jsii.member(jsii_name="toCreateRouteCalculator")
    def to_create_route_calculator(self) -> "Geo":
        '''(experimental) Grants permission to create a route calculator resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/location/latest/APIReference/API_CreateRouteCalculator.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toCreateRouteCalculator", []))

    @jsii.member(jsii_name="toCreateTracker")
    def to_create_tracker(self) -> "Geo":
        '''(experimental) Grants permission to create a tracker resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/location/latest/APIReference/API_CreateTracker.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toCreateTracker", []))

    @jsii.member(jsii_name="toDeleteGeofenceCollection")
    def to_delete_geofence_collection(self) -> "Geo":
        '''(experimental) Grants permission to delete a geofence-collection.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/APIReference/API_DeleteGeofenceCollection.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDeleteGeofenceCollection", []))

    @jsii.member(jsii_name="toDeleteKey")
    def to_delete_key(self) -> "Geo":
        '''(experimental) Grants permission to delete an API key resource.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/APIReference/API_DeleteKey.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDeleteKey", []))

    @jsii.member(jsii_name="toDeleteMap")
    def to_delete_map(self) -> "Geo":
        '''(experimental) Grants permission to delete a map resource.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/APIReference/API_DeleteMap.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDeleteMap", []))

    @jsii.member(jsii_name="toDeletePlaceIndex")
    def to_delete_place_index(self) -> "Geo":
        '''(experimental) Grants permission to delete a place index resource.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/APIReference/API_DeletePlaceIndex.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDeletePlaceIndex", []))

    @jsii.member(jsii_name="toDeleteRouteCalculator")
    def to_delete_route_calculator(self) -> "Geo":
        '''(experimental) Grants permission to delete a route calculator resource.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/APIReference/API_DeleteRouteCalculator.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDeleteRouteCalculator", []))

    @jsii.member(jsii_name="toDeleteTracker")
    def to_delete_tracker(self) -> "Geo":
        '''(experimental) Grants permission to delete a tracker resource.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/APIReference/API_DeleteTracker.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDeleteTracker", []))

    @jsii.member(jsii_name="toDescribeGeofenceCollection")
    def to_describe_geofence_collection(self) -> "Geo":
        '''(experimental) Grants permission to retrieve geofence collection details.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/APIReference/API_DescribeGeofenceCollection.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDescribeGeofenceCollection", []))

    @jsii.member(jsii_name="toDescribeKey")
    def to_describe_key(self) -> "Geo":
        '''(experimental) Grants permission to retrieve API key resource details and secret.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/APIReference/API_DescribeKey.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDescribeKey", []))

    @jsii.member(jsii_name="toDescribeMap")
    def to_describe_map(self) -> "Geo":
        '''(experimental) Grants permission to retrieve map resource details.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/APIReference/API_DescribeMap.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDescribeMap", []))

    @jsii.member(jsii_name="toDescribePlaceIndex")
    def to_describe_place_index(self) -> "Geo":
        '''(experimental) Grants permission to retrieve place-index resource details.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/APIReference/API_DescribePlaceIndex.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDescribePlaceIndex", []))

    @jsii.member(jsii_name="toDescribeRouteCalculator")
    def to_describe_route_calculator(self) -> "Geo":
        '''(experimental) Grants permission to retrieve route calculator resource details.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/APIReference/API_DescribeRouteCalculator.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDescribeRouteCalculator", []))

    @jsii.member(jsii_name="toDescribeTracker")
    def to_describe_tracker(self) -> "Geo":
        '''(experimental) Grants permission to retrieve a tracker resource details.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/APIReference/API_DescribeTracker.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDescribeTracker", []))

    @jsii.member(jsii_name="toDisassociateTrackerConsumer")
    def to_disassociate_tracker_consumer(self) -> "Geo":
        '''(experimental) Grants permission to remove the association between a tracker resource and a geofence-collection.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/APIReference/API_DisassociateTrackerConsumer.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toDisassociateTrackerConsumer", []))

    @jsii.member(jsii_name="toGetDevicePosition")
    def to_get_device_position(self) -> "Geo":
        '''(experimental) Grants permission to retrieve the latest device position.

        Access Level: Read

        Possible conditions:

        - .ifDeviceIds()

        https://docs.aws.amazon.com/location/latest/APIReference/API_GetDevicePosition.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toGetDevicePosition", []))

    @jsii.member(jsii_name="toGetDevicePositionHistory")
    def to_get_device_position_history(self) -> "Geo":
        '''(experimental) Grants permission to retrieve the device position history.

        Access Level: Read

        Possible conditions:

        - .ifDeviceIds()

        https://docs.aws.amazon.com/location/latest/APIReference/API_GetDevicePositionHistory.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toGetDevicePositionHistory", []))

    @jsii.member(jsii_name="toGetGeofence")
    def to_get_geofence(self) -> "Geo":
        '''(experimental) Grants permission to retrieve the geofence details from a geofence-collection.

        Access Level: Read

        Possible conditions:

        - .ifGeofenceIds()

        https://docs.aws.amazon.com/location/latest/APIReference/API_GetGeofence.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toGetGeofence", []))

    @jsii.member(jsii_name="toGetMapGlyphs")
    def to_get_map_glyphs(self) -> "Geo":
        '''(experimental) Grants permission to retrieve the glyph file for a map resource.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/APIReference/API_GetMapGlyphs.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toGetMapGlyphs", []))

    @jsii.member(jsii_name="toGetMapSprites")
    def to_get_map_sprites(self) -> "Geo":
        '''(experimental) Grants permission to retrieve the sprite file for a map resource.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/APIReference/API_GetMapSprites.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toGetMapSprites", []))

    @jsii.member(jsii_name="toGetMapStyleDescriptor")
    def to_get_map_style_descriptor(self) -> "Geo":
        '''(experimental) Grants permission to retrieve the map style descriptor from a map resource.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/APIReference/API_GetMapStyleDescriptor.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toGetMapStyleDescriptor", []))

    @jsii.member(jsii_name="toGetMapTile")
    def to_get_map_tile(self) -> "Geo":
        '''(experimental) Grants permission to retrieve the map tile from the map resource.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/APIReference/API_GetMapTile.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toGetMapTile", []))

    @jsii.member(jsii_name="toGetPlace")
    def to_get_place(self) -> "Geo":
        '''(experimental) Grants permission to find a place by its unique ID.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/APIReference/API_GetPlace.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toGetPlace", []))

    @jsii.member(jsii_name="toListDevicePositions")
    def to_list_device_positions(self) -> "Geo":
        '''(experimental) Grants permission to retrieve a list of devices and their latest positions from the given tracker resource.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/APIReference/API_ListDevicePositions.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toListDevicePositions", []))

    @jsii.member(jsii_name="toListGeofenceCollections")
    def to_list_geofence_collections(self) -> "Geo":
        '''(experimental) Grants permission to lists geofence-collections.

        Access Level: List

        https://docs.aws.amazon.com/location/latest/APIReference/API_ListGeofenceCollections.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toListGeofenceCollections", []))

    @jsii.member(jsii_name="toListGeofences")
    def to_list_geofences(self) -> "Geo":
        '''(experimental) Grants permission to list geofences stored in a given geofence collection.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/APIReference/API_ListGeofences.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toListGeofences", []))

    @jsii.member(jsii_name="toListKeys")
    def to_list_keys(self) -> "Geo":
        '''(experimental) Grants permission to list API key resources.

        Access Level: List

        https://docs.aws.amazon.com/location/latest/APIReference/API_ListKeys.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toListKeys", []))

    @jsii.member(jsii_name="toListMaps")
    def to_list_maps(self) -> "Geo":
        '''(experimental) Grants permission to list map resources.

        Access Level: List

        https://docs.aws.amazon.com/location/latest/APIReference/API_ListMaps.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toListMaps", []))

    @jsii.member(jsii_name="toListPlaceIndexes")
    def to_list_place_indexes(self) -> "Geo":
        '''(experimental) Grants permission to return a list of place index resources.

        Access Level: List

        https://docs.aws.amazon.com/location/latest/APIReference/API_ListPlaceIndexes.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toListPlaceIndexes", []))

    @jsii.member(jsii_name="toListRouteCalculators")
    def to_list_route_calculators(self) -> "Geo":
        '''(experimental) Grants permission to return a list of route calculator resources.

        Access Level: List

        https://docs.aws.amazon.com/location/latest/APIReference/API_ListRouteCalculators.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toListRouteCalculators", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Geo":
        '''(experimental) Grants permission to list the tags (metadata) which you have assigned to the resource.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTrackerConsumers")
    def to_list_tracker_consumers(self) -> "Geo":
        '''(experimental) Grants permission to retrieve a list of geofence collections currently associated to the given tracker resource.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/APIReference/API_ListTrackerConsumers.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toListTrackerConsumers", []))

    @jsii.member(jsii_name="toListTrackers")
    def to_list_trackers(self) -> "Geo":
        '''(experimental) Grants permission to return a list of tracker resources.

        Access Level: List

        https://docs.aws.amazon.com/location/latest/APIReference/API_ListTrackers.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toListTrackers", []))

    @jsii.member(jsii_name="toPutGeofence")
    def to_put_geofence(self) -> "Geo":
        '''(experimental) Grants permission to add a new geofence or update an existing geofence to a given geofence-collection.

        Access Level: Write

        Possible conditions:

        - .ifGeofenceIds()

        https://docs.aws.amazon.com/location/latest/APIReference/API_PutGeofence.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toPutGeofence", []))

    @jsii.member(jsii_name="toSearchPlaceIndexForPosition")
    def to_search_place_index_for_position(self) -> "Geo":
        '''(experimental) Grants permission to reverse geocodes a given coordinate.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/APIReference/API_SearchPlaceIndexForPosition.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toSearchPlaceIndexForPosition", []))

    @jsii.member(jsii_name="toSearchPlaceIndexForSuggestions")
    def to_search_place_index_for_suggestions(self) -> "Geo":
        '''(experimental) Grants permission to generate suggestions for addresses and points of interest based on partial or misspelled free-form text.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/APIReference/API_SearchPlaceIndexForSuggestions.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toSearchPlaceIndexForSuggestions", []))

    @jsii.member(jsii_name="toSearchPlaceIndexForText")
    def to_search_place_index_for_text(self) -> "Geo":
        '''(experimental) Grants permission to geocode free-form text, such as an address, name, city or region.

        Access Level: Read

        https://docs.aws.amazon.com/location/latest/APIReference/API_SearchPlaceIndexForText.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toSearchPlaceIndexForText", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Geo":
        '''(experimental) Grants permission to adds to or modifies the tags of the given resource.

        Tags are metadata which can be used to manage a resource

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/location/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Geo":
        '''(experimental) Grants permission to remove the given tags (metadata) from the resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/location/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateGeofenceCollection")
    def to_update_geofence_collection(self) -> "Geo":
        '''(experimental) Grants permission to update a geofence collection.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/APIReference/API_UpdateGeofenceCollection.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toUpdateGeofenceCollection", []))

    @jsii.member(jsii_name="toUpdateKey")
    def to_update_key(self) -> "Geo":
        '''(experimental) Grants permission to update an API key resource.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/APIReference/API_UpdateKey.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toUpdateKey", []))

    @jsii.member(jsii_name="toUpdateMap")
    def to_update_map(self) -> "Geo":
        '''(experimental) Grants permission to update a map resource.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/APIReference/API_UpdateMap.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toUpdateMap", []))

    @jsii.member(jsii_name="toUpdatePlaceIndex")
    def to_update_place_index(self) -> "Geo":
        '''(experimental) Grants permission to update a place index resource.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/APIReference/API_UpdatePlaceIndex.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toUpdatePlaceIndex", []))

    @jsii.member(jsii_name="toUpdateRouteCalculator")
    def to_update_route_calculator(self) -> "Geo":
        '''(experimental) Grants permission to update a route calculator resource.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/APIReference/API_UpdateRouteCalculator.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toUpdateRouteCalculator", []))

    @jsii.member(jsii_name="toUpdateTracker")
    def to_update_tracker(self) -> "Geo":
        '''(experimental) Grants permission to update a tracker resource.

        Access Level: Write

        https://docs.aws.amazon.com/location/latest/APIReference/API_UpdateTracker.html

        :stability: experimental
        '''
        return typing.cast("Geo", jsii.invoke(self, "toUpdateTracker", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__71336cc667c2ce12408fbf742dece81a908d2febe1191b7b7548d529a9653477)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3e0aef3465bd3fae93723a32817bf55f404b5ce71fda663794af3727d91baad2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Glacier(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Glacier"):
    '''(experimental) Statement provider for service `glacier <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3glacier.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `glacier <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3glacier.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4fbfc6d084e87336a442c62a41dd5084953cd1c827b275bcd4ca9ebc78f3a63a)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifArchiveAgeInDays")
    def if_archive_age_in_days(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Glacier":
        '''(experimental) Filters access by how long an archive has been stored in the vault, in days.

        https://docs.aws.amazon.com/amazonglacier/latest/dev/access-control-overview.html#specifying-conditions

        Applies to actions:

        - .toDeleteArchive()
        - .toInitiateJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__940c3e116a9166c91a3beab4314f1cfee4208db38885c5f1a010a3bde30c01e4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Glacier", jsii.invoke(self, "ifArchiveAgeInDays", [value, operator]))

    @jsii.member(jsii_name="ifResourceTagExists")
    def if_resource_tag_exists(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Glacier":
        '''(experimental) Filters access by a customer-defined tag.

        https://docs.aws.amazon.com/amazonglacier/latest/dev/access-control-overview.html#specifying-conditions

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__aff740988e2d6eaf59818e56cadae6b7f678bd124e23523b5f2dcb309ebd2220)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Glacier", jsii.invoke(self, "ifResourceTagExists", [value, operator]))

    @jsii.member(jsii_name="onVault")
    def on_vault(
        self,
        vault_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glacier":
        '''(experimental) Adds a resource of type vault to the statement.

        https://docs.aws.amazon.com/amazonglacier/latest/dev/working-with-vaults.html

        :param vault_name: - Identifier for the vaultName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ed0881d5f886235ecfd466c40d6d6feb77bf92cb0afe50e5a86c01574ed165fa)
            check_type(argname="argument vault_name", value=vault_name, expected_type=type_hints["vault_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Glacier", jsii.invoke(self, "onVault", [vault_name, account, region, partition]))

    @jsii.member(jsii_name="toAbortMultipartUpload")
    def to_abort_multipart_upload(self) -> "Glacier":
        '''(experimental) Grants permission to abort a multipart upload identified by the upload ID.

        Access Level: Write

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-multipart-abort-upload.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toAbortMultipartUpload", []))

    @jsii.member(jsii_name="toAbortVaultLock")
    def to_abort_vault_lock(self) -> "Glacier":
        '''(experimental) Grants permission to abort the vault locking process if the vault lock is not in the Locked state.

        Access Level: Permissions management

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-AbortVaultLock.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toAbortVaultLock", []))

    @jsii.member(jsii_name="toAddTagsToVault")
    def to_add_tags_to_vault(self) -> "Glacier":
        '''(experimental) Grants permission to add the specified tags to a vault.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-AddTagsToVault.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toAddTagsToVault", []))

    @jsii.member(jsii_name="toCompleteMultipartUpload")
    def to_complete_multipart_upload(self) -> "Glacier":
        '''(experimental) Grants permission to complete a multipart upload process.

        Access Level: Write

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-multipart-complete-upload.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toCompleteMultipartUpload", []))

    @jsii.member(jsii_name="toCompleteVaultLock")
    def to_complete_vault_lock(self) -> "Glacier":
        '''(experimental) Grants permission to complete the vault locking process.

        Access Level: Permissions management

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-CompleteVaultLock.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toCompleteVaultLock", []))

    @jsii.member(jsii_name="toCreateVault")
    def to_create_vault(self) -> "Glacier":
        '''(experimental) Grants permission to create a new vault with the specified name.

        Access Level: Write

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-vault-put.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toCreateVault", []))

    @jsii.member(jsii_name="toDeleteArchive")
    def to_delete_archive(self) -> "Glacier":
        '''(experimental) Grants permission to delete an archive from a vault.

        Access Level: Write

        Possible conditions:

        - .ifArchiveAgeInDays()

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-archive-delete.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toDeleteArchive", []))

    @jsii.member(jsii_name="toDeleteVault")
    def to_delete_vault(self) -> "Glacier":
        '''(experimental) Grants permission to delete a vault.

        Access Level: Write

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-vault-delete.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toDeleteVault", []))

    @jsii.member(jsii_name="toDeleteVaultAccessPolicy")
    def to_delete_vault_access_policy(self) -> "Glacier":
        '''(experimental) Grants permission to delete the access policy associated with the specified vault.

        Access Level: Permissions management

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-DeleteVaultAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toDeleteVaultAccessPolicy", []))

    @jsii.member(jsii_name="toDeleteVaultNotifications")
    def to_delete_vault_notifications(self) -> "Glacier":
        '''(experimental) Grants permission to delete the notification configuration set for a vault.

        Access Level: Write

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-vault-notifications-delete.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toDeleteVaultNotifications", []))

    @jsii.member(jsii_name="toDescribeJob")
    def to_describe_job(self) -> "Glacier":
        '''(experimental) Grants permission to get information about a job previously initiated.

        Access Level: Read

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-describe-job-get.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toDescribeJob", []))

    @jsii.member(jsii_name="toDescribeVault")
    def to_describe_vault(self) -> "Glacier":
        '''(experimental) Grants permission to get information about a vault.

        Access Level: Read

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-vault-get.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toDescribeVault", []))

    @jsii.member(jsii_name="toGetDataRetrievalPolicy")
    def to_get_data_retrieval_policy(self) -> "Glacier":
        '''(experimental) Grants permission to get the data retrieval policy.

        Access Level: Read

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-GetDataRetrievalPolicy.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toGetDataRetrievalPolicy", []))

    @jsii.member(jsii_name="toGetJobOutput")
    def to_get_job_output(self) -> "Glacier":
        '''(experimental) Grants permission to download the output of the job specified.

        Access Level: Read

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-job-output-get.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toGetJobOutput", []))

    @jsii.member(jsii_name="toGetVaultAccessPolicy")
    def to_get_vault_access_policy(self) -> "Glacier":
        '''(experimental) Grants permission to retrieve the access-policy subresource set on the vault.

        Access Level: Read

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-GetVaultAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toGetVaultAccessPolicy", []))

    @jsii.member(jsii_name="toGetVaultLock")
    def to_get_vault_lock(self) -> "Glacier":
        '''(experimental) Grants permission to retrieve attributes from the lock-policy subresource set on the specified vault.

        Access Level: Read

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-GetVaultLock.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toGetVaultLock", []))

    @jsii.member(jsii_name="toGetVaultNotifications")
    def to_get_vault_notifications(self) -> "Glacier":
        '''(experimental) Grants permission to retrieve the notification-configuration subresource set on the vault.

        Access Level: Read

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-vault-notifications-get.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toGetVaultNotifications", []))

    @jsii.member(jsii_name="toInitiateJob")
    def to_initiate_job(self) -> "Glacier":
        '''(experimental) Grants permission to initiate a job of the specified type.

        Access Level: Write

        Possible conditions:

        - .ifArchiveAgeInDays()

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-initiate-job-post.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toInitiateJob", []))

    @jsii.member(jsii_name="toInitiateMultipartUpload")
    def to_initiate_multipart_upload(self) -> "Glacier":
        '''(experimental) Grants permission to initiate a multipart upload.

        Access Level: Write

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-multipart-initiate-upload.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toInitiateMultipartUpload", []))

    @jsii.member(jsii_name="toInitiateVaultLock")
    def to_initiate_vault_lock(self) -> "Glacier":
        '''(experimental) Grants permission to initiate the vault locking process.

        Access Level: Permissions management

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-InitiateVaultLock.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toInitiateVaultLock", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Glacier":
        '''(experimental) Grants permission to list jobs for a vault that are in-progress and jobs that have recently finished.

        Access Level: List

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-jobs-get.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListMultipartUploads")
    def to_list_multipart_uploads(self) -> "Glacier":
        '''(experimental) Grants permission to list in-progress multipart uploads for the specified vault.

        Access Level: List

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-multipart-list-uploads.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toListMultipartUploads", []))

    @jsii.member(jsii_name="toListParts")
    def to_list_parts(self) -> "Glacier":
        '''(experimental) Grants permission to list the parts of an archive that have been uploaded in a specific multipart upload.

        Access Level: List

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-multipart-list-parts.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toListParts", []))

    @jsii.member(jsii_name="toListProvisionedCapacity")
    def to_list_provisioned_capacity(self) -> "Glacier":
        '''(experimental) Grants permission to list the provisioned capacity for the specified AWS account.

        Access Level: List

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-ListProvisionedCapacity.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toListProvisionedCapacity", []))

    @jsii.member(jsii_name="toListTagsForVault")
    def to_list_tags_for_vault(self) -> "Glacier":
        '''(experimental) Grants permission to list all the tags attached to a vault.

        Access Level: List

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-ListTagsForVault.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toListTagsForVault", []))

    @jsii.member(jsii_name="toListVaults")
    def to_list_vaults(self) -> "Glacier":
        '''(experimental) Grants permission to list all vaults.

        Access Level: List

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-vaults-get.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toListVaults", []))

    @jsii.member(jsii_name="toPurchaseProvisionedCapacity")
    def to_purchase_provisioned_capacity(self) -> "Glacier":
        '''(experimental) Grants permission to purchases a provisioned capacity unit for an AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-PurchaseProvisionedCapacity.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toPurchaseProvisionedCapacity", []))

    @jsii.member(jsii_name="toRemoveTagsFromVault")
    def to_remove_tags_from_vault(self) -> "Glacier":
        '''(experimental) Grants permission to remove one or more tags from the set of tags attached to a vault.

        Access Level: Tagging

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-RemoveTagsFromVault.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toRemoveTagsFromVault", []))

    @jsii.member(jsii_name="toSetDataRetrievalPolicy")
    def to_set_data_retrieval_policy(self) -> "Glacier":
        '''(experimental) Grants permission to set and then enacts a data retrieval policy in the region specified in the PUT request.

        Access Level: Permissions management

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-SetDataRetrievalPolicy.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toSetDataRetrievalPolicy", []))

    @jsii.member(jsii_name="toSetVaultAccessPolicy")
    def to_set_vault_access_policy(self) -> "Glacier":
        '''(experimental) Grants permission to configure an access policy for a vault; will overwrite an existing policy.

        Access Level: Permissions management

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-SetVaultAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toSetVaultAccessPolicy", []))

    @jsii.member(jsii_name="toSetVaultNotifications")
    def to_set_vault_notifications(self) -> "Glacier":
        '''(experimental) Grants permission to configure vault notifications.

        Access Level: Write

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-vault-notifications-put.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toSetVaultNotifications", []))

    @jsii.member(jsii_name="toUploadArchive")
    def to_upload_archive(self) -> "Glacier":
        '''(experimental) Grants permission to upload an archive to a vault.

        Access Level: Write

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-archive-post.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toUploadArchive", []))

    @jsii.member(jsii_name="toUploadMultipartPart")
    def to_upload_multipart_part(self) -> "Glacier":
        '''(experimental) Grants permission to upload a part of an archive.

        Access Level: Write

        https://docs.aws.amazon.com/amazonglacier/latest/dev/api-upload-part.html

        :stability: experimental
        '''
        return typing.cast("Glacier", jsii.invoke(self, "toUploadMultipartPart", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e24ef6b94d892038900c0d6d79038b6bfa682e3bfe465f20ea543d7c1d3c0fb1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__df63561f082e0af7a4bfd4cfe0ba412874f38b99bc99d6506ab8d7548a47df7e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Globalaccelerator(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Globalaccelerator",
):
    '''(experimental) Statement provider for service `globalaccelerator <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsglobalaccelerator.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `globalaccelerator <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsglobalaccelerator.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3ef877591f8b6dad4cf105165fe95ad72ac0c9a179ce3bf194e49fd2ffbe4a60)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAccelerator")
    def on_accelerator(
        self,
        accelerator_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Globalaccelerator":
        '''(experimental) Adds a resource of type accelerator to the statement.

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_Accelerator.html

        :param accelerator_id: - Identifier for the acceleratorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e82130690cc4239ffcf27ad16fb9014fe38ae61ab896088f4be8c460cb2422de)
            check_type(argname="argument accelerator_id", value=accelerator_id, expected_type=type_hints["accelerator_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Globalaccelerator", jsii.invoke(self, "onAccelerator", [accelerator_id, account, partition]))

    @jsii.member(jsii_name="onEndpointgroup")
    def on_endpointgroup(
        self,
        accelerator_id: builtins.str,
        listener_id: builtins.str,
        endpoint_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Globalaccelerator":
        '''(experimental) Adds a resource of type endpointgroup to the statement.

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_EndpointGroup.html

        :param accelerator_id: - Identifier for the acceleratorId.
        :param listener_id: - Identifier for the listenerId.
        :param endpoint_group_id: - Identifier for the endpointGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5a3aefed135b1c2d28bef99bff37b198ee496126c3d44aaf8a8d6b04eab27edc)
            check_type(argname="argument accelerator_id", value=accelerator_id, expected_type=type_hints["accelerator_id"])
            check_type(argname="argument listener_id", value=listener_id, expected_type=type_hints["listener_id"])
            check_type(argname="argument endpoint_group_id", value=endpoint_group_id, expected_type=type_hints["endpoint_group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Globalaccelerator", jsii.invoke(self, "onEndpointgroup", [accelerator_id, listener_id, endpoint_group_id, account, partition]))

    @jsii.member(jsii_name="onListener")
    def on_listener(
        self,
        accelerator_id: builtins.str,
        listener_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Globalaccelerator":
        '''(experimental) Adds a resource of type listener to the statement.

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_Listener.html

        :param accelerator_id: - Identifier for the acceleratorId.
        :param listener_id: - Identifier for the listenerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5513c1d2c6998a8643e3f4c83fc55eedab1ac70b4513842216692462f1856579)
            check_type(argname="argument accelerator_id", value=accelerator_id, expected_type=type_hints["accelerator_id"])
            check_type(argname="argument listener_id", value=listener_id, expected_type=type_hints["listener_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Globalaccelerator", jsii.invoke(self, "onListener", [accelerator_id, listener_id, account, partition]))

    @jsii.member(jsii_name="toAddCustomRoutingEndpoints")
    def to_add_custom_routing_endpoints(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to add a virtual private cloud (VPC) subnet endpoint to a custom routing accelerator endpoint group.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_AddCustomRoutingEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toAddCustomRoutingEndpoints", []))

    @jsii.member(jsii_name="toAddEndpoints")
    def to_add_endpoints(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to add an endpoint to a standard accelerator endpoint group.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_AddEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toAddEndpoints", []))

    @jsii.member(jsii_name="toAdvertiseByoipCidr")
    def to_advertise_byoip_cidr(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to advertises an IPv4 address range that is provisioned for use with your accelerator through bring your own IP addresses (BYOIP).

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_AdvertiseByoipCidr.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toAdvertiseByoipCidr", []))

    @jsii.member(jsii_name="toAllowCustomRoutingTraffic")
    def to_allow_custom_routing_traffic(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to allows custom routing of user traffic to a private destination IP:PORT in a specific VPC subnet.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_AllowCustomRoutingTraffic.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toAllowCustomRoutingTraffic", []))

    @jsii.member(jsii_name="toCreateAccelerator")
    def to_create_accelerator(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to create a standard accelerator.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_CreateAccelerator.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toCreateAccelerator", []))

    @jsii.member(jsii_name="toCreateCustomRoutingAccelerator")
    def to_create_custom_routing_accelerator(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to create a Custom Routing accelerator.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_CreateCustomRoutingAccelerator.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toCreateCustomRoutingAccelerator", []))

    @jsii.member(jsii_name="toCreateCustomRoutingEndpointGroup")
    def to_create_custom_routing_endpoint_group(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to create an endpoint group for the specified listener for a custom routing accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_CreateCustomRoutingEndpointGroup.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toCreateCustomRoutingEndpointGroup", []))

    @jsii.member(jsii_name="toCreateCustomRoutingListener")
    def to_create_custom_routing_listener(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to create a listener to process inbound connections from clients to a custom routing accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_CreateCustomRoutingListener.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toCreateCustomRoutingListener", []))

    @jsii.member(jsii_name="toCreateEndpointGroup")
    def to_create_endpoint_group(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to add an endpoint group to a standard accelerator listener.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_CreateEndpointGroup.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toCreateEndpointGroup", []))

    @jsii.member(jsii_name="toCreateListener")
    def to_create_listener(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to add a listener to a standard accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_CreateListener.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toCreateListener", []))

    @jsii.member(jsii_name="toDeleteAccelerator")
    def to_delete_accelerator(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to delete a standard accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DeleteAccelerator.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDeleteAccelerator", []))

    @jsii.member(jsii_name="toDeleteCustomRoutingAccelerator")
    def to_delete_custom_routing_accelerator(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to delete a custom routing accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DeleteCustomRoutingAccelerator.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDeleteCustomRoutingAccelerator", []))

    @jsii.member(jsii_name="toDeleteCustomRoutingEndpointGroup")
    def to_delete_custom_routing_endpoint_group(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to delete an endpoint group from a listener for a custom routing accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DeleteCustomRoutingEndpointGroup.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDeleteCustomRoutingEndpointGroup", []))

    @jsii.member(jsii_name="toDeleteCustomRoutingListener")
    def to_delete_custom_routing_listener(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to delete a listener for a custom routing accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DeleteCustomRoutingListener.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDeleteCustomRoutingListener", []))

    @jsii.member(jsii_name="toDeleteEndpointGroup")
    def to_delete_endpoint_group(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to delete an endpoint group associated with a standard accelerator listener.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DeleteEndpointGroup.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDeleteEndpointGroup", []))

    @jsii.member(jsii_name="toDeleteListener")
    def to_delete_listener(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to delete a listener from a standard accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DeleteListener.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDeleteListener", []))

    @jsii.member(jsii_name="toDenyCustomRoutingTraffic")
    def to_deny_custom_routing_traffic(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to disallows custom routing of user traffic to a private destination IP:PORT in a specific VPC subnet.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DenyCustomRoutingTraffic.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDenyCustomRoutingTraffic", []))

    @jsii.member(jsii_name="toDeprovisionByoipCidr")
    def to_deprovision_byoip_cidr(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to releases the specified address range that you provisioned for use with your accelerator through bring your own IP addresses (BYOIP).

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DeprovisionByoipCidr.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDeprovisionByoipCidr", []))

    @jsii.member(jsii_name="toDescribeAccelerator")
    def to_describe_accelerator(self) -> "Globalaccelerator":
        '''(experimental) Grants permissions to describe a standard accelerator.

        Access Level: Read

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DescribeAccelerator.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDescribeAccelerator", []))

    @jsii.member(jsii_name="toDescribeAcceleratorAttributes")
    def to_describe_accelerator_attributes(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to describe a standard accelerator attributes.

        Access Level: Read

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DescribeAcceleratorAttributes.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDescribeAcceleratorAttributes", []))

    @jsii.member(jsii_name="toDescribeCustomRoutingAccelerator")
    def to_describe_custom_routing_accelerator(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to describe a custom routing accelerator.

        Access Level: Read

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DescribeCustomRoutingAccelerator.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDescribeCustomRoutingAccelerator", []))

    @jsii.member(jsii_name="toDescribeCustomRoutingAcceleratorAttributes")
    def to_describe_custom_routing_accelerator_attributes(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to describe the attributes of a custom routing accelerator.

        Access Level: Read

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DescribeCustomRoutingAcceleratorAttributes.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDescribeCustomRoutingAcceleratorAttributes", []))

    @jsii.member(jsii_name="toDescribeCustomRoutingEndpointGroup")
    def to_describe_custom_routing_endpoint_group(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to describe an endpoint group for a custom routing accelerator.

        Access Level: Read

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DescribeCustomRoutingEndpointGroup.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDescribeCustomRoutingEndpointGroup", []))

    @jsii.member(jsii_name="toDescribeCustomRoutingListener")
    def to_describe_custom_routing_listener(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to describe a listener for a custom routing accelerator.

        Access Level: Read

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DescribeCustomRoutingListener.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDescribeCustomRoutingListener", []))

    @jsii.member(jsii_name="toDescribeEndpointGroup")
    def to_describe_endpoint_group(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to describe a standard accelerator endpoint group.

        Access Level: Read

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DescribeEndpointGroup.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDescribeEndpointGroup", []))

    @jsii.member(jsii_name="toDescribeListener")
    def to_describe_listener(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to describe a standard accelerator listener.

        Access Level: Read

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_DescribeListener.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toDescribeListener", []))

    @jsii.member(jsii_name="toListAccelerators")
    def to_list_accelerators(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to list all standard accelerators.

        Access Level: List

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ListAccelerators.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toListAccelerators", []))

    @jsii.member(jsii_name="toListByoipCidrs")
    def to_list_byoip_cidrs(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to list the BYOIP cidrs.

        Access Level: List

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ListByoipCidrs.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toListByoipCidrs", []))

    @jsii.member(jsii_name="toListCustomRoutingAccelerators")
    def to_list_custom_routing_accelerators(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to list the custom routing accelerators for an AWS account.

        Access Level: List

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ListCustomRoutingAccelerators.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toListCustomRoutingAccelerators", []))

    @jsii.member(jsii_name="toListCustomRoutingEndpointGroups")
    def to_list_custom_routing_endpoint_groups(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to list the endpoint groups that are associated with a listener for a custom routing accelerator.

        Access Level: List

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ListCustomRoutingEndpointGroups.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toListCustomRoutingEndpointGroups", []))

    @jsii.member(jsii_name="toListCustomRoutingListeners")
    def to_list_custom_routing_listeners(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to list the listeners for a custom routing accelerator.

        Access Level: List

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ListCustomRoutingListeners.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toListCustomRoutingListeners", []))

    @jsii.member(jsii_name="toListCustomRoutingPortMappings")
    def to_list_custom_routing_port_mappings(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to list the port mappings for a custom routing accelerator.

        Access Level: List

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ListCustomRoutingPortMappings.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toListCustomRoutingPortMappings", []))

    @jsii.member(jsii_name="toListCustomRoutingPortMappingsByDestination")
    def to_list_custom_routing_port_mappings_by_destination(
        self,
    ) -> "Globalaccelerator":
        '''(experimental) Grants permission to list the port mappings for a specific endpoint IP address (a destination address) in a subnet.

        Access Level: List

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ListCustomRoutingPortMappingsByDestination.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toListCustomRoutingPortMappingsByDestination", []))

    @jsii.member(jsii_name="toListEndpointGroups")
    def to_list_endpoint_groups(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to list all endpoint groups associated with a standard accelerator listener.

        Access Level: List

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ListEndpointGroups.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toListEndpointGroups", []))

    @jsii.member(jsii_name="toListListeners")
    def to_list_listeners(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to list all listeners associated with a standard accelerator.

        Access Level: List

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ListListeners.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toListListeners", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to list tags for a globalaccelerator resource.

        Access Level: Read

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toProvisionByoipCidr")
    def to_provision_byoip_cidr(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to provisions an address range for use with your accelerator through bring your own IP addresses (BYOIP).

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_ProvisionByoipCidr.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toProvisionByoipCidr", []))

    @jsii.member(jsii_name="toRemoveCustomRoutingEndpoints")
    def to_remove_custom_routing_endpoints(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to remove virtual private cloud (VPC) subnet endpoints from a custom routing accelerator endpoint group.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_RemoveCustomRoutingEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toRemoveCustomRoutingEndpoints", []))

    @jsii.member(jsii_name="toRemoveEndpoints")
    def to_remove_endpoints(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to remove an endpoint from a standard accelerator endpoint group.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_RemoveEndpoints.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toRemoveEndpoints", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to add tags to a globalaccelerator resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to remove tags from a globalaccelerator resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAccelerator")
    def to_update_accelerator(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to update a standard accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_UpdateAccelerator.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toUpdateAccelerator", []))

    @jsii.member(jsii_name="toUpdateAcceleratorAttributes")
    def to_update_accelerator_attributes(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to update a standard accelerator attributes.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_UpdateAcceleratorAttributes.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toUpdateAcceleratorAttributes", []))

    @jsii.member(jsii_name="toUpdateCustomRoutingAccelerator")
    def to_update_custom_routing_accelerator(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to update a custom routing accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_UpdateCustomRoutingAccelerator.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toUpdateCustomRoutingAccelerator", []))

    @jsii.member(jsii_name="toUpdateCustomRoutingAcceleratorAttributes")
    def to_update_custom_routing_accelerator_attributes(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to update the attributes for a custom routing accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_UpdateCustomRoutingAcceleratorAttributes.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toUpdateCustomRoutingAcceleratorAttributes", []))

    @jsii.member(jsii_name="toUpdateCustomRoutingListener")
    def to_update_custom_routing_listener(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to update a listener for a custom routing accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_UpdateCustomRoutingListener.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toUpdateCustomRoutingListener", []))

    @jsii.member(jsii_name="toUpdateEndpointGroup")
    def to_update_endpoint_group(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to update an endpoint group on a standard accelerator listener.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_UpdateEndpointGroup.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toUpdateEndpointGroup", []))

    @jsii.member(jsii_name="toUpdateListener")
    def to_update_listener(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to update a listener on a standard accelerator.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_UpdateListener.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toUpdateListener", []))

    @jsii.member(jsii_name="toWithdrawByoipCidr")
    def to_withdraw_byoip_cidr(self) -> "Globalaccelerator":
        '''(experimental) Grants permission to stops advertising a BYOIP IPv4 address.

        Access Level: Write

        https://docs.aws.amazon.com/global-accelerator/latest/api/API_WithdrawByoipCidr.html

        :stability: experimental
        '''
        return typing.cast("Globalaccelerator", jsii.invoke(self, "toWithdrawByoipCidr", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d131bb1e8e5fbab406278580090ca0188f9ca992b4ab24e279fb90af06de6677)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e49aa0def079113cd00b2da1104dced042a32f0228c60c774af064f1455423c6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Glue(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Glue"):
    '''(experimental) Statement provider for service `glue <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsglue.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `glue <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsglue.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6716f36572ac09275698deaca65d6b333b59359792270a3d4d51af332d10d4fc)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifCredentialIssuingService")
    def if_credential_issuing_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Glue":
        '''(experimental) Filters access by the service from which the credentials of the request is issued.

        https://docs.aws.amazon.com/glue/latest/dg/using-identity-based-policies.html#glue-identity-based-policy-condition-keys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__38a7ed8df613fe126455f574630800b2d8717421a275db0a3efff0d55a0dacb5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Glue", jsii.invoke(self, "ifCredentialIssuingService", [value, operator]))

    @jsii.member(jsii_name="ifRoleAssumedBy")
    def if_role_assumed_by(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Glue":
        '''(experimental) Filters access by the service from which the credentials of the request is obtained by assuming the customer role.

        https://docs.aws.amazon.com/glue/latest/dg/using-identity-based-policies.html#glue-identity-based-policy-condition-keys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__60aa7c5050f00240e2fd2e62e9b27d70a5c80080b23493460f28a1b18b614638)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Glue", jsii.invoke(self, "ifRoleAssumedBy", [value, operator]))

    @jsii.member(jsii_name="ifSecurityGroupIds")
    def if_security_group_ids(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Glue":
        '''(experimental) Filters access by the ID of security groups configured for the Glue job.

        https://docs.aws.amazon.com/glue/latest/dg/using-identity-based-policies.html#glue-identity-based-policy-condition-keys

        Applies to actions:

        - .toCreateJob()
        - .toUpdateJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__29f6ddb5a7b03086242fc367872afb0aacdfc030fa08e0c9a86bd7babba2e10b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Glue", jsii.invoke(self, "ifSecurityGroupIds", [value, operator]))

    @jsii.member(jsii_name="ifSubnetIds")
    def if_subnet_ids(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Glue":
        '''(experimental) Filters access by the ID of subnets configured for the Glue job.

        https://docs.aws.amazon.com/glue/latest/dg/using-identity-based-policies.html#glue-identity-based-policy-condition-keys

        Applies to actions:

        - .toCreateJob()
        - .toUpdateJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2dd1f37de56821a48f21775a9f40ceb237ad485637d518575466b0e91c23d873)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Glue", jsii.invoke(self, "ifSubnetIds", [value, operator]))

    @jsii.member(jsii_name="ifVpcIds")
    def if_vpc_ids(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Glue":
        '''(experimental) Filters access by the ID of the VPC configured for the Glue job.

        https://docs.aws.amazon.com/glue/latest/dg/using-identity-based-policies.html#glue-identity-based-policy-condition-keys

        Applies to actions:

        - .toCreateJob()
        - .toUpdateJob()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7cd806a065ea06337a17032e1ce9f1422e3341e0d12c5e9d15df2b8ad515cf80)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Glue", jsii.invoke(self, "ifVpcIds", [value, operator]))

    @jsii.member(jsii_name="onBlueprint")
    def on_blueprint(
        self,
        blueprint_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type blueprint to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param blueprint_name: - Identifier for the blueprintName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9f67f9669b958035491e6c053e7f5e40c64befe6df69ec13e64673b5d847ceeb)
            check_type(argname="argument blueprint_name", value=blueprint_name, expected_type=type_hints["blueprint_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Glue", jsii.invoke(self, "onBlueprint", [blueprint_name, account, region, partition]))

    @jsii.member(jsii_name="onCatalog")
    def on_catalog(
        self,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type catalog to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__21f524d1ad477c00e4d78a9540b180e469a4dbeba5da4e42a16959abf52d3fb2)
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Glue", jsii.invoke(self, "onCatalog", [account, region, partition]))

    @jsii.member(jsii_name="onConnection")
    def on_connection(
        self,
        connection_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type connection to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param connection_name: - Identifier for the connectionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bbd44618bbd6730cb48c0b60ea37a780eca7a27b9abd2ac487dd1ebefdc27e3d)
            check_type(argname="argument connection_name", value=connection_name, expected_type=type_hints["connection_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Glue", jsii.invoke(self, "onConnection", [connection_name, account, region, partition]))

    @jsii.member(jsii_name="onCrawler")
    def on_crawler(
        self,
        crawler_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type crawler to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param crawler_name: - Identifier for the crawlerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__571d907baac3fe080f28967125beb3d867fb98f05c24ed3b35cfc23e7f464dcd)
            check_type(argname="argument crawler_name", value=crawler_name, expected_type=type_hints["crawler_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Glue", jsii.invoke(self, "onCrawler", [crawler_name, account, region, partition]))

    @jsii.member(jsii_name="onDatabase")
    def on_database(
        self,
        database_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type database to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param database_name: - Identifier for the databaseName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a71c05adf94fdc784c21acccd422a65d82b5c9bdbe5494b598a2b6688f0a28e3)
            check_type(argname="argument database_name", value=database_name, expected_type=type_hints["database_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Glue", jsii.invoke(self, "onDatabase", [database_name, account, region, partition]))

    @jsii.member(jsii_name="onDataQualityRuleset")
    def on_data_quality_ruleset(
        self,
        ruleset_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type dataQualityRuleset to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param ruleset_name: - Identifier for the rulesetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8ccaf09f5914457320ee456e4be6d1dbf0994992c807fb943e3c1c95bcabfce8)
            check_type(argname="argument ruleset_name", value=ruleset_name, expected_type=type_hints["ruleset_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Glue", jsii.invoke(self, "onDataQualityRuleset", [ruleset_name, account, region, partition]))

    @jsii.member(jsii_name="onDevendpoint")
    def on_devendpoint(
        self,
        dev_endpoint_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type devendpoint to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param dev_endpoint_name: - Identifier for the devEndpointName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__72265743de11a28b23fc11562fba464c77e22892d73b53bc52cbea9b07bc9fae)
            check_type(argname="argument dev_endpoint_name", value=dev_endpoint_name, expected_type=type_hints["dev_endpoint_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Glue", jsii.invoke(self, "onDevendpoint", [dev_endpoint_name, account, region, partition]))

    @jsii.member(jsii_name="onJob")
    def on_job(
        self,
        job_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type job to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param job_name: - Identifier for the jobName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c2c41964658a1d9a164647adca496f6896d5684600aa83ae24a81c6d0387d393)
            check_type(argname="argument job_name", value=job_name, expected_type=type_hints["job_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Glue", jsii.invoke(self, "onJob", [job_name, account, region, partition]))

    @jsii.member(jsii_name="onMlTransform")
    def on_ml_transform(
        self,
        transform_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type mlTransform to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param transform_id: - Identifier for the transformId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1ef9c4df89377cb019b8f229ead27e8eb6027d8f98e74ce4f35923276063e5e8)
            check_type(argname="argument transform_id", value=transform_id, expected_type=type_hints["transform_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Glue", jsii.invoke(self, "onMlTransform", [transform_id, account, region, partition]))

    @jsii.member(jsii_name="onRegistry")
    def on_registry(
        self,
        registry_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type registry to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param registry_name: - Identifier for the registryName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__339121adda4d5791810cf246dad0cd5ac37983e1bfd8317bdbb69c191d00c3bb)
            check_type(argname="argument registry_name", value=registry_name, expected_type=type_hints["registry_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Glue", jsii.invoke(self, "onRegistry", [registry_name, account, region, partition]))

    @jsii.member(jsii_name="onSchema")
    def on_schema(
        self,
        schema_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type schema to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param schema_name: - Identifier for the schemaName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__04249e9d741385a4501bb8a5e1aab8cd2bb88504eb782e14a6b4529e184e625f)
            check_type(argname="argument schema_name", value=schema_name, expected_type=type_hints["schema_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Glue", jsii.invoke(self, "onSchema", [schema_name, account, region, partition]))

    @jsii.member(jsii_name="onSession")
    def on_session(
        self,
        session_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type session to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param session_id: - Identifier for the sessionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0a8bfda6cb407ad188506ad3c1ca5ade7f094e9b484279de7ca89f41c4e78ef2)
            check_type(argname="argument session_id", value=session_id, expected_type=type_hints["session_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Glue", jsii.invoke(self, "onSession", [session_id, account, region, partition]))

    @jsii.member(jsii_name="onTable")
    def on_table(
        self,
        database_name: builtins.str,
        table_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type table to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param database_name: - Identifier for the databaseName.
        :param table_name: - Identifier for the tableName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a6872a9a1ed237f63fdeb7028e88434e60fafbbca23bbe94973fa4c1f35167a9)
            check_type(argname="argument database_name", value=database_name, expected_type=type_hints["database_name"])
            check_type(argname="argument table_name", value=table_name, expected_type=type_hints["table_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Glue", jsii.invoke(self, "onTable", [database_name, table_name, account, region, partition]))

    @jsii.member(jsii_name="onTableversion")
    def on_tableversion(
        self,
        database_name: builtins.str,
        table_name: builtins.str,
        table_version_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type tableversion to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param database_name: - Identifier for the databaseName.
        :param table_name: - Identifier for the tableName.
        :param table_version_name: - Identifier for the tableVersionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__34d981007dbb7c32a62d7653e3f7e834c51657f7b6788e338a88fefea0b905f4)
            check_type(argname="argument database_name", value=database_name, expected_type=type_hints["database_name"])
            check_type(argname="argument table_name", value=table_name, expected_type=type_hints["table_name"])
            check_type(argname="argument table_version_name", value=table_version_name, expected_type=type_hints["table_version_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Glue", jsii.invoke(self, "onTableversion", [database_name, table_name, table_version_name, account, region, partition]))

    @jsii.member(jsii_name="onTrigger")
    def on_trigger(
        self,
        trigger_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type trigger to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param trigger_name: - Identifier for the triggerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5839bf27b6f5d4084a7b90f5a65ae2c1174f2fd7d4981193d259932a0ad2b7c4)
            check_type(argname="argument trigger_name", value=trigger_name, expected_type=type_hints["trigger_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Glue", jsii.invoke(self, "onTrigger", [trigger_name, account, region, partition]))

    @jsii.member(jsii_name="onUserdefinedfunction")
    def on_userdefinedfunction(
        self,
        database_name: builtins.str,
        user_defined_function_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type userdefinedfunction to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param database_name: - Identifier for the databaseName.
        :param user_defined_function_name: - Identifier for the userDefinedFunctionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cc7b5c338af0dae0b2b352f6c03d3bc51ba4f8870142153ec02bbbebd8fb4d2c)
            check_type(argname="argument database_name", value=database_name, expected_type=type_hints["database_name"])
            check_type(argname="argument user_defined_function_name", value=user_defined_function_name, expected_type=type_hints["user_defined_function_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Glue", jsii.invoke(self, "onUserdefinedfunction", [database_name, user_defined_function_name, account, region, partition]))

    @jsii.member(jsii_name="onWorkflow")
    def on_workflow(
        self,
        workflow_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Glue":
        '''(experimental) Adds a resource of type workflow to the statement.

        https://docs.aws.amazon.com/glue/latest/dg/glue-specifying-resource-arns.html

        :param workflow_name: - Identifier for the workflowName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5d91155e7182c071b335000f034fa36075368637804406679fc290a7b7383b3d)
            check_type(argname="argument workflow_name", value=workflow_name, expected_type=type_hints["workflow_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Glue", jsii.invoke(self, "onWorkflow", [workflow_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchCreatePartition")
    def to_batch_create_partition(self) -> "Glue":
        '''(experimental) Grants permission to create one or more partitions.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-partitions.html#aws-glue-api-catalog-partitions-BatchCreatePartition

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchCreatePartition", []))

    @jsii.member(jsii_name="toBatchDeleteConnection")
    def to_batch_delete_connection(self) -> "Glue":
        '''(experimental) Grants permission to delete one or more connections.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-connections.html#aws-glue-api-catalog-connections-BatchDeleteConnection

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchDeleteConnection", []))

    @jsii.member(jsii_name="toBatchDeletePartition")
    def to_batch_delete_partition(self) -> "Glue":
        '''(experimental) Grants permission to delete one or more partitions.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-partitions.html#aws-glue-api-catalog-partitions-BatchDeletePartition

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchDeletePartition", []))

    @jsii.member(jsii_name="toBatchDeleteTable")
    def to_batch_delete_table(self) -> "Glue":
        '''(experimental) Grants permission to delete one or more tables.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-BatchDeleteTable

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchDeleteTable", []))

    @jsii.member(jsii_name="toBatchDeleteTableVersion")
    def to_batch_delete_table_version(self) -> "Glue":
        '''(experimental) Grants permission to delete one or more versions of a table.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-DeleteTableVersion

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchDeleteTableVersion", []))

    @jsii.member(jsii_name="toBatchGetBlueprints")
    def to_batch_get_blueprints(self) -> "Glue":
        '''(experimental) Grants permission to retrieve one or more blueprints.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-BatchGetBlueprints

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchGetBlueprints", []))

    @jsii.member(jsii_name="toBatchGetCrawlers")
    def to_batch_get_crawlers(self) -> "Glue":
        '''(experimental) Grants permission to retrieve one or more crawlers.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-BatchGetCrawlers

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchGetCrawlers", []))

    @jsii.member(jsii_name="toBatchGetCustomEntityTypes")
    def to_batch_get_custom_entity_types(self) -> "Glue":
        '''(experimental) Grants permission to retrieve one or more Custom Entity Types.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-sensitive-data-api.html#aws-glue-api-sensitive-data-api-BatchGetCustomEntityTypes

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchGetCustomEntityTypes", []))

    @jsii.member(jsii_name="toBatchGetDevEndpoints")
    def to_batch_get_dev_endpoints(self) -> "Glue":
        '''(experimental) Grants permission to retrieve one or more development endpoints.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-dev-endpoint.html#aws-glue-api-dev-endpoint-BatchGetDevEndpoints

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchGetDevEndpoints", []))

    @jsii.member(jsii_name="toBatchGetJobs")
    def to_batch_get_jobs(self) -> "Glue":
        '''(experimental) Grants permission to retrieve one or more jobs.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html#aws-glue-api-jobs-job-BatchGetJobs

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchGetJobs", []))

    @jsii.member(jsii_name="toBatchGetPartition")
    def to_batch_get_partition(self) -> "Glue":
        '''(experimental) Grants permission to retrieve one or more partitions.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-partitions.html#aws-glue-api-catalog-partitions-BatchGetPartition

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchGetPartition", []))

    @jsii.member(jsii_name="toBatchGetTriggers")
    def to_batch_get_triggers(self) -> "Glue":
        '''(experimental) Grants permission to retrieve one or more triggers.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-trigger.html#aws-glue-api-jobs-trigger-BatchGetTriggers

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchGetTriggers", []))

    @jsii.member(jsii_name="toBatchGetWorkflows")
    def to_batch_get_workflows(self) -> "Glue":
        '''(experimental) Grants permission to retrieve one or more workflows.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-BatchGetWorkflows

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchGetWorkflows", []))

    @jsii.member(jsii_name="toBatchStopJobRun")
    def to_batch_stop_job_run(self) -> "Glue":
        '''(experimental) Grants permission to stop one or more job runs for a job.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-runs.html#aws-glue-api-jobs-runs-BatchStopStartJobRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchStopJobRun", []))

    @jsii.member(jsii_name="toBatchUpdatePartition")
    def to_batch_update_partition(self) -> "Glue":
        '''(experimental) Grants permission to update one or more partitions.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-partitions.html#aws-glue-api-catalog-partitions-BatchUpdatePartition

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toBatchUpdatePartition", []))

    @jsii.member(jsii_name="toCancelDataQualityRuleRecommendationRun")
    def to_cancel_data_quality_rule_recommendation_run(self) -> "Glue":
        '''(experimental) Grants permission to stop a running Data Quality rule recommendation run.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-data-quality-api.html#aws-glue-api-data-quality-api-CancelDataQualityRuleRecommendationRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCancelDataQualityRuleRecommendationRun", []))

    @jsii.member(jsii_name="toCancelDataQualityRulesetEvaluationRun")
    def to_cancel_data_quality_ruleset_evaluation_run(self) -> "Glue":
        '''(experimental) Grants permission to stop a running Data Quality ruleset evaluation run.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-data-quality-api.html#aws-glue-api-data-quality-api-CancelDataQualityRulesetEvaluationRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCancelDataQualityRulesetEvaluationRun", []))

    @jsii.member(jsii_name="toCancelMLTaskRun")
    def to_cancel_ml_task_run(self) -> "Glue":
        '''(experimental) Grants permission to stop a running ML Task Run.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-CancelMLTaskRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCancelMLTaskRun", []))

    @jsii.member(jsii_name="toCancelStatement")
    def to_cancel_statement(self) -> "Glue":
        '''(experimental) Grants permission to cancel a statement in an interactive session.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-interactive-sessions.html#aws-glue-interactive-sessions-CancelStatement

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCancelStatement", []))

    @jsii.member(jsii_name="toCheckSchemaVersionValidity")
    def to_check_schema_version_validity(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a check the validity of schema version.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-CheckSchemaVersionValidity

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCheckSchemaVersionValidity", []))

    @jsii.member(jsii_name="toCreateBlueprint")
    def to_create_blueprint(self) -> "Glue":
        '''(experimental) Grants permission to create a blueprint.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-CreateBlueprint

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateBlueprint", []))

    @jsii.member(jsii_name="toCreateClassifier")
    def to_create_classifier(self) -> "Glue":
        '''(experimental) Grants permission to create a classifier.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-classifiers.html#aws-glue-api-crawler-classifiers-CreateClassifier

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateClassifier", []))

    @jsii.member(jsii_name="toCreateConnection")
    def to_create_connection(self) -> "Glue":
        '''(experimental) Grants permission to create a connection.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-connections.html#aws-glue-api-catalog-connections-CreateConnection

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateConnection", []))

    @jsii.member(jsii_name="toCreateCrawler")
    def to_create_crawler(self) -> "Glue":
        '''(experimental) Grants permission to create a crawler.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-CreateCrawler

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateCrawler", []))

    @jsii.member(jsii_name="toCreateCustomEntityType")
    def to_create_custom_entity_type(self) -> "Glue":
        '''(experimental) Grants permission to create a Custom Entity Type.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-sensitive-data-api.html#aws-glue-api-sensitive-data-api-CreateCustomEntityType

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateCustomEntityType", []))

    @jsii.member(jsii_name="toCreateDatabase")
    def to_create_database(self) -> "Glue":
        '''(experimental) Grants permission to create a database.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-databases.html#aws-glue-api-catalog-databases-CreateDatabase

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateDatabase", []))

    @jsii.member(jsii_name="toCreateDataQualityRuleset")
    def to_create_data_quality_ruleset(self) -> "Glue":
        '''(experimental) Grants permission to create a Data Quality ruleset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-data-quality-api.html#aws-glue-api-data-quality-api-CreateDataQualityRuleset

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateDataQualityRuleset", []))

    @jsii.member(jsii_name="toCreateDevEndpoint")
    def to_create_dev_endpoint(self) -> "Glue":
        '''(experimental) Grants permission to create a development endpoint.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-dev-endpoint.html#aws-glue-api-dev-endpoint-CreateDevEndpoint

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateDevEndpoint", []))

    @jsii.member(jsii_name="toCreateJob")
    def to_create_job(self) -> "Glue":
        '''(experimental) Grants permission to create a job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifVpcIds()
        - .ifSubnetIds()
        - .ifSecurityGroupIds()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html#aws-glue-api-jobs-job-CreateJob

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateJob", []))

    @jsii.member(jsii_name="toCreateMLTransform")
    def to_create_ml_transform(self) -> "Glue":
        '''(experimental) Grants permission to create an ML Transform.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-CreateMLTransform

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateMLTransform", []))

    @jsii.member(jsii_name="toCreatePartition")
    def to_create_partition(self) -> "Glue":
        '''(experimental) Grants permission to create a partition.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-partitions.html#aws-glue-api-catalog-partitions-CreatePartition

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreatePartition", []))

    @jsii.member(jsii_name="toCreatePartitionIndex")
    def to_create_partition_index(self) -> "Glue":
        '''(experimental) Grants permission to create a specified partition index in an existing table.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-CreatePartitionIndex

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreatePartitionIndex", []))

    @jsii.member(jsii_name="toCreateRegistry")
    def to_create_registry(self) -> "Glue":
        '''(experimental) Grants permission to create a new schema registry.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-CreateRegistry

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateRegistry", []))

    @jsii.member(jsii_name="toCreateSchema")
    def to_create_schema(self) -> "Glue":
        '''(experimental) Grants permission to create a new schema container.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-CreateSchema

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateSchema", []))

    @jsii.member(jsii_name="toCreateScript")
    def to_create_script(self) -> "Glue":
        '''(experimental) Grants permission to create a script.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-etl-script-generation.html#aws-glue-api-etl-script-generation-CreateScript

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateScript", []))

    @jsii.member(jsii_name="toCreateSecurityConfiguration")
    def to_create_security_configuration(self) -> "Glue":
        '''(experimental) Grants permission to create a security configuration.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-security.html#aws-glue-api-jobs-security-CreateSecurityConfiguration

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateSecurityConfiguration", []))

    @jsii.member(jsii_name="toCreateSession")
    def to_create_session(self) -> "Glue":
        '''(experimental) Grants permission to create an interactive session.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-interactive-sessions.html#aws-glue-api-interactive-sessions-CreateSession

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateSession", []))

    @jsii.member(jsii_name="toCreateTable")
    def to_create_table(self) -> "Glue":
        '''(experimental) Grants permission to create a table.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-CreateTable

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateTable", []))

    @jsii.member(jsii_name="toCreateTrigger")
    def to_create_trigger(self) -> "Glue":
        '''(experimental) Grants permission to create a trigger.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-trigger.html#aws-glue-api-jobs-trigger-CreateTrigger

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateTrigger", []))

    @jsii.member(jsii_name="toCreateUserDefinedFunction")
    def to_create_user_defined_function(self) -> "Glue":
        '''(experimental) Grants permission to create a function definition.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-functions.html#aws-glue-api-catalog-functions-CreateUserDefinedFunction

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateUserDefinedFunction", []))

    @jsii.member(jsii_name="toCreateWorkflow")
    def to_create_workflow(self) -> "Glue":
        '''(experimental) Grants permission to create a workflow.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-CreateWorkflow

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toCreateWorkflow", []))

    @jsii.member(jsii_name="toDeleteBlueprint")
    def to_delete_blueprint(self) -> "Glue":
        '''(experimental) Grants permission to delete a blueprint.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-DeleteBlueprint

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteBlueprint", []))

    @jsii.member(jsii_name="toDeleteClassifier")
    def to_delete_classifier(self) -> "Glue":
        '''(experimental) Grants permission to delete a classifier.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-classifiers.html#aws-glue-api-crawler-classifiers-DeleteClassifier

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteClassifier", []))

    @jsii.member(jsii_name="toDeleteColumnStatisticsForPartition")
    def to_delete_column_statistics_for_partition(self) -> "Glue":
        '''(experimental) Grants permission to delete the partition column statistics of a column.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-partitions.html#aws-glue-api-catalog-partitions-DeleteColumnStatisticsForPartition

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteColumnStatisticsForPartition", []))

    @jsii.member(jsii_name="toDeleteColumnStatisticsForTable")
    def to_delete_column_statistics_for_table(self) -> "Glue":
        '''(experimental) Grants permission to delete the table statistics of columns.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-DeleteColumnStatisticsForTable

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteColumnStatisticsForTable", []))

    @jsii.member(jsii_name="toDeleteConnection")
    def to_delete_connection(self) -> "Glue":
        '''(experimental) Grants permission to delete a connection.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-connections.html#aws-glue-api-catalog-connections-DeleteConnection

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteConnection", []))

    @jsii.member(jsii_name="toDeleteCrawler")
    def to_delete_crawler(self) -> "Glue":
        '''(experimental) Grants permission to delete a crawler.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-DeleteCrawler

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteCrawler", []))

    @jsii.member(jsii_name="toDeleteCustomEntityType")
    def to_delete_custom_entity_type(self) -> "Glue":
        '''(experimental) Grants permission to delete a Custom Entity Type.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-sensitive-data-api.html#aws-glue-api-sensitive-data-api-DeleteCustomEntityType

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteCustomEntityType", []))

    @jsii.member(jsii_name="toDeleteDatabase")
    def to_delete_database(self) -> "Glue":
        '''(experimental) Grants permission to delete a database.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-databases.html#aws-glue-api-catalog-databases-DeleteDatabase

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteDatabase", []))

    @jsii.member(jsii_name="toDeleteDataQualityRuleset")
    def to_delete_data_quality_ruleset(self) -> "Glue":
        '''(experimental) Grants permission to delete a Data Quality ruleset.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-data-quality-api.html#aws-glue-api-data-quality-api-DeleteDataQualityRuleset

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteDataQualityRuleset", []))

    @jsii.member(jsii_name="toDeleteDevEndpoint")
    def to_delete_dev_endpoint(self) -> "Glue":
        '''(experimental) Grants permission to delete a development endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-dev-endpoint.html#aws-glue-api-dev-endpoint-DeleteDevEndpoint

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteDevEndpoint", []))

    @jsii.member(jsii_name="toDeleteJob")
    def to_delete_job(self) -> "Glue":
        '''(experimental) Grants permission to delete a job.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html#aws-glue-api-jobs-job-DeleteJob

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteJob", []))

    @jsii.member(jsii_name="toDeleteMLTransform")
    def to_delete_ml_transform(self) -> "Glue":
        '''(experimental) Grants permission to delete an ML Transform.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-DeleteMLTransform

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteMLTransform", []))

    @jsii.member(jsii_name="toDeletePartition")
    def to_delete_partition(self) -> "Glue":
        '''(experimental) Grants permission to delete a partition.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-partitions.html#aws-glue-api-catalog-partitions-DeletePartition

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeletePartition", []))

    @jsii.member(jsii_name="toDeletePartitionIndex")
    def to_delete_partition_index(self) -> "Glue":
        '''(experimental) Grants permission to delete a specified partition index from an existing table.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-DeletePartitionIndex

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeletePartitionIndex", []))

    @jsii.member(jsii_name="toDeleteRegistry")
    def to_delete_registry(self) -> "Glue":
        '''(experimental) Grants permission to delete a schema registry.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-DeleteRegistry

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteRegistry", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "Glue":
        '''(experimental) Grants permission to delete a resource policy.

        Access Level: Permissions management

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-security.html#aws-glue-api-jobs-security-DeleteResourcePolicy

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteSchema")
    def to_delete_schema(self) -> "Glue":
        '''(experimental) Grants permission to delete a schema container.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-DeleteSchema

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteSchema", []))

    @jsii.member(jsii_name="toDeleteSchemaVersions")
    def to_delete_schema_versions(self) -> "Glue":
        '''(experimental) Grants permission to delete a range of schema versions.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-DeleteSchemaVersions

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteSchemaVersions", []))

    @jsii.member(jsii_name="toDeleteSecurityConfiguration")
    def to_delete_security_configuration(self) -> "Glue":
        '''(experimental) Grants permission to delete a security configuration.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-security.html#aws-glue-api-jobs-security-DeleteSecurityConfiguration

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteSecurityConfiguration", []))

    @jsii.member(jsii_name="toDeleteSession")
    def to_delete_session(self) -> "Glue":
        '''(experimental) Grants permission to delete an interactive session after stopping the session if not already stopped.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-interactive-sessions.html#aws-glue-interactive-sessions-DeleteSession

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteSession", []))

    @jsii.member(jsii_name="toDeleteTable")
    def to_delete_table(self) -> "Glue":
        '''(experimental) Grants permission to delete a table.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-DeleteTable

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteTable", []))

    @jsii.member(jsii_name="toDeleteTableVersion")
    def to_delete_table_version(self) -> "Glue":
        '''(experimental) Grants permission to delete a version of a table.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-DeleteTableVersion

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteTableVersion", []))

    @jsii.member(jsii_name="toDeleteTrigger")
    def to_delete_trigger(self) -> "Glue":
        '''(experimental) Grants permission to delete a trigger.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-trigger.html#aws-glue-api-jobs-trigger-DeleteTrigger

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteTrigger", []))

    @jsii.member(jsii_name="toDeleteUserDefinedFunction")
    def to_delete_user_defined_function(self) -> "Glue":
        '''(experimental) Grants permission to delete a function definition.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-functions.html#aws-glue-api-catalog-functions-DeleteUserDefinedFunction

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteUserDefinedFunction", []))

    @jsii.member(jsii_name="toDeleteWorkflow")
    def to_delete_workflow(self) -> "Glue":
        '''(experimental) Grants permission to delete a workflow.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-DeleteWorkflow

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeleteWorkflow", []))

    @jsii.member(jsii_name="toDeregisterDataPreview")
    def to_deregister_data_preview(self) -> "Glue":
        '''(experimental) Grants permission to terminate Glue Studio Notebook session.

        Access Level: Permissions management

        https://docs.aws.amazon.com/glue/latest/ug/notebook-getting-started.html#create-notebook-permissions-operations

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toDeregisterDataPreview", []))

    @jsii.member(jsii_name="toGetBlueprint")
    def to_get_blueprint(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a blueprint.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-GetBlueprint

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetBlueprint", []))

    @jsii.member(jsii_name="toGetBlueprintRun")
    def to_get_blueprint_run(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a blueprint run.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-GetBlueprintRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetBlueprintRun", []))

    @jsii.member(jsii_name="toGetBlueprintRuns")
    def to_get_blueprint_runs(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all runs of a blueprint.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-GetBlueprintRuns

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetBlueprintRuns", []))

    @jsii.member(jsii_name="toGetCatalogImportStatus")
    def to_get_catalog_import_status(self) -> "Glue":
        '''(experimental) Grants permission to retrieve the catalog import status.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-migration.html#aws-glue-api-catalog-migration-GetCatalogImportStatus

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetCatalogImportStatus", []))

    @jsii.member(jsii_name="toGetClassifier")
    def to_get_classifier(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a classifier.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-classifiers.html#aws-glue-api-crawler-classifiers-GetClassifier

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetClassifier", []))

    @jsii.member(jsii_name="toGetClassifiers")
    def to_get_classifiers(self) -> "Glue":
        '''(experimental) Grants permission to list all classifiers.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-classifiers.html#aws-glue-api-crawler-classifiers-GetClassifiers

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetClassifiers", []))

    @jsii.member(jsii_name="toGetColumnStatisticsForPartition")
    def to_get_column_statistics_for_partition(self) -> "Glue":
        '''(experimental) Grants permission to retrieve partition statistics of columns.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-partitions.html#aws-glue-api-catalog-partitions-GetColumnStatisticsForPartition

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetColumnStatisticsForPartition", []))

    @jsii.member(jsii_name="toGetColumnStatisticsForTable")
    def to_get_column_statistics_for_table(self) -> "Glue":
        '''(experimental) Grants permission to retrieve table statistics of columns.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-GetColumnStatisticsForTable

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetColumnStatisticsForTable", []))

    @jsii.member(jsii_name="toGetConnection")
    def to_get_connection(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a connection.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-connections.html#aws-glue-api-catalog-connections-GetConnection

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetConnection", []))

    @jsii.member(jsii_name="toGetConnections")
    def to_get_connections(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a list of connections.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-connections.html#aws-glue-api-catalog-connections-GetConnections

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetConnections", []))

    @jsii.member(jsii_name="toGetCrawler")
    def to_get_crawler(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a crawler.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-GetCrawler

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetCrawler", []))

    @jsii.member(jsii_name="toGetCrawlerMetrics")
    def to_get_crawler_metrics(self) -> "Glue":
        '''(experimental) Grants permission to retrieve metrics about crawlers.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-GetCrawlerMetrics

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetCrawlerMetrics", []))

    @jsii.member(jsii_name="toGetCrawlers")
    def to_get_crawlers(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all crawlers.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-GetCrawlers

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetCrawlers", []))

    @jsii.member(jsii_name="toGetCustomEntityType")
    def to_get_custom_entity_type(self) -> "Glue":
        '''(experimental) Grants permission to read a Custom Entity Type.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-sensitive-data-api.html#aws-glue-api-sensitive-data-api-GetCustomEntityType

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetCustomEntityType", []))

    @jsii.member(jsii_name="toGetDatabase")
    def to_get_database(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a database.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-databases.html#aws-glue-api-catalog-databases-GetDatabase

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetDatabase", []))

    @jsii.member(jsii_name="toGetDatabases")
    def to_get_databases(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all databases.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-databases.html#aws-glue-api-catalog-databases-GetDatabases

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetDatabases", []))

    @jsii.member(jsii_name="toGetDataCatalogEncryptionSettings")
    def to_get_data_catalog_encryption_settings(self) -> "Glue":
        '''(experimental) Grants permission to retrieve catalog encryption settings.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-security.html#aws-glue-api-jobs-security-GetDataCatalogEncryptionSettings

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetDataCatalogEncryptionSettings", []))

    @jsii.member(jsii_name="toGetDataflowGraph")
    def to_get_dataflow_graph(self) -> "Glue":
        '''(experimental) Grants permission to transform a script into a directed acyclic graph (DAG).

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-etl-script-generation.html#aws-glue-api-etl-script-generation-GetDataflowGraph

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetDataflowGraph", []))

    @jsii.member(jsii_name="toGetDataPreviewStatement")
    def to_get_data_preview_statement(self) -> "Glue":
        '''(experimental) Grants permission to get Data Preview Statement.

        Access Level: Permissions management

        https://docs.aws.amazon.com/glue/latest/ug/notebook-getting-started.html#create-notebook-permissions-operations

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetDataPreviewStatement", []))

    @jsii.member(jsii_name="toGetDataQualityResult")
    def to_get_data_quality_result(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a Data Quality result.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-data-quality-api.html#aws-glue-api-data-quality-api-GetDataQualityResult

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetDataQualityResult", []))

    @jsii.member(jsii_name="toGetDataQualityRuleRecommendationRun")
    def to_get_data_quality_rule_recommendation_run(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a Data Quality rule recommendation run.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-data-quality-api.html#aws-glue-api-data-quality-api-GetDataQualityRuleRecommendationRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetDataQualityRuleRecommendationRun", []))

    @jsii.member(jsii_name="toGetDataQualityRuleset")
    def to_get_data_quality_ruleset(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a Data Quality ruleset.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-data-quality-api.html#aws-glue-api-data-quality-api-GetDataQualityRuleset

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetDataQualityRuleset", []))

    @jsii.member(jsii_name="toGetDataQualityRulesetEvaluationRun")
    def to_get_data_quality_ruleset_evaluation_run(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a Data Quality rule recommendation run.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-data-quality-api.html#aws-glue-api-data-quality-api-GetDataQualityRulesetEvaluationRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetDataQualityRulesetEvaluationRun", []))

    @jsii.member(jsii_name="toGetDevEndpoint")
    def to_get_dev_endpoint(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a development endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-dev-endpoint.html#aws-glue-api-dev-endpoint-GetDevEndpoint

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetDevEndpoint", []))

    @jsii.member(jsii_name="toGetDevEndpoints")
    def to_get_dev_endpoints(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all development endpoints.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-dev-endpoint.html#aws-glue-api-dev-endpoint-GetDevEndpoints

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetDevEndpoints", []))

    @jsii.member(jsii_name="toGetJob")
    def to_get_job(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a job.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html#aws-glue-api-jobs-job-GetJob

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetJob", []))

    @jsii.member(jsii_name="toGetJobBookmark")
    def to_get_job_bookmark(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a job bookmark.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-runs.html#aws-glue-api-jobs-job-GetJobBookmark

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetJobBookmark", []))

    @jsii.member(jsii_name="toGetJobRun")
    def to_get_job_run(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a job run.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-runs.html#aws-glue-api-jobs-runs-GetJobRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetJobRun", []))

    @jsii.member(jsii_name="toGetJobRuns")
    def to_get_job_runs(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all job runs of a job.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-runs.html#aws-glue-api-jobs-runs-GetJobRuns

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetJobRuns", []))

    @jsii.member(jsii_name="toGetJobs")
    def to_get_jobs(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all current jobs.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html#aws-glue-api-jobs-job-GetJobs

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetJobs", []))

    @jsii.member(jsii_name="toGetMapping")
    def to_get_mapping(self) -> "Glue":
        '''(experimental) Grants permission to create a mapping.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-etl-script-generation.html#aws-glue-api-etl-script-generation-GetMapping

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetMapping", []))

    @jsii.member(jsii_name="toGetMLTaskRun")
    def to_get_ml_task_run(self) -> "Glue":
        '''(experimental) Grants permission to retrieve an ML Task Run.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-GetMLTaskRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetMLTaskRun", []))

    @jsii.member(jsii_name="toGetMLTaskRuns")
    def to_get_ml_task_runs(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all ML Task Runs.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-GetMLTaskRuns

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetMLTaskRuns", []))

    @jsii.member(jsii_name="toGetMLTransform")
    def to_get_ml_transform(self) -> "Glue":
        '''(experimental) Grants permission to retrieve an ML Transform.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-GetMLTransform

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetMLTransform", []))

    @jsii.member(jsii_name="toGetMLTransforms")
    def to_get_ml_transforms(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all ML Transforms.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-GetMLTransforms

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetMLTransforms", []))

    @jsii.member(jsii_name="toGetNotebookInstanceStatus")
    def to_get_notebook_instance_status(self) -> "Glue":
        '''(experimental) Grants permission to retrieve Glue Studio Notebooks session status.

        Access Level: Permissions management

        https://docs.aws.amazon.com/glue/latest/ug/notebook-getting-started.html#create-notebook-permissions-operations

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetNotebookInstanceStatus", []))

    @jsii.member(jsii_name="toGetPartition")
    def to_get_partition(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a partition.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-partitions.html#aws-glue-api-catalog-partitions-GetPartition

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetPartition", []))

    @jsii.member(jsii_name="toGetPartitionIndexes")
    def to_get_partition_indexes(self) -> "Glue":
        '''(experimental) Grants permission to retrieve partition indexes for a table.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-GetPartitionIndexes

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetPartitionIndexes", []))

    @jsii.member(jsii_name="toGetPartitions")
    def to_get_partitions(self) -> "Glue":
        '''(experimental) Grants permission to retrieve the partitions of a table.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-partitions.html#aws-glue-api-catalog-partitions-GetPartitions

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetPartitions", []))

    @jsii.member(jsii_name="toGetPlan")
    def to_get_plan(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a mapping for a script.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-etl-script-generation.html#aws-glue-api-etl-script-generation-GetPlan

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetPlan", []))

    @jsii.member(jsii_name="toGetRegistry")
    def to_get_registry(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a schema registry.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-GetRegistry

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetRegistry", []))

    @jsii.member(jsii_name="toGetResourcePolicies")
    def to_get_resource_policies(self) -> "Glue":
        '''(experimental) Grants permission to retrieve resource policies.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-security.html#aws-glue-api-jobs-security-GetResourcePolicies

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetResourcePolicies", []))

    @jsii.member(jsii_name="toGetResourcePolicy")
    def to_get_resource_policy(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a resource policy.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-security.html#aws-glue-api-jobs-security-GetResourcePolicy

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetResourcePolicy", []))

    @jsii.member(jsii_name="toGetSchema")
    def to_get_schema(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a schema container.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-GetSchema

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetSchema", []))

    @jsii.member(jsii_name="toGetSchemaByDefinition")
    def to_get_schema_by_definition(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a schema version based on schema definition.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-GetSchemaByDefinition

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetSchemaByDefinition", []))

    @jsii.member(jsii_name="toGetSchemaVersion")
    def to_get_schema_version(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a schema version.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-GetSchemaVersion

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetSchemaVersion", []))

    @jsii.member(jsii_name="toGetSchemaVersionsDiff")
    def to_get_schema_versions_diff(self) -> "Glue":
        '''(experimental) Grants permission to compare two schema versions in schema registry.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-GetSchemaVersionsDiff

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetSchemaVersionsDiff", []))

    @jsii.member(jsii_name="toGetSecurityConfiguration")
    def to_get_security_configuration(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a security configuration.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-security.html#aws-glue-api-jobs-security-GetSecurityConfiguration

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetSecurityConfiguration", []))

    @jsii.member(jsii_name="toGetSecurityConfigurations")
    def to_get_security_configurations(self) -> "Glue":
        '''(experimental) Grants permission to retrieve one or more security configurations.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-security.html#aws-glue-api-jobs-security-GetSecurityConfigurations

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetSecurityConfigurations", []))

    @jsii.member(jsii_name="toGetSession")
    def to_get_session(self) -> "Glue":
        '''(experimental) Grants permission to retrieve an interactive session.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-interactive-sessions.html#aws-glue-interactive-sessions-GetSession

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetSession", []))

    @jsii.member(jsii_name="toGetStatement")
    def to_get_statement(self) -> "Glue":
        '''(experimental) Grants permission to retrieve result and information about a statement in an interactive session.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-interactive-sessions.html#aws-glue-interactive-sessions-GetStatement

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetStatement", []))

    @jsii.member(jsii_name="toGetTable")
    def to_get_table(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a table.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-GetTable

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetTable", []))

    @jsii.member(jsii_name="toGetTables")
    def to_get_tables(self) -> "Glue":
        '''(experimental) Grants permission to retrieve the tables in a database.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-GetTables

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetTables", []))

    @jsii.member(jsii_name="toGetTableVersion")
    def to_get_table_version(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a version of a table.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-GetTableVersion

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetTableVersion", []))

    @jsii.member(jsii_name="toGetTableVersions")
    def to_get_table_versions(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a list of versions of a table.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-GetTableVersions

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetTableVersions", []))

    @jsii.member(jsii_name="toGetTags")
    def to_get_tags(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all tags associated with a resource.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-tags.html#aws-glue-api-tags-UntagResource

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetTags", []))

    @jsii.member(jsii_name="toGetTrigger")
    def to_get_trigger(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a trigger.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-trigger.html#aws-glue-api-jobs-trigger-GetTrigger

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetTrigger", []))

    @jsii.member(jsii_name="toGetTriggers")
    def to_get_triggers(self) -> "Glue":
        '''(experimental) Grants permission to retrieve the triggers associated with a job.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-trigger.html#aws-glue-api-jobs-trigger-GetTriggers

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetTriggers", []))

    @jsii.member(jsii_name="toGetUserDefinedFunction")
    def to_get_user_defined_function(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a function definition.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-functions.html#aws-glue-api-catalog-functions-GetUserDefinedFunction

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetUserDefinedFunction", []))

    @jsii.member(jsii_name="toGetUserDefinedFunctions")
    def to_get_user_defined_functions(self) -> "Glue":
        '''(experimental) Grants permission to retrieve multiple function definitions.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-functions.html#aws-glue-api-catalog-functions-GetUserDefinedFunctions

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetUserDefinedFunctions", []))

    @jsii.member(jsii_name="toGetWorkflow")
    def to_get_workflow(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a workflow.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-GetWorkflow

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetWorkflow", []))

    @jsii.member(jsii_name="toGetWorkflowRun")
    def to_get_workflow_run(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a workflow run.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-GetWorkflowRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetWorkflowRun", []))

    @jsii.member(jsii_name="toGetWorkflowRunProperties")
    def to_get_workflow_run_properties(self) -> "Glue":
        '''(experimental) Grants permission to retrieve workflow run properties.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-GetWorkflowRunProperties

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetWorkflowRunProperties", []))

    @jsii.member(jsii_name="toGetWorkflowRuns")
    def to_get_workflow_runs(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all runs of a workflow.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-GetWorkflowRuns

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGetWorkflowRuns", []))

    @jsii.member(jsii_name="toGlueNotebookAuthorize")
    def to_glue_notebook_authorize(self) -> "Glue":
        '''(experimental) Grants permission to access Glue Studio Notebooks.

        Access Level: Permissions management

        https://docs.aws.amazon.com/glue/latest/ug/notebook-getting-started.html#create-notebook-permissions-operations

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGlueNotebookAuthorize", []))

    @jsii.member(jsii_name="toGlueNotebookRefreshCredentials")
    def to_glue_notebook_refresh_credentials(self) -> "Glue":
        '''(experimental) Grants permission to refresh Glue Studio Notebooks credentials.

        Access Level: Permissions management

        https://docs.aws.amazon.com/glue/latest/ug/notebook-getting-started.html#create-notebook-permissions-operations

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toGlueNotebookRefreshCredentials", []))

    @jsii.member(jsii_name="toImportCatalogToGlue")
    def to_import_catalog_to_glue(self) -> "Glue":
        '''(experimental) Grants permission to import an Athena data catalog into AWS Glue.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-migration.html#aws-glue-api-catalog-migration-ImportCatalogToGlue

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toImportCatalogToGlue", []))

    @jsii.member(jsii_name="toListBlueprints")
    def to_list_blueprints(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all blueprints.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-ListBlueprints

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListBlueprints", []))

    @jsii.member(jsii_name="toListCrawlers")
    def to_list_crawlers(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all crawlers.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-ListCrawlers

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListCrawlers", []))

    @jsii.member(jsii_name="toListCrawls")
    def to_list_crawls(self) -> "Glue":
        '''(experimental) Grants permission to retrieve crawl run history for a crawler.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-ListCrawls

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListCrawls", []))

    @jsii.member(jsii_name="toListCustomEntityTypes")
    def to_list_custom_entity_types(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all Custom Entity Types.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-sensitive-data-api.html#aws-glue-api-sensitive-data-api-ListGetCustomEntityTypes

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListCustomEntityTypes", []))

    @jsii.member(jsii_name="toListDataQualityResults")
    def to_list_data_quality_results(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all Data Quality results.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-data-quality-api.html#aws-glue-api-data-quality-api-ListDataQualityResults

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListDataQualityResults", []))

    @jsii.member(jsii_name="toListDataQualityRuleRecommendationRuns")
    def to_list_data_quality_rule_recommendation_runs(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all Data Quality rule recommendation runs.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-data-quality-api.html#aws-glue-api-data-quality-api-ListDataQualityRuleRecommendationRuns

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListDataQualityRuleRecommendationRuns", []))

    @jsii.member(jsii_name="toListDataQualityRulesetEvaluationRuns")
    def to_list_data_quality_ruleset_evaluation_runs(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all Data Quality rule recommendation runs.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-data-quality-api.html#aws-glue-api-data-quality-api-ListDataQualityRulesetEvaluationRuns

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListDataQualityRulesetEvaluationRuns", []))

    @jsii.member(jsii_name="toListDataQualityRulesets")
    def to_list_data_quality_rulesets(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a list of Data Quality rulesets.

        Access Level: List

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-data-quality-api.html#aws-glue-api-data-quality-api-ListDataQualityRulesets

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListDataQualityRulesets", []))

    @jsii.member(jsii_name="toListDevEndpoints")
    def to_list_dev_endpoints(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all development endpoints.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-dev-endpoint.html#aws-glue-api-dev-endpoint-ListDevEndpoints

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListDevEndpoints", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all current jobs.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html#aws-glue-api-jobs-job-ListJobs

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListMLTransforms")
    def to_list_ml_transforms(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all ML Transforms.

        Access Level: List

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-ListMLTransforms

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListMLTransforms", []))

    @jsii.member(jsii_name="toListRegistries")
    def to_list_registries(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a list of schema registries.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-ListRegistries

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListRegistries", []))

    @jsii.member(jsii_name="toListSchemas")
    def to_list_schemas(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a list of schema containers.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-ListSchemas

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListSchemas", []))

    @jsii.member(jsii_name="toListSchemaVersions")
    def to_list_schema_versions(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a list of schema versions.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-ListSchemaVersions

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListSchemaVersions", []))

    @jsii.member(jsii_name="toListSessions")
    def to_list_sessions(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a list of interactive session.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-interactive-sessions.html#aws-glue-interactive-sessions-ListSessions

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListSessions", []))

    @jsii.member(jsii_name="toListStatements")
    def to_list_statements(self) -> "Glue":
        '''(experimental) Grants permission to retrieve a list of statements in an interactive session.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-interactive-sessions.html#aws-glue-interactive-sessions-ListStatements

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListStatements", []))

    @jsii.member(jsii_name="toListTriggers")
    def to_list_triggers(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all triggers.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-trigger.html#aws-glue-api-jobs-trigger-ListTriggers

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListTriggers", []))

    @jsii.member(jsii_name="toListWorkflows")
    def to_list_workflows(self) -> "Glue":
        '''(experimental) Grants permission to retrieve all workflows.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-ListWorkflows

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toListWorkflows", []))

    @jsii.member(jsii_name="toNotifyEvent")
    def to_notify_event(self) -> "Glue":
        '''(experimental) Grants permission to notify an event to the event-driven workflow.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/starting-workflow-eventbridge.html

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toNotifyEvent", []))

    @jsii.member(jsii_name="toPublishDataQuality")
    def to_publish_data_quality(self) -> "Glue":
        '''(experimental) Grants permission to publish Data Quality results.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-data-quality-api.html

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toPublishDataQuality", []))

    @jsii.member(jsii_name="toPutDataCatalogEncryptionSettings")
    def to_put_data_catalog_encryption_settings(self) -> "Glue":
        '''(experimental) Grants permission to update catalog encryption settings.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-security.html#aws-glue-api-jobs-security-PutDataCatalogEncryptionSettings

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toPutDataCatalogEncryptionSettings", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "Glue":
        '''(experimental) Grants permission to update a resource policy.

        Access Level: Permissions management

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-security.html#aws-glue-api-jobs-security-PutResourcePolicy

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toPutSchemaVersionMetadata")
    def to_put_schema_version_metadata(self) -> "Glue":
        '''(experimental) Grants permission to add metadata to schema version.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-PutSchemaVersionMetadata

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toPutSchemaVersionMetadata", []))

    @jsii.member(jsii_name="toPutWorkflowRunProperties")
    def to_put_workflow_run_properties(self) -> "Glue":
        '''(experimental) Grants permission to update workflow run properties.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-PutWorkflowRunProperties

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toPutWorkflowRunProperties", []))

    @jsii.member(jsii_name="toQuerySchemaVersionMetadata")
    def to_query_schema_version_metadata(self) -> "Glue":
        '''(experimental) Grants permission to fetch metadata for a schema version.

        Access Level: List

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-QuerySchemaVersionMetadata

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toQuerySchemaVersionMetadata", []))

    @jsii.member(jsii_name="toRegisterSchemaVersion")
    def to_register_schema_version(self) -> "Glue":
        '''(experimental) Grants permission to create a new schema version.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-RegisterSchemaVersion

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toRegisterSchemaVersion", []))

    @jsii.member(jsii_name="toRemoveSchemaVersionMetadata")
    def to_remove_schema_version_metadata(self) -> "Glue":
        '''(experimental) Grants permission to remove metadata from schema version.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-RemoveSchemaVersionMetadata

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toRemoveSchemaVersionMetadata", []))

    @jsii.member(jsii_name="toResetJobBookmark")
    def to_reset_job_bookmark(self) -> "Glue":
        '''(experimental) Grants permission to reset a job bookmark.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-runs.html#aws-glue-api-jobs-runs-ResetJobBookmark

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toResetJobBookmark", []))

    @jsii.member(jsii_name="toResumeWorkflowRun")
    def to_resume_workflow_run(self) -> "Glue":
        '''(experimental) Grants permission to resume a workflow run.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-ResumeWorkflowRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toResumeWorkflowRun", []))

    @jsii.member(jsii_name="toRunDataPreviewStatement")
    def to_run_data_preview_statement(self) -> "Glue":
        '''(experimental) Grants permission to run Data Preview Statement.

        Access Level: Permissions management

        https://docs.aws.amazon.com/glue/latest/ug/notebook-getting-started.html#create-notebook-permissions-operations

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toRunDataPreviewStatement", []))

    @jsii.member(jsii_name="toRunStatement")
    def to_run_statement(self) -> "Glue":
        '''(experimental) Grants permission to run a code or statement in an interactive session.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-interactive-sessions.html#aws-glue-interactive-sessions-RunStatement

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toRunStatement", []))

    @jsii.member(jsii_name="toSearchTables")
    def to_search_tables(self) -> "Glue":
        '''(experimental) Grants permission to retrieve the tables in the catalog.

        Access Level: Read

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-SearchTables

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toSearchTables", []))

    @jsii.member(jsii_name="toStartBlueprintRun")
    def to_start_blueprint_run(self) -> "Glue":
        '''(experimental) Grants permission to start running a blueprint.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-StartBlueprintRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartBlueprintRun", []))

    @jsii.member(jsii_name="toStartCrawler")
    def to_start_crawler(self) -> "Glue":
        '''(experimental) Grants permission to start a crawler.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-StartCrawler

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartCrawler", []))

    @jsii.member(jsii_name="toStartCrawlerSchedule")
    def to_start_crawler_schedule(self) -> "Glue":
        '''(experimental) Grants permission to change the schedule state of a crawler to SCHEDULED.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-scheduler.html#aws-glue-api-crawler-scheduler-StartCrawlerSchedule

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartCrawlerSchedule", []))

    @jsii.member(jsii_name="toStartDataQualityRuleRecommendationRun")
    def to_start_data_quality_rule_recommendation_run(self) -> "Glue":
        '''(experimental) Grants permission to start a Data Quality rule recommendation run.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-data-quality-api.html#aws-glue-api-data-quality-api-StartDataQualityRuleRecommendationRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartDataQualityRuleRecommendationRun", []))

    @jsii.member(jsii_name="toStartDataQualityRulesetEvaluationRun")
    def to_start_data_quality_ruleset_evaluation_run(self) -> "Glue":
        '''(experimental) Grants permission to start a Data Quality rule recommendation run.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-data-quality-api.html#aws-glue-api-data-quality-api-StartDataQualityRulesetEvaluationRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartDataQualityRulesetEvaluationRun", []))

    @jsii.member(jsii_name="toStartExportLabelsTaskRun")
    def to_start_export_labels_task_run(self) -> "Glue":
        '''(experimental) Grants permission to start an Export Labels ML Task Run.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-StartExportLabelsTaskRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartExportLabelsTaskRun", []))

    @jsii.member(jsii_name="toStartImportLabelsTaskRun")
    def to_start_import_labels_task_run(self) -> "Glue":
        '''(experimental) Grants permission to start an Import Labels ML Task Run.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-StartImportLabelsTaskRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartImportLabelsTaskRun", []))

    @jsii.member(jsii_name="toStartJobRun")
    def to_start_job_run(self) -> "Glue":
        '''(experimental) Grants permission to start running a job.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-runs.html#aws-glue-api-jobs-runs-StartJobRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartJobRun", []))

    @jsii.member(jsii_name="toStartMLEvaluationTaskRun")
    def to_start_ml_evaluation_task_run(self) -> "Glue":
        '''(experimental) Grants permission to start an Evaluation ML Task Run.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-StartMLEvaluationTaskRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartMLEvaluationTaskRun", []))

    @jsii.member(jsii_name="toStartMLLabelingSetGenerationTaskRun")
    def to_start_ml_labeling_set_generation_task_run(self) -> "Glue":
        '''(experimental) Grants permission to start a Labeling Set Generation ML Task Run.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-StartMLLabelingSetGenerationTaskRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartMLLabelingSetGenerationTaskRun", []))

    @jsii.member(jsii_name="toStartNotebook")
    def to_start_notebook(self) -> "Glue":
        '''(experimental) Grants permission to start Glue Studio Notebooks.

        Access Level: Permissions management

        https://docs.aws.amazon.com/glue/latest/ug/notebook-getting-started.html#create-notebook-permissions-operations

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartNotebook", []))

    @jsii.member(jsii_name="toStartTrigger")
    def to_start_trigger(self) -> "Glue":
        '''(experimental) Grants permission to start a trigger.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-trigger.html#aws-glue-api-jobs-trigger-StartTrigger

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartTrigger", []))

    @jsii.member(jsii_name="toStartWorkflowRun")
    def to_start_workflow_run(self) -> "Glue":
        '''(experimental) Grants permission to start running a workflow.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-StartWorkflowRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStartWorkflowRun", []))

    @jsii.member(jsii_name="toStopCrawler")
    def to_stop_crawler(self) -> "Glue":
        '''(experimental) Grants permission to stop a running crawler.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-StopCrawler

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStopCrawler", []))

    @jsii.member(jsii_name="toStopCrawlerSchedule")
    def to_stop_crawler_schedule(self) -> "Glue":
        '''(experimental) Grants permission to set the schedule state of a crawler to NOT_SCHEDULED.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-scheduler.html#aws-glue-api-crawler-scheduler-StopCrawlerSchedule

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStopCrawlerSchedule", []))

    @jsii.member(jsii_name="toStopSession")
    def to_stop_session(self) -> "Glue":
        '''(experimental) Grants permission to stop an interactive session.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-interactive-sessions.html#aws-glue-interactive-sessions-StopSession

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStopSession", []))

    @jsii.member(jsii_name="toStopTrigger")
    def to_stop_trigger(self) -> "Glue":
        '''(experimental) Grants permission to stop a trigger.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-trigger.html#aws-glue-api-jobs-trigger-StopTrigger

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStopTrigger", []))

    @jsii.member(jsii_name="toStopWorkflowRun")
    def to_stop_workflow_run(self) -> "Glue":
        '''(experimental) Grants permission to stop a workflow run.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-StopWorkflowRun

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toStopWorkflowRun", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Glue":
        '''(experimental) Grants permission to add tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-tags.html#aws-glue-api-tags-TagResource

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTerminateNotebook")
    def to_terminate_notebook(self) -> "Glue":
        '''(experimental) Grants permission to terminate Glue Studio Notebooks.

        Access Level: Permissions management

        https://docs.aws.amazon.com/glue/latest/ug/notebook-getting-started.html#create-notebook-permissions-operations

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toTerminateNotebook", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Glue":
        '''(experimental) Grants permission to remove tags associated with a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-tags.html#aws-glue-api-tags-UntagResource

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateBlueprint")
    def to_update_blueprint(self) -> "Glue":
        '''(experimental) Grants permission to update a blueprint.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-UpdateBlueprint

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateBlueprint", []))

    @jsii.member(jsii_name="toUpdateClassifier")
    def to_update_classifier(self) -> "Glue":
        '''(experimental) Grants permission to update a classifier.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-classifiers.html#aws-glue-api-crawler-classifiers-UpdateClassifier

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateClassifier", []))

    @jsii.member(jsii_name="toUpdateColumnStatisticsForPartition")
    def to_update_column_statistics_for_partition(self) -> "Glue":
        '''(experimental) Grants permission to update partition statistics of columns.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-partitions.html#aws-glue-api-catalog-partitions-UpdateColumnStatisticsForPartition

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateColumnStatisticsForPartition", []))

    @jsii.member(jsii_name="toUpdateColumnStatisticsForTable")
    def to_update_column_statistics_for_table(self) -> "Glue":
        '''(experimental) Grants permission to update table statistics of columns.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-UpdateColumnStatisticsForTable

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateColumnStatisticsForTable", []))

    @jsii.member(jsii_name="toUpdateConnection")
    def to_update_connection(self) -> "Glue":
        '''(experimental) Grants permission to update a connection.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-connections.html#aws-glue-api-catalog-connections-UpdateConnection

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateConnection", []))

    @jsii.member(jsii_name="toUpdateCrawler")
    def to_update_crawler(self) -> "Glue":
        '''(experimental) Grants permission to update a crawler.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-crawling.html#aws-glue-api-crawler-crawling-UpdateCrawler

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateCrawler", []))

    @jsii.member(jsii_name="toUpdateCrawlerSchedule")
    def to_update_crawler_schedule(self) -> "Glue":
        '''(experimental) Grants permission to update the schedule of a crawler.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-crawler-scheduler.html#aws-glue-api-crawler-scheduler-UpdateCrawlerSchedule

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateCrawlerSchedule", []))

    @jsii.member(jsii_name="toUpdateDatabase")
    def to_update_database(self) -> "Glue":
        '''(experimental) Grants permission to update a database.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-databases.html#aws-glue-api-catalog-databases-UpdateDatabase

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateDatabase", []))

    @jsii.member(jsii_name="toUpdateDataQualityRuleset")
    def to_update_data_quality_ruleset(self) -> "Glue":
        '''(experimental) Grants permission to update a Data Quality ruleset.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-data-quality-api.html#aws-glue-api-data-quality-api-UpdateDataQualityRuleset

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateDataQualityRuleset", []))

    @jsii.member(jsii_name="toUpdateDevEndpoint")
    def to_update_dev_endpoint(self) -> "Glue":
        '''(experimental) Grants permission to update a development endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-dev-endpoint.html#aws-glue-api-dev-endpoint-UpdateDevEndpoint

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateDevEndpoint", []))

    @jsii.member(jsii_name="toUpdateJob")
    def to_update_job(self) -> "Glue":
        '''(experimental) Grants permission to update a job.

        Access Level: Write

        Possible conditions:

        - .ifVpcIds()
        - .ifSubnetIds()
        - .ifSecurityGroupIds()

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html#aws-glue-api-jobs-job-UpdateJob

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateJob", []))

    @jsii.member(jsii_name="toUpdateJobFromSourceControl")
    def to_update_job_from_source_control(self) -> "Glue":
        '''(experimental) Grants permission to update a job from source control provider.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html#aws-glue-api-jobs-job-UpdateJobFromSourceControl

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateJobFromSourceControl", []))

    @jsii.member(jsii_name="toUpdateMLTransform")
    def to_update_ml_transform(self) -> "Glue":
        '''(experimental) Grants permission to update an ML Transform.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html#aws-glue-api-machine-learning-api-UpdateMLTransform

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateMLTransform", []))

    @jsii.member(jsii_name="toUpdatePartition")
    def to_update_partition(self) -> "Glue":
        '''(experimental) Grants permission to update a partition.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-partitions.html#aws-glue-api-catalog-partitions-UpdatePartition

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdatePartition", []))

    @jsii.member(jsii_name="toUpdateRegistry")
    def to_update_registry(self) -> "Glue":
        '''(experimental) Grants permission to update a schema registry.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-UpdateRegistry

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateRegistry", []))

    @jsii.member(jsii_name="toUpdateSchema")
    def to_update_schema(self) -> "Glue":
        '''(experimental) Grants permission to update a schema container.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-schema-registry-api.html#aws-glue-api-schema-registry-api-UpdateSchema

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateSchema", []))

    @jsii.member(jsii_name="toUpdateSourceControlFromJob")
    def to_update_source_control_from_job(self) -> "Glue":
        '''(experimental) Grants permission to update source control provider from a job.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-job.html#aws-glue-api-jobs-job-UpdateSourceControlFromJob

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateSourceControlFromJob", []))

    @jsii.member(jsii_name="toUpdateTable")
    def to_update_table(self) -> "Glue":
        '''(experimental) Grants permission to update a table.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-UpdateTable

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateTable", []))

    @jsii.member(jsii_name="toUpdateTrigger")
    def to_update_trigger(self) -> "Glue":
        '''(experimental) Grants permission to update a trigger.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-jobs-trigger.html#aws-glue-api-jobs-trigger-UpdateTrigger

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateTrigger", []))

    @jsii.member(jsii_name="toUpdateUserDefinedFunction")
    def to_update_user_defined_function(self) -> "Glue":
        '''(experimental) Grants permission to update a function definition.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-functions.html#aws-glue-api-catalog-functions-UpdateUserDefinedFunction

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateUserDefinedFunction", []))

    @jsii.member(jsii_name="toUpdateWorkflow")
    def to_update_workflow(self) -> "Glue":
        '''(experimental) Grants permission to update a workflow.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-workflow.html#aws-glue-api-workflow-UpdateWorkflow

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUpdateWorkflow", []))

    @jsii.member(jsii_name="toUseGlueStudio")
    def to_use_glue_studio(self) -> "Glue":
        '''(experimental) Grants permission to use Glue Studio and access its internal APIs.

        Access Level: Permissions management

        https://docs.aws.amazon.com/glue/latest/ug/setting-up.html#getting-started-min-privs

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUseGlueStudio", []))

    @jsii.member(jsii_name="toUseMLTransforms")
    def to_use_ml_transforms(self) -> "Glue":
        '''(experimental) Grants permission to use an ML Transform from within a Glue ETL Script.

        Access Level: Write

        https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-machine-learning-api.html

        :stability: experimental
        '''
        return typing.cast("Glue", jsii.invoke(self, "toUseMLTransforms", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c273dbdaed13b5ae9df3d3da8a9065e6d94e00423d3744dec6db2645b0415be5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7eb1c565b135f5d2e132dfa7dab577f6e1527c87fb6f7f545e2efd5f5c5b642d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Grafana(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Grafana"):
    '''(experimental) Statement provider for service `grafana <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedgrafana.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `grafana <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedgrafana.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7f6a9eae32d70c56303c06a42cd7ab758e3f9a0c43a0f524ba7c9cc0dca5c71c)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onWorkspace")
    def on_workspace(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Grafana":
        '''(experimental) Adds a resource of type workspace to the statement.

        https://docs.aws.amazon.com/grafana/latest/userguide/security-iam.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2743311678adda4ee2c7da213e16f9cec5f697ff17a7394e9d0c8c8edd9b3afa)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Grafana", jsii.invoke(self, "onWorkspace", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateLicense")
    def to_associate_license(self) -> "Grafana":
        '''(experimental) Grants permission to upgrade a workspace with a license.

        Access Level: Write

        Dependent actions:

        - aws-marketplace:ViewSubscriptions

        https://docs.aws.amazon.com/grafana/latest/userguide/AMG-and-IAM.html

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toAssociateLicense", []))

    @jsii.member(jsii_name="toCreateWorkspace")
    def to_create_workspace(self) -> "Grafana":
        '''(experimental) Grants permission to create a workspace.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:GetManagedPrefixListEntries
        - iam:CreateServiceLinkedRole
        - organizations:DescribeOrganization
        - sso:CreateManagedApplicationInstance
        - sso:DescribeRegisteredRegions
        - sso:GetSharedSsoConfiguration

        https://docs.aws.amazon.com/grafana/latest/userguide/AMG-and-IAM.html

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toCreateWorkspace", []))

    @jsii.member(jsii_name="toCreateWorkspaceApiKey")
    def to_create_workspace_api_key(self) -> "Grafana":
        '''(experimental) Grants permission to create API keys for a workspace.

        Access Level: Write

        https://docs.aws.amazon.com/grafana/latest/userguide/AMG-and-IAM.html

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toCreateWorkspaceApiKey", []))

    @jsii.member(jsii_name="toDeleteWorkspace")
    def to_delete_workspace(self) -> "Grafana":
        '''(experimental) Grants permission to delete a workspace.

        Access Level: Write

        Dependent actions:

        - sso:DeleteManagedApplicationInstance

        https://docs.aws.amazon.com/grafana/latest/userguide/AMG-and-IAM.html

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toDeleteWorkspace", []))

    @jsii.member(jsii_name="toDeleteWorkspaceApiKey")
    def to_delete_workspace_api_key(self) -> "Grafana":
        '''(experimental) Grants permission to delete API keys from a workspace.

        Access Level: Write

        https://docs.aws.amazon.com/grafana/latest/userguide/AMG-and-IAM.html

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toDeleteWorkspaceApiKey", []))

    @jsii.member(jsii_name="toDescribeWorkspace")
    def to_describe_workspace(self) -> "Grafana":
        '''(experimental) Grants permission to describe a workspace.

        Access Level: Read

        https://docs.aws.amazon.com/grafana/latest/userguide/AMG-and-IAM.html

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toDescribeWorkspace", []))

    @jsii.member(jsii_name="toDescribeWorkspaceAuthentication")
    def to_describe_workspace_authentication(self) -> "Grafana":
        '''(experimental) Grants permission to describe authentication providers on a workspace.

        Access Level: Read

        https://docs.aws.amazon.com/grafana/latest/userguide/AMG-and-IAM.html

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toDescribeWorkspaceAuthentication", []))

    @jsii.member(jsii_name="toDescribeWorkspaceConfiguration")
    def to_describe_workspace_configuration(self) -> "Grafana":
        '''(experimental) Grants permission to describe the current configuration string for the given workspace.

        Access Level: Read

        https://docs.aws.amazon.com/grafana/latest/APIReference/API_DescribeWorkspaceConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toDescribeWorkspaceConfiguration", []))

    @jsii.member(jsii_name="toDisassociateLicense")
    def to_disassociate_license(self) -> "Grafana":
        '''(experimental) Grants permission to remove a license from a workspace.

        Access Level: Write

        https://docs.aws.amazon.com/grafana/latest/userguide/AMG-and-IAM.html

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toDisassociateLicense", []))

    @jsii.member(jsii_name="toListPermissions")
    def to_list_permissions(self) -> "Grafana":
        '''(experimental) Grants permission to list the permissions on a wokspace.

        Access Level: List

        https://docs.aws.amazon.com/grafana/latest/userguide/AMG-and-IAM.html

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toListPermissions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Grafana":
        '''(experimental) Grants permission to list tags associated with a workspace.

        Access Level: Read

        https://docs.aws.amazon.com/grafana/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWorkspaces")
    def to_list_workspaces(self) -> "Grafana":
        '''(experimental) Grants permission to list workspaces.

        Access Level: Read

        https://docs.aws.amazon.com/grafana/latest/userguide/AMG-and-IAM.html

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toListWorkspaces", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Grafana":
        '''(experimental) Grants permission to add tags to, or update tag values of, a workspace.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/grafana/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Grafana":
        '''(experimental) Grants permission to remove tags from a workspace.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/grafana/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdatePermissions")
    def to_update_permissions(self) -> "Grafana":
        '''(experimental) Grants permission to modify the permissions on a workspace.

        Access Level: Permissions management

        https://docs.aws.amazon.com/grafana/latest/userguide/AMG-and-IAM.html

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toUpdatePermissions", []))

    @jsii.member(jsii_name="toUpdateWorkspace")
    def to_update_workspace(self) -> "Grafana":
        '''(experimental) Grants permission to modify a workspace.

        Access Level: Write

        Dependent actions:

        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:GetManagedPrefixListEntries
        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/grafana/latest/userguide/AMG-and-IAM.html

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toUpdateWorkspace", []))

    @jsii.member(jsii_name="toUpdateWorkspaceAuthentication")
    def to_update_workspace_authentication(self) -> "Grafana":
        '''(experimental) Grants permission to modify authentication providers on a workspace.

        Access Level: Write

        https://docs.aws.amazon.com/grafana/latest/userguide/AMG-and-IAM.html

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toUpdateWorkspaceAuthentication", []))

    @jsii.member(jsii_name="toUpdateWorkspaceConfiguration")
    def to_update_workspace_configuration(self) -> "Grafana":
        '''(experimental) Grants permission to update the configuration string for the given workspace.

        Access Level: Write

        https://docs.aws.amazon.com/grafana/latest/APIReference/API_UpdateWorkspaceConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Grafana", jsii.invoke(self, "toUpdateWorkspaceConfiguration", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ddbfb9f21f6c007989de15cd6a618e1ab48856cf034d312525f029825e71d32f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c3ba934107d7174391d25205837f3ba4d59612274d9f6dce2a183eafa33a7849)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Greengrass(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Greengrass",
):
    '''(experimental) Statement provider for service `greengrass <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotgreengrass.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `greengrass <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotgreengrass.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__43f2884b738ead98f8ac1166052c7e733d04e2f498c6568fdbb7ee08655d1516)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onBulkDeployment")
    def on_bulk_deployment(
        self,
        bulk_deployment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type bulkDeployment to the statement.

        https://docs.aws.amazon.com/greengrass/latest/developerguide/bulk-deploy-cli.html

        :param bulk_deployment_id: - Identifier for the bulkDeploymentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e080d205cf680aebec07d4a6978d6fd2bb09fae19e1c7ca8f2d8125a8b8de82b)
            check_type(argname="argument bulk_deployment_id", value=bulk_deployment_id, expected_type=type_hints["bulk_deployment_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onBulkDeployment", [bulk_deployment_id, account, region, partition]))

    @jsii.member(jsii_name="onCertificateAuthority")
    def on_certificate_authority(
        self,
        group_id: builtins.str,
        certificate_authority_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type certificateAuthority to the statement.

        https://docs.aws.amazon.com/greengrass/latest/developerguide/gg-sec.html

        :param group_id: - Identifier for the groupId.
        :param certificate_authority_id: - Identifier for the certificateAuthorityId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cf5c98276013e0034457d8b0a27d4f89d0bb42f952065afa7abf33351e20afdf)
            check_type(argname="argument group_id", value=group_id, expected_type=type_hints["group_id"])
            check_type(argname="argument certificate_authority_id", value=certificate_authority_id, expected_type=type_hints["certificate_authority_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onCertificateAuthority", [group_id, certificate_authority_id, account, region, partition]))

    @jsii.member(jsii_name="onConnectivityInfo")
    def on_connectivity_info(
        self,
        thing_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type connectivityInfo to the statement.

        https://docs.aws.amazon.com/greengrass/v1/apireference/definitions-connectivityinfo.html

        :param thing_name: - Identifier for the thingName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__022a07b19edf1849ef1ec527f7d1dbb82f9e6f71e4e020dc6c08d72b93d4c822)
            check_type(argname="argument thing_name", value=thing_name, expected_type=type_hints["thing_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onConnectivityInfo", [thing_name, account, region, partition]))

    @jsii.member(jsii_name="onConnectorDefinition")
    def on_connector_definition(
        self,
        connector_definition_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type connectorDefinition to the statement.

        https://docs.aws.amazon.com/greengrass/v1/apireference/definitions-connector.html

        :param connector_definition_id: - Identifier for the connectorDefinitionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__38f5bec0138a12b8fff5534f85e8a5eeb53968f5ab9f0d1a3b199231d1527e80)
            check_type(argname="argument connector_definition_id", value=connector_definition_id, expected_type=type_hints["connector_definition_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onConnectorDefinition", [connector_definition_id, account, region, partition]))

    @jsii.member(jsii_name="onConnectorDefinitionVersion")
    def on_connector_definition_version(
        self,
        connector_definition_id: builtins.str,
        version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type connectorDefinitionVersion to the statement.

        https://docs.aws.amazon.com/greengrass/v1/apireference/definitions-connectordefinitionversion.html

        :param connector_definition_id: - Identifier for the connectorDefinitionId.
        :param version_id: - Identifier for the versionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4197e2dbd65cf9afae3c5a57cef8a021c5cca1c48777553c2f87cf4f9d329d75)
            check_type(argname="argument connector_definition_id", value=connector_definition_id, expected_type=type_hints["connector_definition_id"])
            check_type(argname="argument version_id", value=version_id, expected_type=type_hints["version_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onConnectorDefinitionVersion", [connector_definition_id, version_id, account, region, partition]))

    @jsii.member(jsii_name="onCoreDefinition")
    def on_core_definition(
        self,
        core_definition_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type coreDefinition to the statement.

        https://docs.aws.amazon.com/greengrass/v1/apireference/definitions-core.html

        :param core_definition_id: - Identifier for the coreDefinitionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__51f00c4b80011deaa18cbab3c75806a5c4fe3337bda98263d9ada7ea7ee2ba20)
            check_type(argname="argument core_definition_id", value=core_definition_id, expected_type=type_hints["core_definition_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onCoreDefinition", [core_definition_id, account, region, partition]))

    @jsii.member(jsii_name="onCoreDefinitionVersion")
    def on_core_definition_version(
        self,
        core_definition_id: builtins.str,
        version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type coreDefinitionVersion to the statement.

        https://docs.aws.amazon.com/greengrass/v1/apireference/definitions-coredefinitionversion.html

        :param core_definition_id: - Identifier for the coreDefinitionId.
        :param version_id: - Identifier for the versionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__56fbccc34a42c2e69c182f3aa53d845bfa1e9c7c262bbf8fa08008d4c320d2f8)
            check_type(argname="argument core_definition_id", value=core_definition_id, expected_type=type_hints["core_definition_id"])
            check_type(argname="argument version_id", value=version_id, expected_type=type_hints["version_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onCoreDefinitionVersion", [core_definition_id, version_id, account, region, partition]))

    @jsii.member(jsii_name="onDeployment")
    def on_deployment(
        self,
        group_id: builtins.str,
        deployment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type deployment to the statement.

        https://docs.aws.amazon.com/greengrass/v1/apireference/definitions-createdeploymentrequest.html

        :param group_id: - Identifier for the groupId.
        :param deployment_id: - Identifier for the deploymentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d6dc540c68277c688df207bd5fc631c1da08b0c4b6d5fa656efc074c04f96a57)
            check_type(argname="argument group_id", value=group_id, expected_type=type_hints["group_id"])
            check_type(argname="argument deployment_id", value=deployment_id, expected_type=type_hints["deployment_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onDeployment", [group_id, deployment_id, account, region, partition]))

    @jsii.member(jsii_name="onDeviceDefinition")
    def on_device_definition(
        self,
        device_definition_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type deviceDefinition to the statement.

        https://docs.aws.amazon.com/greengrass/v1/apireference/definitions-device.html

        :param device_definition_id: - Identifier for the deviceDefinitionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8f95d273492d6d04196881709a43c524fa8689008d6e4b8dc7846fd517079f12)
            check_type(argname="argument device_definition_id", value=device_definition_id, expected_type=type_hints["device_definition_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onDeviceDefinition", [device_definition_id, account, region, partition]))

    @jsii.member(jsii_name="onDeviceDefinitionVersion")
    def on_device_definition_version(
        self,
        device_definition_id: builtins.str,
        version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type deviceDefinitionVersion to the statement.

        https://docs.aws.amazon.com/greengrass/v1/apireference/definitions-devicedefinitionversion.html

        :param device_definition_id: - Identifier for the deviceDefinitionId.
        :param version_id: - Identifier for the versionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2c13236146c0ea9675303531672c48fd692faf02a36ec0e2592c96a1e12966a5)
            check_type(argname="argument device_definition_id", value=device_definition_id, expected_type=type_hints["device_definition_id"])
            check_type(argname="argument version_id", value=version_id, expected_type=type_hints["version_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onDeviceDefinitionVersion", [device_definition_id, version_id, account, region, partition]))

    @jsii.member(jsii_name="onFunctionDefinition")
    def on_function_definition(
        self,
        function_definition_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type functionDefinition to the statement.

        https://docs.aws.amazon.com/greengrass/v1/apireference/definitions-function.html

        :param function_definition_id: - Identifier for the functionDefinitionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a7955e4af0bbf848d653f29010dfd5b23a3e7065c7c786917c2a54f5fc998191)
            check_type(argname="argument function_definition_id", value=function_definition_id, expected_type=type_hints["function_definition_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onFunctionDefinition", [function_definition_id, account, region, partition]))

    @jsii.member(jsii_name="onFunctionDefinitionVersion")
    def on_function_definition_version(
        self,
        function_definition_id: builtins.str,
        version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type functionDefinitionVersion to the statement.

        https://docs.aws.amazon.com/greengrass/v1/apireference/definitions-functiondefinitionversion.html

        :param function_definition_id: - Identifier for the functionDefinitionId.
        :param version_id: - Identifier for the versionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4e01213cdd06fd1d76fa6474cf67dec6fcc10ce0aa03ccc64a8647b7beca7e21)
            check_type(argname="argument function_definition_id", value=function_definition_id, expected_type=type_hints["function_definition_id"])
            check_type(argname="argument version_id", value=version_id, expected_type=type_hints["version_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onFunctionDefinitionVersion", [function_definition_id, version_id, account, region, partition]))

    @jsii.member(jsii_name="onGroup")
    def on_group(
        self,
        group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type group to the statement.

        https://docs.aws.amazon.com/greengrass/v1/apireference/definitions-groupinformation.html

        :param group_id: - Identifier for the groupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__25d7e398a3b044ecb2c62d473b10110476cf83b6bb795ae325a5465bc833fb89)
            check_type(argname="argument group_id", value=group_id, expected_type=type_hints["group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onGroup", [group_id, account, region, partition]))

    @jsii.member(jsii_name="onGroupVersion")
    def on_group_version(
        self,
        group_id: builtins.str,
        version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type groupVersion to the statement.

        https://docs.aws.amazon.com/greengrass/v1/apireference/definitions-groupversion.html

        :param group_id: - Identifier for the groupId.
        :param version_id: - Identifier for the versionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__19775e8d3bff34edb4aa8cfd1efb559f7982169e4dbaf954ed6f86ce863d68b7)
            check_type(argname="argument group_id", value=group_id, expected_type=type_hints["group_id"])
            check_type(argname="argument version_id", value=version_id, expected_type=type_hints["version_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onGroupVersion", [group_id, version_id, account, region, partition]))

    @jsii.member(jsii_name="onLoggerDefinition")
    def on_logger_definition(
        self,
        logger_definition_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type loggerDefinition to the statement.

        https://docs.aws.amazon.com/greengrass/v1/apireference/definitions-logger.html

        :param logger_definition_id: - Identifier for the loggerDefinitionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1ed4796001aaa86bc913d75624a2e927ccfbfc7cee3dc49e4de439f7ccd4e4ac)
            check_type(argname="argument logger_definition_id", value=logger_definition_id, expected_type=type_hints["logger_definition_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onLoggerDefinition", [logger_definition_id, account, region, partition]))

    @jsii.member(jsii_name="onLoggerDefinitionVersion")
    def on_logger_definition_version(
        self,
        logger_definition_id: builtins.str,
        version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type loggerDefinitionVersion to the statement.

        https://docs.aws.amazon.com/greengrass/v1/apireference/definitions-loggerdefinitionversion.html

        :param logger_definition_id: - Identifier for the loggerDefinitionId.
        :param version_id: - Identifier for the versionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f8994407f91f61db9a6d343e797c2fcef9d896f367170ecc7e56a5195948297a)
            check_type(argname="argument logger_definition_id", value=logger_definition_id, expected_type=type_hints["logger_definition_id"])
            check_type(argname="argument version_id", value=version_id, expected_type=type_hints["version_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onLoggerDefinitionVersion", [logger_definition_id, version_id, account, region, partition]))

    @jsii.member(jsii_name="onResourceDefinition")
    def on_resource_definition(
        self,
        resource_definition_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type resourceDefinition to the statement.

        https://docs.aws.amazon.com/greengrass/v1/apireference/definitions-resource.html

        :param resource_definition_id: - Identifier for the resourceDefinitionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b6bd157edb3f1f3e0b25d0146d26a600db09bfefc6d0c3cc62844715637e4290)
            check_type(argname="argument resource_definition_id", value=resource_definition_id, expected_type=type_hints["resource_definition_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onResourceDefinition", [resource_definition_id, account, region, partition]))

    @jsii.member(jsii_name="onResourceDefinitionVersion")
    def on_resource_definition_version(
        self,
        resource_definition_id: builtins.str,
        version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type resourceDefinitionVersion to the statement.

        https://docs.aws.amazon.com/greengrass/v1/apireference/definitions-resourcedefinitionversion.html

        :param resource_definition_id: - Identifier for the resourceDefinitionId.
        :param version_id: - Identifier for the versionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fc87fcf98ba0ed62b482180136a739da27c448e21b00aa3830ed13839b097827)
            check_type(argname="argument resource_definition_id", value=resource_definition_id, expected_type=type_hints["resource_definition_id"])
            check_type(argname="argument version_id", value=version_id, expected_type=type_hints["version_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onResourceDefinitionVersion", [resource_definition_id, version_id, account, region, partition]))

    @jsii.member(jsii_name="onSubscriptionDefinition")
    def on_subscription_definition(
        self,
        subscription_definition_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type subscriptionDefinition to the statement.

        https://docs.aws.amazon.com/greengrass/v1/apireference/definitions-subscription.html

        :param subscription_definition_id: - Identifier for the subscriptionDefinitionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6cb60b83d953c829db590640ce1f53ca0c4f255b4f3c80c7bedf044bb77efb7c)
            check_type(argname="argument subscription_definition_id", value=subscription_definition_id, expected_type=type_hints["subscription_definition_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onSubscriptionDefinition", [subscription_definition_id, account, region, partition]))

    @jsii.member(jsii_name="onSubscriptionDefinitionVersion")
    def on_subscription_definition_version(
        self,
        subscription_definition_id: builtins.str,
        version_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type subscriptionDefinitionVersion to the statement.

        https://docs.aws.amazon.com/greengrass/v1/apireference/definitions-subscriptiondefinitionversion.html

        :param subscription_definition_id: - Identifier for the subscriptionDefinitionId.
        :param version_id: - Identifier for the versionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__98691e81fe60996706852c7e263d2d09f67836553fe46a853b99e9c75cf8de86)
            check_type(argname="argument subscription_definition_id", value=subscription_definition_id, expected_type=type_hints["subscription_definition_id"])
            check_type(argname="argument version_id", value=version_id, expected_type=type_hints["version_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onSubscriptionDefinitionVersion", [subscription_definition_id, version_id, account, region, partition]))

    @jsii.member(jsii_name="onThing")
    def on_thing(
        self,
        thing_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type thing to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/thing-registry.html

        :param thing_name: - Identifier for the thingName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a1f3c50c272f6ad4da21f6e5bf3c1238094211a73fd70be23c8360bff5d1c82a)
            check_type(argname="argument thing_name", value=thing_name, expected_type=type_hints["thing_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onThing", [thing_name, account, region, partition]))

    @jsii.member(jsii_name="onThingRuntimeConfig")
    def on_thing_runtime_config(
        self,
        thing_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Greengrass":
        '''(experimental) Adds a resource of type thingRuntimeConfig to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/thing-registry.html

        :param thing_name: - Identifier for the thingName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ddcd2e079e673316e225c0e253c48871705f176c26ca39b622567513aea1f078)
            check_type(argname="argument thing_name", value=thing_name, expected_type=type_hints["thing_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Greengrass", jsii.invoke(self, "onThingRuntimeConfig", [thing_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateRoleToGroup")
    def to_associate_role_to_group(self) -> "Greengrass":
        '''(experimental) Grants permission to associate a role with a group.

        The role's permissions must allow Greengrass core Lambda functions and connectors to perform actions in other AWS services

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/associateroletogroup-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toAssociateRoleToGroup", []))

    @jsii.member(jsii_name="toAssociateServiceRoleToAccount")
    def to_associate_service_role_to_account(self) -> "Greengrass":
        '''(experimental) Grants permission to associate a role with your account.

        AWS IoT Greengrass uses this role to access your Lambda functions and AWS IoT resources

        Access Level: Permissions management

        https://docs.aws.amazon.com/greengrass/v1/apireference/associateserviceroletoaccount-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toAssociateServiceRoleToAccount", []))

    @jsii.member(jsii_name="toCreateConnectorDefinition")
    def to_create_connector_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to create a connector definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/v1/apireference/createconnectordefinition-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateConnectorDefinition", []))

    @jsii.member(jsii_name="toCreateConnectorDefinitionVersion")
    def to_create_connector_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to create a version of an existing connector definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/createconnectordefinitionversion-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateConnectorDefinitionVersion", []))

    @jsii.member(jsii_name="toCreateCoreDefinition")
    def to_create_core_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to create a core definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/v1/apireference/createcoredefinition-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateCoreDefinition", []))

    @jsii.member(jsii_name="toCreateCoreDefinitionVersion")
    def to_create_core_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to create a version of an existing core definition.

        Greengrass groups must each contain exactly one Greengrass core

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/createcoredefinitionversion-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateCoreDefinitionVersion", []))

    @jsii.member(jsii_name="toCreateDeployment")
    def to_create_deployment(self) -> "Greengrass":
        '''(experimental) Grants permission to create a deployment.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/createdeployment-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateDeployment", []))

    @jsii.member(jsii_name="toCreateDeviceDefinition")
    def to_create_device_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to create a device definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/v1/apireference/createdevicedefinition-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateDeviceDefinition", []))

    @jsii.member(jsii_name="toCreateDeviceDefinitionVersion")
    def to_create_device_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to create a version of an existing device definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/createdevicedefinitionversion-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateDeviceDefinitionVersion", []))

    @jsii.member(jsii_name="toCreateFunctionDefinition")
    def to_create_function_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to create a Lambda function definition to be used in a group that contains a list of Lambda functions and their configurations.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/v1/apireference/createfunctiondefinition-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateFunctionDefinition", []))

    @jsii.member(jsii_name="toCreateFunctionDefinitionVersion")
    def to_create_function_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to create a version of an existing Lambda function definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/createfunctiondefinitionversion-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateFunctionDefinitionVersion", []))

    @jsii.member(jsii_name="toCreateGroup")
    def to_create_group(self) -> "Greengrass":
        '''(experimental) Grants permission to create a group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/v1/apireference/creategroup-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateGroup", []))

    @jsii.member(jsii_name="toCreateGroupCertificateAuthority")
    def to_create_group_certificate_authority(self) -> "Greengrass":
        '''(experimental) Grants permission to create a CA for the group, or rotate the existing CA.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/creategroupcertificateauthority-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateGroupCertificateAuthority", []))

    @jsii.member(jsii_name="toCreateGroupVersion")
    def to_create_group_version(self) -> "Greengrass":
        '''(experimental) Grants permission to create a version of a group that has already been defined.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/creategroupversion-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateGroupVersion", []))

    @jsii.member(jsii_name="toCreateLoggerDefinition")
    def to_create_logger_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to create a logger definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/v1/apireference/createloggerdefinition-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateLoggerDefinition", []))

    @jsii.member(jsii_name="toCreateLoggerDefinitionVersion")
    def to_create_logger_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to create a version of an existing logger definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/createloggerdefinitionversion-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateLoggerDefinitionVersion", []))

    @jsii.member(jsii_name="toCreateResourceDefinition")
    def to_create_resource_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to create a resource definition that contains a list of resources to be used in a group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/v1/apireference/createresourcedefinition-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateResourceDefinition", []))

    @jsii.member(jsii_name="toCreateResourceDefinitionVersion")
    def to_create_resource_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to create a version of an existing resource definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/createresourcedefinitionversion-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateResourceDefinitionVersion", []))

    @jsii.member(jsii_name="toCreateSoftwareUpdateJob")
    def to_create_software_update_job(self) -> "Greengrass":
        '''(experimental) Grants permission to create an AWS IoT job that will trigger your Greengrass cores to update the software they are running.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/createsoftwareupdatejob-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateSoftwareUpdateJob", []))

    @jsii.member(jsii_name="toCreateSubscriptionDefinition")
    def to_create_subscription_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to create a subscription definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/v1/apireference/createsubscriptiondefinition-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateSubscriptionDefinition", []))

    @jsii.member(jsii_name="toCreateSubscriptionDefinitionVersion")
    def to_create_subscription_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to create a version of an existing subscription definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/createsubscriptiondefinitionversion-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toCreateSubscriptionDefinitionVersion", []))

    @jsii.member(jsii_name="toDeleteConnectorDefinition")
    def to_delete_connector_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to delete a connector definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/deleteconnectordefinition-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDeleteConnectorDefinition", []))

    @jsii.member(jsii_name="toDeleteCoreDefinition")
    def to_delete_core_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to delete a core definition.

        Deleting a definition that is currently in use in a deployment affects future deployments

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/deletecoredefinition-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDeleteCoreDefinition", []))

    @jsii.member(jsii_name="toDeleteDeviceDefinition")
    def to_delete_device_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to delete a device definition.

        Deleting a definition that is currently in use in a deployment affects future deployments

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/deletedevicedefinition-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDeleteDeviceDefinition", []))

    @jsii.member(jsii_name="toDeleteFunctionDefinition")
    def to_delete_function_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to delete a Lambda function definition.

        Deleting a definition that is currently in use in a deployment affects future deployments

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/deletefunctiondefinition-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDeleteFunctionDefinition", []))

    @jsii.member(jsii_name="toDeleteGroup")
    def to_delete_group(self) -> "Greengrass":
        '''(experimental) Grants permission to delete a group that is not currently in use in a deployment.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/deletegroup-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDeleteGroup", []))

    @jsii.member(jsii_name="toDeleteLoggerDefinition")
    def to_delete_logger_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to delete a logger definition.

        Deleting a definition that is currently in use in a deployment affects future deployments

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/deleteloggerdefinition-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDeleteLoggerDefinition", []))

    @jsii.member(jsii_name="toDeleteResourceDefinition")
    def to_delete_resource_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to delete a resource definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/deleteresourcedefinition-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDeleteResourceDefinition", []))

    @jsii.member(jsii_name="toDeleteSubscriptionDefinition")
    def to_delete_subscription_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to delete a subscription definition.

        Deleting a definition that is currently in use in a deployment affects future deployments

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/deletesubscriptiondefinition-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDeleteSubscriptionDefinition", []))

    @jsii.member(jsii_name="toDisassociateRoleFromGroup")
    def to_disassociate_role_from_group(self) -> "Greengrass":
        '''(experimental) Grants permission to disassociate the role from a group.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/disassociaterolefromgroup-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDisassociateRoleFromGroup", []))

    @jsii.member(jsii_name="toDisassociateServiceRoleFromAccount")
    def to_disassociate_service_role_from_account(self) -> "Greengrass":
        '''(experimental) Grants permission to disassociate the service role from an account. Without a service role, deployments will not work.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/disassociateservicerolefromaccount-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDisassociateServiceRoleFromAccount", []))

    @jsii.member(jsii_name="toDiscover")
    def to_discover(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information required to connect to a Greengrass core.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/latest/developerguide/gg-discover-api.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toDiscover", []))

    @jsii.member(jsii_name="toGetAssociatedRole")
    def to_get_associated_role(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve the role associated with a group.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getassociatedrole-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetAssociatedRole", []))

    @jsii.member(jsii_name="toGetBulkDeploymentStatus")
    def to_get_bulk_deployment_status(self) -> "Greengrass":
        '''(experimental) Grants permission to return the status of a bulk deployment.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getbulkdeploymentstatus-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetBulkDeploymentStatus", []))

    @jsii.member(jsii_name="toGetConnectivityInfo")
    def to_get_connectivity_info(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve the connectivity information for a core.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getconnectivityinfo-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetConnectivityInfo", []))

    @jsii.member(jsii_name="toGetConnectorDefinition")
    def to_get_connector_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a connector definition.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getconnectordefinition-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetConnectorDefinition", []))

    @jsii.member(jsii_name="toGetConnectorDefinitionVersion")
    def to_get_connector_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a connector definition version.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getconnectordefinitionversion-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetConnectorDefinitionVersion", []))

    @jsii.member(jsii_name="toGetCoreDefinition")
    def to_get_core_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a core definition.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getcoredefinition-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetCoreDefinition", []))

    @jsii.member(jsii_name="toGetCoreDefinitionVersion")
    def to_get_core_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a core definition version.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getcoredefinitionversion-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetCoreDefinitionVersion", []))

    @jsii.member(jsii_name="toGetDeploymentStatus")
    def to_get_deployment_status(self) -> "Greengrass":
        '''(experimental) Grants permission to return the status of a deployment.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getdeploymentstatus-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetDeploymentStatus", []))

    @jsii.member(jsii_name="toGetDeviceDefinition")
    def to_get_device_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a device definition.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getdevicedefinition-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetDeviceDefinition", []))

    @jsii.member(jsii_name="toGetDeviceDefinitionVersion")
    def to_get_device_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a device definition version.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getdevicedefinitionversion-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetDeviceDefinitionVersion", []))

    @jsii.member(jsii_name="toGetFunctionDefinition")
    def to_get_function_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a Lambda function definition, such as its creation time and latest version.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getfunctiondefinition-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetFunctionDefinition", []))

    @jsii.member(jsii_name="toGetFunctionDefinitionVersion")
    def to_get_function_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a Lambda function definition version, such as which Lambda functions are included in the version and their configurations.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getfunctiondefinitionversion-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetFunctionDefinitionVersion", []))

    @jsii.member(jsii_name="toGetGroup")
    def to_get_group(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a group.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getgroup-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetGroup", []))

    @jsii.member(jsii_name="toGetGroupCertificateAuthority")
    def to_get_group_certificate_authority(self) -> "Greengrass":
        '''(experimental) Grants permission to return the public key of the CA associated with a group.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getgroupcertificateauthority-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetGroupCertificateAuthority", []))

    @jsii.member(jsii_name="toGetGroupCertificateConfiguration")
    def to_get_group_certificate_configuration(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve the current configuration for the CA used by a group.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getgroupcertificateconfiguration-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetGroupCertificateConfiguration", []))

    @jsii.member(jsii_name="toGetGroupVersion")
    def to_get_group_version(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a group version.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getgroupversion-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetGroupVersion", []))

    @jsii.member(jsii_name="toGetLoggerDefinition")
    def to_get_logger_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a logger definition.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getloggerdefinition-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetLoggerDefinition", []))

    @jsii.member(jsii_name="toGetLoggerDefinitionVersion")
    def to_get_logger_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a logger definition version.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getloggerdefinitionversion-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetLoggerDefinitionVersion", []))

    @jsii.member(jsii_name="toGetResourceDefinition")
    def to_get_resource_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a resource definition, such as its creation time and latest version.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getresourcedefinition-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetResourceDefinition", []))

    @jsii.member(jsii_name="toGetResourceDefinitionVersion")
    def to_get_resource_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a resource definition version, such as which resources are included in the version.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getresourcedefinitionversion-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetResourceDefinitionVersion", []))

    @jsii.member(jsii_name="toGetServiceRoleForAccount")
    def to_get_service_role_for_account(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve the service role that is attached to an account.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getserviceroleforaccount-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetServiceRoleForAccount", []))

    @jsii.member(jsii_name="toGetSubscriptionDefinition")
    def to_get_subscription_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a subscription definition.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getsubscriptiondefinition-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetSubscriptionDefinition", []))

    @jsii.member(jsii_name="toGetSubscriptionDefinitionVersion")
    def to_get_subscription_definition_version(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve information about a subscription definition version.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getsubscriptiondefinitionversion-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetSubscriptionDefinitionVersion", []))

    @jsii.member(jsii_name="toGetThingRuntimeConfiguration")
    def to_get_thing_runtime_configuration(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve runtime configuration of a thing.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/getthingruntimeconfiguration-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toGetThingRuntimeConfiguration", []))

    @jsii.member(jsii_name="toListBulkDeploymentDetailedReports")
    def to_list_bulk_deployment_detailed_reports(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a paginated list of the deployments that have been started in a bulk deployment operation and their current deployment status.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v1/apireference/listbulkdeploymentdetailedreports-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListBulkDeploymentDetailedReports", []))

    @jsii.member(jsii_name="toListBulkDeployments")
    def to_list_bulk_deployments(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of bulk deployments.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v1/apireference/listbulkdeployments-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListBulkDeployments", []))

    @jsii.member(jsii_name="toListConnectorDefinitions")
    def to_list_connector_definitions(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of connector definitions.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v1/apireference/listconnectordefinitions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListConnectorDefinitions", []))

    @jsii.member(jsii_name="toListConnectorDefinitionVersions")
    def to_list_connector_definition_versions(self) -> "Greengrass":
        '''(experimental) Grants permission to list the versions of a connector definition.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v1/apireference/listconnectordefinitionversions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListConnectorDefinitionVersions", []))

    @jsii.member(jsii_name="toListCoreDefinitions")
    def to_list_core_definitions(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of core definitions.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v1/apireference/listcoredefinitions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListCoreDefinitions", []))

    @jsii.member(jsii_name="toListCoreDefinitionVersions")
    def to_list_core_definition_versions(self) -> "Greengrass":
        '''(experimental) Grants permission to list the versions of a core definition.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v1/apireference/listcoredefinitionversions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListCoreDefinitionVersions", []))

    @jsii.member(jsii_name="toListDeployments")
    def to_list_deployments(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of all deployments for a group.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v1/apireference/listdeployments-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListDeployments", []))

    @jsii.member(jsii_name="toListDeviceDefinitions")
    def to_list_device_definitions(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of device definitions.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v1/apireference/listdevicedefinitions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListDeviceDefinitions", []))

    @jsii.member(jsii_name="toListDeviceDefinitionVersions")
    def to_list_device_definition_versions(self) -> "Greengrass":
        '''(experimental) Grants permission to list the versions of a device definition.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v1/apireference/listdevicedefinitionversions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListDeviceDefinitionVersions", []))

    @jsii.member(jsii_name="toListFunctionDefinitions")
    def to_list_function_definitions(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of Lambda function definitions.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v1/apireference/listfunctiondefinitions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListFunctionDefinitions", []))

    @jsii.member(jsii_name="toListFunctionDefinitionVersions")
    def to_list_function_definition_versions(self) -> "Greengrass":
        '''(experimental) Grants permission to list the versions of a Lambda function definition.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v1/apireference/listfunctiondefinitionversions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListFunctionDefinitionVersions", []))

    @jsii.member(jsii_name="toListGroupCertificateAuthorities")
    def to_list_group_certificate_authorities(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of current CAs for a group.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v1/apireference/listgroupcertificateauthorities-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListGroupCertificateAuthorities", []))

    @jsii.member(jsii_name="toListGroups")
    def to_list_groups(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of groups.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v1/apireference/listgroups-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListGroups", []))

    @jsii.member(jsii_name="toListGroupVersions")
    def to_list_group_versions(self) -> "Greengrass":
        '''(experimental) Grants permission to list the versions of a group.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v1/apireference/listgroupversions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListGroupVersions", []))

    @jsii.member(jsii_name="toListLoggerDefinitions")
    def to_list_logger_definitions(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of logger definitions.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v1/apireference/listloggerdefinitions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListLoggerDefinitions", []))

    @jsii.member(jsii_name="toListLoggerDefinitionVersions")
    def to_list_logger_definition_versions(self) -> "Greengrass":
        '''(experimental) Grants permission to list the versions of a logger definition.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v1/apireference/listloggerdefinitionversions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListLoggerDefinitionVersions", []))

    @jsii.member(jsii_name="toListResourceDefinitions")
    def to_list_resource_definitions(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of resource definitions.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v1/apireference/listresourcedefinitions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListResourceDefinitions", []))

    @jsii.member(jsii_name="toListResourceDefinitionVersions")
    def to_list_resource_definition_versions(self) -> "Greengrass":
        '''(experimental) Grants permission to list the versions of a resource definition.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v1/apireference/listresourcedefinitionversions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListResourceDefinitionVersions", []))

    @jsii.member(jsii_name="toListSubscriptionDefinitions")
    def to_list_subscription_definitions(self) -> "Greengrass":
        '''(experimental) Grants permission to retrieve a list of subscription definitions.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v1/apireference/listsubscriptiondefinitions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListSubscriptionDefinitions", []))

    @jsii.member(jsii_name="toListSubscriptionDefinitionVersions")
    def to_list_subscription_definition_versions(self) -> "Greengrass":
        '''(experimental) Grants permission to list the versions of a subscription definition.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v1/apireference/listsubscriptiondefinitionversions-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListSubscriptionDefinitionVersions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Greengrass":
        '''(experimental) Grants permission to list the tags for a resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/v1/apireference/listtagsforresource-get.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toResetDeployments")
    def to_reset_deployments(self) -> "Greengrass":
        '''(experimental) Grants permission to reset a group's deployments.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/resetdeployments-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toResetDeployments", []))

    @jsii.member(jsii_name="toStartBulkDeployment")
    def to_start_bulk_deployment(self) -> "Greengrass":
        '''(experimental) Grants permission to deploy multiple groups in one operation.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/v1/apireference/startbulkdeployment-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toStartBulkDeployment", []))

    @jsii.member(jsii_name="toStopBulkDeployment")
    def to_stop_bulk_deployment(self) -> "Greengrass":
        '''(experimental) Grants permission to stop the execution of a bulk deployment.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/stopbulkdeployment-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toStopBulkDeployment", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Greengrass":
        '''(experimental) Grants permission to add tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/v1/apireference/tagresource-post.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Greengrass":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/v1/apireference/untagresource-delete.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateConnectivityInfo")
    def to_update_connectivity_info(self) -> "Greengrass":
        '''(experimental) Grants permission to update the connectivity information for a Greengrass core.

        Any devices that belong to the group that has this core will receive this information in order to find the location of the core and connect to it

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/updateconnectivityinfo-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateConnectivityInfo", []))

    @jsii.member(jsii_name="toUpdateConnectorDefinition")
    def to_update_connector_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to update a connector definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/updateconnectordefinition-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateConnectorDefinition", []))

    @jsii.member(jsii_name="toUpdateCoreDefinition")
    def to_update_core_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to update a core definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/updatecoredefinition-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateCoreDefinition", []))

    @jsii.member(jsii_name="toUpdateDeviceDefinition")
    def to_update_device_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to update a device definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/updatedevicedefinition-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateDeviceDefinition", []))

    @jsii.member(jsii_name="toUpdateFunctionDefinition")
    def to_update_function_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to update a Lambda function definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/updatefunctiondefinition-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateFunctionDefinition", []))

    @jsii.member(jsii_name="toUpdateGroup")
    def to_update_group(self) -> "Greengrass":
        '''(experimental) Grants permission to update a group.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/updategroup-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateGroup", []))

    @jsii.member(jsii_name="toUpdateGroupCertificateConfiguration")
    def to_update_group_certificate_configuration(self) -> "Greengrass":
        '''(experimental) Grants permission to update the certificate expiry time for a group.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/updategroupcertificateconfiguration-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateGroupCertificateConfiguration", []))

    @jsii.member(jsii_name="toUpdateLoggerDefinition")
    def to_update_logger_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to update a logger definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/updateloggerdefinition-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateLoggerDefinition", []))

    @jsii.member(jsii_name="toUpdateResourceDefinition")
    def to_update_resource_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to update a resource definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/updateresourcedefinition-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateResourceDefinition", []))

    @jsii.member(jsii_name="toUpdateSubscriptionDefinition")
    def to_update_subscription_definition(self) -> "Greengrass":
        '''(experimental) Grants permission to update a subscription definition.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/updatesubscriptiondefinition-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateSubscriptionDefinition", []))

    @jsii.member(jsii_name="toUpdateThingRuntimeConfiguration")
    def to_update_thing_runtime_configuration(self) -> "Greengrass":
        '''(experimental) Grants permission to update runtime configuration of a thing.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v1/apireference/updatethingruntimeconfiguration-put.html

        :stability: experimental
        '''
        return typing.cast("Greengrass", jsii.invoke(self, "toUpdateThingRuntimeConfiguration", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a61e88b98056daa89fb27f26dfb064170fb8fbd8f452cef66fb952b0fd357324)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__13d35ff1d4a4d0344d422aa8dd6a4b703075b189e068401cd7c61383d9cf06d3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class GreengrassV2(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.GreengrassV2",
):
    '''(experimental) Statement provider for service `greengrass-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotgreengrassv2.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `greengrass-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotgreengrassv2.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5fab5343d36b1a35d6387253f5a007d2bf99f597bb256449aa35a6584b3bac16)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onComponent")
    def on_component(
        self,
        component_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "GreengrassV2":
        '''(experimental) Adds a resource of type component to the statement.

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_Component.html

        :param component_name: - Identifier for the componentName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4a9983f5766872fe9a76632ad1a7c369bfc2e79b7bb99f6e37f25fe6ec5ed786)
            check_type(argname="argument component_name", value=component_name, expected_type=type_hints["component_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("GreengrassV2", jsii.invoke(self, "onComponent", [component_name, account, region, partition]))

    @jsii.member(jsii_name="onComponentVersion")
    def on_component_version(
        self,
        component_name: builtins.str,
        component_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "GreengrassV2":
        '''(experimental) Adds a resource of type componentVersion to the statement.

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_Component.html

        :param component_name: - Identifier for the componentName.
        :param component_version: - Identifier for the componentVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6484b2d4bab864e470b78f0c49cfe28b440334a9319de3f6ae12b96937207d0d)
            check_type(argname="argument component_name", value=component_name, expected_type=type_hints["component_name"])
            check_type(argname="argument component_version", value=component_version, expected_type=type_hints["component_version"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("GreengrassV2", jsii.invoke(self, "onComponentVersion", [component_name, component_version, account, region, partition]))

    @jsii.member(jsii_name="onConnectivityInfo")
    def on_connectivity_info(
        self,
        thing_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "GreengrassV2":
        '''(experimental) Adds a resource of type connectivityInfo to the statement.

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_ConnectivityInfo.html

        :param thing_name: - Identifier for the thingName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5983e28cfebd2a78fbb95a0d777026f2f6b31800cde33667db848d09aa7382b5)
            check_type(argname="argument thing_name", value=thing_name, expected_type=type_hints["thing_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("GreengrassV2", jsii.invoke(self, "onConnectivityInfo", [thing_name, account, region, partition]))

    @jsii.member(jsii_name="onCoreDevice")
    def on_core_device(
        self,
        core_device_thing_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "GreengrassV2":
        '''(experimental) Adds a resource of type coreDevice to the statement.

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_CoreDevice.html

        :param core_device_thing_name: - Identifier for the coreDeviceThingName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8ca69e94fc24361f3d423a46c270f41a732d48cf4f712bc8db600f02a674e717)
            check_type(argname="argument core_device_thing_name", value=core_device_thing_name, expected_type=type_hints["core_device_thing_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("GreengrassV2", jsii.invoke(self, "onCoreDevice", [core_device_thing_name, account, region, partition]))

    @jsii.member(jsii_name="onDeployment")
    def on_deployment(
        self,
        deployment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "GreengrassV2":
        '''(experimental) Adds a resource of type deployment to the statement.

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_Deployment.html

        :param deployment_id: - Identifier for the deploymentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b7713e0f26b402263186d46f84e8b2040840b81d823c456589041d6945c212c1)
            check_type(argname="argument deployment_id", value=deployment_id, expected_type=type_hints["deployment_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("GreengrassV2", jsii.invoke(self, "onDeployment", [deployment_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateServiceRoleToAccount")
    def to_associate_service_role_to_account(self) -> "GreengrassV2":
        '''(experimental) Grants permission to associate a role with your account.

        AWS IoT Greengrass uses this role to access your Lambda functions and AWS IoT resources

        Access Level: Permissions management

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_AssociateServiceRoleToAccount.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toAssociateServiceRoleToAccount", []))

    @jsii.member(jsii_name="toBatchAssociateClientDeviceWithCoreDevice")
    def to_batch_associate_client_device_with_core_device(self) -> "GreengrassV2":
        '''(experimental) Grants permission to associate a list of client devices with a core device.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_BatchAssociateClientDeviceWithCoreDevice.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toBatchAssociateClientDeviceWithCoreDevice", []))

    @jsii.member(jsii_name="toBatchDisassociateClientDeviceFromCoreDevice")
    def to_batch_disassociate_client_device_from_core_device(self) -> "GreengrassV2":
        '''(experimental) Grants permission to disassociate a list of client devices from a core device.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_BatchDisassociateClientDeviceFromCoreDevice.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toBatchDisassociateClientDeviceFromCoreDevice", []))

    @jsii.member(jsii_name="toCancelDeployment")
    def to_cancel_deployment(self) -> "GreengrassV2":
        '''(experimental) Grants permission to cancel a deployment.

        Access Level: Write

        Dependent actions:

        - iot:CancelJob
        - iot:DeleteThingShadow
        - iot:DescribeJob
        - iot:DescribeThing
        - iot:DescribeThingGroup
        - iot:GetThingShadow
        - iot:UpdateJob
        - iot:UpdateThingShadow

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_CancelDeployment.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toCancelDeployment", []))

    @jsii.member(jsii_name="toCreateComponentVersion")
    def to_create_component_version(self) -> "GreengrassV2":
        '''(experimental) Grants permission to create a component.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_CreateComponentVersion.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toCreateComponentVersion", []))

    @jsii.member(jsii_name="toCreateDeployment")
    def to_create_deployment(self) -> "GreengrassV2":
        '''(experimental) Grants permission to create a deployment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iot:CancelJob
        - iot:CreateJob
        - iot:DeleteThingShadow
        - iot:DescribeJob
        - iot:DescribeThing
        - iot:DescribeThingGroup
        - iot:GetThingShadow
        - iot:UpdateJob
        - iot:UpdateThingShadow

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_CreateDeployment.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toCreateDeployment", []))

    @jsii.member(jsii_name="toDeleteComponent")
    def to_delete_component(self) -> "GreengrassV2":
        '''(experimental) Grants permission to delete a component.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_DeleteComponent.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toDeleteComponent", []))

    @jsii.member(jsii_name="toDeleteCoreDevice")
    def to_delete_core_device(self) -> "GreengrassV2":
        '''(experimental) Grants permission to delete a AWS IoT Greengrass core device, which is an AWS IoT thing.

        This operation removes the core device from the list of core devices. This operation doesn't delete the AWS IoT thing

        Access Level: Write

        Dependent actions:

        - iot:DescribeJobExecution

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_DeleteCoreDevice.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toDeleteCoreDevice", []))

    @jsii.member(jsii_name="toDeleteDeployment")
    def to_delete_deployment(self) -> "GreengrassV2":
        '''(experimental) Grants permission to delete a deployment. To delete an active deployment, it needs to be cancelled first.

        Access Level: Write

        Dependent actions:

        - iot:DeleteJob

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_DeleteDeployment.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toDeleteDeployment", []))

    @jsii.member(jsii_name="toDescribeComponent")
    def to_describe_component(self) -> "GreengrassV2":
        '''(experimental) Grants permission to retrieve metadata for a version of a component.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_DescribeComponent.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toDescribeComponent", []))

    @jsii.member(jsii_name="toDisassociateServiceRoleFromAccount")
    def to_disassociate_service_role_from_account(self) -> "GreengrassV2":
        '''(experimental) Grants permission to disassociate the service role from an account. Without a service role, deployments will not work.

        Access Level: Write

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_DisassociateServiceRoleFromAccount.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toDisassociateServiceRoleFromAccount", []))

    @jsii.member(jsii_name="toGetComponent")
    def to_get_component(self) -> "GreengrassV2":
        '''(experimental) Grants permission to get the recipe for a version of a component.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_GetComponent.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toGetComponent", []))

    @jsii.member(jsii_name="toGetComponentVersionArtifact")
    def to_get_component_version_artifact(self) -> "GreengrassV2":
        '''(experimental) Grants permission to get the pre-signed URL to download a public component artifact.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_GetComponentVersionArtifact.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toGetComponentVersionArtifact", []))

    @jsii.member(jsii_name="toGetConnectivityInfo")
    def to_get_connectivity_info(self) -> "GreengrassV2":
        '''(experimental) Grants permission to retrieve the connectivity information for a Greengrass core device.

        Access Level: Read

        Dependent actions:

        - iot:GetThingShadow

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_GetConnectivityInfo.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toGetConnectivityInfo", []))

    @jsii.member(jsii_name="toGetCoreDevice")
    def to_get_core_device(self) -> "GreengrassV2":
        '''(experimental) Grants permission to retrieves metadata for a AWS IoT Greengrass core device.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_GetCoreDevice.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toGetCoreDevice", []))

    @jsii.member(jsii_name="toGetDeployment")
    def to_get_deployment(self) -> "GreengrassV2":
        '''(experimental) Grants permission to get a deployment.

        Access Level: Read

        Dependent actions:

        - iot:DescribeJob
        - iot:DescribeThing
        - iot:DescribeThingGroup
        - iot:GetThingShadow

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_GetDeployment.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toGetDeployment", []))

    @jsii.member(jsii_name="toGetServiceRoleForAccount")
    def to_get_service_role_for_account(self) -> "GreengrassV2":
        '''(experimental) Grants permission to retrieve the service role that is attached to an account.

        Access Level: Read

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_GetServiceRoleForAccount.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toGetServiceRoleForAccount", []))

    @jsii.member(jsii_name="toListClientDevicesAssociatedWithCoreDevice")
    def to_list_client_devices_associated_with_core_device(self) -> "GreengrassV2":
        '''(experimental) Grants permission to retrieve a paginated list of client devices associated to a AWS IoT Greengrass core device.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_ListClientDevicesAssociatedWithCoreDevice.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toListClientDevicesAssociatedWithCoreDevice", []))

    @jsii.member(jsii_name="toListComponents")
    def to_list_components(self) -> "GreengrassV2":
        '''(experimental) Grants permission to retrieve a paginated list of component summaries.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_ListComponents.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toListComponents", []))

    @jsii.member(jsii_name="toListComponentVersions")
    def to_list_component_versions(self) -> "GreengrassV2":
        '''(experimental) Grants permission to retrieve a paginated list of all versions for a component.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_ListComponentVersions.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toListComponentVersions", []))

    @jsii.member(jsii_name="toListCoreDevices")
    def to_list_core_devices(self) -> "GreengrassV2":
        '''(experimental) Grants permission to retrieve a paginated list of AWS IoT Greengrass core devices.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_ListCoreDevices.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toListCoreDevices", []))

    @jsii.member(jsii_name="toListDeployments")
    def to_list_deployments(self) -> "GreengrassV2":
        '''(experimental) Grants permission to retrieves a paginated list of deployments.

        Access Level: List

        Dependent actions:

        - iot:DescribeJob
        - iot:DescribeThing
        - iot:DescribeThingGroup
        - iot:GetThingShadow

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_ListDeployments.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toListDeployments", []))

    @jsii.member(jsii_name="toListEffectiveDeployments")
    def to_list_effective_deployments(self) -> "GreengrassV2":
        '''(experimental) Grants permission to retrieves a paginated list of deployment jobs that AWS IoT Greengrass sends to AWS IoT Greengrass core devices.

        Access Level: List

        Dependent actions:

        - iot:DescribeJob
        - iot:DescribeJobExecution
        - iot:DescribeThing
        - iot:DescribeThingGroup
        - iot:GetThingShadow

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_ListEffectiveDeployments.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toListEffectiveDeployments", []))

    @jsii.member(jsii_name="toListInstalledComponents")
    def to_list_installed_components(self) -> "GreengrassV2":
        '''(experimental) Grants permission to retrieve a paginated list of the components that a AWS IoT Greengrass core device runs.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_ListInstalledComponents.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toListInstalledComponents", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "GreengrassV2":
        '''(experimental) Grants permission to list the tags for a resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toResolveComponentCandidates")
    def to_resolve_component_candidates(self) -> "GreengrassV2":
        '''(experimental) Grants permission to list components that meet the component, version, and platform requirements of a deployment.

        Access Level: List

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_ResolveComponentCandidates.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toResolveComponentCandidates", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "GreengrassV2":
        '''(experimental) Grants permission to add tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "GreengrassV2":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateConnectivityInfo")
    def to_update_connectivity_info(self) -> "GreengrassV2":
        '''(experimental) Grants permission to update the connectivity information for a Greengrass core.

        Any devices that belong to the group that has this core will receive this information in order to find the location of the core and connect to it

        Access Level: Write

        Dependent actions:

        - iot:GetThingShadow
        - iot:UpdateThingShadow

        https://docs.aws.amazon.com/greengrass/v2/APIReference/API_UpdateConnectivityInfo.html

        :stability: experimental
        '''
        return typing.cast("GreengrassV2", jsii.invoke(self, "toUpdateConnectivityInfo", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__86367ceb9892b29be292706fbe68e905d11ade62e1b2e59094a0923b68aada9b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8162029af3352b2eeb9de5d8ff5773470c928351e776e7dff72bc4159ebb2c11)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Groundstation(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Groundstation",
):
    '''(experimental) Statement provider for service `groundstation <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsgroundstation.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `groundstation <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsgroundstation.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3d90d49dbaa56a6c34d3a7afca77e778771317740283ec3167ff99857acce5e4)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAgentId")
    def if_agent_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Groundstation":
        '''(experimental) Filters access by the ID of an agent.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_RegisterAgent.html#groundstation-RegisterAgent-response-agentId

        Applies to resource types:

        - Agent

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__12d6910ee6a456197113b975e2c23cb9d9303d0f2af7851482c90983131a1004)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Groundstation", jsii.invoke(self, "ifAgentId", [value, operator]))

    @jsii.member(jsii_name="ifConfigId")
    def if_config_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Groundstation":
        '''(experimental) Filters access by the ID of a config.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_CreateConfig.html#groundstation-CreateConfig-response-configId

        Applies to resource types:

        - Config

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f68abacc8d33ae6d5b03b9da9869421a8dee749e2c7d1ab42eec13b1f01dd527)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Groundstation", jsii.invoke(self, "ifConfigId", [value, operator]))

    @jsii.member(jsii_name="ifConfigType")
    def if_config_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Groundstation":
        '''(experimental) Filters access by the type of a config.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_CreateConfig.html#groundstation-CreateConfig-response-configType

        Applies to resource types:

        - Config

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__86390e1d2cc94923a69b896b356413f35f9bd6d986d85532a6b60c864c7c1498)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Groundstation", jsii.invoke(self, "ifConfigType", [value, operator]))

    @jsii.member(jsii_name="ifContactId")
    def if_contact_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Groundstation":
        '''(experimental) Filters access by the ID of a contact.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ReserveContact.html#groundstation-ReserveContact-response-contactId

        Applies to resource types:

        - Contact

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9c9b3c54e71bd52c71ee658218871673dbbdba6314260b0ce66d3a99cf20d581)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Groundstation", jsii.invoke(self, "ifContactId", [value, operator]))

    @jsii.member(jsii_name="ifDataflowEndpointGroupId")
    def if_dataflow_endpoint_group_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Groundstation":
        '''(experimental) Filters access by the ID of a dataflow endpoint group.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_CreateDataflowEndpointGroup.html#groundstation-CreateDataflowEndpointGroup-response-dataflowEndpointGroupId

        Applies to resource types:

        - DataflowEndpointGroup

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__96b0e3d5d6f504eef12f46502ca5fe483db13c165aebd0e9d5a6c0eda6ba888f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Groundstation", jsii.invoke(self, "ifDataflowEndpointGroupId", [value, operator]))

    @jsii.member(jsii_name="ifEphemerisId")
    def if_ephemeris_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Groundstation":
        '''(experimental) Filters access by the ID of an ephemeris.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_CreateEphemeris.html#groundstation-CreateEphemeris-response-ephemerisId

        Applies to resource types:

        - EphemerisItem

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1898be7ec81f82dfa645b17c101517fb4aa7f723696be4d688ab1b6870d54cd4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Groundstation", jsii.invoke(self, "ifEphemerisId", [value, operator]))

    @jsii.member(jsii_name="ifGroundStationId")
    def if_ground_station_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Groundstation":
        '''(experimental) Filters access by the ID of a ground station.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_GroundStationData.html#groundstation-Type-GroundStationData-groundStationId

        Applies to resource types:

        - GroundStationResource

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bb6059df73bd204d691b4396f3afeb4c16b5981832590fb6bd0f1b9cc79987ff)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Groundstation", jsii.invoke(self, "ifGroundStationId", [value, operator]))

    @jsii.member(jsii_name="ifMissionProfileId")
    def if_mission_profile_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Groundstation":
        '''(experimental) Filters access by the ID of a mission profile.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_CreateMissionProfile.html#groundstation-CreateMissionProfile-response-missionProfileId

        Applies to resource types:

        - MissionProfile

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cee1ab0ec34f41b7c06fafac8e093cdee65c54be56e7f5427c36dc7a7f0f9556)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Groundstation", jsii.invoke(self, "ifMissionProfileId", [value, operator]))

    @jsii.member(jsii_name="ifSatelliteId")
    def if_satellite_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Groundstation":
        '''(experimental) Filters access by the ID of a satellite.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_SatelliteListItem.html#groundstation-Type-SatelliteListItem-satelliteId

        Applies to resource types:

        - Satellite

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__11e1ab8eb84180e2d6c2bdfdbc1936cce969f0401937ff076bf422c3e6160699)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Groundstation", jsii.invoke(self, "ifSatelliteId", [value, operator]))

    @jsii.member(jsii_name="onAgent")
    def on_agent(
        self,
        agent_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Groundstation":
        '''(experimental) Adds a resource of type Agent to the statement.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_AgentDetails.html

        :param agent_id: - Identifier for the agentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAgentId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7c530ede65e6aa95af353ef4b51af8f7f9306bddf1d519613100d2dcdd4966f5)
            check_type(argname="argument agent_id", value=agent_id, expected_type=type_hints["agent_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Groundstation", jsii.invoke(self, "onAgent", [agent_id, account, region, partition]))

    @jsii.member(jsii_name="onConfig")
    def on_config(
        self,
        config_type: builtins.str,
        config_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Groundstation":
        '''(experimental) Adds a resource of type Config to the statement.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ConfigListItem.html

        :param config_type: - Identifier for the configType.
        :param config_id: - Identifier for the configId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifConfigId() - .ifConfigType()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b29d3115dbe8c8996ed909029daac285ae734f167e39c36c76b72ebfa56895de)
            check_type(argname="argument config_type", value=config_type, expected_type=type_hints["config_type"])
            check_type(argname="argument config_id", value=config_id, expected_type=type_hints["config_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Groundstation", jsii.invoke(self, "onConfig", [config_type, config_id, account, region, partition]))

    @jsii.member(jsii_name="onContact")
    def on_contact(
        self,
        contact_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Groundstation":
        '''(experimental) Adds a resource of type Contact to the statement.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ContactData.html

        :param contact_id: - Identifier for the contactId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifContactId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e17db7256e74fa188798b42b185bf565490fb239deaf7dda4633e71b562e8d00)
            check_type(argname="argument contact_id", value=contact_id, expected_type=type_hints["contact_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Groundstation", jsii.invoke(self, "onContact", [contact_id, account, region, partition]))

    @jsii.member(jsii_name="onDataflowEndpointGroup")
    def on_dataflow_endpoint_group(
        self,
        dataflow_endpoint_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Groundstation":
        '''(experimental) Adds a resource of type DataflowEndpointGroup to the statement.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_DataflowEndpoint.html

        :param dataflow_endpoint_group_id: - Identifier for the dataflowEndpointGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifDataflowEndpointGroupId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__81bb5e13436e1f07d3f30f315d17b17489f60f011c95c7d027d631400d7e7ba1)
            check_type(argname="argument dataflow_endpoint_group_id", value=dataflow_endpoint_group_id, expected_type=type_hints["dataflow_endpoint_group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Groundstation", jsii.invoke(self, "onDataflowEndpointGroup", [dataflow_endpoint_group_id, account, region, partition]))

    @jsii.member(jsii_name="onEphemerisItem")
    def on_ephemeris_item(
        self,
        ephemeris_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Groundstation":
        '''(experimental) Adds a resource of type EphemerisItem to the statement.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_EphemerisItem.html

        :param ephemeris_id: - Identifier for the ephemerisId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifEphemerisId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__00ef39cadf4bb96746742ecfb9cf846e3c253eb4fc5e32b8b095b6c7447c4e89)
            check_type(argname="argument ephemeris_id", value=ephemeris_id, expected_type=type_hints["ephemeris_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Groundstation", jsii.invoke(self, "onEphemerisItem", [ephemeris_id, account, region, partition]))

    @jsii.member(jsii_name="onGroundStationResource")
    def on_ground_station_resource(
        self,
        ground_station_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Groundstation":
        '''(experimental) Adds a resource of type GroundStationResource to the statement.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_GroundStationData.html

        :param ground_station_id: - Identifier for the groundStationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifGroundStationId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d2109e8b06478f979f091c14c7211c0da6783ce9d32332b61402b531a637e282)
            check_type(argname="argument ground_station_id", value=ground_station_id, expected_type=type_hints["ground_station_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Groundstation", jsii.invoke(self, "onGroundStationResource", [ground_station_id, account, region, partition]))

    @jsii.member(jsii_name="onMissionProfile")
    def on_mission_profile(
        self,
        mission_profile_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Groundstation":
        '''(experimental) Adds a resource of type MissionProfile to the statement.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_MissionProfileListItem.html

        :param mission_profile_id: - Identifier for the missionProfileId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifMissionProfileId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7650b761f10d9d4033ad9d0aa995049143383d2a196ecd7173a98343e5f78640)
            check_type(argname="argument mission_profile_id", value=mission_profile_id, expected_type=type_hints["mission_profile_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Groundstation", jsii.invoke(self, "onMissionProfile", [mission_profile_id, account, region, partition]))

    @jsii.member(jsii_name="onSatellite")
    def on_satellite(
        self,
        satellite_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Groundstation":
        '''(experimental) Adds a resource of type Satellite to the statement.

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_SatelliteListItem.html

        :param satellite_id: - Identifier for the satelliteId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifSatelliteId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3fcfd1ec5b954ecac39bfb947a6c4cfff01a3278b1e51a31cff59cfcce640e2a)
            check_type(argname="argument satellite_id", value=satellite_id, expected_type=type_hints["satellite_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Groundstation", jsii.invoke(self, "onSatellite", [satellite_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelContact")
    def to_cancel_contact(self) -> "Groundstation":
        '''(experimental) Grants permission to cancel a contact.

        Access Level: Write

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_CancelContact.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toCancelContact", []))

    @jsii.member(jsii_name="toCreateConfig")
    def to_create_config(self) -> "Groundstation":
        '''(experimental) Grants permission to create a configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_CreateConfig.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toCreateConfig", []))

    @jsii.member(jsii_name="toCreateDataflowEndpointGroup")
    def to_create_dataflow_endpoint_group(self) -> "Groundstation":
        '''(experimental) Grants permission to create a data flow endpoint group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_CreateDataflowEndpointGroup.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toCreateDataflowEndpointGroup", []))

    @jsii.member(jsii_name="toCreateEphemeris")
    def to_create_ephemeris(self) -> "Groundstation":
        '''(experimental) Grants permission to create an ephemeris item.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_CreateEphemeris.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toCreateEphemeris", []))

    @jsii.member(jsii_name="toCreateMissionProfile")
    def to_create_mission_profile(self) -> "Groundstation":
        '''(experimental) Grants permission to create a mission profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_CreateMissionProfile.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toCreateMissionProfile", []))

    @jsii.member(jsii_name="toDeleteConfig")
    def to_delete_config(self) -> "Groundstation":
        '''(experimental) Grants permission to delete a config.

        Access Level: Write

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_DeleteConfig.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toDeleteConfig", []))

    @jsii.member(jsii_name="toDeleteDataflowEndpointGroup")
    def to_delete_dataflow_endpoint_group(self) -> "Groundstation":
        '''(experimental) Grants permission to delete a data flow endpoint group.

        Access Level: Write

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_DeleteDataflowEndpointGroup.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toDeleteDataflowEndpointGroup", []))

    @jsii.member(jsii_name="toDeleteEphemeris")
    def to_delete_ephemeris(self) -> "Groundstation":
        '''(experimental) Grants permission to delete an ephemeris item.

        Access Level: Write

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_DeleteEphemeris.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toDeleteEphemeris", []))

    @jsii.member(jsii_name="toDeleteMissionProfile")
    def to_delete_mission_profile(self) -> "Groundstation":
        '''(experimental) Grants permission to delete a mission profile.

        Access Level: Write

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_DeleteMissionProfile.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toDeleteMissionProfile", []))

    @jsii.member(jsii_name="toDescribeContact")
    def to_describe_contact(self) -> "Groundstation":
        '''(experimental) Grants permission to describe a contact.

        Access Level: Read

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_DescribeContact.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toDescribeContact", []))

    @jsii.member(jsii_name="toDescribeEphemeris")
    def to_describe_ephemeris(self) -> "Groundstation":
        '''(experimental) Grants permission to describe an ephemeris item.

        Access Level: Read

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_DescribeEphemeris.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toDescribeEphemeris", []))

    @jsii.member(jsii_name="toGetAgentConfiguration")
    def to_get_agent_configuration(self) -> "Groundstation":
        '''(experimental) Grants permission to get the configuration of an agent.

        Access Level: Read

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_GetAgentConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toGetAgentConfiguration", []))

    @jsii.member(jsii_name="toGetConfig")
    def to_get_config(self) -> "Groundstation":
        '''(experimental) Grants permission to return a configuration.

        Access Level: Read

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_GetConfig.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toGetConfig", []))

    @jsii.member(jsii_name="toGetDataflowEndpointGroup")
    def to_get_dataflow_endpoint_group(self) -> "Groundstation":
        '''(experimental) Grants permission to return a data flow endpoint group.

        Access Level: Read

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_GetDataflowEndpointGroup.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toGetDataflowEndpointGroup", []))

    @jsii.member(jsii_name="toGetMinuteUsage")
    def to_get_minute_usage(self) -> "Groundstation":
        '''(experimental) Grants permission to return minutes usage.

        Access Level: Read

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_GetMinuteUsage.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toGetMinuteUsage", []))

    @jsii.member(jsii_name="toGetMissionProfile")
    def to_get_mission_profile(self) -> "Groundstation":
        '''(experimental) Grants permission to retrieve a mission profile.

        Access Level: Read

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_GetMissionProfile.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toGetMissionProfile", []))

    @jsii.member(jsii_name="toGetSatellite")
    def to_get_satellite(self) -> "Groundstation":
        '''(experimental) Grants permission to return information about a satellite.

        Access Level: Read

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_GetSatellite.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toGetSatellite", []))

    @jsii.member(jsii_name="toListConfigs")
    def to_list_configs(self) -> "Groundstation":
        '''(experimental) Grants permission to return a list of past configurations.

        Access Level: List

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ListConfigs.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toListConfigs", []))

    @jsii.member(jsii_name="toListContacts")
    def to_list_contacts(self) -> "Groundstation":
        '''(experimental) Grants permission to return a list of contacts.

        Access Level: List

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ListContacts.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toListContacts", []))

    @jsii.member(jsii_name="toListDataflowEndpointGroups")
    def to_list_dataflow_endpoint_groups(self) -> "Groundstation":
        '''(experimental) Grants permission to list data flow endpoint groups.

        Access Level: List

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ListDataflowEndpointGroups.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toListDataflowEndpointGroups", []))

    @jsii.member(jsii_name="toListEphemerides")
    def to_list_ephemerides(self) -> "Groundstation":
        '''(experimental) Grants permission to list ephemerides.

        Access Level: List

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ListEphemerides.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toListEphemerides", []))

    @jsii.member(jsii_name="toListGroundStations")
    def to_list_ground_stations(self) -> "Groundstation":
        '''(experimental) Grants permission to list ground stations.

        Access Level: List

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ListGroundStations.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toListGroundStations", []))

    @jsii.member(jsii_name="toListMissionProfiles")
    def to_list_mission_profiles(self) -> "Groundstation":
        '''(experimental) Grants permission to return a list of mission profiles.

        Access Level: List

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ListMissionProfiles.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toListMissionProfiles", []))

    @jsii.member(jsii_name="toListSatellites")
    def to_list_satellites(self) -> "Groundstation":
        '''(experimental) Grants permission to list satellites.

        Access Level: List

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ListSatellites.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toListSatellites", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Groundstation":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRegisterAgent")
    def to_register_agent(self) -> "Groundstation":
        '''(experimental) Grants permission to register an agent.

        Access Level: Write

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_RegisterAgent.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toRegisterAgent", []))

    @jsii.member(jsii_name="toReserveContact")
    def to_reserve_contact(self) -> "Groundstation":
        '''(experimental) Grants permission to reserve a contact.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_ReserveContact.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toReserveContact", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Groundstation":
        '''(experimental) Grants permission to assign a resource tag.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Groundstation":
        '''(experimental) Grants permission to deassign a resource tag.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAgentStatus")
    def to_update_agent_status(self) -> "Groundstation":
        '''(experimental) Grants permission to update the status of an agent.

        Access Level: Write

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_UpdateAgentStatus.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toUpdateAgentStatus", []))

    @jsii.member(jsii_name="toUpdateConfig")
    def to_update_config(self) -> "Groundstation":
        '''(experimental) Grants permission to update a configuration.

        Access Level: Write

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_UpdateConfig.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toUpdateConfig", []))

    @jsii.member(jsii_name="toUpdateEphemeris")
    def to_update_ephemeris(self) -> "Groundstation":
        '''(experimental) Grants permission to update an ephemeris item.

        Access Level: Write

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_UpdateEphemeris.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toUpdateEphemeris", []))

    @jsii.member(jsii_name="toUpdateMissionProfile")
    def to_update_mission_profile(self) -> "Groundstation":
        '''(experimental) Grants permission to update a mission profile.

        Access Level: Write

        https://docs.aws.amazon.com/ground-station/latest/APIReference/API_UpdateMissionProfile.html

        :stability: experimental
        '''
        return typing.cast("Groundstation", jsii.invoke(self, "toUpdateMissionProfile", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ea994e4aa58ac686c88100392f855b2c2ef38c34fcfebd74f78e3e82c02ad7ca)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c19392ce02fef0fce44708a48a5433184fc95b68a215ec8eaba13f5af2348d80)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Groundtruthlabeling(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Groundtruthlabeling",
):
    '''(experimental) Statement provider for service `groundtruthlabeling <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazongroundtruthlabeling.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `groundtruthlabeling <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazongroundtruthlabeling.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4d145ac119c5b2a07ebbe91af5a1676afc02e141d3311456fd144ae4b6e5059a)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toAssociatePatchToManifestJob")
    def to_associate_patch_to_manifest_job(self) -> "Groundtruthlabeling":
        '''(experimental) Grants permission to associate a patch file with the manifest file to update the manifest file.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/sms-data-input.html#sms-console-create-manifest-file

        :stability: experimental
        '''
        return typing.cast("Groundtruthlabeling", jsii.invoke(self, "toAssociatePatchToManifestJob", []))

    @jsii.member(jsii_name="toDescribeConsoleJob")
    def to_describe_console_job(self) -> "Groundtruthlabeling":
        '''(experimental) Grants permission to get status of GroundTruthLabeling Jobs.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/sms-data-input.html#sms-console-create-manifest-file

        :stability: experimental
        '''
        return typing.cast("Groundtruthlabeling", jsii.invoke(self, "toDescribeConsoleJob", []))

    @jsii.member(jsii_name="toListDatasetObjects")
    def to_list_dataset_objects(self) -> "Groundtruthlabeling":
        '''(experimental) Grants permission to list dataset objects in a manifest file.

        Access Level: Read

        https://docs.aws.amazon.com/sagemaker/latest/dg/sms-data-input.html#sms-console-create-manifest-file

        :stability: experimental
        '''
        return typing.cast("Groundtruthlabeling", jsii.invoke(self, "toListDatasetObjects", []))

    @jsii.member(jsii_name="toRunFilterOrSampleDatasetJob")
    def to_run_filter_or_sample_dataset_job(self) -> "Groundtruthlabeling":
        '''(experimental) Grants permission to filter records from a manifest file using S3 select. Get sample entries based on random sampling.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/sms-data-input.html#sms-data-filtering

        :stability: experimental
        '''
        return typing.cast("Groundtruthlabeling", jsii.invoke(self, "toRunFilterOrSampleDatasetJob", []))

    @jsii.member(jsii_name="toRunGenerateManifestByCrawlingJob")
    def to_run_generate_manifest_by_crawling_job(self) -> "Groundtruthlabeling":
        '''(experimental) Grants permission to list a S3 prefix and create manifest files from objects in that location.

        Access Level: Write

        https://docs.aws.amazon.com/sagemaker/latest/dg/sms-data-input.html#sms-console-create-manifest-file

        :stability: experimental
        '''
        return typing.cast("Groundtruthlabeling", jsii.invoke(self, "toRunGenerateManifestByCrawlingJob", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1dd6e9c92f39679756138438005e10dabb14c359248b28657ab226a55e890661)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__987c306e8ab0326257771a524a8ef333dbd527b0ef450c9e02ac7fa63d511c2d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Guardduty(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Guardduty",
):
    '''(experimental) Statement provider for service `guardduty <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonguardduty.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `guardduty <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonguardduty.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fe664e298887fee32d3831e7ef685dd95b6986624f37cd79497913c2534289e7)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDetector")
    def on_detector(
        self,
        detector_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Guardduty":
        '''(experimental) Adds a resource of type detector to the statement.

        https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_managing_access.html#guardduty-resources

        :param detector_id: - Identifier for the detectorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__57c393a06e7add75f03513e39177a006ed3052f9c805ef2365f471c110b5212d)
            check_type(argname="argument detector_id", value=detector_id, expected_type=type_hints["detector_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Guardduty", jsii.invoke(self, "onDetector", [detector_id, account, region, partition]))

    @jsii.member(jsii_name="onFilter")
    def on_filter(
        self,
        detector_id: builtins.str,
        filter_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Guardduty":
        '''(experimental) Adds a resource of type filter to the statement.

        https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_managing_access.html#guardduty-resources

        :param detector_id: - Identifier for the detectorId.
        :param filter_name: - Identifier for the filterName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f3d2eba21ee4f4a425f4aee0eb40fffde07f29f06b2488601d58455583eac804)
            check_type(argname="argument detector_id", value=detector_id, expected_type=type_hints["detector_id"])
            check_type(argname="argument filter_name", value=filter_name, expected_type=type_hints["filter_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Guardduty", jsii.invoke(self, "onFilter", [detector_id, filter_name, account, region, partition]))

    @jsii.member(jsii_name="onIpset")
    def on_ipset(
        self,
        detector_id: builtins.str,
        i_p_set_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Guardduty":
        '''(experimental) Adds a resource of type ipset to the statement.

        https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_managing_access.html#guardduty-resources

        :param detector_id: - Identifier for the detectorId.
        :param i_p_set_id: - Identifier for the iPSetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__459a3f05554b0c1b94550ba9521f0a8d9ea90aa7b62221832dbd90aa432691b8)
            check_type(argname="argument detector_id", value=detector_id, expected_type=type_hints["detector_id"])
            check_type(argname="argument i_p_set_id", value=i_p_set_id, expected_type=type_hints["i_p_set_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Guardduty", jsii.invoke(self, "onIpset", [detector_id, i_p_set_id, account, region, partition]))

    @jsii.member(jsii_name="onPublishingDestination")
    def on_publishing_destination(
        self,
        detector_id: builtins.str,
        publishing_destination_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Guardduty":
        '''(experimental) Adds a resource of type publishingDestination to the statement.

        https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_managing_access.html#guardduty-resources

        :param detector_id: - Identifier for the detectorId.
        :param publishing_destination_id: - Identifier for the publishingDestinationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__83a1b9b8ec4a95219f8dd6aed2079c0d88d30d1386c197aa702b641fbd3598ff)
            check_type(argname="argument detector_id", value=detector_id, expected_type=type_hints["detector_id"])
            check_type(argname="argument publishing_destination_id", value=publishing_destination_id, expected_type=type_hints["publishing_destination_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Guardduty", jsii.invoke(self, "onPublishingDestination", [detector_id, publishing_destination_id, account, region, partition]))

    @jsii.member(jsii_name="onThreatintelset")
    def on_threatintelset(
        self,
        detector_id: builtins.str,
        threat_intel_set_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Guardduty":
        '''(experimental) Adds a resource of type threatintelset to the statement.

        https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_managing_access.html#guardduty-resources

        :param detector_id: - Identifier for the detectorId.
        :param threat_intel_set_id: - Identifier for the threatIntelSetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__817abc2b0cc93ab0472c15835483e2706cc14d34ca4862f53c45d9d770b129d7)
            check_type(argname="argument detector_id", value=detector_id, expected_type=type_hints["detector_id"])
            check_type(argname="argument threat_intel_set_id", value=threat_intel_set_id, expected_type=type_hints["threat_intel_set_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Guardduty", jsii.invoke(self, "onThreatintelset", [detector_id, threat_intel_set_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptAdministratorInvitation")
    def to_accept_administrator_invitation(self) -> "Guardduty":
        '''(experimental) Grants permission to accept invitations to become a GuardDuty member account.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_AcceptAdministratorInvitation.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toAcceptAdministratorInvitation", []))

    @jsii.member(jsii_name="toAcceptInvitation")
    def to_accept_invitation(self) -> "Guardduty":
        '''(experimental) Grants permission to accept invitations to become a GuardDuty member account.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_AcceptInvitation.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toAcceptInvitation", []))

    @jsii.member(jsii_name="toArchiveFindings")
    def to_archive_findings(self) -> "Guardduty":
        '''(experimental) Grants permission to archive GuardDuty findings.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ArchiveFindings.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toArchiveFindings", []))

    @jsii.member(jsii_name="toCreateDetector")
    def to_create_detector(self) -> "Guardduty":
        '''(experimental) Grants permission to create a detector.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateDetector.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toCreateDetector", []))

    @jsii.member(jsii_name="toCreateFilter")
    def to_create_filter(self) -> "Guardduty":
        '''(experimental) Grants permission to create GuardDuty filters. A filters defines finding attributes and conditions used to filter findings.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateFilter.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toCreateFilter", []))

    @jsii.member(jsii_name="toCreateIPSet")
    def to_create_ip_set(self) -> "Guardduty":
        '''(experimental) Grants permission to create an IPSet.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:DeleteRolePolicy
        - iam:PutRolePolicy

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateIPSet.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toCreateIPSet", []))

    @jsii.member(jsii_name="toCreateMembers")
    def to_create_members(self) -> "Guardduty":
        '''(experimental) Grants permission to create GuardDuty member accounts, where the account used to create a member becomes the GuardDuty administrator account.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateMembers.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toCreateMembers", []))

    @jsii.member(jsii_name="toCreatePublishingDestination")
    def to_create_publishing_destination(self) -> "Guardduty":
        '''(experimental) Grants permission to create a publishing destination.

        Access Level: Write

        Dependent actions:

        - s3:GetObject
        - s3:ListBucket

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreatePublishingDestination.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toCreatePublishingDestination", []))

    @jsii.member(jsii_name="toCreateSampleFindings")
    def to_create_sample_findings(self) -> "Guardduty":
        '''(experimental) Grants permission to create sample findings.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateSampleFindings.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toCreateSampleFindings", []))

    @jsii.member(jsii_name="toCreateThreatIntelSet")
    def to_create_threat_intel_set(self) -> "Guardduty":
        '''(experimental) Grants permission to create GuardDuty ThreatIntelSets, where a ThreatIntelSet consists of known malicious IP addresses used by GuardDuty to generate findings.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_CreateThreatIntelSet.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toCreateThreatIntelSet", []))

    @jsii.member(jsii_name="toDeclineInvitations")
    def to_decline_invitations(self) -> "Guardduty":
        '''(experimental) Grants permission to decline invitations to become a GuardDuty member account.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeclineInvitations.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDeclineInvitations", []))

    @jsii.member(jsii_name="toDeleteDetector")
    def to_delete_detector(self) -> "Guardduty":
        '''(experimental) Grants permission to delete GuardDuty detectors.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteDetector.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDeleteDetector", []))

    @jsii.member(jsii_name="toDeleteFilter")
    def to_delete_filter(self) -> "Guardduty":
        '''(experimental) Grants permission to delete GuardDuty filters.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteFilter.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDeleteFilter", []))

    @jsii.member(jsii_name="toDeleteInvitations")
    def to_delete_invitations(self) -> "Guardduty":
        '''(experimental) Grants permission to delete invitations to become a GuardDuty member account.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteInvitations.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDeleteInvitations", []))

    @jsii.member(jsii_name="toDeleteIPSet")
    def to_delete_ip_set(self) -> "Guardduty":
        '''(experimental) Grants permission to delete GuardDuty IPSets.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteIPSet.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDeleteIPSet", []))

    @jsii.member(jsii_name="toDeleteMembers")
    def to_delete_members(self) -> "Guardduty":
        '''(experimental) Grants permission to delete GuardDuty member accounts.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteMembers.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDeleteMembers", []))

    @jsii.member(jsii_name="toDeletePublishingDestination")
    def to_delete_publishing_destination(self) -> "Guardduty":
        '''(experimental) Grants permission to delete a publishing destination.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeletePublishingDestination.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDeletePublishingDestination", []))

    @jsii.member(jsii_name="toDeleteThreatIntelSet")
    def to_delete_threat_intel_set(self) -> "Guardduty":
        '''(experimental) Grants permission to delete GuardDuty ThreatIntelSets.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteThreatIntelSet.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDeleteThreatIntelSet", []))

    @jsii.member(jsii_name="toDescribeMalwareScans")
    def to_describe_malware_scans(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve details about malware scans.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DescribeMalwareScans.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDescribeMalwareScans", []))

    @jsii.member(jsii_name="toDescribeOrganizationConfiguration")
    def to_describe_organization_configuration(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve details about the delegated administrator associated with a GuardDuty detector.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DescribeOrganizationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDescribeOrganizationConfiguration", []))

    @jsii.member(jsii_name="toDescribePublishingDestination")
    def to_describe_publishing_destination(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve details about a publishing destination.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DescribePublishingDestination.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDescribePublishingDestination", []))

    @jsii.member(jsii_name="toDisableOrganizationAdminAccount")
    def to_disable_organization_admin_account(self) -> "Guardduty":
        '''(experimental) Grants permission to disable the organization delegated administrator for GuardDuty.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DisableOrganizationAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDisableOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toDisassociateFromAdministratorAccount")
    def to_disassociate_from_administrator_account(self) -> "Guardduty":
        '''(experimental) Grants permission to disassociate a GuardDuty member account from its GuardDuty administrator account.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DisassociateFromAdministratorAccount.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDisassociateFromAdministratorAccount", []))

    @jsii.member(jsii_name="toDisassociateFromMasterAccount")
    def to_disassociate_from_master_account(self) -> "Guardduty":
        '''(experimental) Grants permission to disassociate a GuardDuty member account from its GuardDuty administrator account.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DisassociateFromMasterAccount.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDisassociateFromMasterAccount", []))

    @jsii.member(jsii_name="toDisassociateMembers")
    def to_disassociate_members(self) -> "Guardduty":
        '''(experimental) Grants permission to disassociate GuardDuty member accounts from their administrator GuardDuty account.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DisassociateMembers.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toDisassociateMembers", []))

    @jsii.member(jsii_name="toEnableOrganizationAdminAccount")
    def to_enable_organization_admin_account(self) -> "Guardduty":
        '''(experimental) Grants permission to enable an organization delegated administrator for GuardDuty.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_EnableOrganizationAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toEnableOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toGetAdministratorAccount")
    def to_get_administrator_account(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve details of the GuardDuty administrator account associated with a member account.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetAdministratorAccount.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetAdministratorAccount", []))

    @jsii.member(jsii_name="toGetDetector")
    def to_get_detector(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve GuardDuty detectors.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetDetector.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetDetector", []))

    @jsii.member(jsii_name="toGetFilter")
    def to_get_filter(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve GuardDuty filters.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetFilter.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetFilter", []))

    @jsii.member(jsii_name="toGetFindings")
    def to_get_findings(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve GuardDuty findings.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetFindings.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetFindings", []))

    @jsii.member(jsii_name="toGetFindingsStatistics")
    def to_get_findings_statistics(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve a list of GuardDuty finding statistics.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetFindingsStatistics.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetFindingsStatistics", []))

    @jsii.member(jsii_name="toGetInvitationsCount")
    def to_get_invitations_count(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve the count of all GuardDuty invitations sent to a specified account, which does not include the accepted invitation.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetInvitationsCount.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetInvitationsCount", []))

    @jsii.member(jsii_name="toGetIPSet")
    def to_get_ip_set(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve GuardDuty IPSets.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetIPSet.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetIPSet", []))

    @jsii.member(jsii_name="toGetMalwareScanSettings")
    def to_get_malware_scan_settings(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve the malware scan settings.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetMalwareScanSettings.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetMalwareScanSettings", []))

    @jsii.member(jsii_name="toGetMasterAccount")
    def to_get_master_account(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve details of the GuardDuty administrator account associated with a member account.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetMasterAccount.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetMasterAccount", []))

    @jsii.member(jsii_name="toGetMemberDetectors")
    def to_get_member_detectors(self) -> "Guardduty":
        '''(experimental) Grants permission to describe which data sources are enabled for member accounts detectors.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetMemberDetectors.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetMemberDetectors", []))

    @jsii.member(jsii_name="toGetMembers")
    def to_get_members(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve the member accounts associated with an administrator account.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetMembers.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetMembers", []))

    @jsii.member(jsii_name="toGetRemainingFreeTrialDays")
    def to_get_remaining_free_trial_days(self) -> "Guardduty":
        '''(experimental) Grants permission to provide the number of days left for each data source used in the free trial period.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetRemainingFreeTrialDays.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetRemainingFreeTrialDays", []))

    @jsii.member(jsii_name="toGetThreatIntelSet")
    def to_get_threat_intel_set(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve GuardDuty ThreatIntelSets.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetThreatIntelSet.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetThreatIntelSet", []))

    @jsii.member(jsii_name="toGetUsageStatistics")
    def to_get_usage_statistics(self) -> "Guardduty":
        '''(experimental) Grants permission to list Amazon GuardDuty usage statistics over the last 30 days for the specified detector ID.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_GetUsageStatistics.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toGetUsageStatistics", []))

    @jsii.member(jsii_name="toInviteMembers")
    def to_invite_members(self) -> "Guardduty":
        '''(experimental) Grants permission to invite other AWS accounts to enable GuardDuty and become GuardDuty member accounts.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_InviteMembers.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toInviteMembers", []))

    @jsii.member(jsii_name="toListDetectors")
    def to_list_detectors(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve a list of GuardDuty detectors.

        Access Level: List

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListDetectors.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toListDetectors", []))

    @jsii.member(jsii_name="toListFilters")
    def to_list_filters(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve a list of GuardDuty filters.

        Access Level: List

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListFilters.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toListFilters", []))

    @jsii.member(jsii_name="toListFindings")
    def to_list_findings(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve a list of GuardDuty findings.

        Access Level: List

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListFindings.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toListFindings", []))

    @jsii.member(jsii_name="toListInvitations")
    def to_list_invitations(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve a list of all of the GuardDuty membership invitations that were sent to an AWS account.

        Access Level: List

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListInvitations.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toListInvitations", []))

    @jsii.member(jsii_name="toListIPSets")
    def to_list_ip_sets(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve a list of GuardDuty IPSets.

        Access Level: List

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListIPSets.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toListIPSets", []))

    @jsii.member(jsii_name="toListMembers")
    def to_list_members(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve a list of GuardDuty member accounts associated with an administrator account.

        Access Level: List

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListMembers.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toListMembers", []))

    @jsii.member(jsii_name="toListOrganizationAdminAccounts")
    def to_list_organization_admin_accounts(self) -> "Guardduty":
        '''(experimental) Grants permission to list details about the organization delegated administrator for GuardDuty.

        Access Level: List

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListOrganizationAdminAccounts.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toListOrganizationAdminAccounts", []))

    @jsii.member(jsii_name="toListPublishingDestinations")
    def to_list_publishing_destinations(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve a list of publishing destinations.

        Access Level: List

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListPublishingDestinations.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toListPublishingDestinations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve a list of tags associated with a GuardDuty resource.

        Access Level: Read

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListThreatIntelSets")
    def to_list_threat_intel_sets(self) -> "Guardduty":
        '''(experimental) Grants permission to retrieve a list of GuardDuty ThreatIntelSets.

        Access Level: List

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_ListThreatIntelSets.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toListThreatIntelSets", []))

    @jsii.member(jsii_name="toStartMonitoringMembers")
    def to_start_monitoring_members(self) -> "Guardduty":
        '''(experimental) Grants permission to a GuardDuty administrator account to monitor findings from GuardDuty member accounts.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_StartMonitoringMembers.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toStartMonitoringMembers", []))

    @jsii.member(jsii_name="toStopMonitoringMembers")
    def to_stop_monitoring_members(self) -> "Guardduty":
        '''(experimental) Grants permission to disable monitoring findings from member accounts.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_StopMonitoringMembers.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toStopMonitoringMembers", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Guardduty":
        '''(experimental) Grants permission to add tags to a GuardDuty resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUnarchiveFindings")
    def to_unarchive_findings(self) -> "Guardduty":
        '''(experimental) Grants permission to unarchive GuardDuty findings.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UnarchiveFindings.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toUnarchiveFindings", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Guardduty":
        '''(experimental) Grants permission to remove tags from a GuardDuty resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDetector")
    def to_update_detector(self) -> "Guardduty":
        '''(experimental) Grants permission to update GuardDuty detectors.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toUpdateDetector", []))

    @jsii.member(jsii_name="toUpdateFilter")
    def to_update_filter(self) -> "Guardduty":
        '''(experimental) Grants permission to updates GuardDuty filters.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateFilter.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toUpdateFilter", []))

    @jsii.member(jsii_name="toUpdateFindingsFeedback")
    def to_update_findings_feedback(self) -> "Guardduty":
        '''(experimental) Grants permission to update findings feedback to mark GuardDuty findings as useful or not useful.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateFindingsFeedback.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toUpdateFindingsFeedback", []))

    @jsii.member(jsii_name="toUpdateIPSet")
    def to_update_ip_set(self) -> "Guardduty":
        '''(experimental) Grants permission to update GuardDuty IPSets.

        Access Level: Write

        Dependent actions:

        - iam:DeleteRolePolicy
        - iam:PutRolePolicy

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateIPSet.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toUpdateIPSet", []))

    @jsii.member(jsii_name="toUpdateMalwareScanSettings")
    def to_update_malware_scan_settings(self) -> "Guardduty":
        '''(experimental) Grants permission to update the malware scan settings.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateMalwareScanSettings.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toUpdateMalwareScanSettings", []))

    @jsii.member(jsii_name="toUpdateMemberDetectors")
    def to_update_member_detectors(self) -> "Guardduty":
        '''(experimental) Grants permission to update which data sources are enabled for member accounts detectors.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateMemberDetectors.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toUpdateMemberDetectors", []))

    @jsii.member(jsii_name="toUpdateOrganizationConfiguration")
    def to_update_organization_configuration(self) -> "Guardduty":
        '''(experimental) Grants permission to update the delegated administrator configuration associated with a GuardDuty detector.

        Access Level: Write

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateOrganizationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toUpdateOrganizationConfiguration", []))

    @jsii.member(jsii_name="toUpdatePublishingDestination")
    def to_update_publishing_destination(self) -> "Guardduty":
        '''(experimental) Grants permission to update a publishing destination.

        Access Level: Write

        Dependent actions:

        - s3:GetObject
        - s3:ListBucket

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdatePublishingDestination.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toUpdatePublishingDestination", []))

    @jsii.member(jsii_name="toUpdateThreatIntelSet")
    def to_update_threat_intel_set(self) -> "Guardduty":
        '''(experimental) Grants permission to updates the GuardDuty ThreatIntelSets.

        Access Level: Write

        Dependent actions:

        - iam:DeleteRolePolicy
        - iam:PutRolePolicy

        https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateThreatIntelSet.html

        :stability: experimental
        '''
        return typing.cast("Guardduty", jsii.invoke(self, "toUpdateThreatIntelSet", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ebf67f5cb3e70917733c7fa91dcf18722b758caae20e2021569d8975a5e48e48)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__39c66728220278c9189dfff92e762f8bb564e35559af219df7e14c10d0aa8526)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Health(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Health"):
    '''(experimental) Statement provider for service `health <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awshealthapisandnotifications.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `health <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awshealthapisandnotifications.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b9629f18e576753c9ea8203e1c47ee1d21c6fc38d935cd78c80c3637e22779a9)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifEventTypeCode")
    def if_event_type_code(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Health":
        '''(experimental) Filters access by event type.

        https://docs.aws.amazon.com/health/latest/ug/controlling-access.html

        Applies to actions:

        - .toDescribeAffectedEntities()
        - .toDescribeEventDetails()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__278b44ddd5ef37c30b76a1b1b56157bdf8efa48b4c8b42d4e6ea7f312dc4e458)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Health", jsii.invoke(self, "ifEventTypeCode", [value, operator]))

    @jsii.member(jsii_name="ifService")
    def if_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Health":
        '''(experimental) Filters access by impacted service.

        https://docs.aws.amazon.com/health/latest/ug/controlling-access.html

        Applies to actions:

        - .toDescribeAffectedEntities()
        - .toDescribeEventDetails()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2c70782d268b9d4549a0d11a3e0606e4acfebfa5866747f3f5eb5665c1ad0226)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Health", jsii.invoke(self, "ifService", [value, operator]))

    @jsii.member(jsii_name="onEvent")
    def on_event(
        self,
        service: builtins.str,
        event_type_code: builtins.str,
        event_type_plus_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Health":
        '''(experimental) Adds a resource of type event to the statement.

        https://docs.aws.amazon.com/health/latest/ug/supported-operations.html

        :param service: - Identifier for the service.
        :param event_type_code: - Identifier for the eventTypeCode.
        :param event_type_plus_id: - Identifier for the eventTypePlusId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__adfade95816eff360c0da85c16cf6dc5d8eeb8d8f31f61be5c523fbaf7547cb9)
            check_type(argname="argument service", value=service, expected_type=type_hints["service"])
            check_type(argname="argument event_type_code", value=event_type_code, expected_type=type_hints["event_type_code"])
            check_type(argname="argument event_type_plus_id", value=event_type_plus_id, expected_type=type_hints["event_type_plus_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Health", jsii.invoke(self, "onEvent", [service, event_type_code, event_type_plus_id, account, region, partition]))

    @jsii.member(jsii_name="toDescribeAffectedAccountsForOrganization")
    def to_describe_affected_accounts_for_organization(self) -> "Health":
        '''(experimental) Grants permission to retrieve a list of accounts that have been affected by the specified events in organization.

        Access Level: Read

        Dependent actions:

        - organizations:ListAccounts

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeAffectedAccountsForOrganization.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeAffectedAccountsForOrganization", []))

    @jsii.member(jsii_name="toDescribeAffectedEntities")
    def to_describe_affected_entities(self) -> "Health":
        '''(experimental) Grants permission to retrieve a list of entities that have been affected by the specified events.

        Access Level: Read

        Possible conditions:

        - .ifEventTypeCode()
        - .ifService()

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeAffectedEntities.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeAffectedEntities", []))

    @jsii.member(jsii_name="toDescribeAffectedEntitiesForOrganization")
    def to_describe_affected_entities_for_organization(self) -> "Health":
        '''(experimental) Grants permission to retrieve a list of entities that have been affected by the specified events and accounts in organization.

        Access Level: Read

        Dependent actions:

        - organizations:ListAccounts

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeAffectedEntitiesForOrganization.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeAffectedEntitiesForOrganization", []))

    @jsii.member(jsii_name="toDescribeEntityAggregates")
    def to_describe_entity_aggregates(self) -> "Health":
        '''(experimental) Grants permission to retrieve the number of entities that are affected by each of the specified events.

        Access Level: Read

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEntityAggregates.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeEntityAggregates", []))

    @jsii.member(jsii_name="toDescribeEventAggregates")
    def to_describe_event_aggregates(self) -> "Health":
        '''(experimental) Grants permission to retrieve the number of events of each event type (issue, scheduled change, and account notification).

        Access Level: Read

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEventAggregates.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeEventAggregates", []))

    @jsii.member(jsii_name="toDescribeEventDetails")
    def to_describe_event_details(self) -> "Health":
        '''(experimental) Grants permission to retrieve detailed information about one or more specified events.

        Access Level: Read

        Possible conditions:

        - .ifEventTypeCode()
        - .ifService()

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEventDetails.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeEventDetails", []))

    @jsii.member(jsii_name="toDescribeEventDetailsForOrganization")
    def to_describe_event_details_for_organization(self) -> "Health":
        '''(experimental) Grants permission to retrieve detailed information about one or more specified events for provided accounts in organization.

        Access Level: Read

        Dependent actions:

        - organizations:ListAccounts

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEventDetailsForOrganization.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeEventDetailsForOrganization", []))

    @jsii.member(jsii_name="toDescribeEvents")
    def to_describe_events(self) -> "Health":
        '''(experimental) Grants permission to retrieve information about events that meet the specified filter criteria.

        Access Level: Read

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEvents.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeEvents", []))

    @jsii.member(jsii_name="toDescribeEventsForOrganization")
    def to_describe_events_for_organization(self) -> "Health":
        '''(experimental) Grants permission to retrieve information about events that meet the specified filter criteria in organization.

        Access Level: Read

        Dependent actions:

        - organizations:ListAccounts

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEventsForOrganization.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeEventsForOrganization", []))

    @jsii.member(jsii_name="toDescribeEventTypes")
    def to_describe_event_types(self) -> "Health":
        '''(experimental) Grants permission to retrieve the event types that meet the specified filter criteria.

        Access Level: Read

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEventTypes.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeEventTypes", []))

    @jsii.member(jsii_name="toDescribeHealthServiceStatusForOrganization")
    def to_describe_health_service_status_for_organization(self) -> "Health":
        '''(experimental) Grants permission to retrieve the status of enabling or disabling the Organizational View feature.

        Access Level: Read

        Dependent actions:

        - organizations:ListAccounts

        https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeHealthServiceStatusForOrganization.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDescribeHealthServiceStatusForOrganization", []))

    @jsii.member(jsii_name="toDisableHealthServiceAccessForOrganization")
    def to_disable_health_service_access_for_organization(self) -> "Health":
        '''(experimental) Grants permission to disable the Organizational View feature.

        Access Level: Permissions management

        Dependent actions:

        - organizations:DisableAWSServiceAccess
        - organizations:ListAccounts

        https://docs.aws.amazon.com/health/latest/APIReference/API_DisableHealthServiceAccessForOrganization.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toDisableHealthServiceAccessForOrganization", []))

    @jsii.member(jsii_name="toEnableHealthServiceAccessForOrganization")
    def to_enable_health_service_access_for_organization(self) -> "Health":
        '''(experimental) Grants permission to enable the Organizational View feature.

        Access Level: Permissions management

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - organizations:EnableAWSServiceAccess
        - organizations:ListAccounts

        https://docs.aws.amazon.com/health/latest/APIReference/API_EnableHealthServiceAccessForOrganization.html

        :stability: experimental
        '''
        return typing.cast("Health", jsii.invoke(self, "toEnableHealthServiceAccessForOrganization", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4905bedb4a7b89851626f8a84400a49b66c03fa78e80fe2bf926223dfd340671)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__30f823783f10d553fc7f72018d2c5b6b4f03ed7f92c8639b1e05d40bcf684b75)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Healthlake(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Healthlake",
):
    '''(experimental) Statement provider for service `healthlake <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonhealthlake.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `healthlake <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonhealthlake.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d27f22f4fce3fecb9dcb0a3996a09de4a3a04c5d73d9a66ab85ee5d48d2348ad)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDatastore")
    def on_datastore(
        self,
        datastore_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Healthlake":
        '''(experimental) Adds a resource of type datastore to the statement.

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_DatastoreProperties.html

        :param datastore_id: - Identifier for the datastoreId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ffabeee9a84e42a9aac0aebf9ec946bab97b9f1d9561981b79dd334fb42b8a34)
            check_type(argname="argument datastore_id", value=datastore_id, expected_type=type_hints["datastore_id"])
            check_type(argname="argument account_id", value=account_id, expected_type=type_hints["account_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Healthlake", jsii.invoke(self, "onDatastore", [datastore_id, account_id, region, partition]))

    @jsii.member(jsii_name="toCreateFHIRDatastore")
    def to_create_fhir_datastore(self) -> "Healthlake":
        '''(experimental) Grants permission to create a datastore that can ingest and export FHIR data.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_CreateFHIRDatastore.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toCreateFHIRDatastore", []))

    @jsii.member(jsii_name="toCreateResource")
    def to_create_resource(self) -> "Healthlake":
        '''(experimental) Grants permission to create resource.

        Access Level: Write

        https://docs.aws.amazon.com/healthlake/latest/devguide/crud-healthlake.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toCreateResource", []))

    @jsii.member(jsii_name="toDeleteFHIRDatastore")
    def to_delete_fhir_datastore(self) -> "Healthlake":
        '''(experimental) Grants permission to delete a datastore.

        Access Level: Write

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_DeleteFHIRDatastore.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toDeleteFHIRDatastore", []))

    @jsii.member(jsii_name="toDeleteResource")
    def to_delete_resource(self) -> "Healthlake":
        '''(experimental) Grants permission to delete resource.

        Access Level: Write

        https://docs.aws.amazon.com/healthlake/latest/devguide/crud-healthlake.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toDeleteResource", []))

    @jsii.member(jsii_name="toDescribeFHIRDatastore")
    def to_describe_fhir_datastore(self) -> "Healthlake":
        '''(experimental) Grants permission to get the properties associated with the FHIR datastore, including the datastore ID, datastore ARN, datastore name, datastore status, created at, datastore type version, and datastore endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_DescribeFHIRDatastore.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toDescribeFHIRDatastore", []))

    @jsii.member(jsii_name="toDescribeFHIRExportJob")
    def to_describe_fhir_export_job(self) -> "Healthlake":
        '''(experimental) Grants permission to display the properties of a FHIR export job, including the ID, ARN, name, and the status of the datastore.

        Access Level: Read

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_DescribeFHIRExportJob.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toDescribeFHIRExportJob", []))

    @jsii.member(jsii_name="toDescribeFHIRImportJob")
    def to_describe_fhir_import_job(self) -> "Healthlake":
        '''(experimental) Grants permission to display the properties of a FHIR import job, including the ID, ARN, name, and the status of the datastore.

        Access Level: Read

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_DescribeFHIRImportJob.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toDescribeFHIRImportJob", []))

    @jsii.member(jsii_name="toGetCapabilities")
    def to_get_capabilities(self) -> "Healthlake":
        '''(experimental) Grants permission to get the capabilities of a FHIR datastore.

        Access Level: Read

        https://docs.aws.amazon.com/healthlake/latest/devguide/crud-healthlake.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toGetCapabilities", []))

    @jsii.member(jsii_name="toListFHIRDatastores")
    def to_list_fhir_datastores(self) -> "Healthlake":
        '''(experimental) Grants permission to list all FHIR datastores that are in the user’s account, regardless of datastore status.

        Access Level: List

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_ListFHIRDatastores.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toListFHIRDatastores", []))

    @jsii.member(jsii_name="toListFHIRExportJobs")
    def to_list_fhir_export_jobs(self) -> "Healthlake":
        '''(experimental) Grants permission to get a list of export jobs for the specified datastore.

        Access Level: List

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_ListFHIRExportJobs.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toListFHIRExportJobs", []))

    @jsii.member(jsii_name="toListFHIRImportJobs")
    def to_list_fhir_import_jobs(self) -> "Healthlake":
        '''(experimental) Grants permission to get a list of import jobs for the specified datastore.

        Access Level: List

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_ListFHIRImportJobs.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toListFHIRImportJobs", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Healthlake":
        '''(experimental) Grants permission to get a list of tags for the specified datastore.

        Access Level: Read

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toReadResource")
    def to_read_resource(self) -> "Healthlake":
        '''(experimental) Grants permission to read resource.

        Access Level: Read

        https://docs.aws.amazon.com/healthlake/latest/devguide/crud-healthlake.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toReadResource", []))

    @jsii.member(jsii_name="toSearchWithGet")
    def to_search_with_get(self) -> "Healthlake":
        '''(experimental) Grants permission to search resources with GET method.

        Access Level: Read

        https://docs.aws.amazon.com/healthlake/latest/devguide/search-healthlake.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toSearchWithGet", []))

    @jsii.member(jsii_name="toSearchWithPost")
    def to_search_with_post(self) -> "Healthlake":
        '''(experimental) Grants permission to search resources with POST method.

        Access Level: Read

        https://docs.aws.amazon.com/healthlake/latest/devguide/search-healthlake.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toSearchWithPost", []))

    @jsii.member(jsii_name="toStartFHIRExportJob")
    def to_start_fhir_export_job(self) -> "Healthlake":
        '''(experimental) Grants permission to begin a FHIR Export job.

        Access Level: Write

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_StartFHIRExportJob.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toStartFHIRExportJob", []))

    @jsii.member(jsii_name="toStartFHIRImportJob")
    def to_start_fhir_import_job(self) -> "Healthlake":
        '''(experimental) Grants permission to begin a FHIR Import job.

        Access Level: Write

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_StartFHIRImportJob.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toStartFHIRImportJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Healthlake":
        '''(experimental) Grants permission to add tags to a datastore.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Healthlake":
        '''(experimental) Grants permission to remove tags associated with a datastore.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/healthlake/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateResource")
    def to_update_resource(self) -> "Healthlake":
        '''(experimental) Grants permission to update resource.

        Access Level: Write

        https://docs.aws.amazon.com/healthlake/latest/devguide/crud-healthlake.html

        :stability: experimental
        '''
        return typing.cast("Healthlake", jsii.invoke(self, "toUpdateResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4b1573733f0d0761fabb7bea5aa3e37f133b4ef0e766feac33a680bf37103bc8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0ed98e31a582e847d8aded64244e9f093d66ebe777e19d5a0f79959355cf4499)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Honeycode(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Honeycode",
):
    '''(experimental) Statement provider for service `honeycode <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonhoneycode.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `honeycode <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonhoneycode.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__461fae4b7a8f7d9811a1145f52359fc5ff8f60e239c127ab0f2231c4c7728b1a)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onScreen")
    def on_screen(
        self,
        workbook_id: builtins.str,
        app_id: builtins.str,
        screen_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Honeycode":
        '''(experimental) Adds a resource of type screen to the statement.

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/resource-screen.html

        :param workbook_id: - Identifier for the workbookId.
        :param app_id: - Identifier for the appId.
        :param screen_id: - Identifier for the screenId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fce24f0c1a8b6e6aa1f175dd60973219f3fea5e4846b9b64d73f27fd4b530686)
            check_type(argname="argument workbook_id", value=workbook_id, expected_type=type_hints["workbook_id"])
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument screen_id", value=screen_id, expected_type=type_hints["screen_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Honeycode", jsii.invoke(self, "onScreen", [workbook_id, app_id, screen_id, account, region, partition]))

    @jsii.member(jsii_name="onScreenAutomation")
    def on_screen_automation(
        self,
        workbook_id: builtins.str,
        app_id: builtins.str,
        screen_id: builtins.str,
        automation_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Honeycode":
        '''(experimental) Adds a resource of type screen-automation to the statement.

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/resource-screen-automation.html

        :param workbook_id: - Identifier for the workbookId.
        :param app_id: - Identifier for the appId.
        :param screen_id: - Identifier for the screenId.
        :param automation_id: - Identifier for the automationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__854e315411ed0738482a1e4657af787b428519c5b10ee4e00229120f7b9124f8)
            check_type(argname="argument workbook_id", value=workbook_id, expected_type=type_hints["workbook_id"])
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument screen_id", value=screen_id, expected_type=type_hints["screen_id"])
            check_type(argname="argument automation_id", value=automation_id, expected_type=type_hints["automation_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Honeycode", jsii.invoke(self, "onScreenAutomation", [workbook_id, app_id, screen_id, automation_id, account, region, partition]))

    @jsii.member(jsii_name="onTable")
    def on_table(
        self,
        workbook_id: builtins.str,
        table_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Honeycode":
        '''(experimental) Adds a resource of type table to the statement.

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/resource-table.html

        :param workbook_id: - Identifier for the workbookId.
        :param table_id: - Identifier for the tableId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cb1bf0279563adb74f4b0f9d4af3791f5098259396f0b89f0edcc105b8114c02)
            check_type(argname="argument workbook_id", value=workbook_id, expected_type=type_hints["workbook_id"])
            check_type(argname="argument table_id", value=table_id, expected_type=type_hints["table_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Honeycode", jsii.invoke(self, "onTable", [workbook_id, table_id, account, region, partition]))

    @jsii.member(jsii_name="onWorkbook")
    def on_workbook(
        self,
        workbook_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Honeycode":
        '''(experimental) Adds a resource of type workbook to the statement.

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/resource-workbook.html

        :param workbook_id: - Identifier for the workbookId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2bd5569e9008186a483c0c54f51d8eeb2f5a9e710d8eac5ec27fb61363c2a22f)
            check_type(argname="argument workbook_id", value=workbook_id, expected_type=type_hints["workbook_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Honeycode", jsii.invoke(self, "onWorkbook", [workbook_id, account, region, partition]))

    @jsii.member(jsii_name="toApproveTeamAssociation")
    def to_approve_team_association(self) -> "Honeycode":
        '''(experimental) Grants permission to approve a team association request for your AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/team-association.html#approve-team-association

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toApproveTeamAssociation", []))

    @jsii.member(jsii_name="toBatchCreateTableRows")
    def to_batch_create_table_rows(self) -> "Honeycode":
        '''(experimental) Grants permission to create new rows in a table.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_BatchCreateTableRows.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toBatchCreateTableRows", []))

    @jsii.member(jsii_name="toBatchDeleteTableRows")
    def to_batch_delete_table_rows(self) -> "Honeycode":
        '''(experimental) Grants permission to delete rows from a table.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_BatchDeleteTableRows.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toBatchDeleteTableRows", []))

    @jsii.member(jsii_name="toBatchUpdateTableRows")
    def to_batch_update_table_rows(self) -> "Honeycode":
        '''(experimental) Grants permission to update rows in a table.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_BatchUpdateTableRows.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toBatchUpdateTableRows", []))

    @jsii.member(jsii_name="toBatchUpsertTableRows")
    def to_batch_upsert_table_rows(self) -> "Honeycode":
        '''(experimental) Grants permission to upsert rows in a table.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_BatchUpsertTableRows.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toBatchUpsertTableRows", []))

    @jsii.member(jsii_name="toCreateTeam")
    def to_create_team(self) -> "Honeycode":
        '''(experimental) Grants permission to create a new Amazon Honeycode team for your AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/team.html#create-team

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toCreateTeam", []))

    @jsii.member(jsii_name="toCreateTenant")
    def to_create_tenant(self) -> "Honeycode":
        '''(experimental) Grants permission to create a new tenant within Amazon Honeycode for your AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/tenant.html#create-tenant

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toCreateTenant", []))

    @jsii.member(jsii_name="toDeleteDomains")
    def to_delete_domains(self) -> "Honeycode":
        '''(experimental) Grants permission to delete Amazon Honeycode domains for your AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/domain.html#delete-domains

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toDeleteDomains", []))

    @jsii.member(jsii_name="toDeregisterGroups")
    def to_deregister_groups(self) -> "Honeycode":
        '''(experimental) Grants permission to remove groups from an Amazon Honeycode team for your AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/group.html#deregister-groups

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toDeregisterGroups", []))

    @jsii.member(jsii_name="toDescribeTableDataImportJob")
    def to_describe_table_data_import_job(self) -> "Honeycode":
        '''(experimental) Grants permission to get details about a table data import job.

        Access Level: Read

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_DescribeTableDataImportJob.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toDescribeTableDataImportJob", []))

    @jsii.member(jsii_name="toDescribeTeam")
    def to_describe_team(self) -> "Honeycode":
        '''(experimental) Grants permission to get details about Amazon Honeycode teams for your AWS Account.

        Access Level: Read

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/team.html#describe-team

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toDescribeTeam", []))

    @jsii.member(jsii_name="toGetScreenData")
    def to_get_screen_data(self) -> "Honeycode":
        '''(experimental) Grants permission to load the data from a screen.

        Access Level: Read

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_GetScreenData.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toGetScreenData", []))

    @jsii.member(jsii_name="toInvokeScreenAutomation")
    def to_invoke_screen_automation(self) -> "Honeycode":
        '''(experimental) Grants permission to invoke a screen automation.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_InvokeScreenAutomation.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toInvokeScreenAutomation", []))

    @jsii.member(jsii_name="toListDomains")
    def to_list_domains(self) -> "Honeycode":
        '''(experimental) Grants permission to list all Amazon Honeycode domains and their verification status for your AWS Account.

        Access Level: List

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/domain.html#list-domains

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toListDomains", []))

    @jsii.member(jsii_name="toListGroups")
    def to_list_groups(self) -> "Honeycode":
        '''(experimental) Grants permission to list all groups in an Amazon Honeycode team for your AWS Account.

        Access Level: List

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/group.html#list-groups

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toListGroups", []))

    @jsii.member(jsii_name="toListTableColumns")
    def to_list_table_columns(self) -> "Honeycode":
        '''(experimental) Grants permission to list the columns in a table.

        Access Level: List

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_ListTableColumns.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toListTableColumns", []))

    @jsii.member(jsii_name="toListTableRows")
    def to_list_table_rows(self) -> "Honeycode":
        '''(experimental) Grants permission to list the rows in a table.

        Access Level: List

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_ListTableRows.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toListTableRows", []))

    @jsii.member(jsii_name="toListTables")
    def to_list_tables(self) -> "Honeycode":
        '''(experimental) Grants permission to list the tables in a workbook.

        Access Level: List

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_ListTables.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toListTables", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Honeycode":
        '''(experimental) Grants permission to list all tags for a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTeamAssociations")
    def to_list_team_associations(self) -> "Honeycode":
        '''(experimental) Grants permission to list all pending and approved team associations with your AWS Account.

        Access Level: List

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/team-association.html#list-team-associations

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toListTeamAssociations", []))

    @jsii.member(jsii_name="toListTenants")
    def to_list_tenants(self) -> "Honeycode":
        '''(experimental) Grants permission to list all tenants of Amazon Honeycode for your AWS Account.

        Access Level: List

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/tenant.html#list-tenants

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toListTenants", []))

    @jsii.member(jsii_name="toQueryTableRows")
    def to_query_table_rows(self) -> "Honeycode":
        '''(experimental) Grants permission to query the rows of a table using a filter.

        Access Level: Read

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_QueryTableRows.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toQueryTableRows", []))

    @jsii.member(jsii_name="toRegisterDomainForVerification")
    def to_register_domain_for_verification(self) -> "Honeycode":
        '''(experimental) Grants permission to request verification of the Amazon Honeycode domains for your AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/domain.html#register-domain-for-verification

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toRegisterDomainForVerification", []))

    @jsii.member(jsii_name="toRegisterGroups")
    def to_register_groups(self) -> "Honeycode":
        '''(experimental) Grants permission to add groups to an Amazon Honeycode team for your AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/group.html#register-groups

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toRegisterGroups", []))

    @jsii.member(jsii_name="toRejectTeamAssociation")
    def to_reject_team_association(self) -> "Honeycode":
        '''(experimental) Grants permission to reject a team association request for your AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/team-association.html#reject-team-association

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toRejectTeamAssociation", []))

    @jsii.member(jsii_name="toRestartDomainVerification")
    def to_restart_domain_verification(self) -> "Honeycode":
        '''(experimental) Grants permission to restart verification of the Amazon Honeycode domains for your AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/domain.html#restart-domain-verification

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toRestartDomainVerification", []))

    @jsii.member(jsii_name="toStartTableDataImportJob")
    def to_start_table_data_import_job(self) -> "Honeycode":
        '''(experimental) Grants permission to start a table data import job.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_StartTableDataImportJob.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toStartTableDataImportJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Honeycode":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Honeycode":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateTeam")
    def to_update_team(self) -> "Honeycode":
        '''(experimental) Grants permission to update an Amazon Honeycode team for your AWS Account.

        Access Level: Write

        https://docs.aws.amazon.com/honeycode/latest/UserGuide/team.html#update-team

        :stability: experimental
        '''
        return typing.cast("Honeycode", jsii.invoke(self, "toUpdateTeam", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__da4978bae8c783de129561eec56883c55294869baa04ef8d6ba1d81533f124d2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7ef18b0613680ea866931d1fef2db72a1068f0eace34ef38299363310aae91e5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Iam(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Iam"):
    '''(experimental) Statement provider for service `iam <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsidentityandaccessmanagement.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iam <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsidentityandaccessmanagement.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__baf3079436d53289d519e4399565afaf770eb4dd38b84d0813604374c6257814)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAssociatedResourceArn")
    def if_associated_resource_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iam":
        '''(experimental) Filters by the resource that the role will be used on behalf of.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_AssociatedResourceArn

        Applies to actions:

        - .toPassRole()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d3abcb8304ae8a10b3be8d4fbe2acb31b0726ff7912024a4aa997bbad613b21d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iam", jsii.invoke(self, "ifAssociatedResourceArn", [value, operator]))

    @jsii.member(jsii_name="ifAWSServiceName")
    def if_aws_service_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iam":
        '''(experimental) Filters access by the AWS service to which this role is attached.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_AWSServiceName

        Applies to actions:

        - .toCreateServiceLinkedRole()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a9c1e8f51aa02350394bd8ca253763edb503b8f70736d93a913307a791845cca)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iam", jsii.invoke(self, "ifAWSServiceName", [value, operator]))

    @jsii.member(jsii_name="ifOrganizationsPolicyId")
    def if_organizations_policy_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iam":
        '''(experimental) Filters access by the ID of an AWS Organizations policy.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_OrganizationsPolicyId

        Applies to actions:

        - .toGenerateOrganizationsAccessReport()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e3e1c7d50fd25741bf734ab02facaccb244c28f9d4586791ab846a8e0d102d11)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iam", jsii.invoke(self, "ifOrganizationsPolicyId", [value, operator]))

    @jsii.member(jsii_name="ifPassedToService")
    def if_passed_to_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iam":
        '''(experimental) Filters access by the AWS service to which this role is passed.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_PassedToService

        Applies to actions:

        - .toPassRole()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0c76b51e080d77d1658cb2aeeb8caa2cd86b78f32686b0b716beda7821d7e4ca)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iam", jsii.invoke(self, "ifPassedToService", [value, operator]))

    @jsii.member(jsii_name="ifPermissionsBoundary")
    def if_permissions_boundary(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iam":
        '''(experimental) Filters access if the specified policy is set as the permissions boundary on the IAM entity (user or role).

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_PermissionsBoundary

        Applies to actions:

        - .toAttachRolePolicy()
        - .toAttachUserPolicy()
        - .toCreateRole()
        - .toCreateUser()
        - .toDeleteRolePermissionsBoundary()
        - .toDeleteRolePolicy()
        - .toDeleteUserPermissionsBoundary()
        - .toDeleteUserPolicy()
        - .toDetachRolePolicy()
        - .toDetachUserPolicy()
        - .toPutRolePermissionsBoundary()
        - .toPutRolePolicy()
        - .toPutUserPermissionsBoundary()
        - .toPutUserPolicy()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__06252730368f41a559f564cc15e33c7fa5fa01fb7fc49f8d5e5fd3b9db9d4af9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iam", jsii.invoke(self, "ifPermissionsBoundary", [value, operator]))

    @jsii.member(jsii_name="ifPolicyARN")
    def if_policy_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iam":
        '''(experimental) Filters access by the ARN of an IAM policy.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_PolicyARN

        Applies to actions:

        - .toAttachGroupPolicy()
        - .toAttachRolePolicy()
        - .toAttachUserPolicy()
        - .toDetachGroupPolicy()
        - .toDetachRolePolicy()
        - .toDetachUserPolicy()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__91ba9b4908fcfb46a926f319f0af1bcda1101791bb75f4b8239f7055f951722c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iam", jsii.invoke(self, "ifPolicyARN", [value, operator]))

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iam":
        '''(experimental) Filters access by the tags attached to an IAM entity (user or role).

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_ResourceTag

        Applies to resource types:

        - role
        - user

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6e5ee284a77ebf99129b430db2dd047ef49af0d03dd3fb2855cc873cd1f48f3f)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iam", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onAccessReport")
    def on_access_report(
        self,
        entity_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type access-report to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor-view-data-orgs.html

        :param entity_path: - Identifier for the entityPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7bf1f0b4cc4e959369527c74a1093ecaf61338733913b4ff0890c9f608e18df9)
            check_type(argname="argument entity_path", value=entity_path, expected_type=type_hints["entity_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iam", jsii.invoke(self, "onAccessReport", [entity_path, account, partition]))

    @jsii.member(jsii_name="onAssumedRole")
    def on_assumed_role(
        self,
        role_name: builtins.str,
        role_session_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type assumed-role to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html

        :param role_name: - Identifier for the roleName.
        :param role_session_name: - Identifier for the roleSessionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8da3eb3cd34b9b6fdff5d6ba4bba550ce3faf0fa280785e720c2a19523b7c72f)
            check_type(argname="argument role_name", value=role_name, expected_type=type_hints["role_name"])
            check_type(argname="argument role_session_name", value=role_session_name, expected_type=type_hints["role_session_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iam", jsii.invoke(self, "onAssumedRole", [role_name, role_session_name, account, partition]))

    @jsii.member(jsii_name="onFederatedUser")
    def on_federated_user(
        self,
        user_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type federated-user to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html

        :param user_name: - Identifier for the userName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6fc06bdf1d6fd139541238215cfc4141d8de7f2433eaf3e824e568899569bc10)
            check_type(argname="argument user_name", value=user_name, expected_type=type_hints["user_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iam", jsii.invoke(self, "onFederatedUser", [user_name, account, partition]))

    @jsii.member(jsii_name="onGroup")
    def on_group(
        self,
        group_name_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type group to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html

        :param group_name_with_path: - Identifier for the groupNameWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__283e75bef4ca8e02fcb045bb28bfc499f00002ebbcece06ba843ce4722fd56ad)
            check_type(argname="argument group_name_with_path", value=group_name_with_path, expected_type=type_hints["group_name_with_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iam", jsii.invoke(self, "onGroup", [group_name_with_path, account, partition]))

    @jsii.member(jsii_name="onInstanceProfile")
    def on_instance_profile(
        self,
        instance_profile_name_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type instance-profile to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html

        :param instance_profile_name_with_path: - Identifier for the instanceProfileNameWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ac99417185b0816f155041a78377cd971318e97087a3059df16e9514e5f8d0e8)
            check_type(argname="argument instance_profile_name_with_path", value=instance_profile_name_with_path, expected_type=type_hints["instance_profile_name_with_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iam", jsii.invoke(self, "onInstanceProfile", [instance_profile_name_with_path, account, partition]))

    @jsii.member(jsii_name="onMfa")
    def on_mfa(
        self,
        mfa_token_id_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type mfa to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html

        :param mfa_token_id_with_path: - Identifier for the mfaTokenIdWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2c717e87993669907a639ce3ca03e72bdf3edc8a94b2fbc049ff6e4094214076)
            check_type(argname="argument mfa_token_id_with_path", value=mfa_token_id_with_path, expected_type=type_hints["mfa_token_id_with_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iam", jsii.invoke(self, "onMfa", [mfa_token_id_with_path, account, partition]))

    @jsii.member(jsii_name="onOidcProvider")
    def on_oidc_provider(
        self,
        oidc_provider_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type oidc-provider to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html

        :param oidc_provider_name: - Identifier for the oidcProviderName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2f5cd8610284d6fc2da67b13323aa431dff641d9393512c847d7d10e13c8e020)
            check_type(argname="argument oidc_provider_name", value=oidc_provider_name, expected_type=type_hints["oidc_provider_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iam", jsii.invoke(self, "onOidcProvider", [oidc_provider_name, account, partition]))

    @jsii.member(jsii_name="onPolicy")
    def on_policy(
        self,
        policy_name_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type policy to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html

        :param policy_name_with_path: - Identifier for the policyNameWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__faed0a5d64db22b46f9556efc002769861c0921d102355ffcea3667d597ab311)
            check_type(argname="argument policy_name_with_path", value=policy_name_with_path, expected_type=type_hints["policy_name_with_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iam", jsii.invoke(self, "onPolicy", [policy_name_with_path, account, partition]))

    @jsii.member(jsii_name="onRole")
    def on_role(
        self,
        role_name_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type role to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html

        :param role_name_with_path: - Identifier for the roleNameWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c926ec21ba2fbd600d76ddee136a209785b4317067565ab6eac60957e2f1916f)
            check_type(argname="argument role_name_with_path", value=role_name_with_path, expected_type=type_hints["role_name_with_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iam", jsii.invoke(self, "onRole", [role_name_with_path, account, partition]))

    @jsii.member(jsii_name="onSamlProvider")
    def on_saml_provider(
        self,
        saml_provider_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type saml-provider to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html

        :param saml_provider_name: - Identifier for the samlProviderName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__31b00c173826b67a98da7cbb9803c3263931af53cde5a814e66ded5f6a061b3c)
            check_type(argname="argument saml_provider_name", value=saml_provider_name, expected_type=type_hints["saml_provider_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iam", jsii.invoke(self, "onSamlProvider", [saml_provider_name, account, partition]))

    @jsii.member(jsii_name="onServerCertificate")
    def on_server_certificate(
        self,
        certificate_name_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type server-certificate to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_server-certs.html

        :param certificate_name_with_path: - Identifier for the certificateNameWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ef668ae35be63228f0e2586570a88d619684b20f7e6800aad64bef6a45c13311)
            check_type(argname="argument certificate_name_with_path", value=certificate_name_with_path, expected_type=type_hints["certificate_name_with_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iam", jsii.invoke(self, "onServerCertificate", [certificate_name_with_path, account, partition]))

    @jsii.member(jsii_name="onSmsMfa")
    def on_sms_mfa(
        self,
        mfa_token_id_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type sms-mfa to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html

        :param mfa_token_id_with_path: - Identifier for the mfaTokenIdWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a63527c24fab33902a80bd74d0d3983971e2132558696969acaa5d7aa0b3b21a)
            check_type(argname="argument mfa_token_id_with_path", value=mfa_token_id_with_path, expected_type=type_hints["mfa_token_id_with_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iam", jsii.invoke(self, "onSmsMfa", [mfa_token_id_with_path, account, partition]))

    @jsii.member(jsii_name="onUser")
    def on_user(
        self,
        user_name_with_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iam":
        '''(experimental) Adds a resource of type user to the statement.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html

        :param user_name_with_path: - Identifier for the userNameWithPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__45963d5088b82ec49576bd873b04679fae80e5035c03558444226c58eab2af12)
            check_type(argname="argument user_name_with_path", value=user_name_with_path, expected_type=type_hints["user_name_with_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iam", jsii.invoke(self, "onUser", [user_name_with_path, account, partition]))

    @jsii.member(jsii_name="toAddClientIDToOpenIDConnectProvider")
    def to_add_client_id_to_open_id_connect_provider(self) -> "Iam":
        '''(experimental) Grants permission to add a new client ID (audience) to the list of registered IDs for the specified IAM OpenID Connect (OIDC) provider resource.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_AddClientIDToOpenIDConnectProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toAddClientIDToOpenIDConnectProvider", []))

    @jsii.member(jsii_name="toAddRoleToInstanceProfile")
    def to_add_role_to_instance_profile(self) -> "Iam":
        '''(experimental) Grants permission to add an IAM role to the specified instance profile.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_AddRoleToInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toAddRoleToInstanceProfile", []))

    @jsii.member(jsii_name="toAddUserToGroup")
    def to_add_user_to_group(self) -> "Iam":
        '''(experimental) Grants permission to add an IAM user to the specified IAM group.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_AddUserToGroup.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toAddUserToGroup", []))

    @jsii.member(jsii_name="toAttachGroupPolicy")
    def to_attach_group_policy(self) -> "Iam":
        '''(experimental) Grants permission to attach a managed policy to the specified IAM group.

        Access Level: Permissions management

        Possible conditions:

        - .ifPolicyARN()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toAttachGroupPolicy", []))

    @jsii.member(jsii_name="toAttachRolePolicy")
    def to_attach_role_policy(self) -> "Iam":
        '''(experimental) Grants permission to attach a managed policy to the specified IAM role.

        Access Level: Permissions management

        Possible conditions:

        - .ifPolicyARN()
        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachRolePolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toAttachRolePolicy", []))

    @jsii.member(jsii_name="toAttachUserPolicy")
    def to_attach_user_policy(self) -> "Iam":
        '''(experimental) Grants permission to attach a managed policy to the specified IAM user.

        Access Level: Permissions management

        Possible conditions:

        - .ifPolicyARN()
        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachUserPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toAttachUserPolicy", []))

    @jsii.member(jsii_name="toChangePassword")
    def to_change_password(self) -> "Iam":
        '''(experimental) Grants permission for an IAM user to change their own password.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ChangePassword.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toChangePassword", []))

    @jsii.member(jsii_name="toCreateAccessKey")
    def to_create_access_key(self) -> "Iam":
        '''(experimental) Grants permission to create access key and secret access key for the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateAccessKey.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateAccessKey", []))

    @jsii.member(jsii_name="toCreateAccountAlias")
    def to_create_account_alias(self) -> "Iam":
        '''(experimental) Grants permission to create an alias for your AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateAccountAlias.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateAccountAlias", []))

    @jsii.member(jsii_name="toCreateGroup")
    def to_create_group(self) -> "Iam":
        '''(experimental) Grants permission to create a new group.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateGroup.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateGroup", []))

    @jsii.member(jsii_name="toCreateInstanceProfile")
    def to_create_instance_profile(self) -> "Iam":
        '''(experimental) Grants permission to create a new instance profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateInstanceProfile", []))

    @jsii.member(jsii_name="toCreateLoginProfile")
    def to_create_login_profile(self) -> "Iam":
        '''(experimental) Grants permission to create a password for the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateLoginProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateLoginProfile", []))

    @jsii.member(jsii_name="toCreateOpenIDConnectProvider")
    def to_create_open_id_connect_provider(self) -> "Iam":
        '''(experimental) Grants permission to create an IAM resource that describes an identity provider (IdP) that supports OpenID Connect (OIDC).

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateOpenIDConnectProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateOpenIDConnectProvider", []))

    @jsii.member(jsii_name="toCreatePolicy")
    def to_create_policy(self) -> "Iam":
        '''(experimental) Grants permission to create a new managed policy.

        Access Level: Permissions management

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreatePolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreatePolicy", []))

    @jsii.member(jsii_name="toCreatePolicyVersion")
    def to_create_policy_version(self) -> "Iam":
        '''(experimental) Grants permission to create a new version of the specified managed policy.

        Access Level: Permissions management

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreatePolicyVersion.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreatePolicyVersion", []))

    @jsii.member(jsii_name="toCreateRole")
    def to_create_role(self) -> "Iam":
        '''(experimental) Grants permission to create a new role.

        Access Level: Write

        Possible conditions:

        - .ifPermissionsBoundary()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateRole.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateRole", []))

    @jsii.member(jsii_name="toCreateSAMLProvider")
    def to_create_saml_provider(self) -> "Iam":
        '''(experimental) Grants permission to create an IAM resource that describes an identity provider (IdP) that supports SAML 2.0.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateSAMLProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateSAMLProvider", []))

    @jsii.member(jsii_name="toCreateServiceLinkedRole")
    def to_create_service_linked_role(self) -> "Iam":
        '''(experimental) Grants permission to create an IAM role that allows an AWS service to perform actions on your behalf.

        Access Level: Write

        Possible conditions:

        - .ifAWSServiceName()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateServiceLinkedRole.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateServiceLinkedRole", []))

    @jsii.member(jsii_name="toCreateServiceSpecificCredential")
    def to_create_service_specific_credential(self) -> "Iam":
        '''(experimental) Grants permission to create a new service-specific credential for an IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateServiceSpecificCredential.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateServiceSpecificCredential", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Iam":
        '''(experimental) Grants permission to create a new IAM user.

        Access Level: Write

        Possible conditions:

        - .ifPermissionsBoundary()
        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateUser.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toCreateVirtualMFADevice")
    def to_create_virtual_mfa_device(self) -> "Iam":
        '''(experimental) Grants permission to create a new virtual MFA device.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateVirtualMFADevice.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toCreateVirtualMFADevice", []))

    @jsii.member(jsii_name="toDeactivateMFADevice")
    def to_deactivate_mfa_device(self) -> "Iam":
        '''(experimental) Grants permission to deactivate the specified MFA device and remove its association with the IAM user for which it was originally enabled.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeactivateMFADevice.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeactivateMFADevice", []))

    @jsii.member(jsii_name="toDeleteAccessKey")
    def to_delete_access_key(self) -> "Iam":
        '''(experimental) Grants permission to delete the access key pair that is associated with the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteAccessKey.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteAccessKey", []))

    @jsii.member(jsii_name="toDeleteAccountAlias")
    def to_delete_account_alias(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified AWS account alias.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteAccountAlias.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteAccountAlias", []))

    @jsii.member(jsii_name="toDeleteAccountPasswordPolicy")
    def to_delete_account_password_policy(self) -> "Iam":
        '''(experimental) Grants permission to delete the password policy for the AWS account.

        Access Level: Permissions management

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteAccountPasswordPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteAccountPasswordPolicy", []))

    @jsii.member(jsii_name="toDeleteCloudFrontPublicKey")
    def to_delete_cloud_front_public_key(self) -> "Iam":
        '''(experimental) Grants permission to delete an existing CloudFront public key.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteCloudFrontPublicKey", []))

    @jsii.member(jsii_name="toDeleteGroup")
    def to_delete_group(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified IAM group.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteGroup", []))

    @jsii.member(jsii_name="toDeleteGroupPolicy")
    def to_delete_group_policy(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified inline policy from its group.

        Access Level: Permissions management

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteGroupPolicy", []))

    @jsii.member(jsii_name="toDeleteInstanceProfile")
    def to_delete_instance_profile(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified instance profile.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteInstanceProfile", []))

    @jsii.member(jsii_name="toDeleteLoginProfile")
    def to_delete_login_profile(self) -> "Iam":
        '''(experimental) Grants permission to delete the password for the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteLoginProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteLoginProfile", []))

    @jsii.member(jsii_name="toDeleteOpenIDConnectProvider")
    def to_delete_open_id_connect_provider(self) -> "Iam":
        '''(experimental) Grants permission to delete an OpenID Connect identity provider (IdP) resource object in IAM.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteOpenIDConnectProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteOpenIDConnectProvider", []))

    @jsii.member(jsii_name="toDeletePolicy")
    def to_delete_policy(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified managed policy and remove it from any IAM entities (users, groups, or roles) to which it is attached.

        Access Level: Permissions management

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeletePolicy", []))

    @jsii.member(jsii_name="toDeletePolicyVersion")
    def to_delete_policy_version(self) -> "Iam":
        '''(experimental) Grants permission to delete a version from the specified managed policy.

        Access Level: Permissions management

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicyVersion.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeletePolicyVersion", []))

    @jsii.member(jsii_name="toDeleteRole")
    def to_delete_role(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified role.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteRole.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteRole", []))

    @jsii.member(jsii_name="toDeleteRolePermissionsBoundary")
    def to_delete_role_permissions_boundary(self) -> "Iam":
        '''(experimental) Grants permission to remove the permissions boundary from a role.

        Access Level: Permissions management

        Possible conditions:

        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteRolePermissionsBoundary.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteRolePermissionsBoundary", []))

    @jsii.member(jsii_name="toDeleteRolePolicy")
    def to_delete_role_policy(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified inline policy from the specified role.

        Access Level: Permissions management

        Possible conditions:

        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteRolePolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteRolePolicy", []))

    @jsii.member(jsii_name="toDeleteSAMLProvider")
    def to_delete_saml_provider(self) -> "Iam":
        '''(experimental) Grants permission to delete a SAML provider resource in IAM.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSAMLProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteSAMLProvider", []))

    @jsii.member(jsii_name="toDeleteServerCertificate")
    def to_delete_server_certificate(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified server certificate.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteServerCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteServerCertificate", []))

    @jsii.member(jsii_name="toDeleteServiceLinkedRole")
    def to_delete_service_linked_role(self) -> "Iam":
        '''(experimental) Grants permission to delete an IAM role that is linked to a specific AWS service, if the service is no longer using it.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteServiceLinkedRole.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteServiceLinkedRole", []))

    @jsii.member(jsii_name="toDeleteServiceSpecificCredential")
    def to_delete_service_specific_credential(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified service-specific credential for an IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteServiceSpecificCredential.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteServiceSpecificCredential", []))

    @jsii.member(jsii_name="toDeleteSigningCertificate")
    def to_delete_signing_certificate(self) -> "Iam":
        '''(experimental) Grants permission to delete a signing certificate that is associated with the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSigningCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteSigningCertificate", []))

    @jsii.member(jsii_name="toDeleteSSHPublicKey")
    def to_delete_ssh_public_key(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified SSH public key.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSSHPublicKey.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteSSHPublicKey", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDeleteUserPermissionsBoundary")
    def to_delete_user_permissions_boundary(self) -> "Iam":
        '''(experimental) Grants permission to remove the permissions boundary from the specified IAM user.

        Access Level: Permissions management

        Possible conditions:

        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteUserPermissionsBoundary.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteUserPermissionsBoundary", []))

    @jsii.member(jsii_name="toDeleteUserPolicy")
    def to_delete_user_policy(self) -> "Iam":
        '''(experimental) Grants permission to delete the specified inline policy from an IAM user.

        Access Level: Permissions management

        Possible conditions:

        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteUserPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteUserPolicy", []))

    @jsii.member(jsii_name="toDeleteVirtualMFADevice")
    def to_delete_virtual_mfa_device(self) -> "Iam":
        '''(experimental) Grants permission to delete a virtual MFA device.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteVirtualMFADevice.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDeleteVirtualMFADevice", []))

    @jsii.member(jsii_name="toDetachGroupPolicy")
    def to_detach_group_policy(self) -> "Iam":
        '''(experimental) Grants permission to detach a managed policy from the specified IAM group.

        Access Level: Permissions management

        Possible conditions:

        - .ifPolicyARN()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DetachGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDetachGroupPolicy", []))

    @jsii.member(jsii_name="toDetachRolePolicy")
    def to_detach_role_policy(self) -> "Iam":
        '''(experimental) Grants permission to detach a managed policy from the specified role.

        Access Level: Permissions management

        Possible conditions:

        - .ifPolicyARN()
        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DetachRolePolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDetachRolePolicy", []))

    @jsii.member(jsii_name="toDetachUserPolicy")
    def to_detach_user_policy(self) -> "Iam":
        '''(experimental) Grants permission to detach a managed policy from the specified IAM user.

        Access Level: Permissions management

        Possible conditions:

        - .ifPolicyARN()
        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_DetachUserPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toDetachUserPolicy", []))

    @jsii.member(jsii_name="toEnableMFADevice")
    def to_enable_mfa_device(self) -> "Iam":
        '''(experimental) Grants permission to enable an MFA device and associate it with the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_EnableMFADevice.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toEnableMFADevice", []))

    @jsii.member(jsii_name="toGenerateCredentialReport")
    def to_generate_credential_report(self) -> "Iam":
        '''(experimental) Grants permission to generate a credential report for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GenerateCredentialReport.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGenerateCredentialReport", []))

    @jsii.member(jsii_name="toGenerateOrganizationsAccessReport")
    def to_generate_organizations_access_report(self) -> "Iam":
        '''(experimental) Grants permission to generate an access report for an AWS Organizations entity.

        Access Level: Read

        Possible conditions:

        - .ifOrganizationsPolicyId()

        Dependent actions:

        - organizations:DescribePolicy
        - organizations:ListChildren
        - organizations:ListParents
        - organizations:ListPoliciesForTarget
        - organizations:ListRoots
        - organizations:ListTargetsForPolicy

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GenerateOrganizationsAccessReport.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGenerateOrganizationsAccessReport", []))

    @jsii.member(jsii_name="toGenerateServiceLastAccessedDetails")
    def to_generate_service_last_accessed_details(self) -> "Iam":
        '''(experimental) Grants permission to generate a service last accessed data report for an IAM resource.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GenerateServiceLastAccessedDetails.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGenerateServiceLastAccessedDetails", []))

    @jsii.member(jsii_name="toGetAccessKeyLastUsed")
    def to_get_access_key_last_used(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about when the specified access key was last used.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccessKeyLastUsed.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetAccessKeyLastUsed", []))

    @jsii.member(jsii_name="toGetAccountAuthorizationDetails")
    def to_get_account_authorization_details(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about all IAM users, groups, roles, and policies in your AWS account, including their relationships to one another.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountAuthorizationDetails.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetAccountAuthorizationDetails", []))

    @jsii.member(jsii_name="toGetAccountEmailAddress")
    def to_get_account_email_address(self) -> "Iam":
        '''(experimental) Grants permission to retrieve the email address that is associated with the account.

        Access Level: Read

        https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-root-user.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetAccountEmailAddress", []))

    @jsii.member(jsii_name="toGetAccountName")
    def to_get_account_name(self) -> "Iam":
        '''(experimental) Grants permission to retrieve the account name that is associated with the account.

        Access Level: Read

        https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-root-user.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetAccountName", []))

    @jsii.member(jsii_name="toGetAccountPasswordPolicy")
    def to_get_account_password_policy(self) -> "Iam":
        '''(experimental) Grants permission to retrieve the password policy for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountPasswordPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetAccountPasswordPolicy", []))

    @jsii.member(jsii_name="toGetAccountSummary")
    def to_get_account_summary(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about IAM entity usage and IAM quotas in the AWS account.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountSummary.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetAccountSummary", []))

    @jsii.member(jsii_name="toGetCloudFrontPublicKey")
    def to_get_cloud_front_public_key(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about the specified CloudFront public key.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetCloudFrontPublicKey", []))

    @jsii.member(jsii_name="toGetContextKeysForCustomPolicy")
    def to_get_context_keys_for_custom_policy(self) -> "Iam":
        '''(experimental) Grants permission to retrieve a list of all of the context keys that are referenced in the specified policy.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetContextKeysForCustomPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetContextKeysForCustomPolicy", []))

    @jsii.member(jsii_name="toGetContextKeysForPrincipalPolicy")
    def to_get_context_keys_for_principal_policy(self) -> "Iam":
        '''(experimental) Grants permission to retrieve a list of all context keys that are referenced in all IAM policies that are attached to the specified IAM identity (user, group, or role).

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetContextKeysForPrincipalPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetContextKeysForPrincipalPolicy", []))

    @jsii.member(jsii_name="toGetCredentialReport")
    def to_get_credential_report(self) -> "Iam":
        '''(experimental) Grants permission to retrieve a credential report for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetCredentialReport.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetCredentialReport", []))

    @jsii.member(jsii_name="toGetGroup")
    def to_get_group(self) -> "Iam":
        '''(experimental) Grants permission to retrieve a list of IAM users in the specified IAM group.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetGroup.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetGroup", []))

    @jsii.member(jsii_name="toGetGroupPolicy")
    def to_get_group_policy(self) -> "Iam":
        '''(experimental) Grants permission to retrieve an inline policy document that is embedded in the specified IAM group.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetGroupPolicy", []))

    @jsii.member(jsii_name="toGetInstanceProfile")
    def to_get_instance_profile(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about the specified instance profile, including the instance profile's path, GUID, ARN, and role.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetInstanceProfile", []))

    @jsii.member(jsii_name="toGetLoginProfile")
    def to_get_login_profile(self) -> "Iam":
        '''(experimental) Grants permission to retrieve the user name and password creation date for the specified IAM user.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetLoginProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetLoginProfile", []))

    @jsii.member(jsii_name="toGetOpenIDConnectProvider")
    def to_get_open_id_connect_provider(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about the specified OpenID Connect (OIDC) provider resource in IAM.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetOpenIDConnectProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetOpenIDConnectProvider", []))

    @jsii.member(jsii_name="toGetOrganizationsAccessReport")
    def to_get_organizations_access_report(self) -> "Iam":
        '''(experimental) Grants permission to retrieve an AWS Organizations access report.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetOrganizationsAccessReport.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetOrganizationsAccessReport", []))

    @jsii.member(jsii_name="toGetPolicy")
    def to_get_policy(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about the specified managed policy, including the policy's default version and the total number of identities to which the policy is attached.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetPolicy", []))

    @jsii.member(jsii_name="toGetPolicyVersion")
    def to_get_policy_version(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about a version of the specified managed policy, including the policy document.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetPolicyVersion.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetPolicyVersion", []))

    @jsii.member(jsii_name="toGetRole")
    def to_get_role(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about the specified role, including the role's path, GUID, ARN, and the role's trust policy.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetRole.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetRole", []))

    @jsii.member(jsii_name="toGetRolePolicy")
    def to_get_role_policy(self) -> "Iam":
        '''(experimental) Grants permission to retrieve an inline policy document that is embedded with the specified IAM role.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetRolePolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetRolePolicy", []))

    @jsii.member(jsii_name="toGetSAMLProvider")
    def to_get_saml_provider(self) -> "Iam":
        '''(experimental) Grants permission to retrieve the SAML provider metadocument that was uploaded when the IAM SAML provider resource was created or updated.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetSAMLProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetSAMLProvider", []))

    @jsii.member(jsii_name="toGetServerCertificate")
    def to_get_server_certificate(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about the specified server certificate stored in IAM.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetServerCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetServerCertificate", []))

    @jsii.member(jsii_name="toGetServiceLastAccessedDetails")
    def to_get_service_last_accessed_details(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about the service last accessed data report.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetServiceLastAccessedDetails.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetServiceLastAccessedDetails", []))

    @jsii.member(jsii_name="toGetServiceLastAccessedDetailsWithEntities")
    def to_get_service_last_accessed_details_with_entities(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about the entities from the service last accessed data report.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetServiceLastAccessedDetailsWithEntities.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetServiceLastAccessedDetailsWithEntities", []))

    @jsii.member(jsii_name="toGetServiceLinkedRoleDeletionStatus")
    def to_get_service_linked_role_deletion_status(self) -> "Iam":
        '''(experimental) Grants permission to retrieve an IAM service-linked role deletion status.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetServiceLinkedRoleDeletionStatus.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetServiceLinkedRoleDeletionStatus", []))

    @jsii.member(jsii_name="toGetSSHPublicKey")
    def to_get_ssh_public_key(self) -> "Iam":
        '''(experimental) Grants permission to retrieve the specified SSH public key, including metadata about the key.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetSSHPublicKey.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetSSHPublicKey", []))

    @jsii.member(jsii_name="toGetUser")
    def to_get_user(self) -> "Iam":
        '''(experimental) Grants permission to retrieve information about the specified IAM user, including the user's creation date, path, unique ID, and ARN.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetUser.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetUser", []))

    @jsii.member(jsii_name="toGetUserPolicy")
    def to_get_user_policy(self) -> "Iam":
        '''(experimental) Grants permission to retrieve an inline policy document that is embedded in the specified IAM user.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetUserPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toGetUserPolicy", []))

    @jsii.member(jsii_name="toListAccessKeys")
    def to_list_access_keys(self) -> "Iam":
        '''(experimental) Grants permission to list information about the access key IDs that are associated with the specified IAM user.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAccessKeys.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListAccessKeys", []))

    @jsii.member(jsii_name="toListAccountAliases")
    def to_list_account_aliases(self) -> "Iam":
        '''(experimental) Grants permission to list the account alias that is associated with the AWS account.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAccountAliases.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListAccountAliases", []))

    @jsii.member(jsii_name="toListAttachedGroupPolicies")
    def to_list_attached_group_policies(self) -> "Iam":
        '''(experimental) Grants permission to list all managed policies that are attached to the specified IAM group.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedGroupPolicies.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListAttachedGroupPolicies", []))

    @jsii.member(jsii_name="toListAttachedRolePolicies")
    def to_list_attached_role_policies(self) -> "Iam":
        '''(experimental) Grants permission to list all managed policies that are attached to the specified IAM role.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedRolePolicies.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListAttachedRolePolicies", []))

    @jsii.member(jsii_name="toListAttachedUserPolicies")
    def to_list_attached_user_policies(self) -> "Iam":
        '''(experimental) Grants permission to list all managed policies that are attached to the specified IAM user.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedUserPolicies.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListAttachedUserPolicies", []))

    @jsii.member(jsii_name="toListCloudFrontPublicKeys")
    def to_list_cloud_front_public_keys(self) -> "Iam":
        '''(experimental) Grants permission to list all current CloudFront public keys for the account.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListCloudFrontPublicKeys", []))

    @jsii.member(jsii_name="toListEntitiesForPolicy")
    def to_list_entities_for_policy(self) -> "Iam":
        '''(experimental) Grants permission to list all IAM identities to which the specified managed policy is attached.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListEntitiesForPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListEntitiesForPolicy", []))

    @jsii.member(jsii_name="toListGroupPolicies")
    def to_list_group_policies(self) -> "Iam":
        '''(experimental) Grants permission to list the names of the inline policies that are embedded in the specified IAM group.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListGroupPolicies.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListGroupPolicies", []))

    @jsii.member(jsii_name="toListGroups")
    def to_list_groups(self) -> "Iam":
        '''(experimental) Grants permission to list the IAM groups that have the specified path prefix.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListGroups.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListGroups", []))

    @jsii.member(jsii_name="toListGroupsForUser")
    def to_list_groups_for_user(self) -> "Iam":
        '''(experimental) Grants permission to list the IAM groups that the specified IAM user belongs to.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListGroupsForUser.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListGroupsForUser", []))

    @jsii.member(jsii_name="toListInstanceProfiles")
    def to_list_instance_profiles(self) -> "Iam":
        '''(experimental) Grants permission to list the instance profiles that have the specified path prefix.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListInstanceProfiles.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListInstanceProfiles", []))

    @jsii.member(jsii_name="toListInstanceProfilesForRole")
    def to_list_instance_profiles_for_role(self) -> "Iam":
        '''(experimental) Grants permission to list the instance profiles that have the specified associated IAM role.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListInstanceProfilesForRole.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListInstanceProfilesForRole", []))

    @jsii.member(jsii_name="toListInstanceProfileTags")
    def to_list_instance_profile_tags(self) -> "Iam":
        '''(experimental) Grants permission to list the tags that are attached to the specified instance profile.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListInstanceProfileTags.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListInstanceProfileTags", []))

    @jsii.member(jsii_name="toListMFADevices")
    def to_list_mfa_devices(self) -> "Iam":
        '''(experimental) Grants permission to list the MFA devices for an IAM user.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListMFADevices.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListMFADevices", []))

    @jsii.member(jsii_name="toListMFADeviceTags")
    def to_list_mfa_device_tags(self) -> "Iam":
        '''(experimental) Grants permission to list the tags that are attached to the specified virtual mfa device.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListMFADeviceTags.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListMFADeviceTags", []))

    @jsii.member(jsii_name="toListOpenIDConnectProviders")
    def to_list_open_id_connect_providers(self) -> "Iam":
        '''(experimental) Grants permission to list information about the IAM OpenID Connect (OIDC) provider resource objects that are defined in the AWS account.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListOpenIDConnectProviders.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListOpenIDConnectProviders", []))

    @jsii.member(jsii_name="toListOpenIDConnectProviderTags")
    def to_list_open_id_connect_provider_tags(self) -> "Iam":
        '''(experimental) Grants permission to list the tags that are attached to the specified OpenID Connect provider.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListOpenIDConnectProviderTags.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListOpenIDConnectProviderTags", []))

    @jsii.member(jsii_name="toListPolicies")
    def to_list_policies(self) -> "Iam":
        '''(experimental) Grants permission to list all managed policies.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListPolicies.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListPolicies", []))

    @jsii.member(jsii_name="toListPoliciesGrantingServiceAccess")
    def to_list_policies_granting_service_access(self) -> "Iam":
        '''(experimental) Grants permission to list information about the policies that grant an entity access to a specific service.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListPoliciesGrantingServiceAccess.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListPoliciesGrantingServiceAccess", []))

    @jsii.member(jsii_name="toListPolicyTags")
    def to_list_policy_tags(self) -> "Iam":
        '''(experimental) Grants permission to list the tags that are attached to the specified managed policy.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListPolicyTags.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListPolicyTags", []))

    @jsii.member(jsii_name="toListPolicyVersions")
    def to_list_policy_versions(self) -> "Iam":
        '''(experimental) Grants permission to list information about the versions of the specified managed policy, including the version that is currently set as the policy's default version.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListPolicyVersions.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListPolicyVersions", []))

    @jsii.member(jsii_name="toListRolePolicies")
    def to_list_role_policies(self) -> "Iam":
        '''(experimental) Grants permission to list the names of the inline policies that are embedded in the specified IAM role.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListRolePolicies.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListRolePolicies", []))

    @jsii.member(jsii_name="toListRoles")
    def to_list_roles(self) -> "Iam":
        '''(experimental) Grants permission to list the IAM roles that have the specified path prefix.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListRoles.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListRoles", []))

    @jsii.member(jsii_name="toListRoleTags")
    def to_list_role_tags(self) -> "Iam":
        '''(experimental) Grants permission to list the tags that are attached to the specified IAM role.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListRoleTags.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListRoleTags", []))

    @jsii.member(jsii_name="toListSAMLProviders")
    def to_list_saml_providers(self) -> "Iam":
        '''(experimental) Grants permission to list the SAML provider resources in IAM.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListSAMLProviders.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListSAMLProviders", []))

    @jsii.member(jsii_name="toListSAMLProviderTags")
    def to_list_saml_provider_tags(self) -> "Iam":
        '''(experimental) Grants permission to list the tags that are attached to the specified SAML provider.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListSAMLProviderTags.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListSAMLProviderTags", []))

    @jsii.member(jsii_name="toListServerCertificates")
    def to_list_server_certificates(self) -> "Iam":
        '''(experimental) Grants permission to list the server certificates that have the specified path prefix.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListServerCertificates.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListServerCertificates", []))

    @jsii.member(jsii_name="toListServerCertificateTags")
    def to_list_server_certificate_tags(self) -> "Iam":
        '''(experimental) Grants permission to list the tags that are attached to the specified server certificate.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListServerCertificateTags.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListServerCertificateTags", []))

    @jsii.member(jsii_name="toListServiceSpecificCredentials")
    def to_list_service_specific_credentials(self) -> "Iam":
        '''(experimental) Grants permission to list the service-specific credentials that are associated with the specified IAM user.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListServiceSpecificCredentials.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListServiceSpecificCredentials", []))

    @jsii.member(jsii_name="toListSigningCertificates")
    def to_list_signing_certificates(self) -> "Iam":
        '''(experimental) Grants permission to list information about the signing certificates that are associated with the specified IAM user.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListSigningCertificates.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListSigningCertificates", []))

    @jsii.member(jsii_name="toListSSHPublicKeys")
    def to_list_ssh_public_keys(self) -> "Iam":
        '''(experimental) Grants permission to list information about the SSH public keys that are associated with the specified IAM user.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListSSHPublicKeys.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListSSHPublicKeys", []))

    @jsii.member(jsii_name="toListSTSRegionalEndpointsStatus")
    def to_list_sts_regional_endpoints_status(self) -> "Iam":
        '''(experimental) Grants permission to list the status of all active STS regional endpoints.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListSTSRegionalEndpointsStatus", []))

    @jsii.member(jsii_name="toListUserPolicies")
    def to_list_user_policies(self) -> "Iam":
        '''(experimental) Grants permission to list the names of the inline policies that are embedded in the specified IAM user.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListUserPolicies.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListUserPolicies", []))

    @jsii.member(jsii_name="toListUsers")
    def to_list_users(self) -> "Iam":
        '''(experimental) Grants permission to list the IAM users that have the specified path prefix.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListUsers.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListUsers", []))

    @jsii.member(jsii_name="toListUserTags")
    def to_list_user_tags(self) -> "Iam":
        '''(experimental) Grants permission to list the tags that are attached to the specified IAM user.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListUserTags.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListUserTags", []))

    @jsii.member(jsii_name="toListVirtualMFADevices")
    def to_list_virtual_mfa_devices(self) -> "Iam":
        '''(experimental) Grants permission to list virtual MFA devices by assignment status.

        Access Level: List

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListVirtualMFADevices.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toListVirtualMFADevices", []))

    @jsii.member(jsii_name="toPassRole")
    def to_pass_role(self) -> "Iam":
        '''(experimental) Grants permission to pass a role to a service.

        Access Level: Write

        Possible conditions:

        - .ifAssociatedResourceArn()
        - .ifPassedToService()

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toPassRole", []))

    @jsii.member(jsii_name="toPutGroupPolicy")
    def to_put_group_policy(self) -> "Iam":
        '''(experimental) Grants permission to create or update an inline policy document that is embedded in the specified IAM group.

        Access Level: Permissions management

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutGroupPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toPutGroupPolicy", []))

    @jsii.member(jsii_name="toPutRolePermissionsBoundary")
    def to_put_role_permissions_boundary(self) -> "Iam":
        '''(experimental) Grants permission to set a managed policy as a permissions boundary for a role.

        Access Level: Permissions management

        Possible conditions:

        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutRolePermissionsBoundary.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toPutRolePermissionsBoundary", []))

    @jsii.member(jsii_name="toPutRolePolicy")
    def to_put_role_policy(self) -> "Iam":
        '''(experimental) Grants permission to create or update an inline policy document that is embedded in the specified IAM role.

        Access Level: Permissions management

        Possible conditions:

        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutRolePolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toPutRolePolicy", []))

    @jsii.member(jsii_name="toPutUserPermissionsBoundary")
    def to_put_user_permissions_boundary(self) -> "Iam":
        '''(experimental) Grants permission to set a managed policy as a permissions boundary for an IAM user.

        Access Level: Permissions management

        Possible conditions:

        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutUserPermissionsBoundary.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toPutUserPermissionsBoundary", []))

    @jsii.member(jsii_name="toPutUserPolicy")
    def to_put_user_policy(self) -> "Iam":
        '''(experimental) Grants permission to create or update an inline policy document that is embedded in the specified IAM user.

        Access Level: Permissions management

        Possible conditions:

        - .ifPermissionsBoundary()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutUserPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toPutUserPolicy", []))

    @jsii.member(jsii_name="toRemoveClientIDFromOpenIDConnectProvider")
    def to_remove_client_id_from_open_id_connect_provider(self) -> "Iam":
        '''(experimental) Grants permission to remove the client ID (audience) from the list of client IDs in the specified IAM OpenID Connect (OIDC) provider resource.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_RemoveClientIDFromOpenIDConnectProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toRemoveClientIDFromOpenIDConnectProvider", []))

    @jsii.member(jsii_name="toRemoveRoleFromInstanceProfile")
    def to_remove_role_from_instance_profile(self) -> "Iam":
        '''(experimental) Grants permission to remove an IAM role from the specified EC2 instance profile.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_RemoveRoleFromInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toRemoveRoleFromInstanceProfile", []))

    @jsii.member(jsii_name="toRemoveUserFromGroup")
    def to_remove_user_from_group(self) -> "Iam":
        '''(experimental) Grants permission to remove an IAM user from the specified group.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_RemoveUserFromGroup.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toRemoveUserFromGroup", []))

    @jsii.member(jsii_name="toResetServiceSpecificCredential")
    def to_reset_service_specific_credential(self) -> "Iam":
        '''(experimental) Grants permission to reset the password for an existing service-specific credential for an IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ResetServiceSpecificCredential.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toResetServiceSpecificCredential", []))

    @jsii.member(jsii_name="toResyncMFADevice")
    def to_resync_mfa_device(self) -> "Iam":
        '''(experimental) Grants permission to synchronize the specified MFA device with its IAM entity (user or role).

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_ResyncMFADevice.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toResyncMFADevice", []))

    @jsii.member(jsii_name="toSetDefaultPolicyVersion")
    def to_set_default_policy_version(self) -> "Iam":
        '''(experimental) Grants permission to set the version of the specified policy as the policy's default version.

        Access Level: Permissions management

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_SetDefaultPolicyVersion.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toSetDefaultPolicyVersion", []))

    @jsii.member(jsii_name="toSetSecurityTokenServicePreferences")
    def to_set_security_token_service_preferences(self) -> "Iam":
        '''(experimental) Grants permission to set the STS global endpoint token version.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_SetSecurityTokenServicePreferences.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toSetSecurityTokenServicePreferences", []))

    @jsii.member(jsii_name="toSetSTSRegionalEndpointStatus")
    def to_set_sts_regional_endpoint_status(self) -> "Iam":
        '''(experimental) Grants permission to activate or deactivate an STS regional endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toSetSTSRegionalEndpointStatus", []))

    @jsii.member(jsii_name="toSimulateCustomPolicy")
    def to_simulate_custom_policy(self) -> "Iam":
        '''(experimental) Grants permission to simulate whether an identity-based policy or resource-based policy provides permissions for specific API operations and resources.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_SimulateCustomPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toSimulateCustomPolicy", []))

    @jsii.member(jsii_name="toSimulatePrincipalPolicy")
    def to_simulate_principal_policy(self) -> "Iam":
        '''(experimental) Grants permission to simulate whether an identity-based policy that is attached to a specified IAM entity (user or role) provides permissions for specific API operations and resources.

        Access Level: Read

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_SimulatePrincipalPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toSimulatePrincipalPolicy", []))

    @jsii.member(jsii_name="toTagInstanceProfile")
    def to_tag_instance_profile(self) -> "Iam":
        '''(experimental) Grants permission to add tags to an instance profile.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_TagInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toTagInstanceProfile", []))

    @jsii.member(jsii_name="toTagMFADevice")
    def to_tag_mfa_device(self) -> "Iam":
        '''(experimental) Grants permission to add tags to a virtual mfa device.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_TagMFADevice.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toTagMFADevice", []))

    @jsii.member(jsii_name="toTagOpenIDConnectProvider")
    def to_tag_open_id_connect_provider(self) -> "Iam":
        '''(experimental) Grants permission to add tags to an OpenID Connect provider.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_TagOpenIDConnectProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toTagOpenIDConnectProvider", []))

    @jsii.member(jsii_name="toTagPolicy")
    def to_tag_policy(self) -> "Iam":
        '''(experimental) Grants permission to add tags to a managed policy.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_TagPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toTagPolicy", []))

    @jsii.member(jsii_name="toTagRole")
    def to_tag_role(self) -> "Iam":
        '''(experimental) Grants permission to add tags to an IAM role.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_TagRole.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toTagRole", []))

    @jsii.member(jsii_name="toTagSAMLProvider")
    def to_tag_saml_provider(self) -> "Iam":
        '''(experimental) Grants permission to add tags to a SAML Provider.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_TagSAMLProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toTagSAMLProvider", []))

    @jsii.member(jsii_name="toTagServerCertificate")
    def to_tag_server_certificate(self) -> "Iam":
        '''(experimental) Grants permission to add tags to a server certificate.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_TagServerCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toTagServerCertificate", []))

    @jsii.member(jsii_name="toTagUser")
    def to_tag_user(self) -> "Iam":
        '''(experimental) Grants permission to add tags to an IAM user.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_TagUser.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toTagUser", []))

    @jsii.member(jsii_name="toUntagInstanceProfile")
    def to_untag_instance_profile(self) -> "Iam":
        '''(experimental) Grants permission to remove the specified tags from the instance profile.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UntagInstanceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUntagInstanceProfile", []))

    @jsii.member(jsii_name="toUntagMFADevice")
    def to_untag_mfa_device(self) -> "Iam":
        '''(experimental) Grants permission to remove the specified tags from the virtual mfa device.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UntagMFADevice.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUntagMFADevice", []))

    @jsii.member(jsii_name="toUntagOpenIDConnectProvider")
    def to_untag_open_id_connect_provider(self) -> "Iam":
        '''(experimental) Grants permission to remove the specified tags from the OpenID Connect provider.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UntagOpenIDConnectProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUntagOpenIDConnectProvider", []))

    @jsii.member(jsii_name="toUntagPolicy")
    def to_untag_policy(self) -> "Iam":
        '''(experimental) Grants permission to remove the specified tags from the managed policy.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UntagPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUntagPolicy", []))

    @jsii.member(jsii_name="toUntagRole")
    def to_untag_role(self) -> "Iam":
        '''(experimental) Grants permission to remove the specified tags from the role.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UntagRole.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUntagRole", []))

    @jsii.member(jsii_name="toUntagSAMLProvider")
    def to_untag_saml_provider(self) -> "Iam":
        '''(experimental) Grants permission to remove the specified tags from the SAML Provider.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UntagSAMLProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUntagSAMLProvider", []))

    @jsii.member(jsii_name="toUntagServerCertificate")
    def to_untag_server_certificate(self) -> "Iam":
        '''(experimental) Grants permission to remove the specified tags from the server certificate.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UntagServerCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUntagServerCertificate", []))

    @jsii.member(jsii_name="toUntagUser")
    def to_untag_user(self) -> "Iam":
        '''(experimental) Grants permission to remove the specified tags from the user.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UntagUser.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUntagUser", []))

    @jsii.member(jsii_name="toUpdateAccessKey")
    def to_update_access_key(self) -> "Iam":
        '''(experimental) Grants permission to update the status of the specified access key as Active or Inactive.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateAccessKey.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateAccessKey", []))

    @jsii.member(jsii_name="toUpdateAccountEmailAddress")
    def to_update_account_email_address(self) -> "Iam":
        '''(experimental) Grants permission to update the email address that is associated with the account.

        Access Level: Write

        https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-root-user.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateAccountEmailAddress", []))

    @jsii.member(jsii_name="toUpdateAccountName")
    def to_update_account_name(self) -> "Iam":
        '''(experimental) Grants permission to update the account name that is associated with the account.

        Access Level: Write

        https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-root-user.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateAccountName", []))

    @jsii.member(jsii_name="toUpdateAccountPasswordPolicy")
    def to_update_account_password_policy(self) -> "Iam":
        '''(experimental) Grants permission to update the password policy settings for the AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateAccountPasswordPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateAccountPasswordPolicy", []))

    @jsii.member(jsii_name="toUpdateAssumeRolePolicy")
    def to_update_assume_role_policy(self) -> "Iam":
        '''(experimental) Grants permission to update the policy that grants an IAM entity permission to assume a role.

        Access Level: Permissions management

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateAssumeRolePolicy.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateAssumeRolePolicy", []))

    @jsii.member(jsii_name="toUpdateCloudFrontPublicKey")
    def to_update_cloud_front_public_key(self) -> "Iam":
        '''(experimental) Grants permission to update an existing CloudFront public key.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateCloudFrontPublicKey", []))

    @jsii.member(jsii_name="toUpdateGroup")
    def to_update_group(self) -> "Iam":
        '''(experimental) Grants permission to update the name or path of the specified IAM group.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateGroup.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateGroup", []))

    @jsii.member(jsii_name="toUpdateLoginProfile")
    def to_update_login_profile(self) -> "Iam":
        '''(experimental) Grants permission to change the password for the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateLoginProfile.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateLoginProfile", []))

    @jsii.member(jsii_name="toUpdateOpenIDConnectProviderThumbprint")
    def to_update_open_id_connect_provider_thumbprint(self) -> "Iam":
        '''(experimental) Grants permission to update the entire list of server certificate thumbprints that are associated with an OpenID Connect (OIDC) provider resource.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateOpenIDConnectProviderThumbprint.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateOpenIDConnectProviderThumbprint", []))

    @jsii.member(jsii_name="toUpdateRole")
    def to_update_role(self) -> "Iam":
        '''(experimental) Grants permission to update the description or maximum session duration setting of a role.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateRole.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateRole", []))

    @jsii.member(jsii_name="toUpdateRoleDescription")
    def to_update_role_description(self) -> "Iam":
        '''(experimental) Grants permission to update only the description of a role.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateRoleDescription.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateRoleDescription", []))

    @jsii.member(jsii_name="toUpdateSAMLProvider")
    def to_update_saml_provider(self) -> "Iam":
        '''(experimental) Grants permission to update the metadata document for an existing SAML provider resource.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSAMLProvider.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateSAMLProvider", []))

    @jsii.member(jsii_name="toUpdateServerCertificate")
    def to_update_server_certificate(self) -> "Iam":
        '''(experimental) Grants permission to update the name or the path of the specified server certificate stored in IAM.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateServerCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateServerCertificate", []))

    @jsii.member(jsii_name="toUpdateServiceSpecificCredential")
    def to_update_service_specific_credential(self) -> "Iam":
        '''(experimental) Grants permission to update the status of a service-specific credential to active or inactive for an IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateServiceSpecificCredential.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateServiceSpecificCredential", []))

    @jsii.member(jsii_name="toUpdateSigningCertificate")
    def to_update_signing_certificate(self) -> "Iam":
        '''(experimental) Grants permission to update the status of the specified user signing certificate to active or disabled.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSigningCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateSigningCertificate", []))

    @jsii.member(jsii_name="toUpdateSSHPublicKey")
    def to_update_ssh_public_key(self) -> "Iam":
        '''(experimental) Grants permission to update the status of an IAM user's SSH public key to active or inactive.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSSHPublicKey.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateSSHPublicKey", []))

    @jsii.member(jsii_name="toUpdateUser")
    def to_update_user(self) -> "Iam":
        '''(experimental) Grants permission to update the name or the path of the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateUser.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUpdateUser", []))

    @jsii.member(jsii_name="toUploadCloudFrontPublicKey")
    def to_upload_cloud_front_public_key(self) -> "Iam":
        '''(experimental) Grants permission to upload a CloudFront public key.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-trusted-signers.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUploadCloudFrontPublicKey", []))

    @jsii.member(jsii_name="toUploadServerCertificate")
    def to_upload_server_certificate(self) -> "Iam":
        '''(experimental) Grants permission to upload a server certificate entity for the AWS account.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UploadServerCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUploadServerCertificate", []))

    @jsii.member(jsii_name="toUploadSigningCertificate")
    def to_upload_signing_certificate(self) -> "Iam":
        '''(experimental) Grants permission to upload an X.509 signing certificate and associate it with the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UploadSigningCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUploadSigningCertificate", []))

    @jsii.member(jsii_name="toUploadSSHPublicKey")
    def to_upload_ssh_public_key(self) -> "Iam":
        '''(experimental) Grants permission to upload an SSH public key and associate it with the specified IAM user.

        Access Level: Write

        https://docs.aws.amazon.com/IAM/latest/APIReference/API_UploadSSHPublicKey.html

        :stability: experimental
        '''
        return typing.cast("Iam", jsii.invoke(self, "toUploadSSHPublicKey", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ec3a25cda865b76ab319c82abdb412b2503640ddaa2f99acc53fc734cf8a7d2a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__000dfa9ec2bb199d4dff111daed65d9dfa096f4ace84aed96166ef4a6008d1de)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class IdentitySync(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.IdentitySync",
):
    '''(experimental) Statement provider for service `identity-sync <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsidentitysync.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `identity-sync <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsidentitysync.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__92963393e88b91438e80f593789c23a9cad8fcd36e57a687c583fefedfe31e41)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onSyncProfileResource")
    def on_sync_profile_resource(
        self,
        sync_profile_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "IdentitySync":
        '''(experimental) Adds a resource of type SyncProfileResource to the statement.

        https://docs.aws.amazon.com/singlesignon/latest/userguide/security-iam-awsmanpol.html

        :param sync_profile_name: - Identifier for the syncProfileName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0e960d5c90e13f1fa7ad8d67d697c7e10bc74631e6a98ca4a6c5c0dc6137be94)
            check_type(argname="argument sync_profile_name", value=sync_profile_name, expected_type=type_hints["sync_profile_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("IdentitySync", jsii.invoke(self, "onSyncProfileResource", [sync_profile_name, account, region, partition]))

    @jsii.member(jsii_name="onSyncTargetResource")
    def on_sync_target_resource(
        self,
        sync_profile_name: builtins.str,
        sync_target_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "IdentitySync":
        '''(experimental) Adds a resource of type SyncTargetResource to the statement.

        https://docs.aws.amazon.com/singlesignon/latest/userguide/security-iam-awsmanpol.html

        :param sync_profile_name: - Identifier for the syncProfileName.
        :param sync_target_name: - Identifier for the syncTargetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6eac25ae684532f35d56dd26bdb56649a419913f1ebfec83acfee204d3ccab5d)
            check_type(argname="argument sync_profile_name", value=sync_profile_name, expected_type=type_hints["sync_profile_name"])
            check_type(argname="argument sync_target_name", value=sync_target_name, expected_type=type_hints["sync_target_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("IdentitySync", jsii.invoke(self, "onSyncTargetResource", [sync_profile_name, sync_target_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateSyncFilter")
    def to_create_sync_filter(self) -> "IdentitySync":
        '''(experimental) Grants permission to create a sync filter on the sync profile.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/security-iam-awsmanpol.html

        :stability: experimental
        '''
        return typing.cast("IdentitySync", jsii.invoke(self, "toCreateSyncFilter", []))

    @jsii.member(jsii_name="toCreateSyncProfile")
    def to_create_sync_profile(self) -> "IdentitySync":
        '''(experimental) Grants permission to create a sync profile for the identity source.

        Access Level: Write

        Dependent actions:

        - ds:AuthorizeApplication

        https://docs.aws.amazon.com/singlesignon/latest/userguide/security-iam-awsmanpol.html

        :stability: experimental
        '''
        return typing.cast("IdentitySync", jsii.invoke(self, "toCreateSyncProfile", []))

    @jsii.member(jsii_name="toCreateSyncTarget")
    def to_create_sync_target(self) -> "IdentitySync":
        '''(experimental) Grants permission to create a sync target for the identity source.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/security-iam-awsmanpol.html

        :stability: experimental
        '''
        return typing.cast("IdentitySync", jsii.invoke(self, "toCreateSyncTarget", []))

    @jsii.member(jsii_name="toDeleteSyncFilter")
    def to_delete_sync_filter(self) -> "IdentitySync":
        '''(experimental) Grants permission to delete a sync filter from the sync profile.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/security-iam-awsmanpol.html

        :stability: experimental
        '''
        return typing.cast("IdentitySync", jsii.invoke(self, "toDeleteSyncFilter", []))

    @jsii.member(jsii_name="toDeleteSyncProfile")
    def to_delete_sync_profile(self) -> "IdentitySync":
        '''(experimental) Grants permission to delete a sync profile from the source.

        Access Level: Write

        Dependent actions:

        - ds:UnauthorizeApplication

        https://docs.aws.amazon.com/singlesignon/latest/userguide/security-iam-awsmanpol.html

        :stability: experimental
        '''
        return typing.cast("IdentitySync", jsii.invoke(self, "toDeleteSyncProfile", []))

    @jsii.member(jsii_name="toDeleteSyncTarget")
    def to_delete_sync_target(self) -> "IdentitySync":
        '''(experimental) Grants permission to delete a sync target from the source.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/security-iam-awsmanpol.html

        :stability: experimental
        '''
        return typing.cast("IdentitySync", jsii.invoke(self, "toDeleteSyncTarget", []))

    @jsii.member(jsii_name="toGetSyncProfile")
    def to_get_sync_profile(self) -> "IdentitySync":
        '''(experimental) Grants permission to retrieve a sync profile by using a sync profile name.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/security-iam-awsmanpol.html

        :stability: experimental
        '''
        return typing.cast("IdentitySync", jsii.invoke(self, "toGetSyncProfile", []))

    @jsii.member(jsii_name="toGetSyncTarget")
    def to_get_sync_target(self) -> "IdentitySync":
        '''(experimental) Grants permission to retrieve a sync target from the sync profile.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/security-iam-awsmanpol.html

        :stability: experimental
        '''
        return typing.cast("IdentitySync", jsii.invoke(self, "toGetSyncTarget", []))

    @jsii.member(jsii_name="toListSyncFilters")
    def to_list_sync_filters(self) -> "IdentitySync":
        '''(experimental) Grants permission to list the sync filters from the sync profile.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/userguide/security-iam-awsmanpol.html

        :stability: experimental
        '''
        return typing.cast("IdentitySync", jsii.invoke(self, "toListSyncFilters", []))

    @jsii.member(jsii_name="toStartSync")
    def to_start_sync(self) -> "IdentitySync":
        '''(experimental) Grants permission to start a sync process or to resume a sync process that was previously paused.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/security-iam-awsmanpol.html

        :stability: experimental
        '''
        return typing.cast("IdentitySync", jsii.invoke(self, "toStartSync", []))

    @jsii.member(jsii_name="toStopSync")
    def to_stop_sync(self) -> "IdentitySync":
        '''(experimental) Grants permission to stop any planned sync process in the sync schedule from starting.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/security-iam-awsmanpol.html

        :stability: experimental
        '''
        return typing.cast("IdentitySync", jsii.invoke(self, "toStopSync", []))

    @jsii.member(jsii_name="toUpdateSyncTarget")
    def to_update_sync_target(self) -> "IdentitySync":
        '''(experimental) Grants permission to update a sync target on the sync profile.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/security-iam-awsmanpol.html

        :stability: experimental
        '''
        return typing.cast("IdentitySync", jsii.invoke(self, "toUpdateSyncTarget", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__52e374d38af76c6ddeef840dd99bac5836486dbcde76add6fc8c07f2f8fc2607)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d14e3c75ead70d8453eda57fe8c6c2a01344606d58efbd5b2bb5510a2e5bafa6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Identitystore(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Identitystore",
):
    '''(experimental) Statement provider for service `identitystore <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsidentitystore.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `identitystore <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsidentitystore.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__14034568c365e40c2cf86d188122e51c07e0dc5eec5d634a92b939c0ac9eb83e)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAllGroupMemberships")
    def on_all_group_memberships(
        self,
        resource_name: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Identitystore":
        '''(experimental) Adds a resource of type AllGroupMemberships to the statement.

        https://docs.aws.amazon.com/singlesignon/latest/

        :param resource_name: - Identifier for the resourceName.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8504badce8011ae8a2915acbabac84ed02a6a7554c9f954ad4a4e46c03ba9d43)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Identitystore", jsii.invoke(self, "onAllGroupMemberships", [resource_name, partition]))

    @jsii.member(jsii_name="onAllGroups")
    def on_all_groups(
        self,
        resource_name: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Identitystore":
        '''(experimental) Adds a resource of type AllGroups to the statement.

        https://docs.aws.amazon.com/singlesignon/latest/

        :param resource_name: - Identifier for the resourceName.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e23bc4ef1109dd043d6f16575d0b35d4fd36d84d6fc04272b8edd3fd5f87af13)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Identitystore", jsii.invoke(self, "onAllGroups", [resource_name, partition]))

    @jsii.member(jsii_name="onAllUsers")
    def on_all_users(
        self,
        resource_name: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Identitystore":
        '''(experimental) Adds a resource of type AllUsers to the statement.

        https://docs.aws.amazon.com/singlesignon/latest/

        :param resource_name: - Identifier for the resourceName.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__46bf65000a65ea37a43bcfa13441aca74d39902ba0fae42b57d60578667cf049)
            check_type(argname="argument resource_name", value=resource_name, expected_type=type_hints["resource_name"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Identitystore", jsii.invoke(self, "onAllUsers", [resource_name, partition]))

    @jsii.member(jsii_name="onGroup")
    def on_group(
        self,
        group_id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Identitystore":
        '''(experimental) Adds a resource of type Group to the statement.

        https://docs.aws.amazon.com/singlesignon/latest/

        :param group_id: - Identifier for the groupId.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__545a07bae68752e4717952579d17459dde8485051ebbfd40a4344f878f9eee52)
            check_type(argname="argument group_id", value=group_id, expected_type=type_hints["group_id"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Identitystore", jsii.invoke(self, "onGroup", [group_id, partition]))

    @jsii.member(jsii_name="onGroupMembership")
    def on_group_membership(
        self,
        membership_id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Identitystore":
        '''(experimental) Adds a resource of type GroupMembership to the statement.

        https://docs.aws.amazon.com/singlesignon/latest/

        :param membership_id: - Identifier for the membershipId.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a610d2c790797d64ca9980d2a45f8e558d9b27ca214da8cc5dddfa49ef82d288)
            check_type(argname="argument membership_id", value=membership_id, expected_type=type_hints["membership_id"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Identitystore", jsii.invoke(self, "onGroupMembership", [membership_id, partition]))

    @jsii.member(jsii_name="onIdentitystore")
    def on_identitystore(
        self,
        identity_store_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Identitystore":
        '''(experimental) Adds a resource of type Identitystore to the statement.

        https://docs.aws.amazon.com/singlesignon/latest/

        :param identity_store_id: - Identifier for the identityStoreId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5e06c55514bb1dfde8361060d958c452eedd4779313e5ca337d267081f8b1ca9)
            check_type(argname="argument identity_store_id", value=identity_store_id, expected_type=type_hints["identity_store_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Identitystore", jsii.invoke(self, "onIdentitystore", [identity_store_id, account, partition]))

    @jsii.member(jsii_name="onUser")
    def on_user(
        self,
        user_id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Identitystore":
        '''(experimental) Adds a resource of type User to the statement.

        https://docs.aws.amazon.com/singlesignon/latest/

        :param user_id: - Identifier for the userId.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__50c66ea2c810499549eeef7142261d19d95fa8a8a4f9c1850e4a48ab2f9497f2)
            check_type(argname="argument user_id", value=user_id, expected_type=type_hints["user_id"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Identitystore", jsii.invoke(self, "onUser", [user_id, partition]))

    @jsii.member(jsii_name="toCreateGroup")
    def to_create_group(self) -> "Identitystore":
        '''(experimental) Grants permission to create a group in the specified IdentityStore.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_CreateGroup.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toCreateGroup", []))

    @jsii.member(jsii_name="toCreateGroupMembership")
    def to_create_group_membership(self) -> "Identitystore":
        '''(experimental) Grants permission to create a member to a group in the specified IdentityStore.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_CreateGroupMembership.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toCreateGroupMembership", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Identitystore":
        '''(experimental) Grants permission to create a user in the specified IdentityStore.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_CreateUser.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toDeleteGroup")
    def to_delete_group(self) -> "Identitystore":
        '''(experimental) Grants permission to delete a group in the specified IdentityStore.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_DeleteGroup.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toDeleteGroup", []))

    @jsii.member(jsii_name="toDeleteGroupMembership")
    def to_delete_group_membership(self) -> "Identitystore":
        '''(experimental) Grants permission to remove a member that is part of a group in the specified IdentityStore.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_DeleteGroupMembership.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toDeleteGroupMembership", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "Identitystore":
        '''(experimental) Grants permission to delete a user in the specified IdentityStore.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDescribeGroup")
    def to_describe_group(self) -> "Identitystore":
        '''(experimental) Grants permission to retrieve information about a group in the specified IdentityStore.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_DescribeGroup.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toDescribeGroup", []))

    @jsii.member(jsii_name="toDescribeGroupMembership")
    def to_describe_group_membership(self) -> "Identitystore":
        '''(experimental) Grants permission to retrieve information about a member that is part of a group in the specified IdentityStore.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_DescribeGroupMembership.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toDescribeGroupMembership", []))

    @jsii.member(jsii_name="toDescribeUser")
    def to_describe_user(self) -> "Identitystore":
        '''(experimental) Grants permission to retrieve information about user in the specified IdentityStore.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_DescribeUser.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toDescribeUser", []))

    @jsii.member(jsii_name="toGetGroupId")
    def to_get_group_id(self) -> "Identitystore":
        '''(experimental) Grants permission to retrieve ID information about group in the specified IdentityStore.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_GetGroupId.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toGetGroupId", []))

    @jsii.member(jsii_name="toGetGroupMembershipId")
    def to_get_group_membership_id(self) -> "Identitystore":
        '''(experimental) Grants permission to retrieve ID information of a member which is part of a group in the specified IdentityStore.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_GetGroupMembershipId.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toGetGroupMembershipId", []))

    @jsii.member(jsii_name="toGetUserId")
    def to_get_user_id(self) -> "Identitystore":
        '''(experimental) Grants permission to retrieves ID information about user in the specified IdentityStore.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_GetUserId.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toGetUserId", []))

    @jsii.member(jsii_name="toIsMemberInGroups")
    def to_is_member_in_groups(self) -> "Identitystore":
        '''(experimental) Grants permission to check if a member is a part of groups in the specified IdentityStore.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_IsMemberInGroups.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toIsMemberInGroups", []))

    @jsii.member(jsii_name="toListGroupMemberships")
    def to_list_group_memberships(self) -> "Identitystore":
        '''(experimental) Grants permission to retrieve all members that are part of a group in the specified IdentityStore.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_ListGroupMemberships.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toListGroupMemberships", []))

    @jsii.member(jsii_name="toListGroupMembershipsForMember")
    def to_list_group_memberships_for_member(self) -> "Identitystore":
        '''(experimental) Grants permission to list groups of the target member in the specified IdentityStore.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_ListGroupMembershipsForMember.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toListGroupMembershipsForMember", []))

    @jsii.member(jsii_name="toListGroups")
    def to_list_groups(self) -> "Identitystore":
        '''(experimental) Grants permission to search for groups within the specified IdentityStore.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_ListGroups.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toListGroups", []))

    @jsii.member(jsii_name="toListUsers")
    def to_list_users(self) -> "Identitystore":
        '''(experimental) Grants permission to search for users in the specified IdentityStore.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_ListUsers.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toListUsers", []))

    @jsii.member(jsii_name="toUpdateGroup")
    def to_update_group(self) -> "Identitystore":
        '''(experimental) Grants permission to update information about a group in the specified IdentityStore.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_UpdateGroup.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toUpdateGroup", []))

    @jsii.member(jsii_name="toUpdateUser")
    def to_update_user(self) -> "Identitystore":
        '''(experimental) Grants permission to update user information in the specified IdentityStore.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_UpdateUser.html

        :stability: experimental
        '''
        return typing.cast("Identitystore", jsii.invoke(self, "toUpdateUser", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e25b52a548fb64171fde4f15217c55e594de47671ad02e0d7870ea1f52bb3d93)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d5fe936599d716a2a331be185aa358adb07f7f28d675babd7f2cbe28112397f2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class IdentitystoreAuth(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.IdentitystoreAuth",
):
    '''(experimental) Statement provider for service `identitystore-auth <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsidentitystoreauth.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `identitystore-auth <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsidentitystoreauth.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__192947964674bff2c0af60da6c30ed09e4ca3b275fc3b89359691446924d1173)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toBatchDeleteSession")
    def to_batch_delete_session(self) -> "IdentitystoreAuth":
        '''(experimental) Grants permission to delete a batch of specified sessions.

        Access Level: Write

        https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-app-session.html

        :stability: experimental
        '''
        return typing.cast("IdentitystoreAuth", jsii.invoke(self, "toBatchDeleteSession", []))

    @jsii.member(jsii_name="toBatchGetSession")
    def to_batch_get_session(self) -> "IdentitystoreAuth":
        '''(experimental) Grants permission to return session attributes for a batch of specified sessions.

        Access Level: Read

        https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-app-session.html

        :stability: experimental
        '''
        return typing.cast("IdentitystoreAuth", jsii.invoke(self, "toBatchGetSession", []))

    @jsii.member(jsii_name="toListSessions")
    def to_list_sessions(self) -> "IdentitystoreAuth":
        '''(experimental) Grants permission to retrieve a list of active sessions for the specified user.

        Access Level: List

        https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-app-session.html

        :stability: experimental
        '''
        return typing.cast("IdentitystoreAuth", jsii.invoke(self, "toListSessions", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__61cd26df4d5b4982dd422e6985ae7161d960d5e2acf617c83eb67e5352a558fb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c17a08073f8ec123cc598dba2364bfbc8e739d29aa5ce2ecb1eafac550a18cc4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Imagebuilder(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Imagebuilder",
):
    '''(experimental) Statement provider for service `imagebuilder <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2imagebuilder.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `imagebuilder <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2imagebuilder.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bca688477c500c047860e0da083edc7b74ffca8a39c0243b699329b39ddbacc5)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifCreatedResourceTag")
    def if_created_resource_tag(
        self,
        key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Imagebuilder":
        '''(experimental) Filters access by the tag key-value pairs attached to the resource created by Image Builder.

        https://docs.aws.amazon.com/imagebuilder/latest/userguide/security_iam_service-with-iam.html#image-builder-security-createdresourcetag

        Applies to actions:

        - .toCreateInfrastructureConfiguration()
        - .toUpdateInfrastructureConfiguration()

        :param key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ae36185078da0aacb6338ce55454d9870bd64151ecf9fdc02c5363cf287f0efb)
            check_type(argname="argument key", value=key, expected_type=type_hints["key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Imagebuilder", jsii.invoke(self, "ifCreatedResourceTag", [key, value, operator]))

    @jsii.member(jsii_name="ifCreatedResourceTagKeys")
    def if_created_resource_tag_keys(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Imagebuilder":
        '''(experimental) Filters access by the presence of tag keys in the request.

        https://docs.aws.amazon.com/imagebuilder/latest/userguide/security_iam_service-with-iam.html#image-builder-security-createdresourcetagkeys

        Applies to actions:

        - .toCreateInfrastructureConfiguration()
        - .toUpdateInfrastructureConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__09f47415c39f792bd0987a48f1028c90cda6081696ef3120faf07b57711cdf97)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Imagebuilder", jsii.invoke(self, "ifCreatedResourceTagKeys", [value, operator]))

    @jsii.member(jsii_name="ifEc2MetadataHttpTokens")
    def if_ec2_metadata_http_tokens(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Imagebuilder":
        '''(experimental) Filters access by the EC2 Instance Metadata HTTP Token Requirement specified in the request.

        https://docs.aws.amazon.com/imagebuilder/latest/userguide/security_iam_service-with-iam.html#image-builder-security-ec2metadatahttptokens

        Applies to actions:

        - .toCreateInfrastructureConfiguration()
        - .toUpdateInfrastructureConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__385740f1f0c2f07b30c3395fb4cebe22f11c04479c08daffc4da62e1a852cfaf)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Imagebuilder", jsii.invoke(self, "ifEc2MetadataHttpTokens", [value, operator]))

    @jsii.member(jsii_name="ifStatusTopicArn")
    def if_status_topic_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Imagebuilder":
        '''(experimental) Filters access by the SNS Topic Arn in the request to which terminal state notifications will be published.

        https://docs.aws.amazon.com/imagebuilder/latest/userguide/security_iam_service-with-iam.html#image-builder-security-statustopicarn

        Applies to actions:

        - .toCreateInfrastructureConfiguration()
        - .toUpdateInfrastructureConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__349a6759200e1d1e7a42f74960249bd01ee28245dae3fe23e7769c347e2d2112)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Imagebuilder", jsii.invoke(self, "ifStatusTopicArn", [value, operator]))

    @jsii.member(jsii_name="onComponent")
    def on_component(
        self,
        component_name: builtins.str,
        component_version: builtins.str,
        component_build_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Imagebuilder":
        '''(experimental) Adds a resource of type component to the statement.

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_Component.html

        :param component_name: - Identifier for the componentName.
        :param component_version: - Identifier for the componentVersion.
        :param component_build_version: - Identifier for the componentBuildVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__334306085cf209159cf99c075c5e5a43f100012c7493e8542cdbac9d6261afb0)
            check_type(argname="argument component_name", value=component_name, expected_type=type_hints["component_name"])
            check_type(argname="argument component_version", value=component_version, expected_type=type_hints["component_version"])
            check_type(argname="argument component_build_version", value=component_build_version, expected_type=type_hints["component_build_version"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Imagebuilder", jsii.invoke(self, "onComponent", [component_name, component_version, component_build_version, account, region, partition]))

    @jsii.member(jsii_name="onComponentVersion")
    def on_component_version(
        self,
        component_name: builtins.str,
        component_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Imagebuilder":
        '''(experimental) Adds a resource of type componentVersion to the statement.

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ComponentVersion

        :param component_name: - Identifier for the componentName.
        :param component_version: - Identifier for the componentVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e8d6d6870fb4b243cf6fe85482bb5d6199904fcc08595d429bf7c2cfd4061b31)
            check_type(argname="argument component_name", value=component_name, expected_type=type_hints["component_name"])
            check_type(argname="argument component_version", value=component_version, expected_type=type_hints["component_version"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Imagebuilder", jsii.invoke(self, "onComponentVersion", [component_name, component_version, account, region, partition]))

    @jsii.member(jsii_name="onContainerRecipe")
    def on_container_recipe(
        self,
        container_recipe_name: builtins.str,
        container_recipe_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Imagebuilder":
        '''(experimental) Adds a resource of type containerRecipe to the statement.

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ContainerRecipe.html

        :param container_recipe_name: - Identifier for the containerRecipeName.
        :param container_recipe_version: - Identifier for the containerRecipeVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__532bc6d4c97dc5544813e23421e72aebee626abc836b49825751029b739c5c03)
            check_type(argname="argument container_recipe_name", value=container_recipe_name, expected_type=type_hints["container_recipe_name"])
            check_type(argname="argument container_recipe_version", value=container_recipe_version, expected_type=type_hints["container_recipe_version"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Imagebuilder", jsii.invoke(self, "onContainerRecipe", [container_recipe_name, container_recipe_version, account, region, partition]))

    @jsii.member(jsii_name="onDistributionConfiguration")
    def on_distribution_configuration(
        self,
        distribution_configuration_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Imagebuilder":
        '''(experimental) Adds a resource of type distributionConfiguration to the statement.

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_DistributionConfiguration.html

        :param distribution_configuration_name: - Identifier for the distributionConfigurationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5224ad76b26e919c07c0f7b87242f218f8df20d0de0c6c7d3a33b748b2c3f76c)
            check_type(argname="argument distribution_configuration_name", value=distribution_configuration_name, expected_type=type_hints["distribution_configuration_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Imagebuilder", jsii.invoke(self, "onDistributionConfiguration", [distribution_configuration_name, account, region, partition]))

    @jsii.member(jsii_name="onImage")
    def on_image(
        self,
        image_name: builtins.str,
        image_version: builtins.str,
        image_build_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Imagebuilder":
        '''(experimental) Adds a resource of type image to the statement.

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_Image.html

        :param image_name: - Identifier for the imageName.
        :param image_version: - Identifier for the imageVersion.
        :param image_build_version: - Identifier for the imageBuildVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__93e0f86180d70da809891c18a52d305974332ff6159390c7fd73f17b8e2fca0b)
            check_type(argname="argument image_name", value=image_name, expected_type=type_hints["image_name"])
            check_type(argname="argument image_version", value=image_version, expected_type=type_hints["image_version"])
            check_type(argname="argument image_build_version", value=image_build_version, expected_type=type_hints["image_build_version"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Imagebuilder", jsii.invoke(self, "onImage", [image_name, image_version, image_build_version, account, region, partition]))

    @jsii.member(jsii_name="onImagePipeline")
    def on_image_pipeline(
        self,
        image_pipeline_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Imagebuilder":
        '''(experimental) Adds a resource of type imagePipeline to the statement.

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ImagePipeline.html

        :param image_pipeline_name: - Identifier for the imagePipelineName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4d52910595d8443af2ccd101ae4d462156f35fbd49437b8fc9f3b645a62ddbb7)
            check_type(argname="argument image_pipeline_name", value=image_pipeline_name, expected_type=type_hints["image_pipeline_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Imagebuilder", jsii.invoke(self, "onImagePipeline", [image_pipeline_name, account, region, partition]))

    @jsii.member(jsii_name="onImageRecipe")
    def on_image_recipe(
        self,
        image_recipe_name: builtins.str,
        image_recipe_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Imagebuilder":
        '''(experimental) Adds a resource of type imageRecipe to the statement.

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ImageRecipe.html

        :param image_recipe_name: - Identifier for the imageRecipeName.
        :param image_recipe_version: - Identifier for the imageRecipeVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5717bcb2e225655b7d0c3c0733a454fcdb1dff1919207e406714c1368e7e8254)
            check_type(argname="argument image_recipe_name", value=image_recipe_name, expected_type=type_hints["image_recipe_name"])
            check_type(argname="argument image_recipe_version", value=image_recipe_version, expected_type=type_hints["image_recipe_version"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Imagebuilder", jsii.invoke(self, "onImageRecipe", [image_recipe_name, image_recipe_version, account, region, partition]))

    @jsii.member(jsii_name="onImageVersion")
    def on_image_version(
        self,
        image_name: builtins.str,
        image_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Imagebuilder":
        '''(experimental) Adds a resource of type imageVersion to the statement.

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ImageVersion.html

        :param image_name: - Identifier for the imageName.
        :param image_version: - Identifier for the imageVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2000fe2b62723e7e530b434a961f57e3fbe84081f4f0c2e9a1ad86cd404fde2c)
            check_type(argname="argument image_name", value=image_name, expected_type=type_hints["image_name"])
            check_type(argname="argument image_version", value=image_version, expected_type=type_hints["image_version"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Imagebuilder", jsii.invoke(self, "onImageVersion", [image_name, image_version, account, region, partition]))

    @jsii.member(jsii_name="onInfrastructureConfiguration")
    def on_infrastructure_configuration(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Imagebuilder":
        '''(experimental) Adds a resource of type infrastructureConfiguration to the statement.

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_InfrastructureConfiguration.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__13db9ba9a2912ef466a0d628663f29da1772856dba1be9473b8368c5e0c62b52)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Imagebuilder", jsii.invoke(self, "onInfrastructureConfiguration", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onKmsKey")
    def on_kms_key(
        self,
        key_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Imagebuilder":
        '''(experimental) Adds a resource of type kmsKey to the statement.

        https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys

        :param key_id: - Identifier for the keyId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__de4de5f476310c7da7374ca5db1529ababfb41b16c9c91d6b0b6b3cb6706b8ae)
            check_type(argname="argument key_id", value=key_id, expected_type=type_hints["key_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Imagebuilder", jsii.invoke(self, "onKmsKey", [key_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelImageCreation")
    def to_cancel_image_creation(self) -> "Imagebuilder":
        '''(experimental) Grants permission to cancel an image creation.

        Access Level: Write

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_CancelImageCreation.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toCancelImageCreation", []))

    @jsii.member(jsii_name="toCreateComponent")
    def to_create_component(self) -> "Imagebuilder":
        '''(experimental) Grants permission to create a new component.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - imagebuilder:TagResource
        - kms:Encrypt
        - kms:GenerateDataKey
        - kms:GenerateDataKeyWithoutPlaintext

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_CreateComponent.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toCreateComponent", []))

    @jsii.member(jsii_name="toCreateContainerRecipe")
    def to_create_container_recipe(self) -> "Imagebuilder":
        '''(experimental) Grants permission to create a new Container Recipe.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ecr:DescribeImages
        - ecr:DescribeRepositories
        - iam:CreateServiceLinkedRole
        - imagebuilder:GetComponent
        - imagebuilder:GetImage
        - imagebuilder:TagResource
        - kms:Encrypt
        - kms:GenerateDataKey
        - kms:GenerateDataKeyWithoutPlaintext

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_CreateContainerRecipe.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toCreateContainerRecipe", []))

    @jsii.member(jsii_name="toCreateDistributionConfiguration")
    def to_create_distribution_configuration(self) -> "Imagebuilder":
        '''(experimental) Grants permission to create a new distribution configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - imagebuilder:TagResource

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_CreateDistributionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toCreateDistributionConfiguration", []))

    @jsii.member(jsii_name="toCreateImage")
    def to_create_image(self) -> "Imagebuilder":
        '''(experimental) Grants permission to create a new image.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - imagebuilder:GetContainerRecipe
        - imagebuilder:GetDistributionConfiguration
        - imagebuilder:GetImageRecipe
        - imagebuilder:GetInfrastructureConfiguration
        - imagebuilder:TagResource

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_CreateImage.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toCreateImage", []))

    @jsii.member(jsii_name="toCreateImagePipeline")
    def to_create_image_pipeline(self) -> "Imagebuilder":
        '''(experimental) Grants permission to create a new image pipeline.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - imagebuilder:GetContainerRecipe
        - imagebuilder:GetImageRecipe
        - imagebuilder:TagResource

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_CreateImagePipeline.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toCreateImagePipeline", []))

    @jsii.member(jsii_name="toCreateImageRecipe")
    def to_create_image_recipe(self) -> "Imagebuilder":
        '''(experimental) Grants permission to create a new Image Recipe.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:DescribeImages
        - iam:CreateServiceLinkedRole
        - imagebuilder:GetComponent
        - imagebuilder:GetImage
        - imagebuilder:TagResource

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_CreateImageRecipe.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toCreateImageRecipe", []))

    @jsii.member(jsii_name="toCreateInfrastructureConfiguration")
    def to_create_infrastructure_configuration(self) -> "Imagebuilder":
        '''(experimental) Grants permission to create a new infrastructure configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifCreatedResourceTagKeys()
        - .ifCreatedResourceTag()
        - .ifEc2MetadataHttpTokens()
        - .ifStatusTopicArn()

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - iam:PassRole
        - imagebuilder:TagResource
        - sns:Publish

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_CreateInfrastructureConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toCreateInfrastructureConfiguration", []))

    @jsii.member(jsii_name="toDeleteComponent")
    def to_delete_component(self) -> "Imagebuilder":
        '''(experimental) Grants permission to delete a component.

        Access Level: Write

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_DeleteComponent.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toDeleteComponent", []))

    @jsii.member(jsii_name="toDeleteContainerRecipe")
    def to_delete_container_recipe(self) -> "Imagebuilder":
        '''(experimental) Grants permission to delete a container recipe.

        Access Level: Write

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_DeleteContainerRecipe.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toDeleteContainerRecipe", []))

    @jsii.member(jsii_name="toDeleteDistributionConfiguration")
    def to_delete_distribution_configuration(self) -> "Imagebuilder":
        '''(experimental) Grants permission to delete a distribution configuration.

        Access Level: Write

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_DeleteDistributionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toDeleteDistributionConfiguration", []))

    @jsii.member(jsii_name="toDeleteImage")
    def to_delete_image(self) -> "Imagebuilder":
        '''(experimental) Grants permission to delete an image.

        Access Level: Write

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_DeleteImage.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toDeleteImage", []))

    @jsii.member(jsii_name="toDeleteImagePipeline")
    def to_delete_image_pipeline(self) -> "Imagebuilder":
        '''(experimental) Grants permission to delete an image pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_DeleteImagePipeline.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toDeleteImagePipeline", []))

    @jsii.member(jsii_name="toDeleteImageRecipe")
    def to_delete_image_recipe(self) -> "Imagebuilder":
        '''(experimental) Grants permission to delete an image recipe.

        Access Level: Write

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_DeleteImageRecipe.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toDeleteImageRecipe", []))

    @jsii.member(jsii_name="toDeleteInfrastructureConfiguration")
    def to_delete_infrastructure_configuration(self) -> "Imagebuilder":
        '''(experimental) Grants permission to delete an infrastructure configuration.

        Access Level: Write

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_DeleteInfrastructureConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toDeleteInfrastructureConfiguration", []))

    @jsii.member(jsii_name="toGetComponent")
    def to_get_component(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view details about a component.

        Access Level: Read

        Dependent actions:

        - kms:Decrypt

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetComponent.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetComponent", []))

    @jsii.member(jsii_name="toGetComponentPolicy")
    def to_get_component_policy(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view the resource policy associated with a component.

        Access Level: Read

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetComponentPolicy.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetComponentPolicy", []))

    @jsii.member(jsii_name="toGetContainerRecipe")
    def to_get_container_recipe(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view details about a container recipe.

        Access Level: Read

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetContainerRecipe.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetContainerRecipe", []))

    @jsii.member(jsii_name="toGetContainerRecipePolicy")
    def to_get_container_recipe_policy(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view the resource policy associated with a container recipe.

        Access Level: Read

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetContainerRecipePolicy.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetContainerRecipePolicy", []))

    @jsii.member(jsii_name="toGetDistributionConfiguration")
    def to_get_distribution_configuration(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view details about a distribution configuration.

        Access Level: Read

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetDistributionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetDistributionConfiguration", []))

    @jsii.member(jsii_name="toGetImage")
    def to_get_image(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view details about an image.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetImage.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetImage", []))

    @jsii.member(jsii_name="toGetImagePipeline")
    def to_get_image_pipeline(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view details about an image pipeline.

        Access Level: Read

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetImagePipeline.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetImagePipeline", []))

    @jsii.member(jsii_name="toGetImagePolicy")
    def to_get_image_policy(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view the resource policy associated with an image.

        Access Level: Read

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetImagePolicy.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetImagePolicy", []))

    @jsii.member(jsii_name="toGetImageRecipe")
    def to_get_image_recipe(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view details about an image recipe.

        Access Level: Read

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetImageRecipe.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetImageRecipe", []))

    @jsii.member(jsii_name="toGetImageRecipePolicy")
    def to_get_image_recipe_policy(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view the resource policy associated with an image recipe.

        Access Level: Read

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetImageRecipePolicy.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetImageRecipePolicy", []))

    @jsii.member(jsii_name="toGetInfrastructureConfiguration")
    def to_get_infrastructure_configuration(self) -> "Imagebuilder":
        '''(experimental) Grants permission to view details about an infrastructure configuration.

        Access Level: Read

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_GetInfrastructureConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toGetInfrastructureConfiguration", []))

    @jsii.member(jsii_name="toImportComponent")
    def to_import_component(self) -> "Imagebuilder":
        '''(experimental) Grants permission to import a new component.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - imagebuilder:TagResource
        - kms:Encrypt
        - kms:GenerateDataKey
        - kms:GenerateDataKeyWithoutPlaintext

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ImportComponent.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toImportComponent", []))

    @jsii.member(jsii_name="toImportVmImage")
    def to_import_vm_image(self) -> "Imagebuilder":
        '''(experimental) Grants permission to import an image.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:DescribeImportImageTasks
        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ImportVmImage.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toImportVmImage", []))

    @jsii.member(jsii_name="toListComponentBuildVersions")
    def to_list_component_build_versions(self) -> "Imagebuilder":
        '''(experimental) Grants permission to list the component build versions in your account.

        Access Level: List

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListComponentBuildVersions.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListComponentBuildVersions", []))

    @jsii.member(jsii_name="toListComponents")
    def to_list_components(self) -> "Imagebuilder":
        '''(experimental) Grants permission to list the component versions owned by or shared with your account.

        Access Level: List

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListComponents.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListComponents", []))

    @jsii.member(jsii_name="toListContainerRecipes")
    def to_list_container_recipes(self) -> "Imagebuilder":
        '''(experimental) Grants permission to list the container recipes owned by or shared with your account.

        Access Level: List

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListContainerRecipes.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListContainerRecipes", []))

    @jsii.member(jsii_name="toListDistributionConfigurations")
    def to_list_distribution_configurations(self) -> "Imagebuilder":
        '''(experimental) Grants permission to list the distribution configurations in your account.

        Access Level: List

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListDistributionConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListDistributionConfigurations", []))

    @jsii.member(jsii_name="toListImageBuildVersions")
    def to_list_image_build_versions(self) -> "Imagebuilder":
        '''(experimental) Grants permission to list the image build versions in your account.

        Access Level: List

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageBuildVersions.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListImageBuildVersions", []))

    @jsii.member(jsii_name="toListImagePackages")
    def to_list_image_packages(self) -> "Imagebuilder":
        '''(experimental) Grants permission to returns a list of packages installed on the specified image.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImagePackages.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListImagePackages", []))

    @jsii.member(jsii_name="toListImagePipelineImages")
    def to_list_image_pipeline_images(self) -> "Imagebuilder":
        '''(experimental) Grants permission to returns a list of images created by the specified pipeline.

        Access Level: List

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImagePipelineImages.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListImagePipelineImages", []))

    @jsii.member(jsii_name="toListImagePipelines")
    def to_list_image_pipelines(self) -> "Imagebuilder":
        '''(experimental) Grants permission to list the image pipelines in your account.

        Access Level: List

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImagePipelines.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListImagePipelines", []))

    @jsii.member(jsii_name="toListImageRecipes")
    def to_list_image_recipes(self) -> "Imagebuilder":
        '''(experimental) Grants permission to list the image recipes owned by or shared with your account.

        Access Level: List

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImageRecipes.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListImageRecipes", []))

    @jsii.member(jsii_name="toListImages")
    def to_list_images(self) -> "Imagebuilder":
        '''(experimental) Grants permission to list the image versions owned by or shared with your account.

        Access Level: List

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListImages.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListImages", []))

    @jsii.member(jsii_name="toListInfrastructureConfigurations")
    def to_list_infrastructure_configurations(self) -> "Imagebuilder":
        '''(experimental) Grants permission to list the infrastructure configurations in your account.

        Access Level: List

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListInfrastructureConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListInfrastructureConfigurations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Imagebuilder":
        '''(experimental) Grants permission to list tag for an Image Builder resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutComponentPolicy")
    def to_put_component_policy(self) -> "Imagebuilder":
        '''(experimental) Grants permission to set the resource policy associated with a component.

        Access Level: Permissions management

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_PutComponentPolicy.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toPutComponentPolicy", []))

    @jsii.member(jsii_name="toPutContainerRecipePolicy")
    def to_put_container_recipe_policy(self) -> "Imagebuilder":
        '''(experimental) Grants permission to set the resource policy associated with a container recipe.

        Access Level: Permissions management

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_PutContainerRecipePolicy.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toPutContainerRecipePolicy", []))

    @jsii.member(jsii_name="toPutImagePolicy")
    def to_put_image_policy(self) -> "Imagebuilder":
        '''(experimental) Grants permission to set the resource policy associated with an image.

        Access Level: Permissions management

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_PutImagePolicy.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toPutImagePolicy", []))

    @jsii.member(jsii_name="toPutImageRecipePolicy")
    def to_put_image_recipe_policy(self) -> "Imagebuilder":
        '''(experimental) Grants permission to set the resource policy associated with an image recipe.

        Access Level: Permissions management

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_PutImageRecipePolicy.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toPutImageRecipePolicy", []))

    @jsii.member(jsii_name="toStartImagePipelineExecution")
    def to_start_image_pipeline_execution(self) -> "Imagebuilder":
        '''(experimental) Grants permission to create a new image from a pipeline.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - imagebuilder:GetImagePipeline

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_StartImagePipelineExecution.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toStartImagePipelineExecution", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Imagebuilder":
        '''(experimental) Grants permission to tag an Image Builder resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Imagebuilder":
        '''(experimental) Grants permission to untag an Image Builder resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDistributionConfiguration")
    def to_update_distribution_configuration(self) -> "Imagebuilder":
        '''(experimental) Grants permission to update an existing distribution configuration.

        Access Level: Write

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_UpdateDistributionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toUpdateDistributionConfiguration", []))

    @jsii.member(jsii_name="toUpdateImagePipeline")
    def to_update_image_pipeline(self) -> "Imagebuilder":
        '''(experimental) Grants permission to update an existing image pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_UpdateImagePipeline.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toUpdateImagePipeline", []))

    @jsii.member(jsii_name="toUpdateInfrastructureConfiguration")
    def to_update_infrastructure_configuration(self) -> "Imagebuilder":
        '''(experimental) Grants permission to update an existing infrastructure configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifCreatedResourceTagKeys()
        - .ifCreatedResourceTag()
        - .ifEc2MetadataHttpTokens()
        - .ifStatusTopicArn()

        Dependent actions:

        - iam:PassRole
        - sns:Publish

        https://docs.aws.amazon.com/imagebuilder/latest/APIReference/API_UpdateInfrastructureConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Imagebuilder", jsii.invoke(self, "toUpdateInfrastructureConfiguration", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__da6e00cadb5c3e11a9b5d294e0fd23a5e370698ed4534a3c54a27961a83a4c7a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e0741a1740b19325d12cd7b5a7a0bbd6d5c052adc80b7702cd021de11887379d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Importexport(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Importexport",
):
    '''(experimental) Statement provider for service `importexport <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsimportexportdiskservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `importexport <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsimportexportdiskservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f22104a286a6393282f99386d3328872fc6e0b510c8cf972e0937ab5c728a644)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toCancelJob")
    def to_cancel_job(self) -> "Importexport":
        '''(experimental) This action cancels a specified job.

        Only the job owner can cancel it. The action fails if the job has already started or is complete.

        Access Level: Write

        https://docs.aws.amazon.com/AWSImportExport/latest/DG/WebCancelJob.html

        :stability: experimental
        '''
        return typing.cast("Importexport", jsii.invoke(self, "toCancelJob", []))

    @jsii.member(jsii_name="toCreateJob")
    def to_create_job(self) -> "Importexport":
        '''(experimental) This action initiates the process of scheduling an upload or download of your data.

        Access Level: Write

        https://docs.aws.amazon.com/AWSImportExport/latest/DG/WebCreateJob.html

        :stability: experimental
        '''
        return typing.cast("Importexport", jsii.invoke(self, "toCreateJob", []))

    @jsii.member(jsii_name="toGetShippingLabel")
    def to_get_shipping_label(self) -> "Importexport":
        '''(experimental) This action generates a pre-paid shipping label that you will use to ship your device to AWS for processing.

        Access Level: Read

        https://docs.aws.amazon.com/AWSImportExport/latest/DG/WebGetShippingLabel.html

        :stability: experimental
        '''
        return typing.cast("Importexport", jsii.invoke(self, "toGetShippingLabel", []))

    @jsii.member(jsii_name="toGetStatus")
    def to_get_status(self) -> "Importexport":
        '''(experimental) This action returns information about a job, including where the job is in the processing pipeline, the status of the results, and the signature value associated with the job.

        Access Level: Read

        https://docs.aws.amazon.com/AWSImportExport/latest/DG/WebGetStatus.html

        :stability: experimental
        '''
        return typing.cast("Importexport", jsii.invoke(self, "toGetStatus", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Importexport":
        '''(experimental) This action returns the jobs associated with the requester.

        Access Level: List

        https://docs.aws.amazon.com/AWSImportExport/latest/DG/WebListJobs.html

        :stability: experimental
        '''
        return typing.cast("Importexport", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toUpdateJob")
    def to_update_job(self) -> "Importexport":
        '''(experimental) You use this action to change the parameters specified in the original manifest file by supplying a new manifest file.

        Access Level: Write

        https://docs.aws.amazon.com/AWSImportExport/latest/DG/WebUpdateJob.html

        :stability: experimental
        '''
        return typing.cast("Importexport", jsii.invoke(self, "toUpdateJob", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cb2a54c7a7b1f0c2b3423e724c3be34157adbdcdb6f952c26e36d4ada0eaa63a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2a434151a3aac2783a1a5caf23af2a659102f8b0ff50bbc15f8354a8eee028f9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Inspector(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Inspector",
):
    '''(experimental) Statement provider for service `inspector <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoninspector.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `inspector <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoninspector.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__db6e3e829409ebc39cf46fa695c1cf3dd32ea014f824990db3c179f37567d733)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toAddAttributesToFindings")
    def to_add_attributes_to_findings(self) -> "Inspector":
        '''(experimental) Grants permission to assign attributes (key and value pairs) to the findings that are specified by the ARNs of the findings.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_AddAttributesToFindings.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toAddAttributesToFindings", []))

    @jsii.member(jsii_name="toCreateAssessmentTarget")
    def to_create_assessment_target(self) -> "Inspector":
        '''(experimental) Grants permission to create a new assessment target using the ARN of the resource group that is generated by CreateResourceGroup.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_CreateAssessmentTarget.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toCreateAssessmentTarget", []))

    @jsii.member(jsii_name="toCreateAssessmentTemplate")
    def to_create_assessment_template(self) -> "Inspector":
        '''(experimental) Grants permission to create an assessment template for the assessment target that is specified by the ARN of the assessment target.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_CreateAssessmentTemplate.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toCreateAssessmentTemplate", []))

    @jsii.member(jsii_name="toCreateExclusionsPreview")
    def to_create_exclusions_preview(self) -> "Inspector":
        '''(experimental) Grants permission to start the generation of an exclusions preview for the specified assessment template.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_CreateExclusionsPreview.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toCreateExclusionsPreview", []))

    @jsii.member(jsii_name="toCreateResourceGroup")
    def to_create_resource_group(self) -> "Inspector":
        '''(experimental) Grants permission to create a resource group using the specified set of tags (key and value pairs) that are used to select the EC2 instances to be included in an Amazon Inspector assessment target.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_CreateResourceGroup.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toCreateResourceGroup", []))

    @jsii.member(jsii_name="toDeleteAssessmentRun")
    def to_delete_assessment_run(self) -> "Inspector":
        '''(experimental) Grants permission to delete the assessment run that is specified by the ARN of the assessment run.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DeleteAssessmentRun.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDeleteAssessmentRun", []))

    @jsii.member(jsii_name="toDeleteAssessmentTarget")
    def to_delete_assessment_target(self) -> "Inspector":
        '''(experimental) Grants permission to delete the assessment target that is specified by the ARN of the assessment target.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DeleteAssessmentTarget.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDeleteAssessmentTarget", []))

    @jsii.member(jsii_name="toDeleteAssessmentTemplate")
    def to_delete_assessment_template(self) -> "Inspector":
        '''(experimental) Grants permission to delete the assessment template that is specified by the ARN of the assessment template.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DeleteAssessmentTemplate.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDeleteAssessmentTemplate", []))

    @jsii.member(jsii_name="toDescribeAssessmentRuns")
    def to_describe_assessment_runs(self) -> "Inspector":
        '''(experimental) Grants permission to describe the assessment runs that are specified by the ARNs of the assessment runs.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DescribeAssessmentRuns.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDescribeAssessmentRuns", []))

    @jsii.member(jsii_name="toDescribeAssessmentTargets")
    def to_describe_assessment_targets(self) -> "Inspector":
        '''(experimental) Grants permission to describe the assessment targets that are specified by the ARNs of the assessment targets.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DescribeAssessmentTargets.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDescribeAssessmentTargets", []))

    @jsii.member(jsii_name="toDescribeAssessmentTemplates")
    def to_describe_assessment_templates(self) -> "Inspector":
        '''(experimental) Grants permission to describe the assessment templates that are specified by the ARNs of the assessment templates.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DescribeAssessmentTemplates.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDescribeAssessmentTemplates", []))

    @jsii.member(jsii_name="toDescribeCrossAccountAccessRole")
    def to_describe_cross_account_access_role(self) -> "Inspector":
        '''(experimental) Grants permission to describe the IAM role that enables Amazon Inspector to access your AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DescribeCrossAccountAccessRole.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDescribeCrossAccountAccessRole", []))

    @jsii.member(jsii_name="toDescribeExclusions")
    def to_describe_exclusions(self) -> "Inspector":
        '''(experimental) Grants permission to describe the exclusions that are specified by the exclusions' ARNs.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DescribeExclusions.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDescribeExclusions", []))

    @jsii.member(jsii_name="toDescribeFindings")
    def to_describe_findings(self) -> "Inspector":
        '''(experimental) Grants permission to describe the findings that are specified by the ARNs of the findings.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DescribeFindings.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDescribeFindings", []))

    @jsii.member(jsii_name="toDescribeResourceGroups")
    def to_describe_resource_groups(self) -> "Inspector":
        '''(experimental) Grants permission to describe the resource groups that are specified by the ARNs of the resource groups.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DescribeResourceGroups.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDescribeResourceGroups", []))

    @jsii.member(jsii_name="toDescribeRulesPackages")
    def to_describe_rules_packages(self) -> "Inspector":
        '''(experimental) Grants permission to describe the rules packages that are specified by the ARNs of the rules packages.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_DescribeRulesPackages.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toDescribeRulesPackages", []))

    @jsii.member(jsii_name="toGetAssessmentReport")
    def to_get_assessment_report(self) -> "Inspector":
        '''(experimental) Grants permission to produce an assessment report that includes detailed and comprehensive results of a specified assessment run.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_GetAssessmentReport.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toGetAssessmentReport", []))

    @jsii.member(jsii_name="toGetExclusionsPreview")
    def to_get_exclusions_preview(self) -> "Inspector":
        '''(experimental) Grants permission to retrieve the exclusions preview (a list of ExclusionPreview objects) specified by the preview token.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_GetExclusionsPreview.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toGetExclusionsPreview", []))

    @jsii.member(jsii_name="toGetTelemetryMetadata")
    def to_get_telemetry_metadata(self) -> "Inspector":
        '''(experimental) Grants permission to get information about the data that is collected for the specified assessment run.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_GetTelemetryMetadata.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toGetTelemetryMetadata", []))

    @jsii.member(jsii_name="toListAssessmentRunAgents")
    def to_list_assessment_run_agents(self) -> "Inspector":
        '''(experimental) Grants permission to list the agents of the assessment runs that are specified by the ARNs of the assessment runs.

        Access Level: List

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_ListAssessmentRunAgents.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toListAssessmentRunAgents", []))

    @jsii.member(jsii_name="toListAssessmentRuns")
    def to_list_assessment_runs(self) -> "Inspector":
        '''(experimental) Grants permission to list the assessment runs that correspond to the assessment templates that are specified by the ARNs of the assessment templates.

        Access Level: List

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_ListAssessmentRuns.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toListAssessmentRuns", []))

    @jsii.member(jsii_name="toListAssessmentTargets")
    def to_list_assessment_targets(self) -> "Inspector":
        '''(experimental) Grants permission to list the ARNs of the assessment targets within this AWS account.

        Access Level: List

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_ListAssessmentTargets.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toListAssessmentTargets", []))

    @jsii.member(jsii_name="toListAssessmentTemplates")
    def to_list_assessment_templates(self) -> "Inspector":
        '''(experimental) Grants permission to list the assessment templates that correspond to the assessment targets that are specified by the ARNs of the assessment targets.

        Access Level: List

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_ListAssessmentTemplates.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toListAssessmentTemplates", []))

    @jsii.member(jsii_name="toListEventSubscriptions")
    def to_list_event_subscriptions(self) -> "Inspector":
        '''(experimental) Grants permission to list all the event subscriptions for the assessment template that is specified by the ARN of the assessment template.

        Access Level: List

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_ListEventSubscriptions.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toListEventSubscriptions", []))

    @jsii.member(jsii_name="toListExclusions")
    def to_list_exclusions(self) -> "Inspector":
        '''(experimental) Grants permission to list exclusions that are generated by the assessment run.

        Access Level: List

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_ListExclusions.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toListExclusions", []))

    @jsii.member(jsii_name="toListFindings")
    def to_list_findings(self) -> "Inspector":
        '''(experimental) Grants permission to list findings that are generated by the assessment runs that are specified by the ARNs of the assessment runs.

        Access Level: List

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_ListFindings.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toListFindings", []))

    @jsii.member(jsii_name="toListRulesPackages")
    def to_list_rules_packages(self) -> "Inspector":
        '''(experimental) Grants permission to list all available Amazon Inspector rules packages.

        Access Level: List

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_ListRulesPackages.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toListRulesPackages", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Inspector":
        '''(experimental) Grants permission to list all tags associated with an assessment template.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPreviewAgents")
    def to_preview_agents(self) -> "Inspector":
        '''(experimental) Grants permission to preview the agents installed on the EC2 instances that are part of the specified assessment target.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_PreviewAgents.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toPreviewAgents", []))

    @jsii.member(jsii_name="toRegisterCrossAccountAccessRole")
    def to_register_cross_account_access_role(self) -> "Inspector":
        '''(experimental) Grants permission to register the IAM role that Amazon Inspector uses to list your EC2 instances at the start of the assessment run or when you call the PreviewAgents action.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_RegisterCrossAccountAccessRole.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toRegisterCrossAccountAccessRole", []))

    @jsii.member(jsii_name="toRemoveAttributesFromFindings")
    def to_remove_attributes_from_findings(self) -> "Inspector":
        '''(experimental) Grants permission to remove entire attributes (key and value pairs) from the findings that are specified by the ARNs of the findings where an attribute with the specified key exists.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_RemoveAttributesFromFindings.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toRemoveAttributesFromFindings", []))

    @jsii.member(jsii_name="toSetTagsForResource")
    def to_set_tags_for_resource(self) -> "Inspector":
        '''(experimental) Grants permission to set tags (key and value pairs) to the assessment template that is specified by the ARN of the assessment template.

        Access Level: Tagging

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_SetTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toSetTagsForResource", []))

    @jsii.member(jsii_name="toStartAssessmentRun")
    def to_start_assessment_run(self) -> "Inspector":
        '''(experimental) Grants permission to start the assessment run specified by the ARN of the assessment template.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_StartAssessmentRun.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toStartAssessmentRun", []))

    @jsii.member(jsii_name="toStopAssessmentRun")
    def to_stop_assessment_run(self) -> "Inspector":
        '''(experimental) Grants permission to stop the assessment run that is specified by the ARN of the assessment run.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_StopAssessmentRun.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toStopAssessmentRun", []))

    @jsii.member(jsii_name="toSubscribeToEvent")
    def to_subscribe_to_event(self) -> "Inspector":
        '''(experimental) Grants permission to enable the process of sending Amazon Simple Notification Service (SNS) notifications about a specified event to a specified SNS topic.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_SubscribeToEvent.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toSubscribeToEvent", []))

    @jsii.member(jsii_name="toUnsubscribeFromEvent")
    def to_unsubscribe_from_event(self) -> "Inspector":
        '''(experimental) Grants permission to disable the process of sending Amazon Simple Notification Service (SNS) notifications about a specified event to a specified SNS topic.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_UnsubscribeFromEvent.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toUnsubscribeFromEvent", []))

    @jsii.member(jsii_name="toUpdateAssessmentTarget")
    def to_update_assessment_target(self) -> "Inspector":
        '''(experimental) Grants permission to update the assessment target that is specified by the ARN of the assessment target.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/latest/APIReference/API_UpdateAssessmentTarget.html

        :stability: experimental
        '''
        return typing.cast("Inspector", jsii.invoke(self, "toUpdateAssessmentTarget", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9b7956baafb77b4bd8622da928232feef253ba8ca57901b478778276ffba99c1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__86f45568a11dd3dd6eb50faf86f857b1c9d461c2d7407d6d97678a1633f29670)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Inspector2(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Inspector2",
):
    '''(experimental) Statement provider for service `inspector2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoninspector2.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `inspector2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoninspector2.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4dd6b8785c9804318282402cb11b2dfc02ccb30567fa9f4e3940db8b209bf022)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onFilter")
    def on_filter(
        self,
        owner_id: builtins.str,
        filter_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Inspector2":
        '''(experimental) Adds a resource of type Filter to the statement.

        https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html

        :param owner_id: - Identifier for the ownerId.
        :param filter_id: - Identifier for the filterId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f96972d568de99bb73cc5b5d89c5eb1b51c11d65c282c0e3ff61f3fe7697a9c4)
            check_type(argname="argument owner_id", value=owner_id, expected_type=type_hints["owner_id"])
            check_type(argname="argument filter_id", value=filter_id, expected_type=type_hints["filter_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Inspector2", jsii.invoke(self, "onFilter", [owner_id, filter_id, account, region, partition]))

    @jsii.member(jsii_name="onFinding")
    def on_finding(
        self,
        finding_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Inspector2":
        '''(experimental) Adds a resource of type Finding to the statement.

        https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html

        :param finding_id: - Identifier for the findingId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2b7a6125ea2dd82386c277cb709738f4414c58fe4b3ab5467f3c70b530d3af47)
            check_type(argname="argument finding_id", value=finding_id, expected_type=type_hints["finding_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Inspector2", jsii.invoke(self, "onFinding", [finding_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateMember")
    def to_associate_member(self) -> "Inspector2":
        '''(experimental) Grants permission to associate an account with an Amazon Inspector administrator account.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_AssociateMember.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toAssociateMember", []))

    @jsii.member(jsii_name="toBatchGetAccountStatus")
    def to_batch_get_account_status(self) -> "Inspector2":
        '''(experimental) Grants permission to retrieve information about Amazon Inspector accounts for an account.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_BatchGetAccountStatus.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toBatchGetAccountStatus", []))

    @jsii.member(jsii_name="toBatchGetCodeSnippet")
    def to_batch_get_code_snippet(self) -> "Inspector2":
        '''(experimental) Grants permission to retrieve code snippet information about one or more code vulnerability findings.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_BatchGetCodeSnippet.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toBatchGetCodeSnippet", []))

    @jsii.member(jsii_name="toBatchGetFreeTrialInfo")
    def to_batch_get_free_trial_info(self) -> "Inspector2":
        '''(experimental) Grants permission to retrieve free trial period eligibility about Amazon Inspector accounts for an account.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_BatchGetFreeTrialInfo.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toBatchGetFreeTrialInfo", []))

    @jsii.member(jsii_name="toCancelFindingsReport")
    def to_cancel_findings_report(self) -> "Inspector2":
        '''(experimental) Grants permission to cancel the generation of a findings report.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_CancelFindingsReport.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toCancelFindingsReport", []))

    @jsii.member(jsii_name="toCreateFilter")
    def to_create_filter(self) -> "Inspector2":
        '''(experimental) Grants permission to create and define the settings for a findings filter.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_CreateFilter.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toCreateFilter", []))

    @jsii.member(jsii_name="toCreateFindingsReport")
    def to_create_findings_report(self) -> "Inspector2":
        '''(experimental) Grants permission to request the generation of a findings report.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_CreateFindingsReport.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toCreateFindingsReport", []))

    @jsii.member(jsii_name="toDeleteFilter")
    def to_delete_filter(self) -> "Inspector2":
        '''(experimental) Grants permission to delete a findings filter.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_DeleteFilter.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toDeleteFilter", []))

    @jsii.member(jsii_name="toDescribeOrganizationConfiguration")
    def to_describe_organization_configuration(self) -> "Inspector2":
        '''(experimental) Grants permission to retrieve information about the Amazon Inspector configuration settings for an AWS organization.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_DescribeOrganizationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toDescribeOrganizationConfiguration", []))

    @jsii.member(jsii_name="toDisable")
    def to_disable(self) -> "Inspector2":
        '''(experimental) Grants permission to disable an Amazon Inspector account.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_Disable.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toDisable", []))

    @jsii.member(jsii_name="toDisableDelegatedAdminAccount")
    def to_disable_delegated_admin_account(self) -> "Inspector2":
        '''(experimental) Grants permission to disable an account as the delegated Amazon Inspector administrator account for an AWS organization.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_DisableDelegatedAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toDisableDelegatedAdminAccount", []))

    @jsii.member(jsii_name="toDisassociateMember")
    def to_disassociate_member(self) -> "Inspector2":
        '''(experimental) Grants permission to an Amazon Inspector administrator account to disassociate from an Inspector member account.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_DisassociateMember.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toDisassociateMember", []))

    @jsii.member(jsii_name="toEnable")
    def to_enable(self) -> "Inspector2":
        '''(experimental) Grants permission to enable and specify the configuration settings for a new Amazon Inspector account.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_Enable.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toEnable", []))

    @jsii.member(jsii_name="toEnableDelegatedAdminAccount")
    def to_enable_delegated_admin_account(self) -> "Inspector2":
        '''(experimental) Grants permission to enable an account as the delegated Amazon Inspector administrator account for an AWS organization.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_EnableDelegatedAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toEnableDelegatedAdminAccount", []))

    @jsii.member(jsii_name="toGetConfiguration")
    def to_get_configuration(self) -> "Inspector2":
        '''(experimental) Grants permission to retrieve information about the Amazon Inspector configuration settings for an AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_GetConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toGetConfiguration", []))

    @jsii.member(jsii_name="toGetDelegatedAdminAccount")
    def to_get_delegated_admin_account(self) -> "Inspector2":
        '''(experimental) Grants permission to retrieve information about the Amazon Inspector administrator account for an account.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_GetDelegatedAdminAccount.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toGetDelegatedAdminAccount", []))

    @jsii.member(jsii_name="toGetFindingsReportStatus")
    def to_get_findings_report_status(self) -> "Inspector2":
        '''(experimental) Grants permission to retrieve status for a requested findings report.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_GetFindingsReportStatus.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toGetFindingsReportStatus", []))

    @jsii.member(jsii_name="toGetMember")
    def to_get_member(self) -> "Inspector2":
        '''(experimental) Grants permission to retrieve information about an account that's associated with an Amazon Inspector administrator account.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_GetMember.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toGetMember", []))

    @jsii.member(jsii_name="toListAccountPermissions")
    def to_list_account_permissions(self) -> "Inspector2":
        '''(experimental) Grants permission to retrieve feature configuration permissions associated with an Amazon Inspector account within an organization.

        Access Level: List

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_ListAccountPermissions.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toListAccountPermissions", []))

    @jsii.member(jsii_name="toListCoverage")
    def to_list_coverage(self) -> "Inspector2":
        '''(experimental) Grants permission to retrieve the types of statistics Amazon Inspector can generate for resources Inspector monitors.

        Access Level: List

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_ListCoverage.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toListCoverage", []))

    @jsii.member(jsii_name="toListCoverageStatistics")
    def to_list_coverage_statistics(self) -> "Inspector2":
        '''(experimental) Grants permission to retrieve statistical data and other information about the resources Amazon Inspector monitors.

        Access Level: List

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_ListCoverageStatistics.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toListCoverageStatistics", []))

    @jsii.member(jsii_name="toListDelegatedAdminAccounts")
    def to_list_delegated_admin_accounts(self) -> "Inspector2":
        '''(experimental) Grants permission to retrieve information about the delegated Amazon Inspector administrator account for an AWS organization.

        Access Level: List

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_ListDelegatedAdminAccounts.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toListDelegatedAdminAccounts", []))

    @jsii.member(jsii_name="toListFilters")
    def to_list_filters(self) -> "Inspector2":
        '''(experimental) Grants permission to retrieve information about all findings filters.

        Access Level: List

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_ListFilters.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toListFilters", []))

    @jsii.member(jsii_name="toListFindingAggregations")
    def to_list_finding_aggregations(self) -> "Inspector2":
        '''(experimental) Grants permission to retrieve statistical data and other information about Amazon Inspector findings.

        Access Level: List

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_ListFindingAggregations.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toListFindingAggregations", []))

    @jsii.member(jsii_name="toListFindings")
    def to_list_findings(self) -> "Inspector2":
        '''(experimental) Grants permission to retrieve a subset of information about one or more findings.

        Access Level: List

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_ListFindings.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toListFindings", []))

    @jsii.member(jsii_name="toListMembers")
    def to_list_members(self) -> "Inspector2":
        '''(experimental) Grants permission to retrieve information about the Amazon Inspector member accounts that are associated with an Inspector administrator account.

        Access Level: List

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_ListMembers.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toListMembers", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Inspector2":
        '''(experimental) Grants permission to retrieve the tags for an Amazon Inspector resource.

        Access Level: Read

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListUsageTotals")
    def to_list_usage_totals(self) -> "Inspector2":
        '''(experimental) Grants permission to retrieve aggregated usage data for an account.

        Access Level: List

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_ListUsageTotals.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toListUsageTotals", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Inspector2":
        '''(experimental) Grants permission to add or update the tags for an Amazon Inspector resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Inspector2":
        '''(experimental) Grants permission to remove tags from an Amazon Inspector resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateConfiguration")
    def to_update_configuration(self) -> "Inspector2":
        '''(experimental) Grants permission to update information about the Amazon Inspector configuration settings for an AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_UpdateConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toUpdateConfiguration", []))

    @jsii.member(jsii_name="toUpdateFilter")
    def to_update_filter(self) -> "Inspector2":
        '''(experimental) Grants permission to update the settings for a findings filter.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_UpdateFilter.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toUpdateFilter", []))

    @jsii.member(jsii_name="toUpdateOrganizationConfiguration")
    def to_update_organization_configuration(self) -> "Inspector2":
        '''(experimental) Grants permission to update Amazon Inspector configuration settings for an AWS organization.

        Access Level: Write

        https://docs.aws.amazon.com/inspector/v2/APIReference/API_UpdateOrganizationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Inspector2", jsii.invoke(self, "toUpdateOrganizationConfiguration", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__20f27ed31a43d178fece9a5968391aac01b79d095150b1ef307f13de2910b472)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bc7fba0d02c4aaeac1351c2c658acd34d998e6f7250f6a5fb3299492795a44e6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Internetmonitor(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Internetmonitor",
):
    '''(experimental) Statement provider for service `internetmonitor <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchinternetmonitor.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `internetmonitor <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchinternetmonitor.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__01dccad89e053ba7b505ff39c6791ab8e0d507e53c1ec875e7cd2acac9393575)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onHealthEvent")
    def on_health_event(
        self,
        monitor_name: builtins.str,
        event_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Internetmonitor":
        '''(experimental) Adds a resource of type HealthEvent to the statement.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-IM-components.html

        :param monitor_name: - Identifier for the monitorName.
        :param event_id: - Identifier for the eventId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e1ba974037f83c21efe5a3dbce539a3d33db0819297e9c21a71cc0fe8a36f118)
            check_type(argname="argument monitor_name", value=monitor_name, expected_type=type_hints["monitor_name"])
            check_type(argname="argument event_id", value=event_id, expected_type=type_hints["event_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Internetmonitor", jsii.invoke(self, "onHealthEvent", [monitor_name, event_id, account, region, partition]))

    @jsii.member(jsii_name="onMonitor")
    def on_monitor(
        self,
        monitor_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Internetmonitor":
        '''(experimental) Adds a resource of type Monitor to the statement.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-IM-components.html

        :param monitor_name: - Identifier for the monitorName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e625ffb6049ba760bffd5ff106265c4520fab6bd50a93d526eed4944c2a8fae8)
            check_type(argname="argument monitor_name", value=monitor_name, expected_type=type_hints["monitor_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Internetmonitor", jsii.invoke(self, "onMonitor", [monitor_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateMonitor")
    def to_create_monitor(self) -> "Internetmonitor":
        '''(experimental) Grants permission to create a monitor.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/internet-monitor/latest/api/API_CreateMonitor.html

        :stability: experimental
        '''
        return typing.cast("Internetmonitor", jsii.invoke(self, "toCreateMonitor", []))

    @jsii.member(jsii_name="toDeleteMonitor")
    def to_delete_monitor(self) -> "Internetmonitor":
        '''(experimental) Grants permission to delete a monitor.

        Access Level: Write

        https://docs.aws.amazon.com/internet-monitor/latest/api/API_DeleteMonitor.html

        :stability: experimental
        '''
        return typing.cast("Internetmonitor", jsii.invoke(self, "toDeleteMonitor", []))

    @jsii.member(jsii_name="toGetHealthEvent")
    def to_get_health_event(self) -> "Internetmonitor":
        '''(experimental) Grants permission to get information about a health event for a specified monitor.

        Access Level: Read

        https://docs.aws.amazon.com/internet-monitor/latest/api/API_GetHealthEvent.html

        :stability: experimental
        '''
        return typing.cast("Internetmonitor", jsii.invoke(self, "toGetHealthEvent", []))

    @jsii.member(jsii_name="toGetMonitor")
    def to_get_monitor(self) -> "Internetmonitor":
        '''(experimental) Grants permission to get information about a monitor.

        Access Level: Read

        https://docs.aws.amazon.com/internet-monitor/latest/api/API_GetMonitor.html

        :stability: experimental
        '''
        return typing.cast("Internetmonitor", jsii.invoke(self, "toGetMonitor", []))

    @jsii.member(jsii_name="toListHealthEvents")
    def to_list_health_events(self) -> "Internetmonitor":
        '''(experimental) Grants permission to list all health events for a monitor.

        Access Level: List

        https://docs.aws.amazon.com/internet-monitor/latest/api/API_ListHealthEvents.html

        :stability: experimental
        '''
        return typing.cast("Internetmonitor", jsii.invoke(self, "toListHealthEvents", []))

    @jsii.member(jsii_name="toListMonitors")
    def to_list_monitors(self) -> "Internetmonitor":
        '''(experimental) Grants permission to list all monitors in an account and their statuses.

        Access Level: List

        https://docs.aws.amazon.com/internet-monitor/latest/api/API_ListMonitors.html

        :stability: experimental
        '''
        return typing.cast("Internetmonitor", jsii.invoke(self, "toListMonitors", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Internetmonitor":
        '''(experimental) Grants permission to list the tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/internet-monitor/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Internetmonitor", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Internetmonitor":
        '''(experimental) Grants permission to add tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/internet-monitor/latest/api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Internetmonitor", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Internetmonitor":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/internet-monitor/latest/api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Internetmonitor", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateMonitor")
    def to_update_monitor(self) -> "Internetmonitor":
        '''(experimental) Grants permission to update a monitor.

        Access Level: Write

        https://docs.aws.amazon.com/internet-monitor/latest/api/API_UpdateMonitor.html

        :stability: experimental
        '''
        return typing.cast("Internetmonitor", jsii.invoke(self, "toUpdateMonitor", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9750e472c7a54e01370dd1eeae9331f20468baec653d59f340c50d9176f1e03f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5b9e4204e9f69297a6ebab0c284edd9ae6190a986631f6fbfa195b318f27e99d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Invoicing(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Invoicing",
):
    '''(experimental) Statement provider for service `invoicing <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsinvoicingservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `invoicing <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsinvoicingservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f9c838b9888dfe6cb0127dedeb3df24c9daddc77509a194da4e5ed19da5c2278)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toGetInvoiceEmailDeliveryPreferences")
    def to_get_invoice_email_delivery_preferences(self) -> "Invoicing":
        '''(experimental) Grants permission to get Invoice Email Delivery Preferences.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Invoicing", jsii.invoke(self, "toGetInvoiceEmailDeliveryPreferences", []))

    @jsii.member(jsii_name="toGetInvoicePDF")
    def to_get_invoice_pdf(self) -> "Invoicing":
        '''(experimental) Grants permission to get Invoice PDF.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Invoicing", jsii.invoke(self, "toGetInvoicePDF", []))

    @jsii.member(jsii_name="toListInvoiceSummaries")
    def to_list_invoice_summaries(self) -> "Invoicing":
        '''(experimental) Grants permission to get Invoice summary information for your account or linked account.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Invoicing", jsii.invoke(self, "toListInvoiceSummaries", []))

    @jsii.member(jsii_name="toPutInvoiceEmailDeliveryPreferences")
    def to_put_invoice_email_delivery_preferences(self) -> "Invoicing":
        '''(experimental) Grants permission to put Invoice Email Delivery Preferences.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html#user-permissions

        :stability: experimental
        '''
        return typing.cast("Invoicing", jsii.invoke(self, "toPutInvoiceEmailDeliveryPreferences", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1873d7afba852e0124ee3aa3ee4de61be3cb22a8a4d26a4a283277628511ca2f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2a7f03fc2218156ba4eea1dcc49d97b2477f26b7787bba53cece12cb2d3694eb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Iot(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Iot"):
    '''(experimental) Statement provider for service `iot <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iot <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2122102ef90ca4d571705da1ea226a949064bdabc54258aa290c7fa5a3467164)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifClientMode")
    def if_client_mode(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iot":
        '''(experimental) Filters access by the mode of the client for IoT Tunnel.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html

        Applies to actions:

        - .toRotateTunnelAccessToken()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8e4844ef26c87cd752d3eb2a9fa08ebd9c2969c0fdab707068f6afc7f2a8bdf6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iot", jsii.invoke(self, "ifClientMode", [value, operator]))

    @jsii.member(jsii_name="ifDelete")
    def if_delete(self, value: typing.Optional[builtins.bool] = None) -> "Iot":
        '''(experimental) Filters access by a flag indicating whether or not to also delete an IoT Tunnel immediately when making iot:CloseTunnel request.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html

        Applies to actions:

        - .toCloseTunnel()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__392aef392bd6c18ea4ab0451e0a55d8605f3044b7f21f0ff2d8d4793372042c0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Iot", jsii.invoke(self, "ifDelete", [value]))

    @jsii.member(jsii_name="ifDomainName")
    def if_domain_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iot":
        '''(experimental) Filters access by based on the domain name of an IoT DomainConfiguration.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html

        Applies to actions:

        - .toCreateDomainConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4d3f7eee70e44c26013bf8c915efebf37ffbbc49e476a69aad647aa4f6f9015e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iot", jsii.invoke(self, "ifDomainName", [value, operator]))

    @jsii.member(jsii_name="ifThingGroupArn")
    def if_thing_group_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iot":
        '''(experimental) Filters access by a list of IoT Thing Group ARNs that the destination IoT Thing belongs to for an IoT Tunnel.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html

        Applies to actions:

        - .toOpenTunnel()
        - .toRotateTunnelAccessToken()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1e621173316a5190a75748d07d08ac2bcc286e073f33b77b54da41df6bdc0c89)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iot", jsii.invoke(self, "ifThingGroupArn", [value, operator]))

    @jsii.member(jsii_name="ifTunnelDestinationService")
    def if_tunnel_destination_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iot":
        '''(experimental) Filters access by a list of destination services for an IoT Tunnel.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html

        Applies to actions:

        - .toOpenTunnel()
        - .toRotateTunnelAccessToken()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5967e7f8af5efde5b0b0ee8f4727f7612013879b62b5b0628faec6e0476ae643)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iot", jsii.invoke(self, "ifTunnelDestinationService", [value, operator]))

    @jsii.member(jsii_name="onAuthorizer")
    def on_authorizer(
        self,
        authorizer_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type authorizer to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/custom-authorizer.html

        :param authorizer_name: - Identifier for the authorizerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__86a844db6473f5b6d6bba28756fcf01f446ba7fe4472d64bec52a29cd184a97c)
            check_type(argname="argument authorizer_name", value=authorizer_name, expected_type=type_hints["authorizer_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onAuthorizer", [authorizer_name, account, region, partition]))

    @jsii.member(jsii_name="onBillinggroup")
    def on_billinggroup(
        self,
        billing_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type billinggroup to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/billing-groups.html

        :param billing_group_name: - Identifier for the billingGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__84deb84e6206737369b08b8ac1552d35216bf18999c27b36d6ba8ad0092cae72)
            check_type(argname="argument billing_group_name", value=billing_group_name, expected_type=type_hints["billing_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onBillinggroup", [billing_group_name, account, region, partition]))

    @jsii.member(jsii_name="onCacert")
    def on_cacert(
        self,
        c_a_certificate: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type cacert to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/x509-certs.html

        :param c_a_certificate: - Identifier for the cACertificate.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d48d58c2308077274f0149f1e0bd1ccf099362238a1471e7a9782693589a27e0)
            check_type(argname="argument c_a_certificate", value=c_a_certificate, expected_type=type_hints["c_a_certificate"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onCacert", [c_a_certificate, account, region, partition]))

    @jsii.member(jsii_name="onCert")
    def on_cert(
        self,
        certificate: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type cert to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/x509-certs.html

        :param certificate: - Identifier for the certificate.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__02f6148c08d0ce53d0445d047ec2cc1cd5b87e95f71a67d31964a1a3394ee561)
            check_type(argname="argument certificate", value=certificate, expected_type=type_hints["certificate"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onCert", [certificate, account, region, partition]))

    @jsii.member(jsii_name="onClient")
    def on_client(
        self,
        client_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type client to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/iot-message-broker.html

        :param client_id: - Identifier for the clientId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__257d2b418ae06e66584c623f652e410fdd83b9d8f7f31c389db921c29f182396)
            check_type(argname="argument client_id", value=client_id, expected_type=type_hints["client_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onClient", [client_id, account, region, partition]))

    @jsii.member(jsii_name="onCustommetric")
    def on_custommetric(
        self,
        metric_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type custommetric to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/device-defender-detect.html

        :param metric_name: - Identifier for the metricName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6e1018c7d56bd9cf3403a822a11e9cbf5ef37ca1a2023e5f7fcde9cc2fe7b23c)
            check_type(argname="argument metric_name", value=metric_name, expected_type=type_hints["metric_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onCustommetric", [metric_name, account, region, partition]))

    @jsii.member(jsii_name="onDestination")
    def on_destination(
        self,
        destination_type: builtins.str,
        uuid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type destination to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/rule-destination.html

        :param destination_type: - Identifier for the destinationType.
        :param uuid: - Identifier for the uuid.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__34daedaaae9f33325db0c23e5d568615a58cce7edcccd1030d7307042d65a435)
            check_type(argname="argument destination_type", value=destination_type, expected_type=type_hints["destination_type"])
            check_type(argname="argument uuid", value=uuid, expected_type=type_hints["uuid"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onDestination", [destination_type, uuid, account, region, partition]))

    @jsii.member(jsii_name="onDimension")
    def on_dimension(
        self,
        dimension_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type dimension to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/device-defender-detect.html

        :param dimension_name: - Identifier for the dimensionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4a1c7748c4059cddba856936300f379c6719f700a67d1e622ec02414a664f924)
            check_type(argname="argument dimension_name", value=dimension_name, expected_type=type_hints["dimension_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onDimension", [dimension_name, account, region, partition]))

    @jsii.member(jsii_name="onDomainconfiguration")
    def on_domainconfiguration(
        self,
        domain_configuration_name: builtins.str,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type domainconfiguration to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/domain-configuration.html

        :param domain_configuration_name: - Identifier for the domainConfigurationName.
        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5cb97829bdcdbc63427cba20ed27d5fecf63ec0c6fc8dc1ebe2701972709ede0)
            check_type(argname="argument domain_configuration_name", value=domain_configuration_name, expected_type=type_hints["domain_configuration_name"])
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onDomainconfiguration", [domain_configuration_name, id, account, region, partition]))

    @jsii.member(jsii_name="onDynamicthinggroup")
    def on_dynamicthinggroup(
        self,
        thing_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type dynamicthinggroup to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/dynamic-thing-groups.html

        :param thing_group_name: - Identifier for the thingGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__657765ada3765990f1e64351a63e26b93b124ce5c4ed69f4ae1504f42d83a589)
            check_type(argname="argument thing_group_name", value=thing_group_name, expected_type=type_hints["thing_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onDynamicthinggroup", [thing_group_name, account, region, partition]))

    @jsii.member(jsii_name="onFleetmetric")
    def on_fleetmetric(
        self,
        fleet_metric_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type fleetmetric to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/iot-indexing.html

        :param fleet_metric_name: - Identifier for the fleetMetricName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dff0e89387c89e4e762776965fa772eecfae4aba329db43e6ce050b905a1efcc)
            check_type(argname="argument fleet_metric_name", value=fleet_metric_name, expected_type=type_hints["fleet_metric_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onFleetmetric", [fleet_metric_name, account, region, partition]))

    @jsii.member(jsii_name="onIndex")
    def on_index(
        self,
        index_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type index to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/iot-indexing.html

        :param index_name: - Identifier for the indexName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5d350e861710a59d2e03ebb43258ed153e4a08a1f966244c5aa2c5a37b39f72d)
            check_type(argname="argument index_name", value=index_name, expected_type=type_hints["index_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onIndex", [index_name, account, region, partition]))

    @jsii.member(jsii_name="onJob")
    def on_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type job to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/iot-jobs.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0b4d3ffdc3f987069491281a3a4bb32f4ca8384a93c78944117db6d61bca4934)
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onJobtemplate")
    def on_jobtemplate(
        self,
        job_template_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type jobtemplate to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/iot-job-templates.html

        :param job_template_id: - Identifier for the jobTemplateId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9d832f06578db6b9d6c08fd4d229bf5bb8009e20e63f9f08e6bacd0e4595ab79)
            check_type(argname="argument job_template_id", value=job_template_id, expected_type=type_hints["job_template_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onJobtemplate", [job_template_id, account, region, partition]))

    @jsii.member(jsii_name="onMitigationaction")
    def on_mitigationaction(
        self,
        mitigation_action_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type mitigationaction to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/device-defender-mitigation-actions.html

        :param mitigation_action_name: - Identifier for the mitigationActionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__434c905f4f09a382762d23493cb72ab9ed370faa9ecc66739a56b369b409347f)
            check_type(argname="argument mitigation_action_name", value=mitigation_action_name, expected_type=type_hints["mitigation_action_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onMitigationaction", [mitigation_action_name, account, region, partition]))

    @jsii.member(jsii_name="onOtaupdate")
    def on_otaupdate(
        self,
        ota_update_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type otaupdate to the statement.

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ota-dev.html

        :param ota_update_id: - Identifier for the otaUpdateId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6e7b9fb8a81e552cd46b40ce528f6f2e20e5b1a9d0551a3c809da20d8aa40713)
            check_type(argname="argument ota_update_id", value=ota_update_id, expected_type=type_hints["ota_update_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onOtaupdate", [ota_update_id, account, region, partition]))

    @jsii.member(jsii_name="onPolicy")
    def on_policy(
        self,
        policy_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type policy to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/iot-policies.html

        :param policy_name: - Identifier for the policyName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ffa1b8a5e324c502f499987396dda47ff091f2073646d8a6b7cd4e8e2d8e89f8)
            check_type(argname="argument policy_name", value=policy_name, expected_type=type_hints["policy_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onPolicy", [policy_name, account, region, partition]))

    @jsii.member(jsii_name="onProvisioningtemplate")
    def on_provisioningtemplate(
        self,
        provisioning_template: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type provisioningtemplate to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/provision-template.html

        :param provisioning_template: - Identifier for the provisioningTemplate.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f7ef57c3ca1eb3127b04b1747198b80284f982afb1d5090fe4f19e20ad518fc4)
            check_type(argname="argument provisioning_template", value=provisioning_template, expected_type=type_hints["provisioning_template"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onProvisioningtemplate", [provisioning_template, account, region, partition]))

    @jsii.member(jsii_name="onRolealias")
    def on_rolealias(
        self,
        role_alias: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type rolealias to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/authorizing-direct-aws.html

        :param role_alias: - Identifier for the roleAlias.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8814d2ac683fa372a32955d529d2a4a7ce47060673845dbdc02c66c4c74f39d8)
            check_type(argname="argument role_alias", value=role_alias, expected_type=type_hints["role_alias"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onRolealias", [role_alias, account, region, partition]))

    @jsii.member(jsii_name="onRule")
    def on_rule(
        self,
        rule_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type rule to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/iot-rules.html

        :param rule_name: - Identifier for the ruleName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__76a4e95ee51aa3ff7023f19fed263fbaaf0307c43c500646db66de4c43edf848)
            check_type(argname="argument rule_name", value=rule_name, expected_type=type_hints["rule_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onRule", [rule_name, account, region, partition]))

    @jsii.member(jsii_name="onScheduledaudit")
    def on_scheduledaudit(
        self,
        schedule_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type scheduledaudit to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/device-defender-audit.html

        :param schedule_name: - Identifier for the scheduleName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c9a11774ec1012ce7611205caa1dcca91cd500d81f3e42364941462b95a1e06d)
            check_type(argname="argument schedule_name", value=schedule_name, expected_type=type_hints["schedule_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onScheduledaudit", [schedule_name, account, region, partition]))

    @jsii.member(jsii_name="onSecurityprofile")
    def on_securityprofile(
        self,
        security_profile_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type securityprofile to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/device-defender-detect.html

        :param security_profile_name: - Identifier for the securityProfileName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cd76de7544221cd8365251c886654bfabc99c734dda33968f5c42a50b3ce01aa)
            check_type(argname="argument security_profile_name", value=security_profile_name, expected_type=type_hints["security_profile_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onSecurityprofile", [security_profile_name, account, region, partition]))

    @jsii.member(jsii_name="onStream")
    def on_stream(
        self,
        stream_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type stream to the statement.

        https://docs.aws.amazon.com/freertos/latest/userguide/freertos-ota-dev.html

        :param stream_id: - Identifier for the streamId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d0b0e2d37ffe2beca1e0ca81fb2010bcda26cd873eb4183f9ec8a51307e01706)
            check_type(argname="argument stream_id", value=stream_id, expected_type=type_hints["stream_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onStream", [stream_id, account, region, partition]))

    @jsii.member(jsii_name="onThing")
    def on_thing(
        self,
        thing_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type thing to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/thing-registry.html

        :param thing_name: - Identifier for the thingName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d1c33d6751ae7a0603b8136cf2a14b6523cf2fb81989e44627053608cf9bb7cc)
            check_type(argname="argument thing_name", value=thing_name, expected_type=type_hints["thing_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onThing", [thing_name, account, region, partition]))

    @jsii.member(jsii_name="onThinggroup")
    def on_thinggroup(
        self,
        thing_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type thinggroup to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/thing-groups.html

        :param thing_group_name: - Identifier for the thingGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__25fc2c77264cb8a9c43077f36cacb8fdd2451b5affd0c7f6653a47b3e6d72352)
            check_type(argname="argument thing_group_name", value=thing_group_name, expected_type=type_hints["thing_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onThinggroup", [thing_group_name, account, region, partition]))

    @jsii.member(jsii_name="onThingtype")
    def on_thingtype(
        self,
        thing_type_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type thingtype to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/thing-types.html

        :param thing_type_name: - Identifier for the thingTypeName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ff976602d02e1316828645fb121b5c8b85d443c8a9b25e9ee5261290bb8d8a51)
            check_type(argname="argument thing_type_name", value=thing_type_name, expected_type=type_hints["thing_type_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onThingtype", [thing_type_name, account, region, partition]))

    @jsii.member(jsii_name="onTopic")
    def on_topic(
        self,
        topic_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type topic to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/iot-message-broker.html

        :param topic_name: - Identifier for the topicName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d605240958422ba698cfef512421adde52e1ce4774da5302c62cee57bcb8a98e)
            check_type(argname="argument topic_name", value=topic_name, expected_type=type_hints["topic_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onTopic", [topic_name, account, region, partition]))

    @jsii.member(jsii_name="onTopicfilter")
    def on_topicfilter(
        self,
        topic_filter: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type topicfilter to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/topics.html

        :param topic_filter: - Identifier for the topicFilter.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eea7f560a491c0ccfb1301999ffbcca2725f1085900713a83feb965082f343bf)
            check_type(argname="argument topic_filter", value=topic_filter, expected_type=type_hints["topic_filter"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onTopicfilter", [topic_filter, account, region, partition]))

    @jsii.member(jsii_name="onTunnel")
    def on_tunnel(
        self,
        tunnel_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot":
        '''(experimental) Adds a resource of type tunnel to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/iot-tunnels.html

        :param tunnel_id: - Identifier for the tunnelId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1b5980104522a2de54ad1f4a30a361377cd133acf1b7da309d7c146d6106f8a6)
            check_type(argname="argument tunnel_id", value=tunnel_id, expected_type=type_hints["tunnel_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot", jsii.invoke(self, "onTunnel", [tunnel_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptCertificateTransfer")
    def to_accept_certificate_transfer(self) -> "Iot":
        '''(experimental) Grants permission to accept a pending certificate transfer.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_AcceptCertificateTransfer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toAcceptCertificateTransfer", []))

    @jsii.member(jsii_name="toAddThingToBillingGroup")
    def to_add_thing_to_billing_group(self) -> "Iot":
        '''(experimental) Grants permission to add a thing to the specified billing group.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_AddThingToBillingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toAddThingToBillingGroup", []))

    @jsii.member(jsii_name="toAddThingToThingGroup")
    def to_add_thing_to_thing_group(self) -> "Iot":
        '''(experimental) Grants permission to add a thing to the specified thing group.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_AddThingToThingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toAddThingToThingGroup", []))

    @jsii.member(jsii_name="toAssociateTargetsWithJob")
    def to_associate_targets_with_job(self) -> "Iot":
        '''(experimental) Grants permission to associate a group with a continuous job.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_AssociateTargetsWithJob.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toAssociateTargetsWithJob", []))

    @jsii.member(jsii_name="toAttachPolicy")
    def to_attach_policy(self) -> "Iot":
        '''(experimental) Grants permission to attach a policy to the specified target.

        Access Level: Permissions management

        https://docs.aws.amazon.com/iot/latest/apireference/API_AttachPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toAttachPolicy", []))

    @jsii.member(jsii_name="toAttachPrincipalPolicy")
    def to_attach_principal_policy(self) -> "Iot":
        '''(experimental) Grants permission to attach the specified policy to the specified principal (certificate or other credential).

        Access Level: Permissions management

        https://docs.aws.amazon.com/iot/latest/apireference/API_AttachPrincipalPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toAttachPrincipalPolicy", []))

    @jsii.member(jsii_name="toAttachSecurityProfile")
    def to_attach_security_profile(self) -> "Iot":
        '''(experimental) Grants permission to associate a Device Defender security profile with a thing group or with this account.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_AttachSecurityProfile.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toAttachSecurityProfile", []))

    @jsii.member(jsii_name="toAttachThingPrincipal")
    def to_attach_thing_principal(self) -> "Iot":
        '''(experimental) Grants permission to attach the specified principal to the specified thing.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_AttachThingPrincipal.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toAttachThingPrincipal", []))

    @jsii.member(jsii_name="toCancelAuditMitigationActionsTask")
    def to_cancel_audit_mitigation_actions_task(self) -> "Iot":
        '''(experimental) Grants permission to cancel a mitigation action task that is in progress.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CancelAuditMitigationActionsTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCancelAuditMitigationActionsTask", []))

    @jsii.member(jsii_name="toCancelAuditTask")
    def to_cancel_audit_task(self) -> "Iot":
        '''(experimental) Grants permission to cancel an audit that is in progress. The audit can be either scheduled or on-demand.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CancelAuditTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCancelAuditTask", []))

    @jsii.member(jsii_name="toCancelCertificateTransfer")
    def to_cancel_certificate_transfer(self) -> "Iot":
        '''(experimental) Grants permission to cancel a pending transfer for the specified certificate.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CancelCertificateTransfer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCancelCertificateTransfer", []))

    @jsii.member(jsii_name="toCancelDetectMitigationActionsTask")
    def to_cancel_detect_mitigation_actions_task(self) -> "Iot":
        '''(experimental) Grants permission to cancel a Device Defender ML Detect mitigation action.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CancelDetectMitigationActionsTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCancelDetectMitigationActionsTask", []))

    @jsii.member(jsii_name="toCancelJob")
    def to_cancel_job(self) -> "Iot":
        '''(experimental) Grants permission to cancel a job.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CancelJob.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCancelJob", []))

    @jsii.member(jsii_name="toCancelJobExecution")
    def to_cancel_job_execution(self) -> "Iot":
        '''(experimental) Grants permission to cancel a job execution on a particular device.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CancelJobExecution.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCancelJobExecution", []))

    @jsii.member(jsii_name="toClearDefaultAuthorizer")
    def to_clear_default_authorizer(self) -> "Iot":
        '''(experimental) Grants permission to clear the default authorizer.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_ClearDefaultAuthorizer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toClearDefaultAuthorizer", []))

    @jsii.member(jsii_name="toCloseTunnel")
    def to_close_tunnel(self) -> "Iot":
        '''(experimental) Grants permission to close a tunnel.

        Access Level: Write

        Possible conditions:

        - .ifDelete()

        https://docs.aws.amazon.com/iot/latest/apireference/API_iot-secure-tunneling_CloseTunnel.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCloseTunnel", []))

    @jsii.member(jsii_name="toConfirmTopicRuleDestination")
    def to_confirm_topic_rule_destination(self) -> "Iot":
        '''(experimental) Grants permission to confirm a http url TopicRuleDestinationDestination.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_ConfirmTopicRuleDestination.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toConfirmTopicRuleDestination", []))

    @jsii.member(jsii_name="toConnect")
    def to_connect(self) -> "Iot":
        '''(experimental) Grants permission to connect as the specified client.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/developerguide/policy-actions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toConnect", []))

    @jsii.member(jsii_name="toCreateAuditSuppression")
    def to_create_audit_suppression(self) -> "Iot":
        '''(experimental) Grants permission to create a Device Defender audit suppression.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateAuditSuppression.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateAuditSuppression", []))

    @jsii.member(jsii_name="toCreateAuthorizer")
    def to_create_authorizer(self) -> "Iot":
        '''(experimental) Grants permission to create an authorizer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateAuthorizer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateAuthorizer", []))

    @jsii.member(jsii_name="toCreateBillingGroup")
    def to_create_billing_group(self) -> "Iot":
        '''(experimental) Grants permission to create a billing group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateBillingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateBillingGroup", []))

    @jsii.member(jsii_name="toCreateCertificateFromCsr")
    def to_create_certificate_from_csr(self) -> "Iot":
        '''(experimental) Grants permission to create an X.509 certificate using the specified certificate signing request.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateCertificateFromCsr.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateCertificateFromCsr", []))

    @jsii.member(jsii_name="toCreateCustomMetric")
    def to_create_custom_metric(self) -> "Iot":
        '''(experimental) Grants permission to create a custom metric for device side metric reporting and monitoring.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateCustomMetric.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateCustomMetric", []))

    @jsii.member(jsii_name="toCreateDimension")
    def to_create_dimension(self) -> "Iot":
        '''(experimental) Grants permission to define a dimension that can be used to to limit the scope of a metric used in a security profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateDimension.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateDimension", []))

    @jsii.member(jsii_name="toCreateDomainConfiguration")
    def to_create_domain_configuration(self) -> "Iot":
        '''(experimental) Grants permission to create a domain configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifDomainName()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateDomainConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateDomainConfiguration", []))

    @jsii.member(jsii_name="toCreateDynamicThingGroup")
    def to_create_dynamic_thing_group(self) -> "Iot":
        '''(experimental) Grants permission to create a Dynamic Thing Group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateDynamicThingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateDynamicThingGroup", []))

    @jsii.member(jsii_name="toCreateFleetMetric")
    def to_create_fleet_metric(self) -> "Iot":
        '''(experimental) Grants permission to create a fleet metric.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/iot-indexing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateFleetMetric", []))

    @jsii.member(jsii_name="toCreateJob")
    def to_create_job(self) -> "Iot":
        '''(experimental) Grants permission to create a job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateJob.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateJob", []))

    @jsii.member(jsii_name="toCreateJobTemplate")
    def to_create_job_template(self) -> "Iot":
        '''(experimental) Grants permission to create a job template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateJobTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateJobTemplate", []))

    @jsii.member(jsii_name="toCreateKeysAndCertificate")
    def to_create_keys_and_certificate(self) -> "Iot":
        '''(experimental) Grants permission to create a 2048 bit RSA key pair and issues an X.509 certificate using the issued public key.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateKeysAndCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateKeysAndCertificate", []))

    @jsii.member(jsii_name="toCreateMitigationAction")
    def to_create_mitigation_action(self) -> "Iot":
        '''(experimental) Grants permission to define an action that can be applied to audit findings by using StartAuditMitigationActionsTask.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateMitigationAction.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateMitigationAction", []))

    @jsii.member(jsii_name="toCreateOTAUpdate")
    def to_create_ota_update(self) -> "Iot":
        '''(experimental) Grants permission to create an OTA update job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateOTAUpdate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateOTAUpdate", []))

    @jsii.member(jsii_name="toCreatePolicy")
    def to_create_policy(self) -> "Iot":
        '''(experimental) Grants permission to create an AWS IoT policy.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreatePolicy.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreatePolicy", []))

    @jsii.member(jsii_name="toCreatePolicyVersion")
    def to_create_policy_version(self) -> "Iot":
        '''(experimental) Grants permission to create a new version of the specified AWS IoT policy.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreatePolicyVersion.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreatePolicyVersion", []))

    @jsii.member(jsii_name="toCreateProvisioningClaim")
    def to_create_provisioning_claim(self) -> "Iot":
        '''(experimental) Grants permission to create a provisioning claim.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateProvisioningClaim.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateProvisioningClaim", []))

    @jsii.member(jsii_name="toCreateProvisioningTemplate")
    def to_create_provisioning_template(self) -> "Iot":
        '''(experimental) Grants permission to create a fleet provisioning template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateProvisioningTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateProvisioningTemplate", []))

    @jsii.member(jsii_name="toCreateProvisioningTemplateVersion")
    def to_create_provisioning_template_version(self) -> "Iot":
        '''(experimental) Grants permission to create a new version of a fleet provisioning template.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateProvisioningTemplateVersion.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateProvisioningTemplateVersion", []))

    @jsii.member(jsii_name="toCreateRoleAlias")
    def to_create_role_alias(self) -> "Iot":
        '''(experimental) Grants permission to create a role alias.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateRoleAlias.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateRoleAlias", []))

    @jsii.member(jsii_name="toCreateScheduledAudit")
    def to_create_scheduled_audit(self) -> "Iot":
        '''(experimental) Grants permission to create a scheduled audit that is run at a specified time interval.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateScheduledAudit.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateScheduledAudit", []))

    @jsii.member(jsii_name="toCreateSecurityProfile")
    def to_create_security_profile(self) -> "Iot":
        '''(experimental) Grants permission to create a Device Defender security profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateSecurityProfile.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateSecurityProfile", []))

    @jsii.member(jsii_name="toCreateStream")
    def to_create_stream(self) -> "Iot":
        '''(experimental) Grants permission to create a new AWS IoT stream.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateStream.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateStream", []))

    @jsii.member(jsii_name="toCreateThing")
    def to_create_thing(self) -> "Iot":
        '''(experimental) Grants permission to create a thing in the thing registry.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateThing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateThing", []))

    @jsii.member(jsii_name="toCreateThingGroup")
    def to_create_thing_group(self) -> "Iot":
        '''(experimental) Grants permission to create a thing group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateThingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateThingGroup", []))

    @jsii.member(jsii_name="toCreateThingType")
    def to_create_thing_type(self) -> "Iot":
        '''(experimental) Grants permission to create a new thing type.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateThingType.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateThingType", []))

    @jsii.member(jsii_name="toCreateTopicRule")
    def to_create_topic_rule(self) -> "Iot":
        '''(experimental) Grants permission to create a rule.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateTopicRule.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateTopicRule", []))

    @jsii.member(jsii_name="toCreateTopicRuleDestination")
    def to_create_topic_rule_destination(self) -> "Iot":
        '''(experimental) Grants permission to create a TopicRuleDestination.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_CreateTopicRuleDestination.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toCreateTopicRuleDestination", []))

    @jsii.member(jsii_name="toDeleteAccountAuditConfiguration")
    def to_delete_account_audit_configuration(self) -> "Iot":
        '''(experimental) Grants permission to delete the audit configuration associated with the account.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteAccountAuditConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteAccountAuditConfiguration", []))

    @jsii.member(jsii_name="toDeleteAuditSuppression")
    def to_delete_audit_suppression(self) -> "Iot":
        '''(experimental) Grants permission to delete a Device Defender audit suppression.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteAuditSuppression.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteAuditSuppression", []))

    @jsii.member(jsii_name="toDeleteAuthorizer")
    def to_delete_authorizer(self) -> "Iot":
        '''(experimental) Grants permission to delete the specified authorizer.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteAuthorizer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteAuthorizer", []))

    @jsii.member(jsii_name="toDeleteBillingGroup")
    def to_delete_billing_group(self) -> "Iot":
        '''(experimental) Grants permission to delete the specified billing group.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteBillingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteBillingGroup", []))

    @jsii.member(jsii_name="toDeleteCACertificate")
    def to_delete_ca_certificate(self) -> "Iot":
        '''(experimental) Grants permission to delete a registered CA certificate.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteCACertificate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteCACertificate", []))

    @jsii.member(jsii_name="toDeleteCertificate")
    def to_delete_certificate(self) -> "Iot":
        '''(experimental) Grants permission to delete the specified certificate.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteCertificate", []))

    @jsii.member(jsii_name="toDeleteCustomMetric")
    def to_delete_custom_metric(self) -> "Iot":
        '''(experimental) Grants permission to deletes the specified custom metric from your AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteCustomMetric.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteCustomMetric", []))

    @jsii.member(jsii_name="toDeleteDimension")
    def to_delete_dimension(self) -> "Iot":
        '''(experimental) Grants permission to remove the specified dimension from your AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteDimension.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteDimension", []))

    @jsii.member(jsii_name="toDeleteDomainConfiguration")
    def to_delete_domain_configuration(self) -> "Iot":
        '''(experimental) Grants permission to delete a domain configuration.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteDomainConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteDomainConfiguration", []))

    @jsii.member(jsii_name="toDeleteDynamicThingGroup")
    def to_delete_dynamic_thing_group(self) -> "Iot":
        '''(experimental) Grants permission to delete the specified Dynamic Thing Group.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteDynamicThingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteDynamicThingGroup", []))

    @jsii.member(jsii_name="toDeleteFleetMetric")
    def to_delete_fleet_metric(self) -> "Iot":
        '''(experimental) Grants permission to delete the specified fleet metric.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/iot-indexing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteFleetMetric", []))

    @jsii.member(jsii_name="toDeleteJob")
    def to_delete_job(self) -> "Iot":
        '''(experimental) Grants permission to delete a job and its related job executions.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteJob.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteJob", []))

    @jsii.member(jsii_name="toDeleteJobExecution")
    def to_delete_job_execution(self) -> "Iot":
        '''(experimental) Grants permission to delete a job execution.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteJobExecution.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteJobExecution", []))

    @jsii.member(jsii_name="toDeleteJobTemplate")
    def to_delete_job_template(self) -> "Iot":
        '''(experimental) Grants permission to delete a job template.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteJobTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteJobTemplate", []))

    @jsii.member(jsii_name="toDeleteMitigationAction")
    def to_delete_mitigation_action(self) -> "Iot":
        '''(experimental) Grants permission to delete a defined mitigation action from your AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteMitigationAction.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteMitigationAction", []))

    @jsii.member(jsii_name="toDeleteOTAUpdate")
    def to_delete_ota_update(self) -> "Iot":
        '''(experimental) Grants permission to delete an OTA update job.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteOTAUpdate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteOTAUpdate", []))

    @jsii.member(jsii_name="toDeletePolicy")
    def to_delete_policy(self) -> "Iot":
        '''(experimental) Grants permission to delete the specified policy.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeletePolicy.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeletePolicy", []))

    @jsii.member(jsii_name="toDeletePolicyVersion")
    def to_delete_policy_version(self) -> "Iot":
        '''(experimental) Grants permission to Delete the specified version of the specified policy.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeletePolicyVersion.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeletePolicyVersion", []))

    @jsii.member(jsii_name="toDeleteProvisioningTemplate")
    def to_delete_provisioning_template(self) -> "Iot":
        '''(experimental) Grants permission to delete a fleet provisioning template.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteProvisioningTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteProvisioningTemplate", []))

    @jsii.member(jsii_name="toDeleteProvisioningTemplateVersion")
    def to_delete_provisioning_template_version(self) -> "Iot":
        '''(experimental) Grants permission to delete a fleet provisioning template version.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteProvisioningTemplateVersion.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteProvisioningTemplateVersion", []))

    @jsii.member(jsii_name="toDeleteRegistrationCode")
    def to_delete_registration_code(self) -> "Iot":
        '''(experimental) Grants permission to delete a CA certificate registration code.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteRegistrationCode.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteRegistrationCode", []))

    @jsii.member(jsii_name="toDeleteRoleAlias")
    def to_delete_role_alias(self) -> "Iot":
        '''(experimental) Grants permission to delete the specified role alias.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteRoleAlias.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteRoleAlias", []))

    @jsii.member(jsii_name="toDeleteScheduledAudit")
    def to_delete_scheduled_audit(self) -> "Iot":
        '''(experimental) Grants permission to delete a scheduled audit.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteScheduledAudit.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteScheduledAudit", []))

    @jsii.member(jsii_name="toDeleteSecurityProfile")
    def to_delete_security_profile(self) -> "Iot":
        '''(experimental) Grants permission to delete a Device Defender security profile.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteSecurityProfile.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteSecurityProfile", []))

    @jsii.member(jsii_name="toDeleteStream")
    def to_delete_stream(self) -> "Iot":
        '''(experimental) Grants permission to delete a specified stream.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteStream.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteStream", []))

    @jsii.member(jsii_name="toDeleteThing")
    def to_delete_thing(self) -> "Iot":
        '''(experimental) Grants permission to delete the specified thing.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteThing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteThing", []))

    @jsii.member(jsii_name="toDeleteThingGroup")
    def to_delete_thing_group(self) -> "Iot":
        '''(experimental) Grants permission to delete the specified thing group.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteThingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteThingGroup", []))

    @jsii.member(jsii_name="toDeleteThingShadow")
    def to_delete_thing_shadow(self) -> "Iot":
        '''(experimental) Grants permission to delete the specified thing shadow.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/developerguide/policy-actions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteThingShadow", []))

    @jsii.member(jsii_name="toDeleteThingType")
    def to_delete_thing_type(self) -> "Iot":
        '''(experimental) Grants permission to delete the specified thing type.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteThingType.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteThingType", []))

    @jsii.member(jsii_name="toDeleteTopicRule")
    def to_delete_topic_rule(self) -> "Iot":
        '''(experimental) Grants permission to delete the specified rule.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteTopicRule.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteTopicRule", []))

    @jsii.member(jsii_name="toDeleteTopicRuleDestination")
    def to_delete_topic_rule_destination(self) -> "Iot":
        '''(experimental) Grants permission to delete a TopicRuleDestination.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteTopicRuleDestination.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteTopicRuleDestination", []))

    @jsii.member(jsii_name="toDeleteV2LoggingLevel")
    def to_delete_v2_logging_level(self) -> "Iot":
        '''(experimental) Grants permission to delete the specified v2 logging level.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeleteV2LoggingLevel.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeleteV2LoggingLevel", []))

    @jsii.member(jsii_name="toDeprecateThingType")
    def to_deprecate_thing_type(self) -> "Iot":
        '''(experimental) Grants permission to deprecate the specified thing type.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DeprecateThingType.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDeprecateThingType", []))

    @jsii.member(jsii_name="toDescribeAccountAuditConfiguration")
    def to_describe_account_audit_configuration(self) -> "Iot":
        '''(experimental) Grants permission to get information about audit configurations for the account.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeAccountAuditConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeAccountAuditConfiguration", []))

    @jsii.member(jsii_name="toDescribeAuditFinding")
    def to_describe_audit_finding(self) -> "Iot":
        '''(experimental) Grants permission to get information about a single audit finding.

        Properties include the reason for noncompliance, the severity of the issue, and when the audit that returned the finding was started

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeAuditFinding.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeAuditFinding", []))

    @jsii.member(jsii_name="toDescribeAuditMitigationActionsTask")
    def to_describe_audit_mitigation_actions_task(self) -> "Iot":
        '''(experimental) Grants permission to get information about an audit mitigation task that is used to apply mitigation actions to a set of audit findings.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeAuditMitigationActionsTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeAuditMitigationActionsTask", []))

    @jsii.member(jsii_name="toDescribeAuditSuppression")
    def to_describe_audit_suppression(self) -> "Iot":
        '''(experimental) Grants permission to get information about a Device Defender audit suppression.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeAuditSuppression.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeAuditSuppression", []))

    @jsii.member(jsii_name="toDescribeAuditTask")
    def to_describe_audit_task(self) -> "Iot":
        '''(experimental) Grants permission to get information about a Device Defender audit.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeAuditTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeAuditTask", []))

    @jsii.member(jsii_name="toDescribeAuthorizer")
    def to_describe_authorizer(self) -> "Iot":
        '''(experimental) Grants permission to describe an authorizer.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeAuthorizer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeAuthorizer", []))

    @jsii.member(jsii_name="toDescribeBillingGroup")
    def to_describe_billing_group(self) -> "Iot":
        '''(experimental) Grants permission to get information about the specified billing group.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeBillingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeBillingGroup", []))

    @jsii.member(jsii_name="toDescribeCACertificate")
    def to_describe_ca_certificate(self) -> "Iot":
        '''(experimental) Grants permission to describe a registered CA certificate.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeCACertificate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeCACertificate", []))

    @jsii.member(jsii_name="toDescribeCertificate")
    def to_describe_certificate(self) -> "Iot":
        '''(experimental) Grants permission to get information about the specified certificate.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeCertificate", []))

    @jsii.member(jsii_name="toDescribeCustomMetric")
    def to_describe_custom_metric(self) -> "Iot":
        '''(experimental) Grants permission to describe a custom metric that is defined in your AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeCustomMetric.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeCustomMetric", []))

    @jsii.member(jsii_name="toDescribeDefaultAuthorizer")
    def to_describe_default_authorizer(self) -> "Iot":
        '''(experimental) Grants permission to describe the default authorizer.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeDefaultAuthorizer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeDefaultAuthorizer", []))

    @jsii.member(jsii_name="toDescribeDetectMitigationActionsTask")
    def to_describe_detect_mitigation_actions_task(self) -> "Iot":
        '''(experimental) Grants permission to describe a Device Defender ML Detect mitigation action.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeDetectMitigationActionsTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeDetectMitigationActionsTask", []))

    @jsii.member(jsii_name="toDescribeDimension")
    def to_describe_dimension(self) -> "Iot":
        '''(experimental) Grants permission to get details about a dimension that is defined in your AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeDimension.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeDimension", []))

    @jsii.member(jsii_name="toDescribeDomainConfiguration")
    def to_describe_domain_configuration(self) -> "Iot":
        '''(experimental) Grants permission to get information about the domain configuration.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeDomainConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeDomainConfiguration", []))

    @jsii.member(jsii_name="toDescribeEndpoint")
    def to_describe_endpoint(self) -> "Iot":
        '''(experimental) Grants permission to get a unique endpoint specific to the AWS account making the call.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeEndpoint", []))

    @jsii.member(jsii_name="toDescribeEventConfigurations")
    def to_describe_event_configurations(self) -> "Iot":
        '''(experimental) Grants permission to get account event configurations.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeEventConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeEventConfigurations", []))

    @jsii.member(jsii_name="toDescribeFleetMetric")
    def to_describe_fleet_metric(self) -> "Iot":
        '''(experimental) Grants permission to get information about the specified fleet metric.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/iot-indexing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeFleetMetric", []))

    @jsii.member(jsii_name="toDescribeIndex")
    def to_describe_index(self) -> "Iot":
        '''(experimental) Grants permission to get information about the specified index.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeIndex.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeIndex", []))

    @jsii.member(jsii_name="toDescribeJob")
    def to_describe_job(self) -> "Iot":
        '''(experimental) Grants permission to describe a job.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeJob.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeJob", []))

    @jsii.member(jsii_name="toDescribeJobExecution")
    def to_describe_job_execution(self) -> "Iot":
        '''(experimental) Grants permission to describe a job execution.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeJobExecution.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeJobExecution", []))

    @jsii.member(jsii_name="toDescribeJobTemplate")
    def to_describe_job_template(self) -> "Iot":
        '''(experimental) Grants permission to describe a job template.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeJobTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeJobTemplate", []))

    @jsii.member(jsii_name="toDescribeManagedJobTemplate")
    def to_describe_managed_job_template(self) -> "Iot":
        '''(experimental) Grants permission to describe a managed job template.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeManagedJobTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeManagedJobTemplate", []))

    @jsii.member(jsii_name="toDescribeMitigationAction")
    def to_describe_mitigation_action(self) -> "Iot":
        '''(experimental) Grants permission to get information about a mitigation action.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeMitigationAction.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeMitigationAction", []))

    @jsii.member(jsii_name="toDescribeProvisioningTemplate")
    def to_describe_provisioning_template(self) -> "Iot":
        '''(experimental) Grants permission to get information about a fleet provisioning template.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeProvisioningTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeProvisioningTemplate", []))

    @jsii.member(jsii_name="toDescribeProvisioningTemplateVersion")
    def to_describe_provisioning_template_version(self) -> "Iot":
        '''(experimental) Grants permission to get information about a fleet provisioning template version.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeProvisioningTemplateVersion.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeProvisioningTemplateVersion", []))

    @jsii.member(jsii_name="toDescribeRoleAlias")
    def to_describe_role_alias(self) -> "Iot":
        '''(experimental) Grants permission to describe a role alias.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeRoleAlias.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeRoleAlias", []))

    @jsii.member(jsii_name="toDescribeScheduledAudit")
    def to_describe_scheduled_audit(self) -> "Iot":
        '''(experimental) Grants permission to get information about a scheduled audit.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeScheduledAudit.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeScheduledAudit", []))

    @jsii.member(jsii_name="toDescribeSecurityProfile")
    def to_describe_security_profile(self) -> "Iot":
        '''(experimental) Grants permission to get information about a Device Defender security profile.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeSecurityProfile.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeSecurityProfile", []))

    @jsii.member(jsii_name="toDescribeStream")
    def to_describe_stream(self) -> "Iot":
        '''(experimental) Grants permission to get information about the specified stream.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeStream.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeStream", []))

    @jsii.member(jsii_name="toDescribeThing")
    def to_describe_thing(self) -> "Iot":
        '''(experimental) Grants permission to get information about the specified thing.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeThing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeThing", []))

    @jsii.member(jsii_name="toDescribeThingGroup")
    def to_describe_thing_group(self) -> "Iot":
        '''(experimental) Grants permission to get information about the specified thing group.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeThingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeThingGroup", []))

    @jsii.member(jsii_name="toDescribeThingRegistrationTask")
    def to_describe_thing_registration_task(self) -> "Iot":
        '''(experimental) Grants permission to get information about the bulk thing registration task.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeThingRegistrationTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeThingRegistrationTask", []))

    @jsii.member(jsii_name="toDescribeThingType")
    def to_describe_thing_type(self) -> "Iot":
        '''(experimental) Grants permission to get information about the specified thing type.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeThingType.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeThingType", []))

    @jsii.member(jsii_name="toDescribeTunnel")
    def to_describe_tunnel(self) -> "Iot":
        '''(experimental) Grants permission to describe a tunnel.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_iot-secure-tunneling_DescribeTunnel.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDescribeTunnel", []))

    @jsii.member(jsii_name="toDetachPolicy")
    def to_detach_policy(self) -> "Iot":
        '''(experimental) Grants permission to detach a policy from the specified target.

        Access Level: Permissions management

        https://docs.aws.amazon.com/iot/latest/apireference/API_DetachPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDetachPolicy", []))

    @jsii.member(jsii_name="toDetachPrincipalPolicy")
    def to_detach_principal_policy(self) -> "Iot":
        '''(experimental) Grants permission to remove the specified policy from the specified certificate.

        Access Level: Permissions management

        https://docs.aws.amazon.com/iot/latest/apireference/API_DetachPrincipalPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDetachPrincipalPolicy", []))

    @jsii.member(jsii_name="toDetachSecurityProfile")
    def to_detach_security_profile(self) -> "Iot":
        '''(experimental) Grants permission to disassociate a Device Defender security profile from a thing group or from this account.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DetachSecurityProfile.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDetachSecurityProfile", []))

    @jsii.member(jsii_name="toDetachThingPrincipal")
    def to_detach_thing_principal(self) -> "Iot":
        '''(experimental) Grants permission to detach the specified principal from the specified thing.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DetachThingPrincipal.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDetachThingPrincipal", []))

    @jsii.member(jsii_name="toDisableTopicRule")
    def to_disable_topic_rule(self) -> "Iot":
        '''(experimental) Grants permission to disable the specified rule.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_DisableTopicRule.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toDisableTopicRule", []))

    @jsii.member(jsii_name="toEnableTopicRule")
    def to_enable_topic_rule(self) -> "Iot":
        '''(experimental) Grants permission to enable the specified rule.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_EnableTopicRule.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toEnableTopicRule", []))

    @jsii.member(jsii_name="toGetBehaviorModelTrainingSummaries")
    def to_get_behavior_model_training_summaries(self) -> "Iot":
        '''(experimental) Grants permission to fetch a Device Defender's ML Detect Security Profile training model's status.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetBehaviorModelTrainingSummaries.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetBehaviorModelTrainingSummaries", []))

    @jsii.member(jsii_name="toGetBucketsAggregation")
    def to_get_buckets_aggregation(self) -> "Iot":
        '''(experimental) Grants permission to get buckets aggregation for IoT fleet index.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/iot-indexing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetBucketsAggregation", []))

    @jsii.member(jsii_name="toGetCardinality")
    def to_get_cardinality(self) -> "Iot":
        '''(experimental) Grants permission to get cardinality for IoT fleet index.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetCardinality.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetCardinality", []))

    @jsii.member(jsii_name="toGetEffectivePolicies")
    def to_get_effective_policies(self) -> "Iot":
        '''(experimental) Grants permission to get effective policies.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetEffectivePolicies.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetEffectivePolicies", []))

    @jsii.member(jsii_name="toGetIndexingConfiguration")
    def to_get_indexing_configuration(self) -> "Iot":
        '''(experimental) Grants permission to get current fleet indexing configuration.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetIndexingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetIndexingConfiguration", []))

    @jsii.member(jsii_name="toGetJobDocument")
    def to_get_job_document(self) -> "Iot":
        '''(experimental) Grants permission to get a job document.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetJobDocument.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetJobDocument", []))

    @jsii.member(jsii_name="toGetLoggingOptions")
    def to_get_logging_options(self) -> "Iot":
        '''(experimental) Grants permission to get the logging options.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetLoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetLoggingOptions", []))

    @jsii.member(jsii_name="toGetOTAUpdate")
    def to_get_ota_update(self) -> "Iot":
        '''(experimental) Grants permission to get the information about the OTA update job.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetOTAUpdate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetOTAUpdate", []))

    @jsii.member(jsii_name="toGetPercentiles")
    def to_get_percentiles(self) -> "Iot":
        '''(experimental) Grants permission to get percentiles for IoT fleet index.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetPercentiles.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetPercentiles", []))

    @jsii.member(jsii_name="toGetPolicy")
    def to_get_policy(self) -> "Iot":
        '''(experimental) Grants permission to get information about the specified policy with the policy document of the default version.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetPolicy", []))

    @jsii.member(jsii_name="toGetPolicyVersion")
    def to_get_policy_version(self) -> "Iot":
        '''(experimental) Grants permission to get information about the specified policy version.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetPolicyVersion.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetPolicyVersion", []))

    @jsii.member(jsii_name="toGetRegistrationCode")
    def to_get_registration_code(self) -> "Iot":
        '''(experimental) Grants permission to get a registration code used to register a CA certificate with AWS IoT.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetRegistrationCode.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetRegistrationCode", []))

    @jsii.member(jsii_name="toGetRetainedMessage")
    def to_get_retained_message(self) -> "Iot":
        '''(experimental) Grants permission to get the retained message on the specified topic.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/developerguide/policy-actions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetRetainedMessage", []))

    @jsii.member(jsii_name="toGetStatistics")
    def to_get_statistics(self) -> "Iot":
        '''(experimental) Grants permission to get statistics for IoT fleet index.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetStatistics.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetStatistics", []))

    @jsii.member(jsii_name="toGetThingShadow")
    def to_get_thing_shadow(self) -> "Iot":
        '''(experimental) Grants permission to get the thing shadow.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/developerguide/policy-actions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetThingShadow", []))

    @jsii.member(jsii_name="toGetTopicRule")
    def to_get_topic_rule(self) -> "Iot":
        '''(experimental) Grants permission to get information about the specified rule.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetTopicRule.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetTopicRule", []))

    @jsii.member(jsii_name="toGetTopicRuleDestination")
    def to_get_topic_rule_destination(self) -> "Iot":
        '''(experimental) Grants permission to get a TopicRuleDestination.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetTopicRuleDestination.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetTopicRuleDestination", []))

    @jsii.member(jsii_name="toGetV2LoggingOptions")
    def to_get_v2_logging_options(self) -> "Iot":
        '''(experimental) Grants permission to get v2 logging options.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_GetV2LoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toGetV2LoggingOptions", []))

    @jsii.member(jsii_name="toListActiveViolations")
    def to_list_active_violations(self) -> "Iot":
        '''(experimental) Grants permission to list the active violations for a given Device Defender security profile or Thing.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListActiveViolations.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListActiveViolations", []))

    @jsii.member(jsii_name="toListAttachedPolicies")
    def to_list_attached_policies(self) -> "Iot":
        '''(experimental) Grants permission to list the policies attached to the specified thing group.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListAttachedPolicies.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListAttachedPolicies", []))

    @jsii.member(jsii_name="toListAuditFindings")
    def to_list_audit_findings(self) -> "Iot":
        '''(experimental) Grants permission to list the findings (results) of a Device Defender audit or of the audits performed during a specified time period.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListAuditFindings.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListAuditFindings", []))

    @jsii.member(jsii_name="toListAuditMitigationActionsExecutions")
    def to_list_audit_mitigation_actions_executions(self) -> "Iot":
        '''(experimental) Grants permission to get the status of audit mitigation action tasks that were executed.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListAuditMitigationActionsExecutions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListAuditMitigationActionsExecutions", []))

    @jsii.member(jsii_name="toListAuditMitigationActionsTasks")
    def to_list_audit_mitigation_actions_tasks(self) -> "Iot":
        '''(experimental) Grants permission to get a list of audit mitigation action tasks that match the specified filters.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListAuditMitigationActionsTasks.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListAuditMitigationActionsTasks", []))

    @jsii.member(jsii_name="toListAuditSuppressions")
    def to_list_audit_suppressions(self) -> "Iot":
        '''(experimental) Grants permission to list your Device Defender audit suppressions.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListAuditSuppressions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListAuditSuppressions", []))

    @jsii.member(jsii_name="toListAuditTasks")
    def to_list_audit_tasks(self) -> "Iot":
        '''(experimental) Grants permission to list the Device Defender audits that have been performed during a given time period.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListAuditTasks.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListAuditTasks", []))

    @jsii.member(jsii_name="toListAuthorizers")
    def to_list_authorizers(self) -> "Iot":
        '''(experimental) Grants permission to list the authorizers registered in your account.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListAuthorizers.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListAuthorizers", []))

    @jsii.member(jsii_name="toListBillingGroups")
    def to_list_billing_groups(self) -> "Iot":
        '''(experimental) Grants permission to list all billing groups.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListBillingGroups.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListBillingGroups", []))

    @jsii.member(jsii_name="toListCACertificates")
    def to_list_ca_certificates(self) -> "Iot":
        '''(experimental) Grants permission to list the CA certificates registered for your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListCACertificates.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListCACertificates", []))

    @jsii.member(jsii_name="toListCertificates")
    def to_list_certificates(self) -> "Iot":
        '''(experimental) Grants permission to list your certificates.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListCertificates.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListCertificates", []))

    @jsii.member(jsii_name="toListCertificatesByCA")
    def to_list_certificates_by_ca(self) -> "Iot":
        '''(experimental) Grants permission to list the device certificates signed by the specified CA certificate.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListCertificatesByCA.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListCertificatesByCA", []))

    @jsii.member(jsii_name="toListCustomMetrics")
    def to_list_custom_metrics(self) -> "Iot":
        '''(experimental) Grants permission to list the custom metrics in your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListCustomMetrics.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListCustomMetrics", []))

    @jsii.member(jsii_name="toListDetectMitigationActionsExecutions")
    def to_list_detect_mitigation_actions_executions(self) -> "Iot":
        '''(experimental) Grants permission to lists mitigation actions executions for a Device Defender ML Detect Security Profile.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListDetectMitigationActionsExecutions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListDetectMitigationActionsExecutions", []))

    @jsii.member(jsii_name="toListDetectMitigationActionsTasks")
    def to_list_detect_mitigation_actions_tasks(self) -> "Iot":
        '''(experimental) Grants permission to list Device Defender ML Detect mitigation actions tasks.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListDetectMitigationActionsTasks.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListDetectMitigationActionsTasks", []))

    @jsii.member(jsii_name="toListDimensions")
    def to_list_dimensions(self) -> "Iot":
        '''(experimental) Grants permission to list the dimensions that are defined for your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListDimensions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListDimensions", []))

    @jsii.member(jsii_name="toListDomainConfigurations")
    def to_list_domain_configurations(self) -> "Iot":
        '''(experimental) Grants permission to list the domain configuration created by your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListDomainConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListDomainConfigurations", []))

    @jsii.member(jsii_name="toListFleetMetrics")
    def to_list_fleet_metrics(self) -> "Iot":
        '''(experimental) Grants permission to list the fleet metrics in your account.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/iot-indexing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListFleetMetrics", []))

    @jsii.member(jsii_name="toListIndices")
    def to_list_indices(self) -> "Iot":
        '''(experimental) Grants permission to list all indices for fleet index.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListIndices.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListIndices", []))

    @jsii.member(jsii_name="toListJobExecutionsForJob")
    def to_list_job_executions_for_job(self) -> "Iot":
        '''(experimental) Grants permission to list the job executions for a job.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListJobExecutionsForJob.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListJobExecutionsForJob", []))

    @jsii.member(jsii_name="toListJobExecutionsForThing")
    def to_list_job_executions_for_thing(self) -> "Iot":
        '''(experimental) Grants permission to list the job executions for the specified thing.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListJobExecutionsForThing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListJobExecutionsForThing", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Iot":
        '''(experimental) Grants permission to list jobs.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListJobs.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListJobTemplates")
    def to_list_job_templates(self) -> "Iot":
        '''(experimental) Grants permission to list job templates.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListJobTemplates.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListJobTemplates", []))

    @jsii.member(jsii_name="toListManagedJobTemplates")
    def to_list_managed_job_templates(self) -> "Iot":
        '''(experimental) Grants permission to list managed job templates.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListManagedJobTemplates.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListManagedJobTemplates", []))

    @jsii.member(jsii_name="toListMetricValues")
    def to_list_metric_values(self) -> "Iot":
        '''(experimental) Adds support to list metric datapoints collected for IoT devices.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListMetricValues.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListMetricValues", []))

    @jsii.member(jsii_name="toListMitigationActions")
    def to_list_mitigation_actions(self) -> "Iot":
        '''(experimental) Grants permission to get a list of all mitigation actions that match the specified filter criteria.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListMitigationActions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListMitigationActions", []))

    @jsii.member(jsii_name="toListNamedShadowsForThing")
    def to_list_named_shadows_for_thing(self) -> "Iot":
        '''(experimental) Grants permission to list all named shadows for a given thing.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListNamedShadowsForThing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListNamedShadowsForThing", []))

    @jsii.member(jsii_name="toListOTAUpdates")
    def to_list_ota_updates(self) -> "Iot":
        '''(experimental) Grants permission to list OTA update jobs in the account.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListOTAUpdates.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListOTAUpdates", []))

    @jsii.member(jsii_name="toListOutgoingCertificates")
    def to_list_outgoing_certificates(self) -> "Iot":
        '''(experimental) Grants permission to list certificates that are being transfered but not yet accepted.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListOutgoingCertificates.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListOutgoingCertificates", []))

    @jsii.member(jsii_name="toListPolicies")
    def to_list_policies(self) -> "Iot":
        '''(experimental) Grants permission to list your policies.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListPolicies.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListPolicies", []))

    @jsii.member(jsii_name="toListPolicyPrincipals")
    def to_list_policy_principals(self) -> "Iot":
        '''(experimental) Grants permission to list the principals associated with the specified policy.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListPolicyPrincipals.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListPolicyPrincipals", []))

    @jsii.member(jsii_name="toListPolicyVersions")
    def to_list_policy_versions(self) -> "Iot":
        '''(experimental) Grants permission to list the versions of the specified policy, and identifies the default version.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListPolicyVersions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListPolicyVersions", []))

    @jsii.member(jsii_name="toListPrincipalPolicies")
    def to_list_principal_policies(self) -> "Iot":
        '''(experimental) Grants permission to list the policies attached to the specified principal.

        If you use an Amazon Cognito identity, the ID needs to be in Amazon Cognito Identity format

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListPrincipalPolicies.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListPrincipalPolicies", []))

    @jsii.member(jsii_name="toListPrincipalThings")
    def to_list_principal_things(self) -> "Iot":
        '''(experimental) Grants permission to list the things associated with the specified principal.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListPrincipalThings.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListPrincipalThings", []))

    @jsii.member(jsii_name="toListProvisioningTemplates")
    def to_list_provisioning_templates(self) -> "Iot":
        '''(experimental) Grants permission to list the fleet provisioning templates in your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListProvisioningTemplates.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListProvisioningTemplates", []))

    @jsii.member(jsii_name="toListProvisioningTemplateVersions")
    def to_list_provisioning_template_versions(self) -> "Iot":
        '''(experimental) Grants permission to get a list of fleet provisioning template versions.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListProvisioningTemplateVersions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListProvisioningTemplateVersions", []))

    @jsii.member(jsii_name="toListRelatedResourcesForAuditFinding")
    def to_list_related_resources_for_audit_finding(self) -> "Iot":
        '''(experimental) Grants permission to list related resources for a single audit finding.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListRelatedResourcesForAuditFinding.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListRelatedResourcesForAuditFinding", []))

    @jsii.member(jsii_name="toListRetainedMessages")
    def to_list_retained_messages(self) -> "Iot":
        '''(experimental) Grants permission to list the retained messages for your account.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/developerguide/policy-actions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListRetainedMessages", []))

    @jsii.member(jsii_name="toListRoleAliases")
    def to_list_role_aliases(self) -> "Iot":
        '''(experimental) Grants permission to list role aliases.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListRoleAliases.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListRoleAliases", []))

    @jsii.member(jsii_name="toListScheduledAudits")
    def to_list_scheduled_audits(self) -> "Iot":
        '''(experimental) Grants permission to list all of your scheduled audits.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListScheduledAudits.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListScheduledAudits", []))

    @jsii.member(jsii_name="toListSecurityProfiles")
    def to_list_security_profiles(self) -> "Iot":
        '''(experimental) Grants permission to list the Device Defender security profiles you have created.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListSecurityProfiles.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListSecurityProfiles", []))

    @jsii.member(jsii_name="toListSecurityProfilesForTarget")
    def to_list_security_profiles_for_target(self) -> "Iot":
        '''(experimental) Grants permission to list the Device Defender security profiles attached to a target.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListSecurityProfilesForTarget.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListSecurityProfilesForTarget", []))

    @jsii.member(jsii_name="toListStreams")
    def to_list_streams(self) -> "Iot":
        '''(experimental) Grants permission to list the streams in your account.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListStreams.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListStreams", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Iot":
        '''(experimental) Grants permission to list all tags for a given resource.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTargetsForPolicy")
    def to_list_targets_for_policy(self) -> "Iot":
        '''(experimental) Grants permission to list targets for the specified policy.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListTargetsForPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListTargetsForPolicy", []))

    @jsii.member(jsii_name="toListTargetsForSecurityProfile")
    def to_list_targets_for_security_profile(self) -> "Iot":
        '''(experimental) Grants permission to list the targets associated with a given Device Defender security profile.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListTargetsForSecurityProfile.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListTargetsForSecurityProfile", []))

    @jsii.member(jsii_name="toListThingGroups")
    def to_list_thing_groups(self) -> "Iot":
        '''(experimental) Grants permission to list all thing groups.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListThingGroups.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListThingGroups", []))

    @jsii.member(jsii_name="toListThingGroupsForThing")
    def to_list_thing_groups_for_thing(self) -> "Iot":
        '''(experimental) Grants permission to list thing groups to which the specified thing belongs.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListThingGroupsForThing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListThingGroupsForThing", []))

    @jsii.member(jsii_name="toListThingPrincipals")
    def to_list_thing_principals(self) -> "Iot":
        '''(experimental) Grants permission to list the principals associated with the specified thing.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListThingPrincipals.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListThingPrincipals", []))

    @jsii.member(jsii_name="toListThingRegistrationTaskReports")
    def to_list_thing_registration_task_reports(self) -> "Iot":
        '''(experimental) Grants permission to list information about bulk thing registration tasks.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListThingRegistrationTaskReports.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListThingRegistrationTaskReports", []))

    @jsii.member(jsii_name="toListThingRegistrationTasks")
    def to_list_thing_registration_tasks(self) -> "Iot":
        '''(experimental) Grants permission to list bulk thing registration tasks.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListThingRegistrationTasks.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListThingRegistrationTasks", []))

    @jsii.member(jsii_name="toListThings")
    def to_list_things(self) -> "Iot":
        '''(experimental) Grants permission to list all things.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListThings.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListThings", []))

    @jsii.member(jsii_name="toListThingsInBillingGroup")
    def to_list_things_in_billing_group(self) -> "Iot":
        '''(experimental) Grants permission to list all things in the specified billing group.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListThingsInBillingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListThingsInBillingGroup", []))

    @jsii.member(jsii_name="toListThingsInThingGroup")
    def to_list_things_in_thing_group(self) -> "Iot":
        '''(experimental) Grants permission to list all things in the specified thing group.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListThingsInThingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListThingsInThingGroup", []))

    @jsii.member(jsii_name="toListThingTypes")
    def to_list_thing_types(self) -> "Iot":
        '''(experimental) Grants permission to list all thing types.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListThingTypes.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListThingTypes", []))

    @jsii.member(jsii_name="toListTopicRuleDestinations")
    def to_list_topic_rule_destinations(self) -> "Iot":
        '''(experimental) Grants permission to list all TopicRuleDestinations.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListTopicRuleDestinations.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListTopicRuleDestinations", []))

    @jsii.member(jsii_name="toListTopicRules")
    def to_list_topic_rules(self) -> "Iot":
        '''(experimental) Grants permission to list the rules for the specific topic.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListTopicRules.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListTopicRules", []))

    @jsii.member(jsii_name="toListTunnels")
    def to_list_tunnels(self) -> "Iot":
        '''(experimental) Grants permission to list tunnels.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_iot-secure-tunneling_ListTunnels.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListTunnels", []))

    @jsii.member(jsii_name="toListV2LoggingLevels")
    def to_list_v2_logging_levels(self) -> "Iot":
        '''(experimental) Grants permission to list the v2 logging levels.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListV2LoggingLevels.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListV2LoggingLevels", []))

    @jsii.member(jsii_name="toListViolationEvents")
    def to_list_violation_events(self) -> "Iot":
        '''(experimental) Grants permission to list the Device Defender security profile violations discovered during the given time period.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_ListViolationEvents.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toListViolationEvents", []))

    @jsii.member(jsii_name="toOpenTunnel")
    def to_open_tunnel(self) -> "Iot":
        '''(experimental) Grants permission to open a tunnel.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifThingGroupArn()
        - .ifTunnelDestinationService()

        https://docs.aws.amazon.com/iot/latest/apireference/API_iot-secure-tunneling_OpenTunnel.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toOpenTunnel", []))

    @jsii.member(jsii_name="toPublish")
    def to_publish(self) -> "Iot":
        '''(experimental) Grants permission to publish to the specified topic.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/developerguide/policy-actions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toPublish", []))

    @jsii.member(jsii_name="toPutVerificationStateOnViolation")
    def to_put_verification_state_on_violation(self) -> "Iot":
        '''(experimental) Grants permission to put verification state on a violation.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_PutVerificationStateOnViolation.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toPutVerificationStateOnViolation", []))

    @jsii.member(jsii_name="toReceive")
    def to_receive(self) -> "Iot":
        '''(experimental) Grants permission to receive from the specified topic.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/developerguide/policy-actions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toReceive", []))

    @jsii.member(jsii_name="toRegisterCACertificate")
    def to_register_ca_certificate(self) -> "Iot":
        '''(experimental) Grants permission to register a CA certificate with AWS IoT.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/iot/latest/apireference/API_RegisterCACertificate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toRegisterCACertificate", []))

    @jsii.member(jsii_name="toRegisterCertificate")
    def to_register_certificate(self) -> "Iot":
        '''(experimental) Grants permission to register a device certificate with AWS IoT.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_RegisterCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toRegisterCertificate", []))

    @jsii.member(jsii_name="toRegisterCertificateWithoutCA")
    def to_register_certificate_without_ca(self) -> "Iot":
        '''(experimental) Grants permission to register a device certificate with AWS IoT without a registered CA (certificate authority).

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_RegisterCertificateWithoutCA.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toRegisterCertificateWithoutCA", []))

    @jsii.member(jsii_name="toRegisterThing")
    def to_register_thing(self) -> "Iot":
        '''(experimental) Grants permission to register your thing.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_RegisterThing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toRegisterThing", []))

    @jsii.member(jsii_name="toRejectCertificateTransfer")
    def to_reject_certificate_transfer(self) -> "Iot":
        '''(experimental) Grants permission to reject a pending certificate transfer.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_RejectCertificateTransfer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toRejectCertificateTransfer", []))

    @jsii.member(jsii_name="toRemoveThingFromBillingGroup")
    def to_remove_thing_from_billing_group(self) -> "Iot":
        '''(experimental) Grants permission to remove thing from the specified billing group.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_RemoveThingFromBillingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toRemoveThingFromBillingGroup", []))

    @jsii.member(jsii_name="toRemoveThingFromThingGroup")
    def to_remove_thing_from_thing_group(self) -> "Iot":
        '''(experimental) Grants permission to remove thing from the specified thing group.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_RemoveThingFromThingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toRemoveThingFromThingGroup", []))

    @jsii.member(jsii_name="toReplaceTopicRule")
    def to_replace_topic_rule(self) -> "Iot":
        '''(experimental) Grants permission to replace the specified rule.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_ReplaceTopicRule.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toReplaceTopicRule", []))

    @jsii.member(jsii_name="toRetainPublish")
    def to_retain_publish(self) -> "Iot":
        '''(experimental) Grants permission to publish a retained message to the specified topic.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/developerguide/policy-actions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toRetainPublish", []))

    @jsii.member(jsii_name="toRotateTunnelAccessToken")
    def to_rotate_tunnel_access_token(self) -> "Iot":
        '''(experimental) Grants permission to rotate the access token of a tunnel.

        Access Level: Write

        Possible conditions:

        - .ifThingGroupArn()
        - .ifTunnelDestinationService()
        - .ifClientMode()

        https://docs.aws.amazon.com/iot/latest/apireference/API_iot-secure-tunneling_RotateTunnelAccessToken.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toRotateTunnelAccessToken", []))

    @jsii.member(jsii_name="toSearchIndex")
    def to_search_index(self) -> "Iot":
        '''(experimental) Grants permission to search IoT fleet index.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_SearchIndex.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toSearchIndex", []))

    @jsii.member(jsii_name="toSetDefaultAuthorizer")
    def to_set_default_authorizer(self) -> "Iot":
        '''(experimental) Grants permission to set the default authorizer.

        This will be used if a websocket connection is made without specifying an authorizer

        Access Level: Permissions management

        https://docs.aws.amazon.com/iot/latest/apireference/API_SetDefaultAuthorizer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toSetDefaultAuthorizer", []))

    @jsii.member(jsii_name="toSetDefaultPolicyVersion")
    def to_set_default_policy_version(self) -> "Iot":
        '''(experimental) Grants permission to set the specified version of the specified policy as the policy's default (operative) version.

        Access Level: Permissions management

        https://docs.aws.amazon.com/iot/latest/apireference/API_SetDefaultPolicyVersion.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toSetDefaultPolicyVersion", []))

    @jsii.member(jsii_name="toSetLoggingOptions")
    def to_set_logging_options(self) -> "Iot":
        '''(experimental) Grants permission to set the logging options.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_SetLoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toSetLoggingOptions", []))

    @jsii.member(jsii_name="toSetV2LoggingLevel")
    def to_set_v2_logging_level(self) -> "Iot":
        '''(experimental) Grants permission to set the v2 logging level.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_SetV2LoggingLevel.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toSetV2LoggingLevel", []))

    @jsii.member(jsii_name="toSetV2LoggingOptions")
    def to_set_v2_logging_options(self) -> "Iot":
        '''(experimental) Grants permission to set the v2 logging options.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_SetV2LoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toSetV2LoggingOptions", []))

    @jsii.member(jsii_name="toStartAuditMitigationActionsTask")
    def to_start_audit_mitigation_actions_task(self) -> "Iot":
        '''(experimental) Grants permission to start a task that applies a set of mitigation actions to the specified target.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_StartAuditMitigationActionsTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toStartAuditMitigationActionsTask", []))

    @jsii.member(jsii_name="toStartDetectMitigationActionsTask")
    def to_start_detect_mitigation_actions_task(self) -> "Iot":
        '''(experimental) Grants permission to start a Device Defender ML Detect mitigation actions task.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_StartDetectMitigationActionsTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toStartDetectMitigationActionsTask", []))

    @jsii.member(jsii_name="toStartOnDemandAuditTask")
    def to_start_on_demand_audit_task(self) -> "Iot":
        '''(experimental) Grants permission to start an on-demand Device Defender audit.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_StartOnDemandAuditTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toStartOnDemandAuditTask", []))

    @jsii.member(jsii_name="toStartThingRegistrationTask")
    def to_start_thing_registration_task(self) -> "Iot":
        '''(experimental) Grants permission to start a bulk thing registration task.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_StartThingRegistrationTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toStartThingRegistrationTask", []))

    @jsii.member(jsii_name="toStopThingRegistrationTask")
    def to_stop_thing_registration_task(self) -> "Iot":
        '''(experimental) Grants permission to stop a bulk thing registration task.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_StopThingRegistrationTask.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toStopThingRegistrationTask", []))

    @jsii.member(jsii_name="toSubscribe")
    def to_subscribe(self) -> "Iot":
        '''(experimental) Grants permission to subscribe to the specified TopicFilter.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/developerguide/policy-actions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toSubscribe", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Iot":
        '''(experimental) Grants permission to tag a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestAuthorization")
    def to_test_authorization(self) -> "Iot":
        '''(experimental) Grants permission to test the policies evaluation for group policies.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_TestAuthorization.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toTestAuthorization", []))

    @jsii.member(jsii_name="toTestInvokeAuthorizer")
    def to_test_invoke_authorizer(self) -> "Iot":
        '''(experimental) Grants permission to test invoke the specified custom authorizer for testing purposes.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_TestInvokeAuthorizer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toTestInvokeAuthorizer", []))

    @jsii.member(jsii_name="toTransferCertificate")
    def to_transfer_certificate(self) -> "Iot":
        '''(experimental) Grants permission to transfer the specified certificate to the specified AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_TransferCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toTransferCertificate", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Iot":
        '''(experimental) Grants permission to untag a specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAccountAuditConfiguration")
    def to_update_account_audit_configuration(self) -> "Iot":
        '''(experimental) Grants permission to configure or reconfigure the Device Defender audit settings for this account.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateAccountAuditConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateAccountAuditConfiguration", []))

    @jsii.member(jsii_name="toUpdateAuditSuppression")
    def to_update_audit_suppression(self) -> "Iot":
        '''(experimental) Grants permission to update a Device Defender audit suppression.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateAuditSuppression.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateAuditSuppression", []))

    @jsii.member(jsii_name="toUpdateAuthorizer")
    def to_update_authorizer(self) -> "Iot":
        '''(experimental) Grants permission to update an authorizer.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateAuthorizer.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateAuthorizer", []))

    @jsii.member(jsii_name="toUpdateBillingGroup")
    def to_update_billing_group(self) -> "Iot":
        '''(experimental) Grants permission to update information associated with the specified billing group.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateBillingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateBillingGroup", []))

    @jsii.member(jsii_name="toUpdateCACertificate")
    def to_update_ca_certificate(self) -> "Iot":
        '''(experimental) Grants permission to update a registered CA certificate.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateCACertificate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateCACertificate", []))

    @jsii.member(jsii_name="toUpdateCertificate")
    def to_update_certificate(self) -> "Iot":
        '''(experimental) Grants permission to update the status of the specified certificate. This operation is idempotent.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateCertificate", []))

    @jsii.member(jsii_name="toUpdateCustomMetric")
    def to_update_custom_metric(self) -> "Iot":
        '''(experimental) Grants permission to update the specified custom metric.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateCustomMetric.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateCustomMetric", []))

    @jsii.member(jsii_name="toUpdateDimension")
    def to_update_dimension(self) -> "Iot":
        '''(experimental) Grants permission to update the definition for a dimension.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateDimension.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateDimension", []))

    @jsii.member(jsii_name="toUpdateDomainConfiguration")
    def to_update_domain_configuration(self) -> "Iot":
        '''(experimental) Grants permission to update a domain configuration.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateDomainConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateDomainConfiguration", []))

    @jsii.member(jsii_name="toUpdateDynamicThingGroup")
    def to_update_dynamic_thing_group(self) -> "Iot":
        '''(experimental) Grants permission to update a Dynamic Thing Group.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateDynamicThingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateDynamicThingGroup", []))

    @jsii.member(jsii_name="toUpdateEventConfigurations")
    def to_update_event_configurations(self) -> "Iot":
        '''(experimental) Grants permission to update event configurations.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateEventConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateEventConfigurations", []))

    @jsii.member(jsii_name="toUpdateFleetMetric")
    def to_update_fleet_metric(self) -> "Iot":
        '''(experimental) Grants permission to update a fleet metric.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/iot-indexing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateFleetMetric", []))

    @jsii.member(jsii_name="toUpdateIndexingConfiguration")
    def to_update_indexing_configuration(self) -> "Iot":
        '''(experimental) Grants permission to update fleet indexing configuration.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateIndexingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateIndexingConfiguration", []))

    @jsii.member(jsii_name="toUpdateJob")
    def to_update_job(self) -> "Iot":
        '''(experimental) Grants permission to update a job.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateJob.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateJob", []))

    @jsii.member(jsii_name="toUpdateMitigationAction")
    def to_update_mitigation_action(self) -> "Iot":
        '''(experimental) Grants permission to update the definition for the specified mitigation action.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateMitigationAction.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateMitigationAction", []))

    @jsii.member(jsii_name="toUpdateProvisioningTemplate")
    def to_update_provisioning_template(self) -> "Iot":
        '''(experimental) Grants permission to update a fleet provisioning template.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateProvisioningTemplate.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateProvisioningTemplate", []))

    @jsii.member(jsii_name="toUpdateRoleAlias")
    def to_update_role_alias(self) -> "Iot":
        '''(experimental) Grants permission to update the role alias.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateRoleAlias.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateRoleAlias", []))

    @jsii.member(jsii_name="toUpdateScheduledAudit")
    def to_update_scheduled_audit(self) -> "Iot":
        '''(experimental) Grants permission to update a scheduled audit, including what checks are performed and how often the audit takes place.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateScheduledAudit.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateScheduledAudit", []))

    @jsii.member(jsii_name="toUpdateSecurityProfile")
    def to_update_security_profile(self) -> "Iot":
        '''(experimental) Grants permission to update a Device Defender security profile.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateSecurityProfile.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateSecurityProfile", []))

    @jsii.member(jsii_name="toUpdateStream")
    def to_update_stream(self) -> "Iot":
        '''(experimental) Grants permission to update the data for a stream.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateStream.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateStream", []))

    @jsii.member(jsii_name="toUpdateThing")
    def to_update_thing(self) -> "Iot":
        '''(experimental) Grants permission to update information associated with the specified thing.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateThing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateThing", []))

    @jsii.member(jsii_name="toUpdateThingGroup")
    def to_update_thing_group(self) -> "Iot":
        '''(experimental) Grants permission to update information associated with the specified thing group.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateThingGroup.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateThingGroup", []))

    @jsii.member(jsii_name="toUpdateThingGroupsForThing")
    def to_update_thing_groups_for_thing(self) -> "Iot":
        '''(experimental) Grants permission to update the thing groups to which the thing belongs.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateThingGroupsForThing.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateThingGroupsForThing", []))

    @jsii.member(jsii_name="toUpdateThingShadow")
    def to_update_thing_shadow(self) -> "Iot":
        '''(experimental) Grants permission to update the thing shadow.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/developerguide/policy-actions.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateThingShadow", []))

    @jsii.member(jsii_name="toUpdateTopicRuleDestination")
    def to_update_topic_rule_destination(self) -> "Iot":
        '''(experimental) Grants permission to update a TopicRuleDestination.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_UpdateTopicRuleDestination.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toUpdateTopicRuleDestination", []))

    @jsii.member(jsii_name="toValidateSecurityProfileBehaviors")
    def to_validate_security_profile_behaviors(self) -> "Iot":
        '''(experimental) Grants permission to validate a Device Defender security profile behaviors specification.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_ValidateSecurityProfileBehaviors.html

        :stability: experimental
        '''
        return typing.cast("Iot", jsii.invoke(self, "toValidateSecurityProfileBehaviors", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c5fb46c9d94e3580214938c09fd26d2b39f01f4615c6f59726dd4f881a19499c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e38959f5cbf0dc0875d7313e633099bce9befbab63c46c311c2ee64d604ae38c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Iot1click(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Iot1click",
):
    '''(experimental) Statement provider for service `iot1click <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot1-click.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iot1click <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot1-click.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__06e6ee38460f6aa936c6633c3c668b4cb9f23ff7e27691285cd7dd3f9542a424)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDevice")
    def on_device(
        self,
        device_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot1click":
        '''(experimental) Adds a resource of type device to the statement.

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/resources.html

        :param device_id: - Identifier for the deviceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d29ae20bba6bf86b038dd01411bf7dcc49e3378616807441600ae708f42c50fa)
            check_type(argname="argument device_id", value=device_id, expected_type=type_hints["device_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot1click", jsii.invoke(self, "onDevice", [device_id, account, region, partition]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iot1click":
        '''(experimental) Adds a resource of type project to the statement.

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_Operations.html

        :param project_name: - Identifier for the projectName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7288095097d13845f87565ce4c1e7f247e343d37719722e55cb18ba8e870de29)
            check_type(argname="argument project_name", value=project_name, expected_type=type_hints["project_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iot1click", jsii.invoke(self, "onProject", [project_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateDeviceWithPlacement")
    def to_associate_device_with_placement(self) -> "Iot1click":
        '''(experimental) Grants permission to associate a device to a placement.

        Access Level: Write

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_AssociateDeviceWithPlacement.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toAssociateDeviceWithPlacement", []))

    @jsii.member(jsii_name="toClaimDevicesByClaimCode")
    def to_claim_devices_by_claim_code(self) -> "Iot1click":
        '''(experimental) Grants permission to claim a batch of devices with a claim code.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/claims-claimcode.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toClaimDevicesByClaimCode", []))

    @jsii.member(jsii_name="toCreatePlacement")
    def to_create_placement(self) -> "Iot1click":
        '''(experimental) Grants permission to create a new placement in a project.

        Access Level: Write

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_CreatePlacement.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toCreatePlacement", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Iot1click":
        '''(experimental) Grants permission to create a new project.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_CreateProject.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toDeletePlacement")
    def to_delete_placement(self) -> "Iot1click":
        '''(experimental) Grants permission to delete a placement from a project.

        Access Level: Write

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_DeletePlacement.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toDeletePlacement", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Iot1click":
        '''(experimental) Grants permission to delete a project.

        Access Level: Write

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_DeleteProject.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDescribeDevice")
    def to_describe_device(self) -> "Iot1click":
        '''(experimental) Grants permission to describe a device.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/devices-deviceid.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toDescribeDevice", []))

    @jsii.member(jsii_name="toDescribePlacement")
    def to_describe_placement(self) -> "Iot1click":
        '''(experimental) Grants permission to describe a placement.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_DescribePlacement.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toDescribePlacement", []))

    @jsii.member(jsii_name="toDescribeProject")
    def to_describe_project(self) -> "Iot1click":
        '''(experimental) Grants permission to describe a project.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_DescribeProject.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toDescribeProject", []))

    @jsii.member(jsii_name="toDisassociateDeviceFromPlacement")
    def to_disassociate_device_from_placement(self) -> "Iot1click":
        '''(experimental) Grants permission to disassociate a device from a placement.

        Access Level: Write

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_DisassociateDeviceFromPlacement.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toDisassociateDeviceFromPlacement", []))

    @jsii.member(jsii_name="toFinalizeDeviceClaim")
    def to_finalize_device_claim(self) -> "Iot1click":
        '''(experimental) Grants permission to finalize a device claim.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/devices-deviceid-finalize-claim.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toFinalizeDeviceClaim", []))

    @jsii.member(jsii_name="toGetDeviceMethods")
    def to_get_device_methods(self) -> "Iot1click":
        '''(experimental) Grants permission to get available methods of a device.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/devices-deviceid-methods.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toGetDeviceMethods", []))

    @jsii.member(jsii_name="toGetDevicesInPlacement")
    def to_get_devices_in_placement(self) -> "Iot1click":
        '''(experimental) Grants permission to get devices associated to a placement.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_GetDevicesInPlacement.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toGetDevicesInPlacement", []))

    @jsii.member(jsii_name="toInitiateDeviceClaim")
    def to_initiate_device_claim(self) -> "Iot1click":
        '''(experimental) Grants permission to initialize a device claim.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/devices-deviceid-initiate-claim.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toInitiateDeviceClaim", []))

    @jsii.member(jsii_name="toInvokeDeviceMethod")
    def to_invoke_device_method(self) -> "Iot1click":
        '''(experimental) Grants permission to invoke a device method.

        Access Level: Write

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/devices-deviceid-methods.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toInvokeDeviceMethod", []))

    @jsii.member(jsii_name="toListDeviceEvents")
    def to_list_device_events(self) -> "Iot1click":
        '''(experimental) Grants permission to list past events published by a device.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/devices-deviceid-events.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toListDeviceEvents", []))

    @jsii.member(jsii_name="toListDevices")
    def to_list_devices(self) -> "Iot1click":
        '''(experimental) Grants permission to list all devices.

        Access Level: List

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/devices.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toListDevices", []))

    @jsii.member(jsii_name="toListPlacements")
    def to_list_placements(self) -> "Iot1click":
        '''(experimental) Grants permission to list placements in a project.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_ListPlacements.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toListPlacements", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Iot1click":
        '''(experimental) Grants permission to list all projects.

        Access Level: List

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_ListProjects.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Iot1click":
        '''(experimental) Grants permission to lists the tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Iot1click":
        '''(experimental) Grants permission to add or modify the tags of a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUnclaimDevice")
    def to_unclaim_device(self) -> "Iot1click":
        '''(experimental) Grants permission to unclaim a device.

        Access Level: Read

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/devices-deviceid-unclaim.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toUnclaimDevice", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Iot1click":
        '''(experimental) Grants permission to remove the given tags (metadata) from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDeviceState")
    def to_update_device_state(self) -> "Iot1click":
        '''(experimental) Grants permission to update device state.

        Access Level: Write

        https://docs.aws.amazon.com/iot-1-click/1.0/devices-apireference/devices-deviceid-state.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toUpdateDeviceState", []))

    @jsii.member(jsii_name="toUpdatePlacement")
    def to_update_placement(self) -> "Iot1click":
        '''(experimental) Grants permission to update a placement.

        Access Level: Write

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_UpdatePlacement.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toUpdatePlacement", []))

    @jsii.member(jsii_name="toUpdateProject")
    def to_update_project(self) -> "Iot1click":
        '''(experimental) Update a project.

        Access Level: Write

        https://docs.aws.amazon.com/iot-1-click/latest/projects-apireference/API_UpdateProject.html

        :stability: experimental
        '''
        return typing.cast("Iot1click", jsii.invoke(self, "toUpdateProject", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3deb02c6c7d8631534fbb75dfe74a5f80e7acfe9e241cb50d4a42f37cbc41ab3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__92762ec4ae05726d43b7cfcab36ca63152b5f4f697db496fde65c484dd12929c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class IotDeviceTester(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.IotDeviceTester",
):
    '''(experimental) Statement provider for service `iot-device-tester <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotdevicetester.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iot-device-tester <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotdevicetester.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d8463d34efd89d5c21fe0439699b8b011b83bc28dce3d50e7e91bfffa4540b56)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toCheckVersion")
    def to_check_version(self) -> "IotDeviceTester":
        '''(experimental) Grants permission to IoT Device Tester to check if a given set of product, test suite and device tester version are compatible.

        Access Level: Read

        https://docs.aws.amazon.com/freertos/latest/userguide/dev-tester-prereqs.html

        :stability: experimental
        '''
        return typing.cast("IotDeviceTester", jsii.invoke(self, "toCheckVersion", []))

    @jsii.member(jsii_name="toDownloadTestSuite")
    def to_download_test_suite(self) -> "IotDeviceTester":
        '''(experimental) Grants permission to IoT Device Tester to download compatible test suite versions.

        Access Level: Read

        https://docs.aws.amazon.com/freertos/latest/userguide/dev-tester-prereqs.html

        :stability: experimental
        '''
        return typing.cast("IotDeviceTester", jsii.invoke(self, "toDownloadTestSuite", []))

    @jsii.member(jsii_name="toLatestIdt")
    def to_latest_idt(self) -> "IotDeviceTester":
        '''(experimental) Grants permission to IoT Device Tester to get information on latest version of device tester available.

        Access Level: Read

        https://docs.aws.amazon.com/freertos/latest/userguide/dev-tester-prereqs.html

        :stability: experimental
        '''
        return typing.cast("IotDeviceTester", jsii.invoke(self, "toLatestIdt", []))

    @jsii.member(jsii_name="toSendMetrics")
    def to_send_metrics(self) -> "IotDeviceTester":
        '''(experimental) Grants permission to IoT Device Tester to send usage metrics on your behalf.

        Access Level: Write

        https://docs.aws.amazon.com/freertos/latest/userguide/dev-tester-prereqs.html

        :stability: experimental
        '''
        return typing.cast("IotDeviceTester", jsii.invoke(self, "toSendMetrics", []))

    @jsii.member(jsii_name="toSupportedVersion")
    def to_supported_version(self) -> "IotDeviceTester":
        '''(experimental) Grants permission to IoT Device Tester to get list of supported products and test suite versions.

        Access Level: Read

        https://docs.aws.amazon.com/freertos/latest/userguide/dev-tester-prereqs.html

        :stability: experimental
        '''
        return typing.cast("IotDeviceTester", jsii.invoke(self, "toSupportedVersion", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__50dbd432f1f238054818b08dde4d93f14f354870e976ba42a546f8d67d1bbcaa)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0b0af0e4cd6fa9f88e14d2d9f838524b8826561080e0a95e84df31c10b3c346f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Iotanalytics(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Iotanalytics",
):
    '''(experimental) Statement provider for service `iotanalytics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotanalytics.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iotanalytics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotanalytics.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__712989b1ec64907a1ed84153c4c49f4384ea90b58255e98e1033f888a9bc7ba2)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotanalytics":
        '''(experimental) Filters access by the tag key-value pairs attached to the resource.

        https://docs.aws.amazon.com/iotanalytics/latest/userguide/tagging.html#tagging-iam

        Applies to resource types:

        - channel
        - dataset
        - datastore
        - pipeline

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0c9a9a0427a8384dd5495cacb787eb5938f58d0b48a79b55e0e458b9eac518fd)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iotanalytics", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onChannel")
    def on_channel(
        self,
        channel_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotanalytics":
        '''(experimental) Adds a resource of type channel to the statement.

        https://docs.aws.amazon.com/iotanalytics/latest/userguide/welcome.html#aws-iot-analytics-how

        :param channel_name: - Identifier for the channelName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsTagKeys() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__05fa8c8a43b5d1a00c14ee7d7fe16e4c7fb106e2f6b8f4330fac7852d189524d)
            check_type(argname="argument channel_name", value=channel_name, expected_type=type_hints["channel_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotanalytics", jsii.invoke(self, "onChannel", [channel_name, account, region, partition]))

    @jsii.member(jsii_name="onDataset")
    def on_dataset(
        self,
        dataset_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotanalytics":
        '''(experimental) Adds a resource of type dataset to the statement.

        https://docs.aws.amazon.com/iotanalytics/latest/userguide/welcome.html#aws-iot-analytics-how

        :param dataset_name: - Identifier for the datasetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsTagKeys() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8e94892622cdd1bdc72f5e9e749b337fa525c63ee8336a14c94347059604b9b0)
            check_type(argname="argument dataset_name", value=dataset_name, expected_type=type_hints["dataset_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotanalytics", jsii.invoke(self, "onDataset", [dataset_name, account, region, partition]))

    @jsii.member(jsii_name="onDatastore")
    def on_datastore(
        self,
        datastore_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotanalytics":
        '''(experimental) Adds a resource of type datastore to the statement.

        https://docs.aws.amazon.com/iotanalytics/latest/userguide/welcome.html#aws-iot-analytics-how

        :param datastore_name: - Identifier for the datastoreName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsTagKeys() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bbc2d2a1180014413667746e3c4c8a54274ce2281d41d2441121837ccb47a146)
            check_type(argname="argument datastore_name", value=datastore_name, expected_type=type_hints["datastore_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotanalytics", jsii.invoke(self, "onDatastore", [datastore_name, account, region, partition]))

    @jsii.member(jsii_name="onPipeline")
    def on_pipeline(
        self,
        pipeline_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotanalytics":
        '''(experimental) Adds a resource of type pipeline to the statement.

        https://docs.aws.amazon.com/iotanalytics/latest/userguide/welcome.html#aws-iot-analytics-how

        :param pipeline_name: - Identifier for the pipelineName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsTagKeys() - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ce89bb74c114c52d636da8a18b0e5cfa89388e27f28ffd4d9dc4654af5da6ddf)
            check_type(argname="argument pipeline_name", value=pipeline_name, expected_type=type_hints["pipeline_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotanalytics", jsii.invoke(self, "onPipeline", [pipeline_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchPutMessage")
    def to_batch_put_message(self) -> "Iotanalytics":
        '''(experimental) Puts a batch of messages into the specified channel.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_BatchPutMessage.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toBatchPutMessage", []))

    @jsii.member(jsii_name="toCancelPipelineReprocessing")
    def to_cancel_pipeline_reprocessing(self) -> "Iotanalytics":
        '''(experimental) Cancels reprocessing for the specified pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_CancelPipelineReprocessing.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toCancelPipelineReprocessing", []))

    @jsii.member(jsii_name="toCreateChannel")
    def to_create_channel(self) -> "Iotanalytics":
        '''(experimental) Creates a channel.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_CreateChannel.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toCreateChannel", []))

    @jsii.member(jsii_name="toCreateDataset")
    def to_create_dataset(self) -> "Iotanalytics":
        '''(experimental) Creates a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_CreateDataset.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toCreateDataset", []))

    @jsii.member(jsii_name="toCreateDatasetContent")
    def to_create_dataset_content(self) -> "Iotanalytics":
        '''(experimental) Generates content from the specified dataset (by executing the dataset actions).

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_CreateDatasetContent.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toCreateDatasetContent", []))

    @jsii.member(jsii_name="toCreateDatastore")
    def to_create_datastore(self) -> "Iotanalytics":
        '''(experimental) Creates a datastore.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_CreateDatastore.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toCreateDatastore", []))

    @jsii.member(jsii_name="toCreatePipeline")
    def to_create_pipeline(self) -> "Iotanalytics":
        '''(experimental) Creates a pipeline.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_CreatePipeline.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toCreatePipeline", []))

    @jsii.member(jsii_name="toDeleteChannel")
    def to_delete_channel(self) -> "Iotanalytics":
        '''(experimental) Deletes the specified channel.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_DeleteChannel.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toDeleteChannel", []))

    @jsii.member(jsii_name="toDeleteDataset")
    def to_delete_dataset(self) -> "Iotanalytics":
        '''(experimental) Deletes the specified dataset.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_DeleteDataset.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toDeleteDataset", []))

    @jsii.member(jsii_name="toDeleteDatasetContent")
    def to_delete_dataset_content(self) -> "Iotanalytics":
        '''(experimental) Deletes the content of the specified dataset.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_DeleteDatasetContent.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toDeleteDatasetContent", []))

    @jsii.member(jsii_name="toDeleteDatastore")
    def to_delete_datastore(self) -> "Iotanalytics":
        '''(experimental) Deletes the specified datastore.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_DeleteDatastore.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toDeleteDatastore", []))

    @jsii.member(jsii_name="toDeletePipeline")
    def to_delete_pipeline(self) -> "Iotanalytics":
        '''(experimental) Deletes the specified pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_DeletePipeline.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toDeletePipeline", []))

    @jsii.member(jsii_name="toDescribeChannel")
    def to_describe_channel(self) -> "Iotanalytics":
        '''(experimental) Describes the specified channel.

        Access Level: Read

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_DescribeChannel.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toDescribeChannel", []))

    @jsii.member(jsii_name="toDescribeDataset")
    def to_describe_dataset(self) -> "Iotanalytics":
        '''(experimental) Describes the specified dataset.

        Access Level: Read

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_DescribeDataset.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toDescribeDataset", []))

    @jsii.member(jsii_name="toDescribeDatastore")
    def to_describe_datastore(self) -> "Iotanalytics":
        '''(experimental) Describes the specified datastore.

        Access Level: Read

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_DescribeDatastore.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toDescribeDatastore", []))

    @jsii.member(jsii_name="toDescribeLoggingOptions")
    def to_describe_logging_options(self) -> "Iotanalytics":
        '''(experimental) Describes logging options for the the account.

        Access Level: Read

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_DescribeLoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toDescribeLoggingOptions", []))

    @jsii.member(jsii_name="toDescribePipeline")
    def to_describe_pipeline(self) -> "Iotanalytics":
        '''(experimental) Describes the specified pipeline.

        Access Level: Read

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_DescribePipeline.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toDescribePipeline", []))

    @jsii.member(jsii_name="toGetDatasetContent")
    def to_get_dataset_content(self) -> "Iotanalytics":
        '''(experimental) Gets the content of the specified dataset.

        Access Level: Read

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_GetDatasetContent.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toGetDatasetContent", []))

    @jsii.member(jsii_name="toListChannels")
    def to_list_channels(self) -> "Iotanalytics":
        '''(experimental) Lists the channels for the account.

        Access Level: List

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_ListChannels.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toListChannels", []))

    @jsii.member(jsii_name="toListDatasetContents")
    def to_list_dataset_contents(self) -> "Iotanalytics":
        '''(experimental) Lists information about dataset contents that have been created.

        Access Level: List

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_ListDatasetContents.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toListDatasetContents", []))

    @jsii.member(jsii_name="toListDatasets")
    def to_list_datasets(self) -> "Iotanalytics":
        '''(experimental) Lists the datasets for the account.

        Access Level: List

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_ListDatasets.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toListDatasets", []))

    @jsii.member(jsii_name="toListDatastores")
    def to_list_datastores(self) -> "Iotanalytics":
        '''(experimental) Lists the datastores for the account.

        Access Level: List

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_ListDatastores.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toListDatastores", []))

    @jsii.member(jsii_name="toListPipelines")
    def to_list_pipelines(self) -> "Iotanalytics":
        '''(experimental) Lists the pipelines for the account.

        Access Level: List

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_ListPipelines.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toListPipelines", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Iotanalytics":
        '''(experimental) Lists the tags (metadata) which you have assigned to the resource.

        Access Level: Read

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutLoggingOptions")
    def to_put_logging_options(self) -> "Iotanalytics":
        '''(experimental) Puts logging options for the the account.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_PutLoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toPutLoggingOptions", []))

    @jsii.member(jsii_name="toRunPipelineActivity")
    def to_run_pipeline_activity(self) -> "Iotanalytics":
        '''(experimental) Runs the specified pipeline activity.

        Access Level: Read

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_RunPipelineActivity.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toRunPipelineActivity", []))

    @jsii.member(jsii_name="toSampleChannelData")
    def to_sample_channel_data(self) -> "Iotanalytics":
        '''(experimental) Samples the specified channel's data.

        Access Level: Read

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_SampleChannelData.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toSampleChannelData", []))

    @jsii.member(jsii_name="toStartPipelineReprocessing")
    def to_start_pipeline_reprocessing(self) -> "Iotanalytics":
        '''(experimental) Starts reprocessing for the specified pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_StartPipelineReprocessing.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toStartPipelineReprocessing", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Iotanalytics":
        '''(experimental) Adds to or modifies the tags of the given resource.

        Tags are metadata which can be used to manage a resource

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Iotanalytics":
        '''(experimental) Removes the given tags (metadata) from the resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateChannel")
    def to_update_channel(self) -> "Iotanalytics":
        '''(experimental) Updates the specified channel.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_UpdateChannel.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toUpdateChannel", []))

    @jsii.member(jsii_name="toUpdateDataset")
    def to_update_dataset(self) -> "Iotanalytics":
        '''(experimental) Updates the specified dataset.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_UpdateDataset.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toUpdateDataset", []))

    @jsii.member(jsii_name="toUpdateDatastore")
    def to_update_datastore(self) -> "Iotanalytics":
        '''(experimental) Updates the specified datastore.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_UpdateDatastore.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toUpdateDatastore", []))

    @jsii.member(jsii_name="toUpdatePipeline")
    def to_update_pipeline(self) -> "Iotanalytics":
        '''(experimental) Updates the specified pipeline.

        Access Level: Write

        https://docs.aws.amazon.com/iotanalytics/latest/APIReference/API_UpdatePipeline.html

        :stability: experimental
        '''
        return typing.cast("Iotanalytics", jsii.invoke(self, "toUpdatePipeline", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__77105708dcbe4882f49a8e83879cbaa924fabaec99ae535ff6bf963171b281b1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__03aec8a293a3e77e5581e630b93651809d2fb58fd76412d7d1f52afeabf10f28)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Iotdeviceadvisor(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Iotdeviceadvisor",
):
    '''(experimental) Statement provider for service `iotdeviceadvisor <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotcoredeviceadvisor.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iotdeviceadvisor <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotcoredeviceadvisor.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a46f5aa2cfdde226c0a7baa77cd1a7b7a866a834415f1d3d476c4072fb5c5b1c)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onSuitedefinition")
    def on_suitedefinition(
        self,
        suite_definition_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotdeviceadvisor":
        '''(experimental) Adds a resource of type Suitedefinition to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/device-advisor-workflow.html#device-advisor-workflow-create-suite-definition

        :param suite_definition_id: - Identifier for the suiteDefinitionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f4f9413f40bbfdb83873af6cfdc5e0a60c9efba36cd5d34ca7a3b89700e620e1)
            check_type(argname="argument suite_definition_id", value=suite_definition_id, expected_type=type_hints["suite_definition_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "onSuitedefinition", [suite_definition_id, account, region, partition]))

    @jsii.member(jsii_name="onSuiterun")
    def on_suiterun(
        self,
        suite_definition_id: builtins.str,
        suite_run_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotdeviceadvisor":
        '''(experimental) Adds a resource of type Suiterun to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/device-advisor-workflow.html#device-advisor-workflow-start-suite-run

        :param suite_definition_id: - Identifier for the suiteDefinitionId.
        :param suite_run_id: - Identifier for the suiteRunId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__015f490eaab3cea5e89b1127430a03f2f24157f503837decab685e082e11d242)
            check_type(argname="argument suite_definition_id", value=suite_definition_id, expected_type=type_hints["suite_definition_id"])
            check_type(argname="argument suite_run_id", value=suite_run_id, expected_type=type_hints["suite_run_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "onSuiterun", [suite_definition_id, suite_run_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateSuiteDefinition")
    def to_create_suite_definition(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to create a suite definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotdeviceadvisor_CreateSuiteDefinition.html

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toCreateSuiteDefinition", []))

    @jsii.member(jsii_name="toDeleteSuiteDefinition")
    def to_delete_suite_definition(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to delete a suite definition.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotdeviceadvisor_DeleteSuiteDefinition.html

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toDeleteSuiteDefinition", []))

    @jsii.member(jsii_name="toGetEndpoint")
    def to_get_endpoint(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to get a Device Advisor endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotdeviceadvisor_GetEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toGetEndpoint", []))

    @jsii.member(jsii_name="toGetSuiteDefinition")
    def to_get_suite_definition(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to get a suite definition.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotdeviceadvisor_GetSuiteDefinition.html

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toGetSuiteDefinition", []))

    @jsii.member(jsii_name="toGetSuiteRun")
    def to_get_suite_run(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to get a suite run.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotdeviceadvisor_GetSuiteRun.html

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toGetSuiteRun", []))

    @jsii.member(jsii_name="toGetSuiteRunReport")
    def to_get_suite_run_report(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to get the qualification report for a suite run.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotdeviceadvisor_GetSuiteRunReport.html

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toGetSuiteRunReport", []))

    @jsii.member(jsii_name="toListSuiteDefinitions")
    def to_list_suite_definitions(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to list suite definitions.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotdeviceadvisor_ListSuiteDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toListSuiteDefinitions", []))

    @jsii.member(jsii_name="toListSuiteRuns")
    def to_list_suite_runs(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to list suite runs.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotdeviceadvisor_ListSuiteRuns.html

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toListSuiteRuns", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to list the tags (metadata) assigned to a resource.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotdeviceadvisor_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartSuiteRun")
    def to_start_suite_run(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to start a suite run.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotdeviceadvisor_StartSuiteRun.html

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toStartSuiteRun", []))

    @jsii.member(jsii_name="toStopSuiteRun")
    def to_stop_suite_run(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to stop a suite run.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotdeviceadvisor_StopSuiteRun.html

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toStopSuiteRun", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to add to or modify the tags of the given resource.

        Tags are metadata which can be used to manage a resource

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotdeviceadvisor_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to remove the given tags (metadata) from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotdeviceadvisor_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateSuiteDefinition")
    def to_update_suite_definition(self) -> "Iotdeviceadvisor":
        '''(experimental) Grants permission to update a suite definition.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotdeviceadvisor_UpdateSuiteDefinition.html

        :stability: experimental
        '''
        return typing.cast("Iotdeviceadvisor", jsii.invoke(self, "toUpdateSuiteDefinition", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9af2c8c50f523ee94154920a053299466ad7c9ab7f140f1dccd2113e2e0253c1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__48784267dc610f6b49be2212a3bbc5ab4253e8831ea1b5285587d57053dd12c9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Iotevents(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Iotevents",
):
    '''(experimental) Statement provider for service `iotevents <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotevents.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iotevents <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotevents.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9bf505b77f17fb35c5c6dd5af51fa0bd6761ffce9326f56407ff763c97298cf1)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifKeyValue")
    def if_key_value(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotevents":
        '''(experimental) Filters access by the instanceId (key-value) of the message.

        https://docs.aws.amazon.com/iotevents/latest/developerguide/security_iam_id-based-policy-examples.htmlsecurity_iam_service-with-iam-id-based-policies-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b6a9ddcd3b9a8d2fff94cd17c7abc8b5ad0ede7ba74d77c9bd3cdbb3fa0c9160)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iotevents", jsii.invoke(self, "ifKeyValue", [value, operator]))

    @jsii.member(jsii_name="onAlarmModel")
    def on_alarm_model(
        self,
        alarm_model_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotevents":
        '''(experimental) Adds a resource of type alarmModel to the statement.

        https://docs.aws.amazon.com/iotevents/latest/developerguide/iotevents-getting-started.html

        :param alarm_model_name: - Identifier for the alarmModelName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b616a6ec36aa5775c1aedca45822832cd60d1f2cb80b3a4224fb648a2e47786a)
            check_type(argname="argument alarm_model_name", value=alarm_model_name, expected_type=type_hints["alarm_model_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotevents", jsii.invoke(self, "onAlarmModel", [alarm_model_name, account, region, partition]))

    @jsii.member(jsii_name="onDetectorModel")
    def on_detector_model(
        self,
        detector_model_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotevents":
        '''(experimental) Adds a resource of type detectorModel to the statement.

        https://docs.aws.amazon.com/iotevents/latest/developerguide/iotevents-getting-started.html

        :param detector_model_name: - Identifier for the detectorModelName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7736fc1dbb54f2903f4ca4e5626e549bdc1ab7a28ad4238fbb6c907dbd58c67d)
            check_type(argname="argument detector_model_name", value=detector_model_name, expected_type=type_hints["detector_model_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotevents", jsii.invoke(self, "onDetectorModel", [detector_model_name, account, region, partition]))

    @jsii.member(jsii_name="onInput")
    def on_input(
        self,
        input_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotevents":
        '''(experimental) Adds a resource of type input to the statement.

        https://docs.aws.amazon.com/iotevents/latest/developerguide/iotevents-getting-started.html

        :param input_name: - Identifier for the inputName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__98efc9468fd8cec07e94f4df0b3702b46513eba04591acf3b92fe8e1bc9bf299)
            check_type(argname="argument input_name", value=input_name, expected_type=type_hints["input_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotevents", jsii.invoke(self, "onInput", [input_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchAcknowledgeAlarm")
    def to_batch_acknowledge_alarm(self) -> "Iotevents":
        '''(experimental) Grants permission to send one or more acknowledge action requests to AWS IoT Events.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_BatchAcknowledgeAlarm.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toBatchAcknowledgeAlarm", []))

    @jsii.member(jsii_name="toBatchDeleteDetector")
    def to_batch_delete_detector(self) -> "Iotevents":
        '''(experimental) Grants permission to delete a detector instance within the AWS IoT Events system.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_BatchDeleteDetector.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toBatchDeleteDetector", []))

    @jsii.member(jsii_name="toBatchDisableAlarm")
    def to_batch_disable_alarm(self) -> "Iotevents":
        '''(experimental) Grants permission to disable one or more alarm instances.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_BatchDisableAlarm.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toBatchDisableAlarm", []))

    @jsii.member(jsii_name="toBatchEnableAlarm")
    def to_batch_enable_alarm(self) -> "Iotevents":
        '''(experimental) Grants permission to enable one or more alarm instances.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_BatchEnableAlarm.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toBatchEnableAlarm", []))

    @jsii.member(jsii_name="toBatchPutMessage")
    def to_batch_put_message(self) -> "Iotevents":
        '''(experimental) Grants permission to send a set of messages to the AWS IoT Events system.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_BatchPutMessage.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toBatchPutMessage", []))

    @jsii.member(jsii_name="toBatchResetAlarm")
    def to_batch_reset_alarm(self) -> "Iotevents":
        '''(experimental) Grants permission to reset one or more alarm instances.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_BatchResetAlarm.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toBatchResetAlarm", []))

    @jsii.member(jsii_name="toBatchSnoozeAlarm")
    def to_batch_snooze_alarm(self) -> "Iotevents":
        '''(experimental) Grants permission to change one or more alarm instances to the snooze mode.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_BatchSnoozeAlarm.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toBatchSnoozeAlarm", []))

    @jsii.member(jsii_name="toBatchUpdateDetector")
    def to_batch_update_detector(self) -> "Iotevents":
        '''(experimental) Grants permission to update a detector instance within the AWS IoT Events system.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_BatchUpdateDetector.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toBatchUpdateDetector", []))

    @jsii.member(jsii_name="toCreateAlarmModel")
    def to_create_alarm_model(self) -> "Iotevents":
        '''(experimental) Grants permission to create an alarm model to monitor an AWS IoT Events input attribute or an AWS IoT SiteWise asset property.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_CreateAlarmModel.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toCreateAlarmModel", []))

    @jsii.member(jsii_name="toCreateDetectorModel")
    def to_create_detector_model(self) -> "Iotevents":
        '''(experimental) Grants permission to create a detector model to monitor an AWS IoT Events input attribute.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_CreateDetectorModel.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toCreateDetectorModel", []))

    @jsii.member(jsii_name="toCreateInput")
    def to_create_input(self) -> "Iotevents":
        '''(experimental) Grants permission to create an Input in IotEvents.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_CreateInput.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toCreateInput", []))

    @jsii.member(jsii_name="toDeleteAlarmModel")
    def to_delete_alarm_model(self) -> "Iotevents":
        '''(experimental) Grants permission to delete an alarm model.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_DeleteAlarmModel.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toDeleteAlarmModel", []))

    @jsii.member(jsii_name="toDeleteDetectorModel")
    def to_delete_detector_model(self) -> "Iotevents":
        '''(experimental) Grants permission to delete a detector model.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_DeleteDetectorModel.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toDeleteDetectorModel", []))

    @jsii.member(jsii_name="toDeleteInput")
    def to_delete_input(self) -> "Iotevents":
        '''(experimental) Grants permission to delete an input.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_DeleteInput.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toDeleteInput", []))

    @jsii.member(jsii_name="toDescribeAlarm")
    def to_describe_alarm(self) -> "Iotevents":
        '''(experimental) Grants permission to retrieve information about an alarm instance.

        Access Level: Read

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_DescribeAlarm.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toDescribeAlarm", []))

    @jsii.member(jsii_name="toDescribeAlarmModel")
    def to_describe_alarm_model(self) -> "Iotevents":
        '''(experimental) Grants permission to retrieve information about an alarm model.

        Access Level: Read

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_DescribeAlarmModel.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toDescribeAlarmModel", []))

    @jsii.member(jsii_name="toDescribeDetector")
    def to_describe_detector(self) -> "Iotevents":
        '''(experimental) Grants permission to retriev information about a detector instance.

        Access Level: Read

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_DescribeDetector.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toDescribeDetector", []))

    @jsii.member(jsii_name="toDescribeDetectorModel")
    def to_describe_detector_model(self) -> "Iotevents":
        '''(experimental) Grants permission to retrieve information about a detector model.

        Access Level: Read

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_DescribeDetectorModel.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toDescribeDetectorModel", []))

    @jsii.member(jsii_name="toDescribeDetectorModelAnalysis")
    def to_describe_detector_model_analysis(self) -> "Iotevents":
        '''(experimental) Grants permission to retrieve the detector model analysis information.

        Access Level: Read

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_DescribeDetectorModelAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toDescribeDetectorModelAnalysis", []))

    @jsii.member(jsii_name="toDescribeInput")
    def to_describe_input(self) -> "Iotevents":
        '''(experimental) Grants permission to retrieve an information about Input.

        Access Level: Read

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_DescribeInput.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toDescribeInput", []))

    @jsii.member(jsii_name="toDescribeLoggingOptions")
    def to_describe_logging_options(self) -> "Iotevents":
        '''(experimental) Grants permission to retrieve the current settings of the AWS IoT Events logging options.

        Access Level: Read

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_DescribeLoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toDescribeLoggingOptions", []))

    @jsii.member(jsii_name="toGetDetectorModelAnalysisResults")
    def to_get_detector_model_analysis_results(self) -> "Iotevents":
        '''(experimental) Grants permission to retrieve the detector model analysis results.

        Access Level: Read

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_GetDetectorModelAnalysisResults.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toGetDetectorModelAnalysisResults", []))

    @jsii.member(jsii_name="toListAlarmModels")
    def to_list_alarm_models(self) -> "Iotevents":
        '''(experimental) Grants permission to list the alarm models that you created.

        Access Level: List

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_ListAlarmModels.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toListAlarmModels", []))

    @jsii.member(jsii_name="toListAlarmModelVersions")
    def to_list_alarm_model_versions(self) -> "Iotevents":
        '''(experimental) Grants permission to list all the versions of an alarm model.

        Access Level: List

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_ListAlarmModelVersions.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toListAlarmModelVersions", []))

    @jsii.member(jsii_name="toListAlarms")
    def to_list_alarms(self) -> "Iotevents":
        '''(experimental) Grants permission to retrieve information about all alarm instances per alarmModel.

        Access Level: List

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_ListAlarms.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toListAlarms", []))

    @jsii.member(jsii_name="toListDetectorModels")
    def to_list_detector_models(self) -> "Iotevents":
        '''(experimental) Grants permission to list the detector models that you created.

        Access Level: List

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_ListDetectorModels.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toListDetectorModels", []))

    @jsii.member(jsii_name="toListDetectorModelVersions")
    def to_list_detector_model_versions(self) -> "Iotevents":
        '''(experimental) Grants permission to list all the versions of a detector model.

        Access Level: List

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_ListDetectorModelVersions.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toListDetectorModelVersions", []))

    @jsii.member(jsii_name="toListDetectors")
    def to_list_detectors(self) -> "Iotevents":
        '''(experimental) Grants permission to retrieve information about all detector instances per detectormodel.

        Access Level: List

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_iotevents-data_ListDetectors.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toListDetectors", []))

    @jsii.member(jsii_name="toListInputRoutings")
    def to_list_input_routings(self) -> "Iotevents":
        '''(experimental) Grants permission to list one or more input routings.

        Access Level: List

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_ListInputRoutings.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toListInputRoutings", []))

    @jsii.member(jsii_name="toListInputs")
    def to_list_inputs(self) -> "Iotevents":
        '''(experimental) Grants permission to lists the inputs you have created.

        Access Level: List

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_ListInputs.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toListInputs", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Iotevents":
        '''(experimental) Grants permission to list the tags (metadata) which you have assigned to the resource.

        Access Level: Read

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutLoggingOptions")
    def to_put_logging_options(self) -> "Iotevents":
        '''(experimental) Grants permission to set or update the AWS IoT Events logging options.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_PutLoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toPutLoggingOptions", []))

    @jsii.member(jsii_name="toStartDetectorModelAnalysis")
    def to_start_detector_model_analysis(self) -> "Iotevents":
        '''(experimental) Grants permission to start the detector model analysis.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_StartDetectorModelAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toStartDetectorModelAnalysis", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Iotevents":
        '''(experimental) Grants permission to adds to or modifies the tags of the given resource.Tags are metadata which can be used to manage a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Iotevents":
        '''(experimental) Grants permission to remove the given tags (metadata) from the resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAlarmModel")
    def to_update_alarm_model(self) -> "Iotevents":
        '''(experimental) Grants permission to update an alarm model.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_UpdateAlarmModel.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toUpdateAlarmModel", []))

    @jsii.member(jsii_name="toUpdateDetectorModel")
    def to_update_detector_model(self) -> "Iotevents":
        '''(experimental) Grants permission to update a detector model.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_UpdateDetectorModel.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toUpdateDetectorModel", []))

    @jsii.member(jsii_name="toUpdateInput")
    def to_update_input(self) -> "Iotevents":
        '''(experimental) Grants permission to update an input.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_UpdateInput.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toUpdateInput", []))

    @jsii.member(jsii_name="toUpdateInputRouting")
    def to_update_input_routing(self) -> "Iotevents":
        '''(experimental) Grants permission to update input routing.

        Access Level: Write

        https://docs.aws.amazon.com/iotevents/latest/apireference/API_UpdateInputRouting.html

        :stability: experimental
        '''
        return typing.cast("Iotevents", jsii.invoke(self, "toUpdateInputRouting", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__363cfded436398c2f33fa48ae59054cb3abd05a49cfbaedd6429287b694aec33)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c729011f174f0ff1b85f07d75358f25bf7221cd3ab2a970ed3eb1565c209f117)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Iotfleethub(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Iotfleethub",
):
    '''(experimental) Statement provider for service `iotfleethub <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotfleethubfordevicemanagement.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iotfleethub <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotfleethubfordevicemanagement.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__65a16171a2636881876ee610d1cf89ddde519626de192ef436a6ae9b3d8edf42)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        application_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotfleethub":
        '''(experimental) Adds a resource of type application to the statement.

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotfleethub_ApplicationSummary.html

        :param application_id: - Identifier for the applicationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__66604ec28faaa873feb69738b724d0c2003a07e866ced928be9d5d8d8a75ce3f)
            check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotfleethub", jsii.invoke(self, "onApplication", [application_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "Iotfleethub":
        '''(experimental) Grants permission to create an application.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sso:CreateManagedApplicationInstance
        - sso:DescribeRegisteredRegions

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotfleethub_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("Iotfleethub", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "Iotfleethub":
        '''(experimental) Grants permission to delete an application.

        Access Level: Write

        Dependent actions:

        - sso:DeleteManagedApplicationInstance

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotfleethub_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("Iotfleethub", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toDescribeApplication")
    def to_describe_application(self) -> "Iotfleethub":
        '''(experimental) Grants permission to describe an application.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotfleethub_DescribeApplication.html

        :stability: experimental
        '''
        return typing.cast("Iotfleethub", jsii.invoke(self, "toDescribeApplication", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "Iotfleethub":
        '''(experimental) Grants permission to list all applications.

        Access Level: List

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotfleethub_ListApplications.html

        :stability: experimental
        '''
        return typing.cast("Iotfleethub", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Iotfleethub":
        '''(experimental) Grants permission to list all tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotfleethub_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Iotfleethub", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Iotfleethub":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotfleethub_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotfleethub", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Iotfleethub":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotfleethub_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotfleethub", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "Iotfleethub":
        '''(experimental) Grants permission to update an application.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_iotfleethub_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("Iotfleethub", jsii.invoke(self, "toUpdateApplication", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1029e68941f0f6bcd460367744684c589b2d796af4a4662909dc0691ede6e40e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__accb1d5551723ba4b7015f41660a14fc2a4d728672d93ec61e0a0cac2ccdb741)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Iotfleetwise(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Iotfleetwise",
):
    '''(experimental) Statement provider for service `iotfleetwise <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotfleetwise.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iotfleetwise <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotfleetwise.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__29fba8e047a04bb1e07eb3670aa6c3f19719ceda440f2007a0691e4cdf1a9b1c)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifUpdateToDecoderManifestArn")
    def if_update_to_decoder_manifest_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotfleetwise":
        '''(experimental) Filters access by a list of IoT FleetWise Decoder Manifest ARNs.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotfleetwise.html

        Applies to actions:

        - .toBatchUpdateVehicle()
        - .toUpdateVehicle()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__be9f16f6e7b92e54e25f366504594ac8d4f23d3ec0e6f6b1586c6126bf88ba20)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iotfleetwise", jsii.invoke(self, "ifUpdateToDecoderManifestArn", [value, operator]))

    @jsii.member(jsii_name="ifUpdateToModelManifestArn")
    def if_update_to_model_manifest_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotfleetwise":
        '''(experimental) Filters access by a list of IoT FleetWise Model Manifest ARNs.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotfleetwise.html

        Applies to actions:

        - .toBatchUpdateVehicle()
        - .toUpdateVehicle()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__521d5ff8bf9157da8fcabfcc0a319091178f26639b854971b01ee58cfa246f95)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iotfleetwise", jsii.invoke(self, "ifUpdateToModelManifestArn", [value, operator]))

    @jsii.member(jsii_name="onCampaign")
    def on_campaign(
        self,
        campaign_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotfleetwise":
        '''(experimental) Adds a resource of type campaign to the statement.

        https://docs.aws.amazon.com/iot-fleetwise/latest/developerguide/campaigns.html

        :param campaign_name: - Identifier for the campaignName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e5853132e9d8e96dc8b6ec9bcbb8614422ce0729f6eae21cf204cd2abe2e5604)
            check_type(argname="argument campaign_name", value=campaign_name, expected_type=type_hints["campaign_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotfleetwise", jsii.invoke(self, "onCampaign", [campaign_name, account, region, partition]))

    @jsii.member(jsii_name="onDecodermanifest")
    def on_decodermanifest(
        self,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotfleetwise":
        '''(experimental) Adds a resource of type decodermanifest to the statement.

        https://docs.aws.amazon.com/iot-fleetwise/latest/developerguide/decoder-manifests.html

        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a2dd6e999276d99c6f5f31331a44cfb42de7282e0b43852d71d5abc8ecbd2746)
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotfleetwise", jsii.invoke(self, "onDecodermanifest", [name, account, region, partition]))

    @jsii.member(jsii_name="onFleet")
    def on_fleet(
        self,
        fleet_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotfleetwise":
        '''(experimental) Adds a resource of type fleet to the statement.

        https://docs.aws.amazon.com/iot-fleetwise/latest/developerguide/fleets.html

        :param fleet_id: - Identifier for the fleetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6f467b889d650d5e7cbeb12a3944f43aab7e8b272ab66c2a1e59ebd9efa9a7e2)
            check_type(argname="argument fleet_id", value=fleet_id, expected_type=type_hints["fleet_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotfleetwise", jsii.invoke(self, "onFleet", [fleet_id, account, region, partition]))

    @jsii.member(jsii_name="onModelmanifest")
    def on_modelmanifest(
        self,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotfleetwise":
        '''(experimental) Adds a resource of type modelmanifest to the statement.

        https://docs.aws.amazon.com/iot-fleetwise/latest/developerguide/vehicle-models.html

        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4856b1bf0076f6a829949929fe06b4b69478e4e350d253d3962563897c31ee69)
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotfleetwise", jsii.invoke(self, "onModelmanifest", [name, account, region, partition]))

    @jsii.member(jsii_name="onSignalcatalog")
    def on_signalcatalog(
        self,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotfleetwise":
        '''(experimental) Adds a resource of type signalcatalog to the statement.

        https://docs.aws.amazon.com/iot-fleetwise/latest/developerguide/signal-catalogs.html

        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__91e8624852279bd7a6590feb1dec781eaf6016c3cb46a2c95b644500c13b91e0)
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotfleetwise", jsii.invoke(self, "onSignalcatalog", [name, account, region, partition]))

    @jsii.member(jsii_name="onVehicle")
    def on_vehicle(
        self,
        vehicle_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotfleetwise":
        '''(experimental) Adds a resource of type vehicle to the statement.

        https://docs.aws.amazon.com/iot-fleetwise/latest/developerguide/vehicles.html

        :param vehicle_id: - Identifier for the vehicleId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cd27bd0c6de93f817fb8d5633300774e4018d909c2a962f17e83b46ccf0c279d)
            check_type(argname="argument vehicle_id", value=vehicle_id, expected_type=type_hints["vehicle_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotfleetwise", jsii.invoke(self, "onVehicle", [vehicle_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateVehicleFleet")
    def to_associate_vehicle_fleet(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to associate the given vehicle to a fleet.

        Access Level: Write

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_AssociateVehicleFleet.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toAssociateVehicleFleet", []))

    @jsii.member(jsii_name="toBatchCreateVehicle")
    def to_batch_create_vehicle(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to create a batch of vehicles.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iot:CreateThing
        - iot:DescribeThing

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_BatchCreateVehicle.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toBatchCreateVehicle", []))

    @jsii.member(jsii_name="toBatchUpdateVehicle")
    def to_batch_update_vehicle(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to update a batch of vehicles.

        Access Level: Write

        Possible conditions:

        - .ifUpdateToModelManifestArn()
        - .ifUpdateToDecoderManifestArn()

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_BatchUpdateVehicle.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toBatchUpdateVehicle", []))

    @jsii.member(jsii_name="toCreateCampaign")
    def to_create_campaign(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to create a campaign.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_CreateCampaign.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toCreateCampaign", []))

    @jsii.member(jsii_name="toCreateDecoderManifest")
    def to_create_decoder_manifest(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to create a decoder manifest for an existing model.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_CreateDecoderManifest.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toCreateDecoderManifest", []))

    @jsii.member(jsii_name="toCreateFleet")
    def to_create_fleet(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to create a fleet.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_CreateFleet.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toCreateFleet", []))

    @jsii.member(jsii_name="toCreateModelManifest")
    def to_create_model_manifest(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to create a model manifest definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_CreateModelManifest.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toCreateModelManifest", []))

    @jsii.member(jsii_name="toCreateSignalCatalog")
    def to_create_signal_catalog(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to create a signal catalog.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_CreateSignalCatalog.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toCreateSignalCatalog", []))

    @jsii.member(jsii_name="toCreateVehicle")
    def to_create_vehicle(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to create a vehicle.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iot:CreateThing
        - iot:DescribeThing

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_CreateVehicle.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toCreateVehicle", []))

    @jsii.member(jsii_name="toDeleteCampaign")
    def to_delete_campaign(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to delete a campaign.

        Access Level: Write

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_DeleteCampaign.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toDeleteCampaign", []))

    @jsii.member(jsii_name="toDeleteDecoderManifest")
    def to_delete_decoder_manifest(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to delete the given decoder manifest.

        Access Level: Write

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_DeleteDecoderManifest.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toDeleteDecoderManifest", []))

    @jsii.member(jsii_name="toDeleteFleet")
    def to_delete_fleet(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to delete a fleet.

        Access Level: Write

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_DeleteFleet.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toDeleteFleet", []))

    @jsii.member(jsii_name="toDeleteModelManifest")
    def to_delete_model_manifest(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to delete the given model manifest.

        Access Level: Write

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_DeleteModelManifest.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toDeleteModelManifest", []))

    @jsii.member(jsii_name="toDeleteSignalCatalog")
    def to_delete_signal_catalog(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to delete a specific signal catalog.

        Access Level: Write

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_DeleteSignalCatalog.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toDeleteSignalCatalog", []))

    @jsii.member(jsii_name="toDeleteVehicle")
    def to_delete_vehicle(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to delete a vehicle.

        Access Level: Write

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_DeleteVehicle.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toDeleteVehicle", []))

    @jsii.member(jsii_name="toDisassociateVehicleFleet")
    def to_disassociate_vehicle_fleet(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to disassociate a vehicle from an existing fleet.

        Access Level: Write

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_DisassociateVehicleFleet.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toDisassociateVehicleFleet", []))

    @jsii.member(jsii_name="toGetCampaign")
    def to_get_campaign(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to get summary information for a given campaign.

        Access Level: Read

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_GetCampaign.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toGetCampaign", []))

    @jsii.member(jsii_name="toGetDecoderManifest")
    def to_get_decoder_manifest(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to get summary information for a given decoder manifest definition.

        Access Level: Read

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_GetDecoderManifest.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toGetDecoderManifest", []))

    @jsii.member(jsii_name="toGetFleet")
    def to_get_fleet(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to get summary information for a fleet.

        Access Level: Read

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_GetFleet.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toGetFleet", []))

    @jsii.member(jsii_name="toGetLoggingOptions")
    def to_get_logging_options(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to get the logging options for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_GetLoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toGetLoggingOptions", []))

    @jsii.member(jsii_name="toGetModelManifest")
    def to_get_model_manifest(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to get summary information for a given model manifest definition.

        Access Level: Read

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_GetModelManifest.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toGetModelManifest", []))

    @jsii.member(jsii_name="toGetRegisterAccountStatus")
    def to_get_register_account_status(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to get the account registration status with IoT FleetWise.

        Access Level: Read

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_GetRegisterAccountStatus.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toGetRegisterAccountStatus", []))

    @jsii.member(jsii_name="toGetSignalCatalog")
    def to_get_signal_catalog(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to get summary information for a specific signal catalog.

        Access Level: Read

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_GetSignalCatalog.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toGetSignalCatalog", []))

    @jsii.member(jsii_name="toGetVehicle")
    def to_get_vehicle(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to get summary information for a vehicle.

        Access Level: Read

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_GetVehicle.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toGetVehicle", []))

    @jsii.member(jsii_name="toGetVehicleStatus")
    def to_get_vehicle_status(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to get the status of the campaigns running on a specific vehicle.

        Access Level: Read

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_GetVehicleStatus.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toGetVehicleStatus", []))

    @jsii.member(jsii_name="toImportDecoderManifest")
    def to_import_decoder_manifest(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to import an existing decoder manifest.

        Access Level: Write

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_ImportDecoderManifest.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toImportDecoderManifest", []))

    @jsii.member(jsii_name="toImportSignalCatalog")
    def to_import_signal_catalog(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to create a signal catalog by importing existing definitions.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_ImportSignalCatalog.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toImportSignalCatalog", []))

    @jsii.member(jsii_name="toListCampaigns")
    def to_list_campaigns(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to list campaigns.

        Access Level: Read

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_ListCampaigns.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toListCampaigns", []))

    @jsii.member(jsii_name="toListDecoderManifestNetworkInterfaces")
    def to_list_decoder_manifest_network_interfaces(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to list network interfaces associated to the existing decoder manifest.

        Access Level: List

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_ListDecoderManifestNetworkInterfaces.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toListDecoderManifestNetworkInterfaces", []))

    @jsii.member(jsii_name="toListDecoderManifests")
    def to_list_decoder_manifests(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to list all decoder manifests, with an optional filter on model manifest.

        Access Level: Read

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_ListDecoderManifests.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toListDecoderManifests", []))

    @jsii.member(jsii_name="toListDecoderManifestSignals")
    def to_list_decoder_manifest_signals(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to list decoder manifest signals.

        Access Level: List

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_ListDecoderManifestSignals.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toListDecoderManifestSignals", []))

    @jsii.member(jsii_name="toListFleets")
    def to_list_fleets(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to list all fleets.

        Access Level: Read

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_ListFleets.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toListFleets", []))

    @jsii.member(jsii_name="toListFleetsForVehicle")
    def to_list_fleets_for_vehicle(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to list all the fleets that the given vehicle is associated with.

        Access Level: Read

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_ListFleetsForVehicle.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toListFleetsForVehicle", []))

    @jsii.member(jsii_name="toListModelManifestNodes")
    def to_list_model_manifest_nodes(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to list all nodes for the given model manifest.

        Access Level: List

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_ListModelManifestNodes.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toListModelManifestNodes", []))

    @jsii.member(jsii_name="toListModelManifests")
    def to_list_model_manifests(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to list all model manifests, with an optional filter on signal catalog.

        Access Level: Read

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_ListModelManifests.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toListModelManifests", []))

    @jsii.member(jsii_name="toListSignalCatalogNodes")
    def to_list_signal_catalog_nodes(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to list all nodes for a given signal catalog.

        Access Level: Read

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_ListSignalCatalogNodes.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toListSignalCatalogNodes", []))

    @jsii.member(jsii_name="toListSignalCatalogs")
    def to_list_signal_catalogs(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to list all signal catalogs.

        Access Level: Read

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_ListSignalCatalogs.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toListSignalCatalogs", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListVehicles")
    def to_list_vehicles(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to list all vehicles, with an optional filter on model manifest.

        Access Level: Read

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_ListVehicles.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toListVehicles", []))

    @jsii.member(jsii_name="toListVehiclesInFleet")
    def to_list_vehicles_in_fleet(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to list vehicles in the given fleet.

        Access Level: Read

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_ListVehiclesInFleet.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toListVehiclesInFleet", []))

    @jsii.member(jsii_name="toPutLoggingOptions")
    def to_put_logging_options(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to put the logging options for the AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_PutLoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toPutLoggingOptions", []))

    @jsii.member(jsii_name="toRegisterAccount")
    def to_register_account(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to register an AWS account to IoT FleetWise.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_RegisterAccount.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toRegisterAccount", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to add tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateCampaign")
    def to_update_campaign(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to update the given campaign.

        Access Level: Write

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_UpdateCampaign.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toUpdateCampaign", []))

    @jsii.member(jsii_name="toUpdateDecoderManifest")
    def to_update_decoder_manifest(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to update a decoder manifest defnition.

        Access Level: Write

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_UpdateDecoderManifest.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toUpdateDecoderManifest", []))

    @jsii.member(jsii_name="toUpdateFleet")
    def to_update_fleet(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to update the fleet.

        Access Level: Write

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_UpdateFleet.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toUpdateFleet", []))

    @jsii.member(jsii_name="toUpdateModelManifest")
    def to_update_model_manifest(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to update the given model manifest definition.

        Access Level: Write

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_UpdateModelManifest.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toUpdateModelManifest", []))

    @jsii.member(jsii_name="toUpdateSignalCatalog")
    def to_update_signal_catalog(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to update a specific signal catalog definition.

        Access Level: Write

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_UpdateSignalCatalog.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toUpdateSignalCatalog", []))

    @jsii.member(jsii_name="toUpdateVehicle")
    def to_update_vehicle(self) -> "Iotfleetwise":
        '''(experimental) Grants permission to update the vehicle.

        Access Level: Write

        Possible conditions:

        - .ifUpdateToModelManifestArn()
        - .ifUpdateToDecoderManifestArn()

        https://docs.aws.amazon.com/iot-fleetwise/latest/APIReference/API_UpdateVehicle.html

        :stability: experimental
        '''
        return typing.cast("Iotfleetwise", jsii.invoke(self, "toUpdateVehicle", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__94762b4d3d13a6cbc2236c31efb483ce6bc03dd6b68b739c8174071ab0103684)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b7f94270f87454b529ed7ae37724a7e59a210657c53603e84d24d355b294eb2a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Iotjobsdata(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Iotjobsdata",
):
    '''(experimental) Statement provider for service `iotjobsdata <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotjobsdataplane.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iotjobsdata <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotjobsdataplane.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2dc35758f1602f522a3709e2378c863d68eaf2f0dbf03b62e8034ced8b179cb6)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifIotJobId")
    def if_iot_job_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotjobsdata":
        '''(experimental) Filters access by jobId for iotjobsdata:DescribeJobExecution and iotjobsdata:UpdateJobExecution APIs.

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html

        Applies to actions:

        - .toDescribeJobExecution()
        - .toUpdateJobExecution()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d163d9de9f8de26f95d727f34ec7dd311e5b1b25f039db9204aad37936482ee9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iotjobsdata", jsii.invoke(self, "ifIotJobId", [value, operator]))

    @jsii.member(jsii_name="onThing")
    def on_thing(
        self,
        thing_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotjobsdata":
        '''(experimental) Adds a resource of type thing to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/thing-registry.html

        :param thing_name: - Identifier for the thingName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__83b9f018268a4db891893f8884702f7317f7efaee3438776a9ed4e080ec79224)
            check_type(argname="argument thing_name", value=thing_name, expected_type=type_hints["thing_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotjobsdata", jsii.invoke(self, "onThing", [thing_name, account, region, partition]))

    @jsii.member(jsii_name="toDescribeJobExecution")
    def to_describe_job_execution(self) -> "Iotjobsdata":
        '''(experimental) Grants permission to describe a job execution.

        Access Level: Read

        Possible conditions:

        - .ifIotJobId()

        https://docs.aws.amazon.com/iot/latest/apireference/API_iot-jobs-data_DescribeJobExecution.html

        :stability: experimental
        '''
        return typing.cast("Iotjobsdata", jsii.invoke(self, "toDescribeJobExecution", []))

    @jsii.member(jsii_name="toGetPendingJobExecutions")
    def to_get_pending_job_executions(self) -> "Iotjobsdata":
        '''(experimental) Grants permission to get the list of all jobs for a thing that are not in a terminal state.

        Access Level: Read

        https://docs.aws.amazon.com/iot/latest/apireference/API_iot-jobs-data_GetPendingJobExecutions.html

        :stability: experimental
        '''
        return typing.cast("Iotjobsdata", jsii.invoke(self, "toGetPendingJobExecutions", []))

    @jsii.member(jsii_name="toStartNextPendingJobExecution")
    def to_start_next_pending_job_execution(self) -> "Iotjobsdata":
        '''(experimental) Grants permission to get and start the next pending job execution for a thing.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/apireference/API_iot-jobs-data_StartNextPendingJobExecution.html

        :stability: experimental
        '''
        return typing.cast("Iotjobsdata", jsii.invoke(self, "toStartNextPendingJobExecution", []))

    @jsii.member(jsii_name="toUpdateJobExecution")
    def to_update_job_execution(self) -> "Iotjobsdata":
        '''(experimental) Grants permission to update a job execution.

        Access Level: Write

        Possible conditions:

        - .ifIotJobId()

        https://docs.aws.amazon.com/iot/latest/apireference/API_iot-jobs-data_UpdateJobExecution.html

        :stability: experimental
        '''
        return typing.cast("Iotjobsdata", jsii.invoke(self, "toUpdateJobExecution", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fe510e5b17c7f8a1c9d2f1d77496c0a54bc8da8a61ae45480b94375076b4ef94)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dcbaeaed00c72a8c3dfc0b60df2c04b2ddc829e4b77532740e026da6b72a9c15)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Iotroborunner(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Iotroborunner",
):
    '''(experimental) Statement provider for service `iotroborunner <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotroborunner.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iotroborunner <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotroborunner.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__81b606b3435fbe07b10a4b634fa4e46844f9860089bdb7f3c9f176b7a08ab339)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifDestinationResourceId")
    def if_destination_resource_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotroborunner":
        '''(experimental) Filters access by the destination's identifier.

        https://docs.aws.amazon.com/iotroborunner/latest/dev/#Destination

        Applies to resource types:

        - DestinationResource

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__652a3778b2ffd183434028da7b770a862148ef7f14892ccda682bc42ccd195e5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iotroborunner", jsii.invoke(self, "ifDestinationResourceId", [value, operator]))

    @jsii.member(jsii_name="ifSiteResourceId")
    def if_site_resource_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotroborunner":
        '''(experimental) Filters access by the site's identifier.

        https://docs.aws.amazon.com/iotroborunner/latest/dev/#Site

        Applies to resource types:

        - SiteResource

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3070565b68e0dbb069438ac27a3e6144a0606f7f8e710e33885e7bb49ae0a5c9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iotroborunner", jsii.invoke(self, "ifSiteResourceId", [value, operator]))

    @jsii.member(jsii_name="ifWorkerFleetResourceId")
    def if_worker_fleet_resource_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotroborunner":
        '''(experimental) Filters access by the worker fleet's identifier.

        https://docs.aws.amazon.com/iotroborunner/latest/dev/#WorkerFleet

        Applies to resource types:

        - WorkerFleetResource

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6737f6bb1701de694b06de4170aa55bb23f7707962d419cede2e65ec3d9b85fe)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iotroborunner", jsii.invoke(self, "ifWorkerFleetResourceId", [value, operator]))

    @jsii.member(jsii_name="ifWorkerResourceId")
    def if_worker_resource_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotroborunner":
        '''(experimental) Filters access by the workers identifier.

        https://docs.aws.amazon.com/iotroborunner/latest/dev/#Worker

        Applies to resource types:

        - WorkerResource

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__258a5936afa6333e89e5d099ad62176f937a4fa18feabe823779ae872f8980a7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iotroborunner", jsii.invoke(self, "ifWorkerResourceId", [value, operator]))

    @jsii.member(jsii_name="onDestinationResource")
    def on_destination_resource(
        self,
        site_id: builtins.str,
        destination_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotroborunner":
        '''(experimental) Adds a resource of type DestinationResource to the statement.

        https://docs.aws.amazon.com/iotroborunner/latest/api/

        :param site_id: - Identifier for the siteId.
        :param destination_id: - Identifier for the destinationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifDestinationResourceId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c2b2bc72d5d3cab94c50aeee0aa1827da2d59796480b92b3c52d8fa4145cd026)
            check_type(argname="argument site_id", value=site_id, expected_type=type_hints["site_id"])
            check_type(argname="argument destination_id", value=destination_id, expected_type=type_hints["destination_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotroborunner", jsii.invoke(self, "onDestinationResource", [site_id, destination_id, account, region, partition]))

    @jsii.member(jsii_name="onSiteResource")
    def on_site_resource(
        self,
        site_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotroborunner":
        '''(experimental) Adds a resource of type SiteResource to the statement.

        https://docs.aws.amazon.com/iotroborunner/latest/api/

        :param site_id: - Identifier for the siteId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifSiteResourceId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__233565236e54374433029f0f068de95b5d5e675b76ee23a235a3d405cbaa2d67)
            check_type(argname="argument site_id", value=site_id, expected_type=type_hints["site_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotroborunner", jsii.invoke(self, "onSiteResource", [site_id, account, region, partition]))

    @jsii.member(jsii_name="onWorkerFleetResource")
    def on_worker_fleet_resource(
        self,
        site_id: builtins.str,
        worker_fleet_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotroborunner":
        '''(experimental) Adds a resource of type WorkerFleetResource to the statement.

        https://docs.aws.amazon.com/iotroborunner/latest/api/

        :param site_id: - Identifier for the siteId.
        :param worker_fleet_id: - Identifier for the workerFleetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifWorkerFleetResourceId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ed4155e0352fd6529c62fd15484d6811a0c4cadce4191a8d79412db8cc30fd68)
            check_type(argname="argument site_id", value=site_id, expected_type=type_hints["site_id"])
            check_type(argname="argument worker_fleet_id", value=worker_fleet_id, expected_type=type_hints["worker_fleet_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotroborunner", jsii.invoke(self, "onWorkerFleetResource", [site_id, worker_fleet_id, account, region, partition]))

    @jsii.member(jsii_name="onWorkerResource")
    def on_worker_resource(
        self,
        site_id: builtins.str,
        worker_fleet_id: builtins.str,
        worker_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotroborunner":
        '''(experimental) Adds a resource of type WorkerResource to the statement.

        https://docs.aws.amazon.com/iotroborunner/latest/api/

        :param site_id: - Identifier for the siteId.
        :param worker_fleet_id: - Identifier for the workerFleetId.
        :param worker_id: - Identifier for the workerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifWorkerResourceId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8a233d890c295acce845fd85992945431c2a2f53efd938f199ad14085091df13)
            check_type(argname="argument site_id", value=site_id, expected_type=type_hints["site_id"])
            check_type(argname="argument worker_fleet_id", value=worker_fleet_id, expected_type=type_hints["worker_fleet_id"])
            check_type(argname="argument worker_id", value=worker_id, expected_type=type_hints["worker_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotroborunner", jsii.invoke(self, "onWorkerResource", [site_id, worker_fleet_id, worker_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateDestination")
    def to_create_destination(self) -> "Iotroborunner":
        '''(experimental) Grants permission to create a destination.

        Access Level: Write

        https://docs.aws.amazon.com/iotroborunner/latest/api/API_CreateDestination.html

        :stability: experimental
        '''
        return typing.cast("Iotroborunner", jsii.invoke(self, "toCreateDestination", []))

    @jsii.member(jsii_name="toCreateSite")
    def to_create_site(self) -> "Iotroborunner":
        '''(experimental) Grants permission to create a site.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/iotroborunner/latest/api/API_CreateSite.html

        :stability: experimental
        '''
        return typing.cast("Iotroborunner", jsii.invoke(self, "toCreateSite", []))

    @jsii.member(jsii_name="toCreateWorker")
    def to_create_worker(self) -> "Iotroborunner":
        '''(experimental) Grants permission to create a worker.

        Access Level: Write

        https://docs.aws.amazon.com/iotroborunner/latest/api/API_CreateWorker.html

        :stability: experimental
        '''
        return typing.cast("Iotroborunner", jsii.invoke(self, "toCreateWorker", []))

    @jsii.member(jsii_name="toCreateWorkerFleet")
    def to_create_worker_fleet(self) -> "Iotroborunner":
        '''(experimental) Grants permission to create a worker fleet.

        Access Level: Write

        https://docs.aws.amazon.com/iotroborunner/latest/api/API_CreateWorkerFleet.html

        :stability: experimental
        '''
        return typing.cast("Iotroborunner", jsii.invoke(self, "toCreateWorkerFleet", []))

    @jsii.member(jsii_name="toDeleteDestination")
    def to_delete_destination(self) -> "Iotroborunner":
        '''(experimental) Grants permission to delete a destination.

        Access Level: Write

        https://docs.aws.amazon.com/iotroborunner/latest/api/API_DeleteDestination.html

        :stability: experimental
        '''
        return typing.cast("Iotroborunner", jsii.invoke(self, "toDeleteDestination", []))

    @jsii.member(jsii_name="toDeleteSite")
    def to_delete_site(self) -> "Iotroborunner":
        '''(experimental) Grants permission to delete a site.

        Access Level: Write

        https://docs.aws.amazon.com/iotroborunner/latest/api/API_DeleteSite.html

        :stability: experimental
        '''
        return typing.cast("Iotroborunner", jsii.invoke(self, "toDeleteSite", []))

    @jsii.member(jsii_name="toDeleteWorker")
    def to_delete_worker(self) -> "Iotroborunner":
        '''(experimental) Grants permission to delete a worker.

        Access Level: Write

        https://docs.aws.amazon.com/iotroborunner/latest/api/API_DeleteWorker.html

        :stability: experimental
        '''
        return typing.cast("Iotroborunner", jsii.invoke(self, "toDeleteWorker", []))

    @jsii.member(jsii_name="toDeleteWorkerFleet")
    def to_delete_worker_fleet(self) -> "Iotroborunner":
        '''(experimental) Grants permission to delete a worker fleet.

        Access Level: Write

        https://docs.aws.amazon.com/iotroborunner/latest/api/API_DeleteWorkerFleet.html

        :stability: experimental
        '''
        return typing.cast("Iotroborunner", jsii.invoke(self, "toDeleteWorkerFleet", []))

    @jsii.member(jsii_name="toGetDestination")
    def to_get_destination(self) -> "Iotroborunner":
        '''(experimental) Grants permission to get a destination.

        Access Level: Read

        https://docs.aws.amazon.com/iotroborunner/latest/api/API_GetDestination.html

        :stability: experimental
        '''
        return typing.cast("Iotroborunner", jsii.invoke(self, "toGetDestination", []))

    @jsii.member(jsii_name="toGetSite")
    def to_get_site(self) -> "Iotroborunner":
        '''(experimental) Grants permission to get a site.

        Access Level: Read

        https://docs.aws.amazon.com/iotroborunner/latest/api/API_GetSite.html

        :stability: experimental
        '''
        return typing.cast("Iotroborunner", jsii.invoke(self, "toGetSite", []))

    @jsii.member(jsii_name="toGetWorker")
    def to_get_worker(self) -> "Iotroborunner":
        '''(experimental) Grants permission to get a worker.

        Access Level: Read

        https://docs.aws.amazon.com/iotroborunner/latest/api/API_GetWorker.html

        :stability: experimental
        '''
        return typing.cast("Iotroborunner", jsii.invoke(self, "toGetWorker", []))

    @jsii.member(jsii_name="toGetWorkerFleet")
    def to_get_worker_fleet(self) -> "Iotroborunner":
        '''(experimental) Grants permission to get a worker fleet.

        Access Level: Read

        https://docs.aws.amazon.com/iotroborunner/latest/api/API_GetWorkerFleet.html

        :stability: experimental
        '''
        return typing.cast("Iotroborunner", jsii.invoke(self, "toGetWorkerFleet", []))

    @jsii.member(jsii_name="toListDestinations")
    def to_list_destinations(self) -> "Iotroborunner":
        '''(experimental) Grants permission to list destinations.

        Access Level: Read

        https://docs.aws.amazon.com/iotroborunner/latest/api/API_ListDestinations.html

        :stability: experimental
        '''
        return typing.cast("Iotroborunner", jsii.invoke(self, "toListDestinations", []))

    @jsii.member(jsii_name="toListSites")
    def to_list_sites(self) -> "Iotroborunner":
        '''(experimental) Grants permission to list sites.

        Access Level: Read

        https://docs.aws.amazon.com/iotroborunner/latest/api/API_ListSites.html

        :stability: experimental
        '''
        return typing.cast("Iotroborunner", jsii.invoke(self, "toListSites", []))

    @jsii.member(jsii_name="toListWorkerFleets")
    def to_list_worker_fleets(self) -> "Iotroborunner":
        '''(experimental) Grants permission to list worker fleets.

        Access Level: Read

        https://docs.aws.amazon.com/iotroborunner/latest/api/API_ListWorkerFleets.html

        :stability: experimental
        '''
        return typing.cast("Iotroborunner", jsii.invoke(self, "toListWorkerFleets", []))

    @jsii.member(jsii_name="toListWorkers")
    def to_list_workers(self) -> "Iotroborunner":
        '''(experimental) Grants permission to list workers.

        Access Level: Read

        https://docs.aws.amazon.com/iotroborunner/latest/api/API_ListWorkers.html

        :stability: experimental
        '''
        return typing.cast("Iotroborunner", jsii.invoke(self, "toListWorkers", []))

    @jsii.member(jsii_name="toUpdateDestination")
    def to_update_destination(self) -> "Iotroborunner":
        '''(experimental) Grants permission to update a destination.

        Access Level: Write

        https://docs.aws.amazon.com/iotroborunner/latest/api/API_UpdateDestination.html

        :stability: experimental
        '''
        return typing.cast("Iotroborunner", jsii.invoke(self, "toUpdateDestination", []))

    @jsii.member(jsii_name="toUpdateSite")
    def to_update_site(self) -> "Iotroborunner":
        '''(experimental) Grants permission to update a site.

        Access Level: Write

        https://docs.aws.amazon.com/iotroborunner/latest/api/API_UpdateSite.html

        :stability: experimental
        '''
        return typing.cast("Iotroborunner", jsii.invoke(self, "toUpdateSite", []))

    @jsii.member(jsii_name="toUpdateWorker")
    def to_update_worker(self) -> "Iotroborunner":
        '''(experimental) Grants permission to update a worker.

        Access Level: Write

        https://docs.aws.amazon.com/iotroborunner/latest/api/API_UpdateWorker.html

        :stability: experimental
        '''
        return typing.cast("Iotroborunner", jsii.invoke(self, "toUpdateWorker", []))

    @jsii.member(jsii_name="toUpdateWorkerFleet")
    def to_update_worker_fleet(self) -> "Iotroborunner":
        '''(experimental) Grants permission to update a worker fleet.

        Access Level: Write

        https://docs.aws.amazon.com/iotroborunner/latest/api/API_UpdateWorkerFleet.html

        :stability: experimental
        '''
        return typing.cast("Iotroborunner", jsii.invoke(self, "toUpdateWorkerFleet", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b89670376b8c45efc860b760dfefa3298cede4046b4eb5951c9b56f019e9c788)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6c7242cd3179d34af9df35787214be4ff7a9bfe14410990618bd2d5b926e1f33)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Iotsitewise(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Iotsitewise",
):
    '''(experimental) Statement provider for service `iotsitewise <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotsitewise.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iotsitewise <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotsitewise.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__993fb89bb894b532085e86754567d60130b6c41fe69c536277c3e70c95c50317)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAssetHierarchyPath")
    def if_asset_hierarchy_path(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotsitewise":
        '''(experimental) Filters access by an asset hierarchy path, which is the string of asset IDs in the asset's hierarchy, each separated by a forward slash.

        https://docs.aws.amazon.com/iot-sitewise/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__42a6d71a1dce0ac0bc012afa19603d0f42ce2dfdf50344710841c2288b17d728)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iotsitewise", jsii.invoke(self, "ifAssetHierarchyPath", [value, operator]))

    @jsii.member(jsii_name="ifChildAssetId")
    def if_child_asset_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotsitewise":
        '''(experimental) Filters access by the ID of a child asset being associated whith a parent asset.

        https://docs.aws.amazon.com/iot-sitewise/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__84420a4dff4849568af19d5f9f9f3a2320b4956093ab8bf85a243bd994dc7a59)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iotsitewise", jsii.invoke(self, "ifChildAssetId", [value, operator]))

    @jsii.member(jsii_name="ifGroup")
    def if_group(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotsitewise":
        '''(experimental) Filters access by the ID of an AWS Single Sign-On group.

        https://docs.aws.amazon.com/iot-sitewise/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__015c2bda6fb0fe38e7d2afb4cbe5d57b3072a017cd72fdbb5c1410e6321c743d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iotsitewise", jsii.invoke(self, "ifGroup", [value, operator]))

    @jsii.member(jsii_name="ifIam")
    def if_iam(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotsitewise":
        '''(experimental) Filters access by the ID of an AWS IAM identity.

        https://docs.aws.amazon.com/iot-sitewise/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7b57937ef40713bad17396cc401d84bf99552381b5ed10edcc93af0e54dadaaf)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iotsitewise", jsii.invoke(self, "ifIam", [value, operator]))

    @jsii.member(jsii_name="ifIsAssociatedWithAssetProperty")
    def if_is_associated_with_asset_property(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotsitewise":
        '''(experimental) Filters access by data streams associated with or not associated with asset properties.

        https://docs.aws.amazon.com/iot-sitewise/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0c56d0a7389b35fe1ebc78478e85fa5c35e36ac4aeaa28b1c8d6cbfd0147f2a1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iotsitewise", jsii.invoke(self, "ifIsAssociatedWithAssetProperty", [value, operator]))

    @jsii.member(jsii_name="ifPortal")
    def if_portal(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotsitewise":
        '''(experimental) Filters access by the ID of a portal.

        https://docs.aws.amazon.com/iot-sitewise/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7f3d5e200c6246d3d3e30062d79a98dd985c71a4e4ab35c44c4a70f551588e71)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iotsitewise", jsii.invoke(self, "ifPortal", [value, operator]))

    @jsii.member(jsii_name="ifProject")
    def if_project(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotsitewise":
        '''(experimental) Filters access by the ID of a project.

        https://docs.aws.amazon.com/iot-sitewise/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a4ee27f892e13d9c76cdfb422454a8c50edf15e30781717fa7306bbeaeb61fa9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iotsitewise", jsii.invoke(self, "ifProject", [value, operator]))

    @jsii.member(jsii_name="ifPropertyAlias")
    def if_property_alias(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotsitewise":
        '''(experimental) Filters access by the property alias.

        https://docs.aws.amazon.com/iot-sitewise/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__56eb6529b9a41fa4434e62a2a3eea255f0796ca6903f19c725be3bacb83d0de4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iotsitewise", jsii.invoke(self, "ifPropertyAlias", [value, operator]))

    @jsii.member(jsii_name="ifPropertyId")
    def if_property_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotsitewise":
        '''(experimental) Filters access by the ID of an asset property.

        https://docs.aws.amazon.com/iot-sitewise/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dfd3f840d3816deea521dd38d6c56cc1f97524fe2e6d98e97c8cca38573baa9c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iotsitewise", jsii.invoke(self, "ifPropertyId", [value, operator]))

    @jsii.member(jsii_name="ifUser")
    def if_user(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Iotsitewise":
        '''(experimental) Filters access by the ID of an AWS Single Sign-On user.

        https://docs.aws.amazon.com/iot-sitewise/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies-conditionkeys

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__004ae16ebb2d46edbaad4b22160007c1a27c46b82d64391c66ffc0c24d1f5dbe)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Iotsitewise", jsii.invoke(self, "ifUser", [value, operator]))

    @jsii.member(jsii_name="onAccessPolicy")
    def on_access_policy(
        self,
        access_policy_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotsitewise":
        '''(experimental) Adds a resource of type access-policy to the statement.

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateAccessPolicy.html

        :param access_policy_id: - Identifier for the accessPolicyId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7b0a2332bbce5e47d1fcfdffa616599a0898d2fd8813c2fc02a6ebe6338dc1f4)
            check_type(argname="argument access_policy_id", value=access_policy_id, expected_type=type_hints["access_policy_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotsitewise", jsii.invoke(self, "onAccessPolicy", [access_policy_id, account, region, partition]))

    @jsii.member(jsii_name="onAsset")
    def on_asset(
        self,
        asset_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotsitewise":
        '''(experimental) Adds a resource of type asset to the statement.

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateAsset.html

        :param asset_id: - Identifier for the assetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0dbe93d8e13be6609da6cbbb87775f618bd417ad7c70cee78487a8307995985a)
            check_type(argname="argument asset_id", value=asset_id, expected_type=type_hints["asset_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotsitewise", jsii.invoke(self, "onAsset", [asset_id, account, region, partition]))

    @jsii.member(jsii_name="onAssetModel")
    def on_asset_model(
        self,
        asset_model_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotsitewise":
        '''(experimental) Adds a resource of type asset-model to the statement.

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateAssetModel.html

        :param asset_model_id: - Identifier for the assetModelId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__871de8db9220e5769d63270205368e29670b8744c46887fae13c54a526efa4a9)
            check_type(argname="argument asset_model_id", value=asset_model_id, expected_type=type_hints["asset_model_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotsitewise", jsii.invoke(self, "onAssetModel", [asset_model_id, account, region, partition]))

    @jsii.member(jsii_name="onDashboard")
    def on_dashboard(
        self,
        dashboard_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotsitewise":
        '''(experimental) Adds a resource of type dashboard to the statement.

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateDashboard.html

        :param dashboard_id: - Identifier for the dashboardId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d4ecea914fe7c8f7864112cd175627481545ce880a457146f2b6f630b6aec8d7)
            check_type(argname="argument dashboard_id", value=dashboard_id, expected_type=type_hints["dashboard_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotsitewise", jsii.invoke(self, "onDashboard", [dashboard_id, account, region, partition]))

    @jsii.member(jsii_name="onGateway")
    def on_gateway(
        self,
        gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotsitewise":
        '''(experimental) Adds a resource of type gateway to the statement.

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateGateway.html

        :param gateway_id: - Identifier for the gatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8c9800d95ffdf0e50e2ec7bad63acc621dac11e83345e1f02656f2ad1a76dff2)
            check_type(argname="argument gateway_id", value=gateway_id, expected_type=type_hints["gateway_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotsitewise", jsii.invoke(self, "onGateway", [gateway_id, account, region, partition]))

    @jsii.member(jsii_name="onPortal")
    def on_portal(
        self,
        portal_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotsitewise":
        '''(experimental) Adds a resource of type portal to the statement.

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreatePortal.html

        :param portal_id: - Identifier for the portalId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4ae872e23697895c031a4e2da5f29dcb016d6d343b5341a586242cdba159795f)
            check_type(argname="argument portal_id", value=portal_id, expected_type=type_hints["portal_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotsitewise", jsii.invoke(self, "onPortal", [portal_id, account, region, partition]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotsitewise":
        '''(experimental) Adds a resource of type project to the statement.

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateProject.html

        :param project_id: - Identifier for the projectId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a9d7a2334778481a079fa73f9f98edd641d96de41b8ea9d14cc5095d57c8ec00)
            check_type(argname="argument project_id", value=project_id, expected_type=type_hints["project_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotsitewise", jsii.invoke(self, "onProject", [project_id, account, region, partition]))

    @jsii.member(jsii_name="onTimeSeries")
    def on_time_series(
        self,
        time_series_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotsitewise":
        '''(experimental) Adds a resource of type time-series to the statement.

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeTimeSeries.html

        :param time_series_id: - Identifier for the timeSeriesId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1339810419e39bb3153752e9b591b90c809e20aacac4d696a8397c7c913f9015)
            check_type(argname="argument time_series_id", value=time_series_id, expected_type=type_hints["time_series_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotsitewise", jsii.invoke(self, "onTimeSeries", [time_series_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateAssets")
    def to_associate_assets(self) -> "Iotsitewise":
        '''(experimental) Grants permission to associate a child asset with a parent asset through a hierarchy.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_AssociateAssets.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toAssociateAssets", []))

    @jsii.member(jsii_name="toAssociateTimeSeriesToAssetProperty")
    def to_associate_time_series_to_asset_property(self) -> "Iotsitewise":
        '''(experimental) Grants permission to associate a time series with an asset property.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_AssociateTimeSeriesToAssetProperty.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toAssociateTimeSeriesToAssetProperty", []))

    @jsii.member(jsii_name="toBatchAssociateProjectAssets")
    def to_batch_associate_project_assets(self) -> "Iotsitewise":
        '''(experimental) Grants permission to associate assets to a project.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_BatchAssociateProjectAssets.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toBatchAssociateProjectAssets", []))

    @jsii.member(jsii_name="toBatchDisassociateProjectAssets")
    def to_batch_disassociate_project_assets(self) -> "Iotsitewise":
        '''(experimental) Grants permission to disassociate assets from a project.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_BatchDisassociateProjectAssets.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toBatchDisassociateProjectAssets", []))

    @jsii.member(jsii_name="toBatchGetAssetPropertyAggregates")
    def to_batch_get_asset_property_aggregates(self) -> "Iotsitewise":
        '''(experimental) Grants permission to retrieve computed aggregates for multiple asset properties.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_BatchGetAssetPropertyAggregates.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toBatchGetAssetPropertyAggregates", []))

    @jsii.member(jsii_name="toBatchGetAssetPropertyValue")
    def to_batch_get_asset_property_value(self) -> "Iotsitewise":
        '''(experimental) Grants permission to retrieve the latest value for multiple asset properties.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_BatchGetAssetPropertyValue.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toBatchGetAssetPropertyValue", []))

    @jsii.member(jsii_name="toBatchGetAssetPropertyValueHistory")
    def to_batch_get_asset_property_value_history(self) -> "Iotsitewise":
        '''(experimental) Grants permission to retrieve the value history for multiple asset properties.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_BatchGetAssetPropertyValueHistory.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toBatchGetAssetPropertyValueHistory", []))

    @jsii.member(jsii_name="toBatchPutAssetPropertyValue")
    def to_batch_put_asset_property_value(self) -> "Iotsitewise":
        '''(experimental) Grants permission to put property values for asset properties.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_BatchPutAssetPropertyValue.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toBatchPutAssetPropertyValue", []))

    @jsii.member(jsii_name="toCreateAccessPolicy")
    def to_create_access_policy(self) -> "Iotsitewise":
        '''(experimental) Grants permission to create an access policy for a portal or a project.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toCreateAccessPolicy", []))

    @jsii.member(jsii_name="toCreateAsset")
    def to_create_asset(self) -> "Iotsitewise":
        '''(experimental) Grants permission to create an asset from an asset model.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateAsset.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toCreateAsset", []))

    @jsii.member(jsii_name="toCreateAssetModel")
    def to_create_asset_model(self) -> "Iotsitewise":
        '''(experimental) Grants permission to create an asset model.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateAssetModel.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toCreateAssetModel", []))

    @jsii.member(jsii_name="toCreateBulkImportJob")
    def to_create_bulk_import_job(self) -> "Iotsitewise":
        '''(experimental) Grants permission to create bulk import job.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateBulkImportJob.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toCreateBulkImportJob", []))

    @jsii.member(jsii_name="toCreateDashboard")
    def to_create_dashboard(self) -> "Iotsitewise":
        '''(experimental) Grants permission to create a dashboard in a project.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateDashboard.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toCreateDashboard", []))

    @jsii.member(jsii_name="toCreateGateway")
    def to_create_gateway(self) -> "Iotsitewise":
        '''(experimental) Grants permission to create a gateway.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateGateway.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toCreateGateway", []))

    @jsii.member(jsii_name="toCreatePortal")
    def to_create_portal(self) -> "Iotsitewise":
        '''(experimental) Grants permission to create a portal.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - sso:CreateManagedApplicationInstance
        - sso:DescribeRegisteredRegions

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreatePortal.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toCreatePortal", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Iotsitewise":
        '''(experimental) Grants permission to create a project in a portal.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_CreateProject.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toDeleteAccessPolicy")
    def to_delete_access_policy(self) -> "Iotsitewise":
        '''(experimental) Grants permission to delete an access policy.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DeleteAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDeleteAccessPolicy", []))

    @jsii.member(jsii_name="toDeleteAsset")
    def to_delete_asset(self) -> "Iotsitewise":
        '''(experimental) Grants permission to delete an asset.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DeleteAsset.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDeleteAsset", []))

    @jsii.member(jsii_name="toDeleteAssetModel")
    def to_delete_asset_model(self) -> "Iotsitewise":
        '''(experimental) Grants permission to delete an asset model.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DeleteAssetModel.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDeleteAssetModel", []))

    @jsii.member(jsii_name="toDeleteDashboard")
    def to_delete_dashboard(self) -> "Iotsitewise":
        '''(experimental) Grants permission to delete a dashboard.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DeleteDashboard.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDeleteDashboard", []))

    @jsii.member(jsii_name="toDeleteGateway")
    def to_delete_gateway(self) -> "Iotsitewise":
        '''(experimental) Grants permission to delete a gateway.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DeleteGateway.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDeleteGateway", []))

    @jsii.member(jsii_name="toDeletePortal")
    def to_delete_portal(self) -> "Iotsitewise":
        '''(experimental) Grants permission to delete a portal.

        Access Level: Write

        Dependent actions:

        - sso:DeleteManagedApplicationInstance

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DeletePortal.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDeletePortal", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Iotsitewise":
        '''(experimental) Grants permission to delete a project.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DeleteProject.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDeleteTimeSeries")
    def to_delete_time_series(self) -> "Iotsitewise":
        '''(experimental) Grants permission to delete a time series.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DeleteTimeSeries.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDeleteTimeSeries", []))

    @jsii.member(jsii_name="toDescribeAccessPolicy")
    def to_describe_access_policy(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe an access policy.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeAccessPolicy", []))

    @jsii.member(jsii_name="toDescribeAsset")
    def to_describe_asset(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe an asset.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeAsset.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeAsset", []))

    @jsii.member(jsii_name="toDescribeAssetModel")
    def to_describe_asset_model(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe an asset model.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeAssetModel.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeAssetModel", []))

    @jsii.member(jsii_name="toDescribeAssetProperty")
    def to_describe_asset_property(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe an asset property.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeAssetProperty.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeAssetProperty", []))

    @jsii.member(jsii_name="toDescribeBulkImportJob")
    def to_describe_bulk_import_job(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe bulk import job.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeBulkImportJob.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeBulkImportJob", []))

    @jsii.member(jsii_name="toDescribeDashboard")
    def to_describe_dashboard(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe a dashboard.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeDashboard.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeDashboard", []))

    @jsii.member(jsii_name="toDescribeDefaultEncryptionConfiguration")
    def to_describe_default_encryption_configuration(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe the default encryption configuration for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeDefaultEncryptionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeDefaultEncryptionConfiguration", []))

    @jsii.member(jsii_name="toDescribeGateway")
    def to_describe_gateway(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe a gateway.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeGateway.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeGateway", []))

    @jsii.member(jsii_name="toDescribeGatewayCapabilityConfiguration")
    def to_describe_gateway_capability_configuration(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe a capability configuration for a gateway.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeGatewayCapabilityConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeGatewayCapabilityConfiguration", []))

    @jsii.member(jsii_name="toDescribeLoggingOptions")
    def to_describe_logging_options(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe logging options for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeLoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeLoggingOptions", []))

    @jsii.member(jsii_name="toDescribePortal")
    def to_describe_portal(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe a portal.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribePortal.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribePortal", []))

    @jsii.member(jsii_name="toDescribeProject")
    def to_describe_project(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe a project.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeProject.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeProject", []))

    @jsii.member(jsii_name="toDescribeStorageConfiguration")
    def to_describe_storage_configuration(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe the storage configuration for the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeStorageConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeStorageConfiguration", []))

    @jsii.member(jsii_name="toDescribeTimeSeries")
    def to_describe_time_series(self) -> "Iotsitewise":
        '''(experimental) Grants permission to describe a time series.

        Access Level: Read

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DescribeTimeSeries.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDescribeTimeSeries", []))

    @jsii.member(jsii_name="toDisassociateAssets")
    def to_disassociate_assets(self) -> "Iotsitewise":
        '''(experimental) Grants permission to disassociate a child asset from a parent asset by a hierarchy.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DisassociateAssets.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDisassociateAssets", []))

    @jsii.member(jsii_name="toDisassociateTimeSeriesFromAssetProperty")
    def to_disassociate_time_series_from_asset_property(self) -> "Iotsitewise":
        '''(experimental) Grants permission to disassociate a time series from an asset property.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_DisassociateTimeSeriesFromAssetProperty.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toDisassociateTimeSeriesFromAssetProperty", []))

    @jsii.member(jsii_name="toGetAssetPropertyAggregates")
    def to_get_asset_property_aggregates(self) -> "Iotsitewise":
        '''(experimental) Grants permission to retrieve computed aggregates for an asset property.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_GetAssetPropertyAggregates.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toGetAssetPropertyAggregates", []))

    @jsii.member(jsii_name="toGetAssetPropertyValue")
    def to_get_asset_property_value(self) -> "Iotsitewise":
        '''(experimental) Grants permission to retrieve the latest value for an asset property.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_GetAssetPropertyValue.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toGetAssetPropertyValue", []))

    @jsii.member(jsii_name="toGetAssetPropertyValueHistory")
    def to_get_asset_property_value_history(self) -> "Iotsitewise":
        '''(experimental) Grants permission to retrieve the value history for an asset property.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_GetAssetPropertyValueHistory.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toGetAssetPropertyValueHistory", []))

    @jsii.member(jsii_name="toGetInterpolatedAssetPropertyValues")
    def to_get_interpolated_asset_property_values(self) -> "Iotsitewise":
        '''(experimental) Grants permission to retrieve interpolated values for an asset property.

        Access Level: Read

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_GetInterpolatedAssetPropertyValues.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toGetInterpolatedAssetPropertyValues", []))

    @jsii.member(jsii_name="toListAccessPolicies")
    def to_list_access_policies(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list all access policies for an identity or a resource.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListAccessPolicies.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListAccessPolicies", []))

    @jsii.member(jsii_name="toListAssetModelProperties")
    def to_list_asset_model_properties(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list asset model properties.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListAssetModelProperties.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListAssetModelProperties", []))

    @jsii.member(jsii_name="toListAssetModels")
    def to_list_asset_models(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list all asset models.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListAssetModels.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListAssetModels", []))

    @jsii.member(jsii_name="toListAssetProperties")
    def to_list_asset_properties(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list asset properties.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListAssetProperties.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListAssetProperties", []))

    @jsii.member(jsii_name="toListAssetRelationships")
    def to_list_asset_relationships(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list the asset relationship graph for an asset.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListAssetRelationships.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListAssetRelationships", []))

    @jsii.member(jsii_name="toListAssets")
    def to_list_assets(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list all assets.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListAssets.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListAssets", []))

    @jsii.member(jsii_name="toListAssociatedAssets")
    def to_list_associated_assets(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list all assets associated with an asset through a hierarchy.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListAssociatedAssets.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListAssociatedAssets", []))

    @jsii.member(jsii_name="toListBulkImportJobs")
    def to_list_bulk_import_jobs(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list bulk import jobs.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListBulkImportJobs.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListBulkImportJobs", []))

    @jsii.member(jsii_name="toListDashboards")
    def to_list_dashboards(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list all dashboards in a project.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListDashboards.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListDashboards", []))

    @jsii.member(jsii_name="toListGateways")
    def to_list_gateways(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list all gateways.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListGateways.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListGateways", []))

    @jsii.member(jsii_name="toListPortals")
    def to_list_portals(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list all portals.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListPortals.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListPortals", []))

    @jsii.member(jsii_name="toListProjectAssets")
    def to_list_project_assets(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list all assets associated with a project.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListProjectAssets.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListProjectAssets", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list all projects in a portal.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListProjects.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list all tags for a resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTimeSeries")
    def to_list_time_series(self) -> "Iotsitewise":
        '''(experimental) Grants permission to list time series.

        Access Level: List

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_ListTimeSeries.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toListTimeSeries", []))

    @jsii.member(jsii_name="toPutDefaultEncryptionConfiguration")
    def to_put_default_encryption_configuration(self) -> "Iotsitewise":
        '''(experimental) Grants permission to set the default encryption configuration for the AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_PutDefaultEncryptionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toPutDefaultEncryptionConfiguration", []))

    @jsii.member(jsii_name="toPutLoggingOptions")
    def to_put_logging_options(self) -> "Iotsitewise":
        '''(experimental) Grants permission to set logging options for the AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_PutLoggingOptions.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toPutLoggingOptions", []))

    @jsii.member(jsii_name="toPutStorageConfiguration")
    def to_put_storage_configuration(self) -> "Iotsitewise":
        '''(experimental) Grants permission to configure storage settings for the AWS account.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_PutStorageConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toPutStorageConfiguration", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Iotsitewise":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Iotsitewise":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAccessPolicy")
    def to_update_access_policy(self) -> "Iotsitewise":
        '''(experimental) Grants permission to update an access policy.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_UpdateAccessPolicy.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUpdateAccessPolicy", []))

    @jsii.member(jsii_name="toUpdateAsset")
    def to_update_asset(self) -> "Iotsitewise":
        '''(experimental) Grants permission to update an asset.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_UpdateAsset.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUpdateAsset", []))

    @jsii.member(jsii_name="toUpdateAssetModel")
    def to_update_asset_model(self) -> "Iotsitewise":
        '''(experimental) Grants permission to update an asset model.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_UpdateAssetModel.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUpdateAssetModel", []))

    @jsii.member(jsii_name="toUpdateAssetModelPropertyRouting")
    def to_update_asset_model_property_routing(self) -> "Iotsitewise":
        '''(experimental) Grants permission to update an AssetModel property routing.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUpdateAssetModelPropertyRouting", []))

    @jsii.member(jsii_name="toUpdateAssetProperty")
    def to_update_asset_property(self) -> "Iotsitewise":
        '''(experimental) Grants permission to update an asset property.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_UpdateAssetProperty.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUpdateAssetProperty", []))

    @jsii.member(jsii_name="toUpdateDashboard")
    def to_update_dashboard(self) -> "Iotsitewise":
        '''(experimental) Grants permission to update a dashboard.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_UpdateDashboard.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUpdateDashboard", []))

    @jsii.member(jsii_name="toUpdateGateway")
    def to_update_gateway(self) -> "Iotsitewise":
        '''(experimental) Grants permission to update a gateway.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_UpdateGateway.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUpdateGateway", []))

    @jsii.member(jsii_name="toUpdateGatewayCapabilityConfiguration")
    def to_update_gateway_capability_configuration(self) -> "Iotsitewise":
        '''(experimental) Grants permission to update a capability configuration for a gateway.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_UpdateGatewayCapabilityConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUpdateGatewayCapabilityConfiguration", []))

    @jsii.member(jsii_name="toUpdatePortal")
    def to_update_portal(self) -> "Iotsitewise":
        '''(experimental) Grants permission to update a portal.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_UpdatePortal.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUpdatePortal", []))

    @jsii.member(jsii_name="toUpdateProject")
    def to_update_project(self) -> "Iotsitewise":
        '''(experimental) Grants permission to update a project.

        Access Level: Write

        https://docs.aws.amazon.com/iot-sitewise/latest/APIReference/API_UpdateProject.html

        :stability: experimental
        '''
        return typing.cast("Iotsitewise", jsii.invoke(self, "toUpdateProject", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6db063bd4a652590d661d95c67656f14a42561018f6098f53b9688f5775d5d79)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4f4d1ddcdc4795c86bf1e200380c791a3ae47ad029103e2606db8fb76722692f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Iottwinmaker(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Iottwinmaker",
):
    '''(experimental) Statement provider for service `iottwinmaker <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiottwinmaker.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iottwinmaker <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiottwinmaker.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__573b1f38448dcaedd8f4fb70e551d3b5d2ac4d4f99fb8e11aebbac03d7978a3b)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onComponentType")
    def on_component_type(
        self,
        workspace_id: builtins.str,
        component_type_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iottwinmaker":
        '''(experimental) Adds a resource of type componentType to the statement.

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_CreateComponentType.html

        :param workspace_id: - Identifier for the workspaceId.
        :param component_type_id: - Identifier for the componentTypeId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__abf42c4e9b53bda31dddbe9c08d9a65bd31a1ff8160881f8fcdc6c37eeb23b05)
            check_type(argname="argument workspace_id", value=workspace_id, expected_type=type_hints["workspace_id"])
            check_type(argname="argument component_type_id", value=component_type_id, expected_type=type_hints["component_type_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iottwinmaker", jsii.invoke(self, "onComponentType", [workspace_id, component_type_id, account, region, partition]))

    @jsii.member(jsii_name="onEntity")
    def on_entity(
        self,
        workspace_id: builtins.str,
        entity_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iottwinmaker":
        '''(experimental) Adds a resource of type entity to the statement.

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_CreateEntity.html

        :param workspace_id: - Identifier for the workspaceId.
        :param entity_id: - Identifier for the entityId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3e9ad3480ceca1f780c070f0a87ced2d3d7b50fb86e6fad758d2f02a09d35428)
            check_type(argname="argument workspace_id", value=workspace_id, expected_type=type_hints["workspace_id"])
            check_type(argname="argument entity_id", value=entity_id, expected_type=type_hints["entity_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iottwinmaker", jsii.invoke(self, "onEntity", [workspace_id, entity_id, account, region, partition]))

    @jsii.member(jsii_name="onScene")
    def on_scene(
        self,
        workspace_id: builtins.str,
        scene_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iottwinmaker":
        '''(experimental) Adds a resource of type scene to the statement.

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_CreateScene.html

        :param workspace_id: - Identifier for the workspaceId.
        :param scene_id: - Identifier for the sceneId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3bb25125e7a5d78be3240559a87de1a0faf931b9549d2ddc1ff4933314bb433f)
            check_type(argname="argument workspace_id", value=workspace_id, expected_type=type_hints["workspace_id"])
            check_type(argname="argument scene_id", value=scene_id, expected_type=type_hints["scene_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iottwinmaker", jsii.invoke(self, "onScene", [workspace_id, scene_id, account, region, partition]))

    @jsii.member(jsii_name="onSyncJob")
    def on_sync_job(
        self,
        workspace_id: builtins.str,
        sync_job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iottwinmaker":
        '''(experimental) Adds a resource of type syncJob to the statement.

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_CreateSyncJob.html

        :param workspace_id: - Identifier for the workspaceId.
        :param sync_job_id: - Identifier for the syncJobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fb9f626e9993c955154a7e4487a6fb0696c9b2dd0947aeea8840991218e82888)
            check_type(argname="argument workspace_id", value=workspace_id, expected_type=type_hints["workspace_id"])
            check_type(argname="argument sync_job_id", value=sync_job_id, expected_type=type_hints["sync_job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iottwinmaker", jsii.invoke(self, "onSyncJob", [workspace_id, sync_job_id, account, region, partition]))

    @jsii.member(jsii_name="onWorkspace")
    def on_workspace(
        self,
        workspace_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iottwinmaker":
        '''(experimental) Adds a resource of type workspace to the statement.

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_CreateWorkspace.html

        :param workspace_id: - Identifier for the workspaceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b32250f8c66c50f6e1b6f2b3f852e4eda006275c9df3b0fd64f14bf879a82678)
            check_type(argname="argument workspace_id", value=workspace_id, expected_type=type_hints["workspace_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iottwinmaker", jsii.invoke(self, "onWorkspace", [workspace_id, account, region, partition]))

    @jsii.member(jsii_name="toBatchPutPropertyValues")
    def to_batch_put_property_values(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to set values for multiple time series properties.

        Access Level: Write

        Dependent actions:

        - iottwinmaker:GetComponentType
        - iottwinmaker:GetEntity
        - iottwinmaker:GetWorkspace

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_BatchPutPropertyValues.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toBatchPutPropertyValues", []))

    @jsii.member(jsii_name="toCreateComponentType")
    def to_create_component_type(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to create a componentType.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_CreateComponentType.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toCreateComponentType", []))

    @jsii.member(jsii_name="toCreateEntity")
    def to_create_entity(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to create an entity.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_CreateEntity.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toCreateEntity", []))

    @jsii.member(jsii_name="toCreateScene")
    def to_create_scene(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to create a scene.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_CreateScene.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toCreateScene", []))

    @jsii.member(jsii_name="toCreateSyncJob")
    def to_create_sync_job(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to create a sync job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_CreateSyncJob.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toCreateSyncJob", []))

    @jsii.member(jsii_name="toCreateWorkspace")
    def to_create_workspace(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to create a workspace.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_CreateWorkspace.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toCreateWorkspace", []))

    @jsii.member(jsii_name="toDeleteComponentType")
    def to_delete_component_type(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to delete a componentType.

        Access Level: Write

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_DeleteComponentType.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toDeleteComponentType", []))

    @jsii.member(jsii_name="toDeleteEntity")
    def to_delete_entity(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to delete an entity.

        Access Level: Write

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_DeleteEntity.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toDeleteEntity", []))

    @jsii.member(jsii_name="toDeleteScene")
    def to_delete_scene(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to delete a scene.

        Access Level: Write

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_DeleteScene.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toDeleteScene", []))

    @jsii.member(jsii_name="toDeleteSyncJob")
    def to_delete_sync_job(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to delete a sync job.

        Access Level: Write

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_DeleteSyncJob.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toDeleteSyncJob", []))

    @jsii.member(jsii_name="toDeleteWorkspace")
    def to_delete_workspace(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to delete a workspace.

        Access Level: Write

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_DeleteWorkspace.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toDeleteWorkspace", []))

    @jsii.member(jsii_name="toExecuteQuery")
    def to_execute_query(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to execute query.

        Access Level: Read

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_ExecuteQuery.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toExecuteQuery", []))

    @jsii.member(jsii_name="toGetComponentType")
    def to_get_component_type(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to get a componentType.

        Access Level: Read

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_GetComponentType.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toGetComponentType", []))

    @jsii.member(jsii_name="toGetEntity")
    def to_get_entity(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to get an entity.

        Access Level: Read

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_GetEntity.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toGetEntity", []))

    @jsii.member(jsii_name="toGetPricingPlan")
    def to_get_pricing_plan(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to get pricing plan.

        Access Level: Read

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_GetPricingPlan.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toGetPricingPlan", []))

    @jsii.member(jsii_name="toGetPropertyValue")
    def to_get_property_value(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to retrieve the property values.

        Access Level: Read

        Dependent actions:

        - iottwinmaker:GetComponentType
        - iottwinmaker:GetEntity
        - iottwinmaker:GetWorkspace

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_GetPropertyValue.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toGetPropertyValue", []))

    @jsii.member(jsii_name="toGetPropertyValueHistory")
    def to_get_property_value_history(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to retrieve the time series value history.

        Access Level: Read

        Dependent actions:

        - iottwinmaker:GetComponentType
        - iottwinmaker:GetEntity
        - iottwinmaker:GetWorkspace

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_GetPropertyValueHistory.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toGetPropertyValueHistory", []))

    @jsii.member(jsii_name="toGetScene")
    def to_get_scene(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to get a scene.

        Access Level: Read

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_GetScene.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toGetScene", []))

    @jsii.member(jsii_name="toGetSyncJob")
    def to_get_sync_job(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to get a sync job.

        Access Level: Read

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_GetSyncJob.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toGetSyncJob", []))

    @jsii.member(jsii_name="toGetWorkspace")
    def to_get_workspace(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to get a workspace.

        Access Level: Read

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_GetWorkspace.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toGetWorkspace", []))

    @jsii.member(jsii_name="toListComponentTypes")
    def to_list_component_types(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to list all componentTypes in a workspace.

        Access Level: List

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_ListComponentTypes.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toListComponentTypes", []))

    @jsii.member(jsii_name="toListEntities")
    def to_list_entities(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to list all entities in a workspace.

        Access Level: List

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_ListEntities.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toListEntities", []))

    @jsii.member(jsii_name="toListScenes")
    def to_list_scenes(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to list all scenes in a workspace.

        Access Level: List

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_ListScenes.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toListScenes", []))

    @jsii.member(jsii_name="toListSyncJobs")
    def to_list_sync_jobs(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to list all sync jobs in a workspace.

        Access Level: List

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_ListSyncJobs.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toListSyncJobs", []))

    @jsii.member(jsii_name="toListSyncResources")
    def to_list_sync_resources(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to list all sync resources for a sync job.

        Access Level: List

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_ListSyncResources.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toListSyncResources", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to list all tags for a resource.

        Access Level: List

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWorkspaces")
    def to_list_workspaces(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to list all workspaces.

        Access Level: List

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_ListWorkspaces.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toListWorkspaces", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateComponentType")
    def to_update_component_type(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to update a componentType.

        Access Level: Write

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_UpdateComponentType.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toUpdateComponentType", []))

    @jsii.member(jsii_name="toUpdateEntity")
    def to_update_entity(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to update an entity.

        Access Level: Write

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_UpdateEntity.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toUpdateEntity", []))

    @jsii.member(jsii_name="toUpdatePricingPlan")
    def to_update_pricing_plan(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to update pricing plan.

        Access Level: Write

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_UpdatePricingPlan.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toUpdatePricingPlan", []))

    @jsii.member(jsii_name="toUpdateScene")
    def to_update_scene(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to update a scene.

        Access Level: Write

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_UpdateScene.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toUpdateScene", []))

    @jsii.member(jsii_name="toUpdateWorkspace")
    def to_update_workspace(self) -> "Iottwinmaker":
        '''(experimental) Grants permission to update a workspace.

        Access Level: Write

        https://docs.aws.amazon.com/iot-twinmaker/latest/apireference/API_UpdateWorkspace.html

        :stability: experimental
        '''
        return typing.cast("Iottwinmaker", jsii.invoke(self, "toUpdateWorkspace", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__643b6aa80969081898e796e358eeaf493d72f581a3f077d605fc9413b79e7afd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d979276e0d9e2ffdd9977d5f0b9fa42f2501473338a1317213cb423f7c281ef7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Iotwireless(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Iotwireless",
):
    '''(experimental) Statement provider for service `iotwireless <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotwireless.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iotwireless <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiotwireless.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ab26e8b51148bcca7ddc159d3b70ef0a0f2cfe706d250e62b3d9a65d4d6ba15b)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onCert")
    def on_cert(
        self,
        certificate: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type cert to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/x509-client-certs.html

        :param certificate: - Identifier for the certificate.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8798058425bd9eeae617bda8d79d091b8dd2da4b7eaddeea99800596eee67a25)
            check_type(argname="argument certificate", value=certificate, expected_type=type_hints["certificate"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotwireless", jsii.invoke(self, "onCert", [certificate, account, region, partition]))

    @jsii.member(jsii_name="onDestination")
    def on_destination(
        self,
        destination_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type Destination to the statement.

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateDestination.html

        :param destination_name: - Identifier for the destinationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f8c0b96c8e997f9ebfab93067e5ea13bfc0d1bc2f84bf374669943042bdb9645)
            check_type(argname="argument destination_name", value=destination_name, expected_type=type_hints["destination_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotwireless", jsii.invoke(self, "onDestination", [destination_name, account, region, partition]))

    @jsii.member(jsii_name="onDeviceProfile")
    def on_device_profile(
        self,
        device_profile_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type DeviceProfile to the statement.

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateDeviceProfile.html

        :param device_profile_id: - Identifier for the deviceProfileId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ce324c43f1a3074ac5ffe8442549147fa310a5a024a0d4f5c0bfc796d3b6f402)
            check_type(argname="argument device_profile_id", value=device_profile_id, expected_type=type_hints["device_profile_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotwireless", jsii.invoke(self, "onDeviceProfile", [device_profile_id, account, region, partition]))

    @jsii.member(jsii_name="onFuotaTask")
    def on_fuota_task(
        self,
        fuota_task_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type FuotaTask to the statement.

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateFuotaTask.html

        :param fuota_task_id: - Identifier for the fuotaTaskId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0792f5ca86032451e0c2a877142f87fe1afed99d3d5482f68cf25c32b32efd0f)
            check_type(argname="argument fuota_task_id", value=fuota_task_id, expected_type=type_hints["fuota_task_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotwireless", jsii.invoke(self, "onFuotaTask", [fuota_task_id, account, region, partition]))

    @jsii.member(jsii_name="onMulticastGroup")
    def on_multicast_group(
        self,
        multicast_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type MulticastGroup to the statement.

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateMulticastGroup.html

        :param multicast_group_id: - Identifier for the multicastGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d854d11c5b5781e98e50187e573397aa3f5f85378ce00e04d3ce371ceed07f35)
            check_type(argname="argument multicast_group_id", value=multicast_group_id, expected_type=type_hints["multicast_group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotwireless", jsii.invoke(self, "onMulticastGroup", [multicast_group_id, account, region, partition]))

    @jsii.member(jsii_name="onNetworkAnalyzerConfiguration")
    def on_network_analyzer_configuration(
        self,
        network_analyzer_configuration_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type NetworkAnalyzerConfiguration to the statement.

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateNetworkAnalyzerConfiguration.html

        :param network_analyzer_configuration_name: - Identifier for the networkAnalyzerConfigurationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9ce59027807a501fb8c7f2a0590b81c18969345877cd41c0860ec274f44ffe34)
            check_type(argname="argument network_analyzer_configuration_name", value=network_analyzer_configuration_name, expected_type=type_hints["network_analyzer_configuration_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotwireless", jsii.invoke(self, "onNetworkAnalyzerConfiguration", [network_analyzer_configuration_name, account, region, partition]))

    @jsii.member(jsii_name="onServiceProfile")
    def on_service_profile(
        self,
        service_profile_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type ServiceProfile to the statement.

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateServiceProfile.html

        :param service_profile_id: - Identifier for the serviceProfileId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9410d8705b8440f945e2e559613b50498c20ef25a736c9915c5bbeaaf823fb50)
            check_type(argname="argument service_profile_id", value=service_profile_id, expected_type=type_hints["service_profile_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotwireless", jsii.invoke(self, "onServiceProfile", [service_profile_id, account, region, partition]))

    @jsii.member(jsii_name="onSidewalkAccount")
    def on_sidewalk_account(
        self,
        sidewalk_account_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type SidewalkAccount to the statement.

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_AssociateAwsAccountWithPartnerAccount.html

        :param sidewalk_account_id: - Identifier for the sidewalkAccountId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__32e8f2d7a6a8c526d11d19f0e5b108b9c741aa36e33652384b72b3849a8849d9)
            check_type(argname="argument sidewalk_account_id", value=sidewalk_account_id, expected_type=type_hints["sidewalk_account_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotwireless", jsii.invoke(self, "onSidewalkAccount", [sidewalk_account_id, account, region, partition]))

    @jsii.member(jsii_name="onThing")
    def on_thing(
        self,
        thing_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type thing to the statement.

        https://docs.aws.amazon.com/iot/latest/developerguide/thing-registry.html

        :param thing_name: - Identifier for the thingName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0d5b164f3d42b7784860e19fa3c0f875e07533a1a5829ba4a06c5fae048986f7)
            check_type(argname="argument thing_name", value=thing_name, expected_type=type_hints["thing_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotwireless", jsii.invoke(self, "onThing", [thing_name, account, region, partition]))

    @jsii.member(jsii_name="onWirelessDevice")
    def on_wireless_device(
        self,
        wireless_device_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type WirelessDevice to the statement.

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateWirelessDevice.html

        :param wireless_device_id: - Identifier for the wirelessDeviceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4f69afc71a15227ad0739176c1f824752fcab5cdee77e0289ffe3f13aa15baae)
            check_type(argname="argument wireless_device_id", value=wireless_device_id, expected_type=type_hints["wireless_device_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotwireless", jsii.invoke(self, "onWirelessDevice", [wireless_device_id, account, region, partition]))

    @jsii.member(jsii_name="onWirelessDeviceImportTask")
    def on_wireless_device_import_task(
        self,
        wireless_device_import_task_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type WirelessDeviceImportTask to the statement.

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_StartWirelessDeviceImportTask.html

        :param wireless_device_import_task_id: - Identifier for the wirelessDeviceImportTaskId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a3a5245f00cf7396d738653f58f595efc3b989ee06429f486651ce1aff1c9af1)
            check_type(argname="argument wireless_device_import_task_id", value=wireless_device_import_task_id, expected_type=type_hints["wireless_device_import_task_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotwireless", jsii.invoke(self, "onWirelessDeviceImportTask", [wireless_device_import_task_id, account, region, partition]))

    @jsii.member(jsii_name="onWirelessGateway")
    def on_wireless_gateway(
        self,
        wireless_gateway_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type WirelessGateway to the statement.

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateWirelessGateway.html

        :param wireless_gateway_id: - Identifier for the wirelessGatewayId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__199866683c883939efdf9d5bcaeb314098cc2505be977e6051d42cbac2412a32)
            check_type(argname="argument wireless_gateway_id", value=wireless_gateway_id, expected_type=type_hints["wireless_gateway_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotwireless", jsii.invoke(self, "onWirelessGateway", [wireless_gateway_id, account, region, partition]))

    @jsii.member(jsii_name="onWirelessGatewayTaskDefinition")
    def on_wireless_gateway_task_definition(
        self,
        wireless_gateway_task_definition_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iotwireless":
        '''(experimental) Adds a resource of type WirelessGatewayTaskDefinition to the statement.

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateWirelessGatewayTaskDefinition.html

        :param wireless_gateway_task_definition_id: - Identifier for the wirelessGatewayTaskDefinitionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__116ecb5ef212457202869269ba976a05121a00cae3e772aaca4cd45d5740ee0d)
            check_type(argname="argument wireless_gateway_task_definition_id", value=wireless_gateway_task_definition_id, expected_type=type_hints["wireless_gateway_task_definition_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iotwireless", jsii.invoke(self, "onWirelessGatewayTaskDefinition", [wireless_gateway_task_definition_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateAwsAccountWithPartnerAccount")
    def to_associate_aws_account_with_partner_account(self) -> "Iotwireless":
        '''(experimental) Grants permission to link partner accounts with AWS account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_AssociateAwsAccountWithPartnerAccount.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toAssociateAwsAccountWithPartnerAccount", []))

    @jsii.member(jsii_name="toAssociateMulticastGroupWithFuotaTask")
    def to_associate_multicast_group_with_fuota_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to associate the MulticastGroup with FuotaTask.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_AssociateMulticastGroupWithFuotaTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toAssociateMulticastGroupWithFuotaTask", []))

    @jsii.member(jsii_name="toAssociateWirelessDeviceWithFuotaTask")
    def to_associate_wireless_device_with_fuota_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to associate the wireless device with FuotaTask.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_AssociateWirelessDeviceWithFuotaTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toAssociateWirelessDeviceWithFuotaTask", []))

    @jsii.member(jsii_name="toAssociateWirelessDeviceWithMulticastGroup")
    def to_associate_wireless_device_with_multicast_group(self) -> "Iotwireless":
        '''(experimental) Grants permission to associate the WirelessDevice with MulticastGroup.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_AssociateWirelessDeviceWithMulticastGroup.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toAssociateWirelessDeviceWithMulticastGroup", []))

    @jsii.member(jsii_name="toAssociateWirelessDeviceWithThing")
    def to_associate_wireless_device_with_thing(self) -> "Iotwireless":
        '''(experimental) Grants permission to associate the wireless device with AWS IoT thing for a given wirelessDeviceId.

        Access Level: Write

        Dependent actions:

        - iot:DescribeThing

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_AssociateWirelessDeviceWithThing.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toAssociateWirelessDeviceWithThing", []))

    @jsii.member(jsii_name="toAssociateWirelessGatewayWithCertificate")
    def to_associate_wireless_gateway_with_certificate(self) -> "Iotwireless":
        '''(experimental) Grants permission to associate a WirelessGateway with the IoT Core Identity certificate.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_AssociateWirelessGatewayWithCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toAssociateWirelessGatewayWithCertificate", []))

    @jsii.member(jsii_name="toAssociateWirelessGatewayWithThing")
    def to_associate_wireless_gateway_with_thing(self) -> "Iotwireless":
        '''(experimental) Grants permission to associate the wireless gateway with AWS IoT thing for a given wirelessGatewayId.

        Access Level: Write

        Dependent actions:

        - iot:DescribeThing

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_AssociateWirelessGatewayWithThing.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toAssociateWirelessGatewayWithThing", []))

    @jsii.member(jsii_name="toCancelMulticastGroupSession")
    def to_cancel_multicast_group_session(self) -> "Iotwireless":
        '''(experimental) Grants permission to cancel the MulticastGroup session.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CancelMulticastGroupSession.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toCancelMulticastGroupSession", []))

    @jsii.member(jsii_name="toCreateDestination")
    def to_create_destination(self) -> "Iotwireless":
        '''(experimental) Grants permission to create a Destination resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateDestination.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toCreateDestination", []))

    @jsii.member(jsii_name="toCreateDeviceProfile")
    def to_create_device_profile(self) -> "Iotwireless":
        '''(experimental) Grants permission to create a DeviceProfile resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateDeviceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toCreateDeviceProfile", []))

    @jsii.member(jsii_name="toCreateFuotaTask")
    def to_create_fuota_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to create a FuotaTask resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateFuotaTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toCreateFuotaTask", []))

    @jsii.member(jsii_name="toCreateMulticastGroup")
    def to_create_multicast_group(self) -> "Iotwireless":
        '''(experimental) Grants permission to create a MulticastGroup resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateMulticastGroup.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toCreateMulticastGroup", []))

    @jsii.member(jsii_name="toCreateNetworkAnalyzerConfiguration")
    def to_create_network_analyzer_configuration(self) -> "Iotwireless":
        '''(experimental) Grants permission to create a NetworkAnalyzerConfiguration resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateNetworkAnalyzerConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toCreateNetworkAnalyzerConfiguration", []))

    @jsii.member(jsii_name="toCreateServiceProfile")
    def to_create_service_profile(self) -> "Iotwireless":
        '''(experimental) Grants permission to create a ServiceProfile resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateServiceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toCreateServiceProfile", []))

    @jsii.member(jsii_name="toCreateWirelessDevice")
    def to_create_wireless_device(self) -> "Iotwireless":
        '''(experimental) Grants permission to create a WirelessDevice resource with given Destination.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateWirelessDevice.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toCreateWirelessDevice", []))

    @jsii.member(jsii_name="toCreateWirelessGateway")
    def to_create_wireless_gateway(self) -> "Iotwireless":
        '''(experimental) Grants permission to create a WirelessGateway resource.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateWirelessGateway.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toCreateWirelessGateway", []))

    @jsii.member(jsii_name="toCreateWirelessGatewayTask")
    def to_create_wireless_gateway_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to create a task for a given WirelessGateway.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateWirelessGatewayTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toCreateWirelessGatewayTask", []))

    @jsii.member(jsii_name="toCreateWirelessGatewayTaskDefinition")
    def to_create_wireless_gateway_task_definition(self) -> "Iotwireless":
        '''(experimental) Grants permission to create a WirelessGateway task definition.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_CreateWirelessGatewayTaskDefinition.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toCreateWirelessGatewayTaskDefinition", []))

    @jsii.member(jsii_name="toDeleteDestination")
    def to_delete_destination(self) -> "Iotwireless":
        '''(experimental) Grants permission to delete a Destination.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DeleteDestination.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDeleteDestination", []))

    @jsii.member(jsii_name="toDeleteDeviceProfile")
    def to_delete_device_profile(self) -> "Iotwireless":
        '''(experimental) Grants permission to delete a DeviceProfile.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DeleteDeviceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDeleteDeviceProfile", []))

    @jsii.member(jsii_name="toDeleteFuotaTask")
    def to_delete_fuota_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to delete the FuotaTask.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DeleteFuotaTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDeleteFuotaTask", []))

    @jsii.member(jsii_name="toDeleteMulticastGroup")
    def to_delete_multicast_group(self) -> "Iotwireless":
        '''(experimental) Grants permission to delete the MulticastGroup.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DeleteMulticastGroup.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDeleteMulticastGroup", []))

    @jsii.member(jsii_name="toDeleteNetworkAnalyzerConfiguration")
    def to_delete_network_analyzer_configuration(self) -> "Iotwireless":
        '''(experimental) Grants permission to delete the NetworkAnalyzerConfiguration.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DeleteNetworkAnalyzerConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDeleteNetworkAnalyzerConfiguration", []))

    @jsii.member(jsii_name="toDeleteQueuedMessages")
    def to_delete_queued_messages(self) -> "Iotwireless":
        '''(experimental) Grants permission to delete QueuedMessages.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DeleteQueuedMessages.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDeleteQueuedMessages", []))

    @jsii.member(jsii_name="toDeleteServiceProfile")
    def to_delete_service_profile(self) -> "Iotwireless":
        '''(experimental) Grants permission to delete a ServiceProfile.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DeleteServiceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDeleteServiceProfile", []))

    @jsii.member(jsii_name="toDeleteWirelessDevice")
    def to_delete_wireless_device(self) -> "Iotwireless":
        '''(experimental) Grants permission to delete a WirelessDevice.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DeleteWirelessDevice.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDeleteWirelessDevice", []))

    @jsii.member(jsii_name="toDeleteWirelessDeviceImportTask")
    def to_delete_wireless_device_import_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to delete the wireless device import task.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DeleteWirelessDeviceImportTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDeleteWirelessDeviceImportTask", []))

    @jsii.member(jsii_name="toDeleteWirelessGateway")
    def to_delete_wireless_gateway(self) -> "Iotwireless":
        '''(experimental) Grants permission to delete a WirelessGateway.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DeleteWirelessGateway.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDeleteWirelessGateway", []))

    @jsii.member(jsii_name="toDeleteWirelessGatewayTask")
    def to_delete_wireless_gateway_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to delete task for a given WirelessGateway.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DeleteWirelessGatewayTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDeleteWirelessGatewayTask", []))

    @jsii.member(jsii_name="toDeleteWirelessGatewayTaskDefinition")
    def to_delete_wireless_gateway_task_definition(self) -> "Iotwireless":
        '''(experimental) Grants permission to delete a WirelessGateway task definition.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DeleteWirelessGatewayTaskDefinition.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDeleteWirelessGatewayTaskDefinition", []))

    @jsii.member(jsii_name="toDisassociateAwsAccountFromPartnerAccount")
    def to_disassociate_aws_account_from_partner_account(self) -> "Iotwireless":
        '''(experimental) Grants permission to disassociate an AWS account from a partner account.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DisassociateAwsAccountFromPartnerAccount.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDisassociateAwsAccountFromPartnerAccount", []))

    @jsii.member(jsii_name="toDisassociateMulticastGroupFromFuotaTask")
    def to_disassociate_multicast_group_from_fuota_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to disassociate the MulticastGroup from FuotaTask.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DisassociateMulticastGroupFromFuotaTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDisassociateMulticastGroupFromFuotaTask", []))

    @jsii.member(jsii_name="toDisassociateWirelessDeviceFromFuotaTask")
    def to_disassociate_wireless_device_from_fuota_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to disassociate the wireless device from FuotaTask.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DisassociateWirelessDeviceFromFuotaTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDisassociateWirelessDeviceFromFuotaTask", []))

    @jsii.member(jsii_name="toDisassociateWirelessDeviceFromMulticastGroup")
    def to_disassociate_wireless_device_from_multicast_group(self) -> "Iotwireless":
        '''(experimental) Grants permission to disassociate the wireless device from MulticastGroup.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DisassociateWirelessDeviceFromMulticastGroup.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDisassociateWirelessDeviceFromMulticastGroup", []))

    @jsii.member(jsii_name="toDisassociateWirelessDeviceFromThing")
    def to_disassociate_wireless_device_from_thing(self) -> "Iotwireless":
        '''(experimental) Grants permission to disassociate a wireless device from a AWS IoT thing.

        Access Level: Write

        Dependent actions:

        - iot:DescribeThing

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DisassociateWirelessDeviceFromThing.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDisassociateWirelessDeviceFromThing", []))

    @jsii.member(jsii_name="toDisassociateWirelessGatewayFromCertificate")
    def to_disassociate_wireless_gateway_from_certificate(self) -> "Iotwireless":
        '''(experimental) Grants permission to disassociate a WirelessGateway from a IoT Core Identity certificate.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DisassociateWirelessGatewayFromCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDisassociateWirelessGatewayFromCertificate", []))

    @jsii.member(jsii_name="toDisassociateWirelessGatewayFromThing")
    def to_disassociate_wireless_gateway_from_thing(self) -> "Iotwireless":
        '''(experimental) Grants permission to disassociate a WirelessGateway from a IoT Core thing.

        Access Level: Write

        Dependent actions:

        - iot:DescribeThing

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_DisassociateWirelessGatewayFromThing.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toDisassociateWirelessGatewayFromThing", []))

    @jsii.member(jsii_name="toGetDestination")
    def to_get_destination(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the Destination.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetDestination.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetDestination", []))

    @jsii.member(jsii_name="toGetDeviceProfile")
    def to_get_device_profile(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the DeviceProfile.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetDeviceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetDeviceProfile", []))

    @jsii.member(jsii_name="toGetEventConfigurationByResourceTypes")
    def to_get_event_configuration_by_resource_types(self) -> "Iotwireless":
        '''(experimental) Grants permission to get event configuration by resource types.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetEventConfigurationByResourceTypes.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetEventConfigurationByResourceTypes", []))

    @jsii.member(jsii_name="toGetFuotaTask")
    def to_get_fuota_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the FuotaTask.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetFuotaTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetFuotaTask", []))

    @jsii.member(jsii_name="toGetLogLevelsByResourceTypes")
    def to_get_log_levels_by_resource_types(self) -> "Iotwireless":
        '''(experimental) Grants permission to get log levels by resource types.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetLogLevelsByResourceTypes.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetLogLevelsByResourceTypes", []))

    @jsii.member(jsii_name="toGetMulticastGroup")
    def to_get_multicast_group(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the MulticastGroup.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetMulticastGroup.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetMulticastGroup", []))

    @jsii.member(jsii_name="toGetMulticastGroupSession")
    def to_get_multicast_group_session(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the MulticastGroup session.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetMulticastGroupSession.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetMulticastGroupSession", []))

    @jsii.member(jsii_name="toGetNetworkAnalyzerConfiguration")
    def to_get_network_analyzer_configuration(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the NetworkAnalyzerConfiguration.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetNetworkAnalyzerConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetNetworkAnalyzerConfiguration", []))

    @jsii.member(jsii_name="toGetPartnerAccount")
    def to_get_partner_account(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the associated PartnerAccount.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetPartnerAccount.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetPartnerAccount", []))

    @jsii.member(jsii_name="toGetPosition")
    def to_get_position(self) -> "Iotwireless":
        '''(experimental) Grants permission to get position for a given resource.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetPosition.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetPosition", []))

    @jsii.member(jsii_name="toGetPositionConfiguration")
    def to_get_position_configuration(self) -> "Iotwireless":
        '''(experimental) Grants permission to get position configuration for a given resource.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetPositionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetPositionConfiguration", []))

    @jsii.member(jsii_name="toGetPositionEstimate")
    def to_get_position_estimate(self) -> "Iotwireless":
        '''(experimental) Grants permission to get position estimate.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetPositionEstimate.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetPositionEstimate", []))

    @jsii.member(jsii_name="toGetResourceEventConfiguration")
    def to_get_resource_event_configuration(self) -> "Iotwireless":
        '''(experimental) Grants permission to get an event configuration for an identifier.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetResourceEventConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetResourceEventConfiguration", []))

    @jsii.member(jsii_name="toGetResourceLogLevel")
    def to_get_resource_log_level(self) -> "Iotwireless":
        '''(experimental) Grants permission to get resource log level.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetResourceLogLevel.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetResourceLogLevel", []))

    @jsii.member(jsii_name="toGetResourcePosition")
    def to_get_resource_position(self) -> "Iotwireless":
        '''(experimental) Grants permission to get position for a given resource.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetResourcePosition.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetResourcePosition", []))

    @jsii.member(jsii_name="toGetServiceEndpoint")
    def to_get_service_endpoint(self) -> "Iotwireless":
        '''(experimental) Grants permission to retrieve the customer account specific endpoint for CUPS protocol connection or LoRaWAN Network Server (LNS) protocol connection, and optionally server trust certificate in PEM format.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetServiceEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetServiceEndpoint", []))

    @jsii.member(jsii_name="toGetServiceProfile")
    def to_get_service_profile(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the ServiceProfile.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetServiceProfile.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetServiceProfile", []))

    @jsii.member(jsii_name="toGetWirelessDevice")
    def to_get_wireless_device(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the WirelessDevice.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetWirelessDevice.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetWirelessDevice", []))

    @jsii.member(jsii_name="toGetWirelessDeviceImportTask")
    def to_get_wireless_device_import_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the wireless device import task.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetWirelessDeviceImportTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetWirelessDeviceImportTask", []))

    @jsii.member(jsii_name="toGetWirelessDeviceStatistics")
    def to_get_wireless_device_statistics(self) -> "Iotwireless":
        '''(experimental) Grants permission to get statistics info for a given WirelessDevice.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetWirelessDeviceStatistics.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetWirelessDeviceStatistics", []))

    @jsii.member(jsii_name="toGetWirelessGateway")
    def to_get_wireless_gateway(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the WirelessGateway.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetWirelessGateway.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetWirelessGateway", []))

    @jsii.member(jsii_name="toGetWirelessGatewayCertificate")
    def to_get_wireless_gateway_certificate(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the IoT Core Identity certificate id associated with the WirelessGateway.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetWirelessGatewayCertificate.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetWirelessGatewayCertificate", []))

    @jsii.member(jsii_name="toGetWirelessGatewayFirmwareInformation")
    def to_get_wireless_gateway_firmware_information(self) -> "Iotwireless":
        '''(experimental) Grants permission to get Current firmware version and other information for the WirelessGateway.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetWirelessGatewayFirmwareInformation.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetWirelessGatewayFirmwareInformation", []))

    @jsii.member(jsii_name="toGetWirelessGatewayStatistics")
    def to_get_wireless_gateway_statistics(self) -> "Iotwireless":
        '''(experimental) Grants permission to get statistics info for a given WirelessGateway.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetWirelessGatewayStatistics.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetWirelessGatewayStatistics", []))

    @jsii.member(jsii_name="toGetWirelessGatewayTask")
    def to_get_wireless_gateway_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the task for a given WirelessGateway.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetWirelessGatewayTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetWirelessGatewayTask", []))

    @jsii.member(jsii_name="toGetWirelessGatewayTaskDefinition")
    def to_get_wireless_gateway_task_definition(self) -> "Iotwireless":
        '''(experimental) Grants permission to get the given WirelessGateway task definition.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_GetWirelessGatewayTaskDefinition.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toGetWirelessGatewayTaskDefinition", []))

    @jsii.member(jsii_name="toListDestinations")
    def to_list_destinations(self) -> "Iotwireless":
        '''(experimental) Grants permission to list information of available Destinations based on the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListDestinations.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListDestinations", []))

    @jsii.member(jsii_name="toListDeviceProfiles")
    def to_list_device_profiles(self) -> "Iotwireless":
        '''(experimental) Grants permission to list information of available DeviceProfiles based on the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListDeviceProfiles.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListDeviceProfiles", []))

    @jsii.member(jsii_name="toListDevicesForWirelessDeviceImportTask")
    def to_list_devices_for_wireless_device_import_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to list information of devices by wireless device import task based on the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListDevicesForWirelessDeviceImportTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListDevicesForWirelessDeviceImportTask", []))

    @jsii.member(jsii_name="toListEventConfigurations")
    def to_list_event_configurations(self) -> "Iotwireless":
        '''(experimental) Grants permission to list information of available event configurations based on the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListEventConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListEventConfigurations", []))

    @jsii.member(jsii_name="toListFuotaTasks")
    def to_list_fuota_tasks(self) -> "Iotwireless":
        '''(experimental) Grants permission to list information of available FuotaTasks based on the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListFuotaTasks.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListFuotaTasks", []))

    @jsii.member(jsii_name="toListMulticastGroups")
    def to_list_multicast_groups(self) -> "Iotwireless":
        '''(experimental) Grants permission to list information of available MulticastGroups based on the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListMulticastGroups.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListMulticastGroups", []))

    @jsii.member(jsii_name="toListMulticastGroupsByFuotaTask")
    def to_list_multicast_groups_by_fuota_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to list information of available MulticastGroups by FuotaTask based on the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListMulticastGroupsByFuotaTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListMulticastGroupsByFuotaTask", []))

    @jsii.member(jsii_name="toListNetworkAnalyzerConfigurations")
    def to_list_network_analyzer_configurations(self) -> "Iotwireless":
        '''(experimental) Grants permission to list information of available NetworkAnalyzerConfigurations based on the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListNetworkAnalyzerConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListNetworkAnalyzerConfigurations", []))

    @jsii.member(jsii_name="toListPartnerAccounts")
    def to_list_partner_accounts(self) -> "Iotwireless":
        '''(experimental) Grants permission to list the available partner accounts.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListPartnerAccounts.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListPartnerAccounts", []))

    @jsii.member(jsii_name="toListPositionConfigurations")
    def to_list_position_configurations(self) -> "Iotwireless":
        '''(experimental) Grants permission to list information of available position configurations based on the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListPositionConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListPositionConfigurations", []))

    @jsii.member(jsii_name="toListQueuedMessages")
    def to_list_queued_messages(self) -> "Iotwireless":
        '''(experimental) Grants permission to list the Queued Messages.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListQueuedMessages.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListQueuedMessages", []))

    @jsii.member(jsii_name="toListServiceProfiles")
    def to_list_service_profiles(self) -> "Iotwireless":
        '''(experimental) Grants permission to list information of available ServiceProfiles based on the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListServiceProfiles.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListServiceProfiles", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Iotwireless":
        '''(experimental) Grants permission to list all tags for a given resource.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListWirelessDeviceImportTasks")
    def to_list_wireless_device_import_tasks(self) -> "Iotwireless":
        '''(experimental) Grants permission to list wireless device import tasks information of based on the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListWirelessDeviceImportTasks.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListWirelessDeviceImportTasks", []))

    @jsii.member(jsii_name="toListWirelessDevices")
    def to_list_wireless_devices(self) -> "Iotwireless":
        '''(experimental) Grants permission to list information of available WirelessDevices based on the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListWirelessDevices.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListWirelessDevices", []))

    @jsii.member(jsii_name="toListWirelessGateways")
    def to_list_wireless_gateways(self) -> "Iotwireless":
        '''(experimental) Grants permission to list information of available WirelessGateways based on the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListWirelessGateways.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListWirelessGateways", []))

    @jsii.member(jsii_name="toListWirelessGatewayTaskDefinitions")
    def to_list_wireless_gateway_task_definitions(self) -> "Iotwireless":
        '''(experimental) Grants permission to list information of available WirelessGateway task definitions based on the AWS account.

        Access Level: Read

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ListWirelessGatewayTaskDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toListWirelessGatewayTaskDefinitions", []))

    @jsii.member(jsii_name="toPutPositionConfiguration")
    def to_put_position_configuration(self) -> "Iotwireless":
        '''(experimental) Grants permission to put position configuration for a given resource.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_PutPositionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toPutPositionConfiguration", []))

    @jsii.member(jsii_name="toPutResourceLogLevel")
    def to_put_resource_log_level(self) -> "Iotwireless":
        '''(experimental) Grants permission to put resource log level.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_PutResourceLogLevel.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toPutResourceLogLevel", []))

    @jsii.member(jsii_name="toResetAllResourceLogLevels")
    def to_reset_all_resource_log_levels(self) -> "Iotwireless":
        '''(experimental) Grants permission to reset all resource log levels.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ResetAllResourceLogLevels.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toResetAllResourceLogLevels", []))

    @jsii.member(jsii_name="toResetResourceLogLevel")
    def to_reset_resource_log_level(self) -> "Iotwireless":
        '''(experimental) Grants permission to reset resource log level.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_ResetResourceLogLevel.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toResetResourceLogLevel", []))

    @jsii.member(jsii_name="toSendDataToMulticastGroup")
    def to_send_data_to_multicast_group(self) -> "Iotwireless":
        '''(experimental) Grants permission to send data to the MulticastGroup.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_SendDataToMulticastGroup.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toSendDataToMulticastGroup", []))

    @jsii.member(jsii_name="toSendDataToWirelessDevice")
    def to_send_data_to_wireless_device(self) -> "Iotwireless":
        '''(experimental) Grants permission to send the decrypted application data frame to the target device.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_SendDataToWirelessDevice.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toSendDataToWirelessDevice", []))

    @jsii.member(jsii_name="toStartBulkAssociateWirelessDeviceWithMulticastGroup")
    def to_start_bulk_associate_wireless_device_with_multicast_group(
        self,
    ) -> "Iotwireless":
        '''(experimental) Grants permission to associate the WirelessDevices with MulticastGroup.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_StartBulkAssociateWirelessDeviceWithMulticastGroup.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toStartBulkAssociateWirelessDeviceWithMulticastGroup", []))

    @jsii.member(jsii_name="toStartBulkDisassociateWirelessDeviceFromMulticastGroup")
    def to_start_bulk_disassociate_wireless_device_from_multicast_group(
        self,
    ) -> "Iotwireless":
        '''(experimental) Grants permission to bulk disassociate the WirelessDevices from MulticastGroup.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_StartBulkDisassociateWirelessDeviceFromMulticastGroup.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toStartBulkDisassociateWirelessDeviceFromMulticastGroup", []))

    @jsii.member(jsii_name="toStartFuotaTask")
    def to_start_fuota_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to start the FuotaTask.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_StartFuotaTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toStartFuotaTask", []))

    @jsii.member(jsii_name="toStartMulticastGroupSession")
    def to_start_multicast_group_session(self) -> "Iotwireless":
        '''(experimental) Grants permission to start the MulticastGroup session.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_StartMulticastGroupSession.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toStartMulticastGroupSession", []))

    @jsii.member(jsii_name="toStartNetworkAnalyzerStream")
    def to_start_network_analyzer_stream(self) -> "Iotwireless":
        '''(experimental) Grants permission to start NetworkAnalyzer stream.

        Access Level: Write

        https://docs.aws.amazon.com/iot/latest/developerguide/connect-iot-lorawan-network-analyzer-api.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toStartNetworkAnalyzerStream", []))

    @jsii.member(jsii_name="toStartSingleWirelessDeviceImportTask")
    def to_start_single_wireless_device_import_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to start the single wireless device import task.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_StartSingleWirelessDeviceImportTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toStartSingleWirelessDeviceImportTask", []))

    @jsii.member(jsii_name="toStartWirelessDeviceImportTask")
    def to_start_wireless_device_import_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to start the wireless device import task.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_StartWirelessDeviceImportTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toStartWirelessDeviceImportTask", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Iotwireless":
        '''(experimental) Grants permission to tag a given resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestWirelessDevice")
    def to_test_wireless_device(self) -> "Iotwireless":
        '''(experimental) Grants permission to simulate a provisioned device to send an uplink data with payload of 'Hello'.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_TestWirelessDevice.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toTestWirelessDevice", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Iotwireless":
        '''(experimental) Grants permission to remove the given tags from the resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDestination")
    def to_update_destination(self) -> "Iotwireless":
        '''(experimental) Grants permission to update a Destination resource.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_UpdateDestination.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toUpdateDestination", []))

    @jsii.member(jsii_name="toUpdateEventConfigurationByResourceTypes")
    def to_update_event_configuration_by_resource_types(self) -> "Iotwireless":
        '''(experimental) Grants permission to update event configuration by resource types.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_UpdateEventConfigurationByResourceTypes.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toUpdateEventConfigurationByResourceTypes", []))

    @jsii.member(jsii_name="toUpdateFuotaTask")
    def to_update_fuota_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to update the FuotaTask.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_UpdateFuotaTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toUpdateFuotaTask", []))

    @jsii.member(jsii_name="toUpdateLogLevelsByResourceTypes")
    def to_update_log_levels_by_resource_types(self) -> "Iotwireless":
        '''(experimental) Grants permission to update log levels by resource types.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_UpdateLogLevelsByResourceTypes.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toUpdateLogLevelsByResourceTypes", []))

    @jsii.member(jsii_name="toUpdateMulticastGroup")
    def to_update_multicast_group(self) -> "Iotwireless":
        '''(experimental) Grants permission to update the MulticastGroup.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_UpdateMulticastGroup.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toUpdateMulticastGroup", []))

    @jsii.member(jsii_name="toUpdateNetworkAnalyzerConfiguration")
    def to_update_network_analyzer_configuration(self) -> "Iotwireless":
        '''(experimental) Grants permission to update the NetworkAnalyzerConfiguration.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_UpdateNetworkAnalyzerConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toUpdateNetworkAnalyzerConfiguration", []))

    @jsii.member(jsii_name="toUpdatePartnerAccount")
    def to_update_partner_account(self) -> "Iotwireless":
        '''(experimental) Grants permission to update a partner account.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_UpdatePartnerAccount.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toUpdatePartnerAccount", []))

    @jsii.member(jsii_name="toUpdatePosition")
    def to_update_position(self) -> "Iotwireless":
        '''(experimental) Grants permission to update position for a given resource.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_UpdatePosition.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toUpdatePosition", []))

    @jsii.member(jsii_name="toUpdateResourceEventConfiguration")
    def to_update_resource_event_configuration(self) -> "Iotwireless":
        '''(experimental) Grants permission to update an event configuration for an identifier.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_UpdateResourceEventConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toUpdateResourceEventConfiguration", []))

    @jsii.member(jsii_name="toUpdateResourcePosition")
    def to_update_resource_position(self) -> "Iotwireless":
        '''(experimental) Grants permission to update position for a given resource.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_UpdateResourcePosition.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toUpdateResourcePosition", []))

    @jsii.member(jsii_name="toUpdateWirelessDevice")
    def to_update_wireless_device(self) -> "Iotwireless":
        '''(experimental) Grants permission to update a WirelessDevice resource.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_UpdateWirelessDevice.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toUpdateWirelessDevice", []))

    @jsii.member(jsii_name="toUpdateWirelessDeviceImportTask")
    def to_update_wireless_device_import_task(self) -> "Iotwireless":
        '''(experimental) Grants permission to update a wireless device import task.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_UpdateWirelessDeviceImportTask.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toUpdateWirelessDeviceImportTask", []))

    @jsii.member(jsii_name="toUpdateWirelessGateway")
    def to_update_wireless_gateway(self) -> "Iotwireless":
        '''(experimental) Grants permission to update a WirelessGateway resource.

        Access Level: Write

        https://docs.aws.amazon.com/iot-wireless/2020-11-22/apireference/API_UpdateWirelessGateway.html

        :stability: experimental
        '''
        return typing.cast("Iotwireless", jsii.invoke(self, "toUpdateWirelessGateway", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7b6897fb6f4d019270a9bce510edb03e1bfeafb16add72ff1176478de8938736)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9b8381f3552c41dbc76819583bd663e3e23cc736350b15bb9bda5894fe76ab5e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Iq(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Iq"):
    '''(experimental) Statement provider for service `iq <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiq.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iq <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiq.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ffb7df82dfa02ed9a7706298388dc9d3bb07a71e83b2a7dcecfacc10681bb9be)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAttachment")
    def on_attachment(
        self,
        attachment_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iq":
        '''(experimental) Adds a resource of type attachment to the statement.

        https://aws.amazon.com/iq/

        :param attachment_id: - Identifier for the attachmentId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9bade36b7d2a41c054c853634c53440483a036b56af5f5508708f00bdbb262e4)
            check_type(argname="argument attachment_id", value=attachment_id, expected_type=type_hints["attachment_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iq", jsii.invoke(self, "onAttachment", [attachment_id, region, partition]))

    @jsii.member(jsii_name="onBuyer")
    def on_buyer(
        self,
        buyer_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iq":
        '''(experimental) Adds a resource of type buyer to the statement.

        https://aws.amazon.com/iq/

        :param buyer_id: - Identifier for the buyerId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4f5ebf86de912c9705247bd16acba7cedfc943b8a08975ecc1e59385e3b5d437)
            check_type(argname="argument buyer_id", value=buyer_id, expected_type=type_hints["buyer_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iq", jsii.invoke(self, "onBuyer", [buyer_id, region, partition]))

    @jsii.member(jsii_name="onCall")
    def on_call(
        self,
        call_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iq":
        '''(experimental) Adds a resource of type call to the statement.

        https://aws.amazon.com/iq/

        :param call_id: - Identifier for the callId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__de3d85865d677a03c92bcdb48deabd6ea07d918eddae32ee056ad60407c05029)
            check_type(argname="argument call_id", value=call_id, expected_type=type_hints["call_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iq", jsii.invoke(self, "onCall", [call_id, region, partition]))

    @jsii.member(jsii_name="onCompany")
    def on_company(
        self,
        company_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iq":
        '''(experimental) Adds a resource of type company to the statement.

        https://aws.amazon.com/iq/

        :param company_id: - Identifier for the companyId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cfe87d523761f06ab9afb8a3f352417de3e18c50bfc84e78b9f00ec7d28390d0)
            check_type(argname="argument company_id", value=company_id, expected_type=type_hints["company_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iq", jsii.invoke(self, "onCompany", [company_id, region, partition]))

    @jsii.member(jsii_name="onConversation")
    def on_conversation(
        self,
        conversation_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iq":
        '''(experimental) Adds a resource of type conversation to the statement.

        https://aws.amazon.com/iq/

        :param conversation_id: - Identifier for the conversationId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d9561b276cade054cf8262d672e010dedac1ade8138752df69edf208e9a0a362)
            check_type(argname="argument conversation_id", value=conversation_id, expected_type=type_hints["conversation_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iq", jsii.invoke(self, "onConversation", [conversation_id, region, partition]))

    @jsii.member(jsii_name="onExpert")
    def on_expert(
        self,
        expert_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iq":
        '''(experimental) Adds a resource of type expert to the statement.

        https://aws.amazon.com/iq/

        :param expert_id: - Identifier for the expertId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3833dda714ff87359f6ba861557317ea4438681c4d11c3734bd586cb5ceea0f3)
            check_type(argname="argument expert_id", value=expert_id, expected_type=type_hints["expert_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iq", jsii.invoke(self, "onExpert", [expert_id, region, partition]))

    @jsii.member(jsii_name="onListing")
    def on_listing(
        self,
        listing_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iq":
        '''(experimental) Adds a resource of type listing to the statement.

        https://aws.amazon.com/iq/

        :param listing_id: - Identifier for the listingId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__160412a42ae6812db3cbdd5eff99e4ae5108a69db35e6bc80b148b35dcb54b62)
            check_type(argname="argument listing_id", value=listing_id, expected_type=type_hints["listing_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iq", jsii.invoke(self, "onListing", [listing_id, region, partition]))

    @jsii.member(jsii_name="onPaymentRequest")
    def on_payment_request(
        self,
        conversation_id: builtins.str,
        proposal_id: builtins.str,
        payment_request_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iq":
        '''(experimental) Adds a resource of type paymentRequest to the statement.

        https://aws.amazon.com/iq/

        :param conversation_id: - Identifier for the conversationId.
        :param proposal_id: - Identifier for the proposalId.
        :param payment_request_id: - Identifier for the paymentRequestId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__638c6313b99fc7a0ca8eecc5608a39732442d59ffc226ea72cd0597699b19037)
            check_type(argname="argument conversation_id", value=conversation_id, expected_type=type_hints["conversation_id"])
            check_type(argname="argument proposal_id", value=proposal_id, expected_type=type_hints["proposal_id"])
            check_type(argname="argument payment_request_id", value=payment_request_id, expected_type=type_hints["payment_request_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iq", jsii.invoke(self, "onPaymentRequest", [conversation_id, proposal_id, payment_request_id, region, partition]))

    @jsii.member(jsii_name="onPaymentSchedule")
    def on_payment_schedule(
        self,
        conversation_id: builtins.str,
        proposal_id: builtins.str,
        version_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iq":
        '''(experimental) Adds a resource of type paymentSchedule to the statement.

        https://aws.amazon.com/iq/

        :param conversation_id: - Identifier for the conversationId.
        :param proposal_id: - Identifier for the proposalId.
        :param version_id: - Identifier for the versionId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__026f3af517f347cdb2e7220f514b7055508236d125bb3c13f405f4f0ebfeb987)
            check_type(argname="argument conversation_id", value=conversation_id, expected_type=type_hints["conversation_id"])
            check_type(argname="argument proposal_id", value=proposal_id, expected_type=type_hints["proposal_id"])
            check_type(argname="argument version_id", value=version_id, expected_type=type_hints["version_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iq", jsii.invoke(self, "onPaymentSchedule", [conversation_id, proposal_id, version_id, region, partition]))

    @jsii.member(jsii_name="onProposal")
    def on_proposal(
        self,
        conversation_id: builtins.str,
        proposal_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iq":
        '''(experimental) Adds a resource of type proposal to the statement.

        https://aws.amazon.com/iq/

        :param conversation_id: - Identifier for the conversationId.
        :param proposal_id: - Identifier for the proposalId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__926fb786986fb1439b150e99b8581f921eee9dbffd928f3f09497c8e6451c61a)
            check_type(argname="argument conversation_id", value=conversation_id, expected_type=type_hints["conversation_id"])
            check_type(argname="argument proposal_id", value=proposal_id, expected_type=type_hints["proposal_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iq", jsii.invoke(self, "onProposal", [conversation_id, proposal_id, region, partition]))

    @jsii.member(jsii_name="onRequest")
    def on_request(
        self,
        request_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iq":
        '''(experimental) Adds a resource of type request to the statement.

        https://aws.amazon.com/iq/

        :param request_id: - Identifier for the requestId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__68dc2feedc238958c884fb48ea7f47b073982e387071ae66bc5770cd835d7328)
            check_type(argname="argument request_id", value=request_id, expected_type=type_hints["request_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iq", jsii.invoke(self, "onRequest", [request_id, region, partition]))

    @jsii.member(jsii_name="onSeller")
    def on_seller(
        self,
        seller_aws_account_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iq":
        '''(experimental) Adds a resource of type seller to the statement.

        https://aws.amazon.com/iq/

        :param seller_aws_account_id: - Identifier for the sellerAwsAccountId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3b26e109108e40147760bc8ed381ace0b2de99f6905958768b34bf586faeda31)
            check_type(argname="argument seller_aws_account_id", value=seller_aws_account_id, expected_type=type_hints["seller_aws_account_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iq", jsii.invoke(self, "onSeller", [seller_aws_account_id, region, partition]))

    @jsii.member(jsii_name="onToken")
    def on_token(
        self,
        token_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Iq":
        '''(experimental) Adds a resource of type token to the statement.

        https://aws.amazon.com/iq/

        :param token_id: - Identifier for the tokenId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e8fa29f04afbcc6486ace9795205d6c260d3712880a0c5145e5c05d0199907e1)
            check_type(argname="argument token_id", value=token_id, expected_type=type_hints["token_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Iq", jsii.invoke(self, "onToken", [token_id, region, partition]))

    @jsii.member(jsii_name="toAcceptCall")
    def to_accept_call(self) -> "Iq":
        '''(experimental) Grants permission to accept an incoming voice/video call.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toAcceptCall", []))

    @jsii.member(jsii_name="toApprovePaymentRequest")
    def to_approve_payment_request(self) -> "Iq":
        '''(experimental) Grants permission to approve a payment request.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toApprovePaymentRequest", []))

    @jsii.member(jsii_name="toApproveProposal")
    def to_approve_proposal(self) -> "Iq":
        '''(experimental) Grants permission to approve a proposal.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toApproveProposal", []))

    @jsii.member(jsii_name="toArchiveConversation")
    def to_archive_conversation(self) -> "Iq":
        '''(experimental) Grants permission to archive a conversation.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toArchiveConversation", []))

    @jsii.member(jsii_name="toCompleteProposal")
    def to_complete_proposal(self) -> "Iq":
        '''(experimental) Grants permission to complete a proposal.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toCompleteProposal", []))

    @jsii.member(jsii_name="toCreateConversation")
    def to_create_conversation(self) -> "Iq":
        '''(experimental) Grants permission to respond to a request or send a direct message to initiate a conversation.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toCreateConversation", []))

    @jsii.member(jsii_name="toCreateExpert")
    def to_create_expert(self) -> "Iq":
        '''(experimental) Grants permission to create an expert profile.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toCreateExpert", []))

    @jsii.member(jsii_name="toCreateListing")
    def to_create_listing(self) -> "Iq":
        '''(experimental) Grants permission to create a listing.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toCreateListing", []))

    @jsii.member(jsii_name="toCreateMilestoneProposal")
    def to_create_milestone_proposal(self) -> "Iq":
        '''(experimental) Grants permission to create a milestone proposal.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toCreateMilestoneProposal", []))

    @jsii.member(jsii_name="toCreatePaymentRequest")
    def to_create_payment_request(self) -> "Iq":
        '''(experimental) Grants permission to create a payment request.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toCreatePaymentRequest", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Iq":
        '''(experimental) Grants permission to submit new requests.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toCreateRequest")
    def to_create_request(self) -> "Iq":
        '''(experimental) Grants permission to submit new requests.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toCreateRequest", []))

    @jsii.member(jsii_name="toCreateScheduledProposal")
    def to_create_scheduled_proposal(self) -> "Iq":
        '''(experimental) Grants permission to create a scheduled proposal.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toCreateScheduledProposal", []))

    @jsii.member(jsii_name="toCreateSeller")
    def to_create_seller(self) -> "Iq":
        '''(experimental) Grants permission to create a seller profile.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toCreateSeller", []))

    @jsii.member(jsii_name="toCreateUpfrontProposal")
    def to_create_upfront_proposal(self) -> "Iq":
        '''(experimental) Grants permission to create an upfront proposal.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toCreateUpfrontProposal", []))

    @jsii.member(jsii_name="toDeclineCall")
    def to_decline_call(self) -> "Iq":
        '''(experimental) Grants permission to decline an incoming voice/video call.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toDeclineCall", []))

    @jsii.member(jsii_name="toDeleteAttachment")
    def to_delete_attachment(self) -> "Iq":
        '''(experimental) Grants permission to delete an existing attachment.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toDeleteAttachment", []))

    @jsii.member(jsii_name="toEndCall")
    def to_end_call(self) -> "Iq":
        '''(experimental) Grants permission to end a voice/video call.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toEndCall", []))

    @jsii.member(jsii_name="toGetBuyer")
    def to_get_buyer(self) -> "Iq":
        '''(experimental) Grants permission to read buyer information.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toGetBuyer", []))

    @jsii.member(jsii_name="toGetCall")
    def to_get_call(self) -> "Iq":
        '''(experimental) Grants permission to read details of a voice/video call.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toGetCall", []))

    @jsii.member(jsii_name="toGetChatInfo")
    def to_get_chat_info(self) -> "Iq":
        '''(experimental) Grants permission to read the chat environment details about a conversation.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toGetChatInfo", []))

    @jsii.member(jsii_name="toGetChatMessages")
    def to_get_chat_messages(self) -> "Iq":
        '''(experimental) Grants permission to read chat messages in a conversation.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toGetChatMessages", []))

    @jsii.member(jsii_name="toGetChatToken")
    def to_get_chat_token(self) -> "Iq":
        '''(experimental) Grants permission to request a websocket token for the conversation notifications.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toGetChatToken", []))

    @jsii.member(jsii_name="toGetCompanyProfile")
    def to_get_company_profile(self) -> "Iq":
        '''(experimental) Grants permission to read a company profile.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toGetCompanyProfile", []))

    @jsii.member(jsii_name="toGetConversation")
    def to_get_conversation(self) -> "Iq":
        '''(experimental) Grants permission to read details of a conversation.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toGetConversation", []))

    @jsii.member(jsii_name="toGetExpert")
    def to_get_expert(self) -> "Iq":
        '''(experimental) Grants permission to read expert information.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toGetExpert", []))

    @jsii.member(jsii_name="toGetListing")
    def to_get_listing(self) -> "Iq":
        '''(experimental) Grants permission to read a listing.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toGetListing", []))

    @jsii.member(jsii_name="toGetMarketplaceSeller")
    def to_get_marketplace_seller(self) -> "Iq":
        '''(experimental) Grants permission to read a seller profile information.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toGetMarketplaceSeller", []))

    @jsii.member(jsii_name="toGetPaymentRequest")
    def to_get_payment_request(self) -> "Iq":
        '''(experimental) Grants permission to read a payment request.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toGetPaymentRequest", []))

    @jsii.member(jsii_name="toGetProposal")
    def to_get_proposal(self) -> "Iq":
        '''(experimental) Grants permission to read a proposal.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toGetProposal", []))

    @jsii.member(jsii_name="toGetReview")
    def to_get_review(self) -> "Iq":
        '''(experimental) Grants permission to read a review for an expert.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toGetReview", []))

    @jsii.member(jsii_name="toHideRequest")
    def to_hide_request(self) -> "Iq":
        '''(experimental) Grants permission to hide a request.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toHideRequest", []))

    @jsii.member(jsii_name="toInitiateCall")
    def to_initiate_call(self) -> "Iq":
        '''(experimental) Grants permission to start a voice/video call.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toInitiateCall", []))

    @jsii.member(jsii_name="toListConversations")
    def to_list_conversations(self) -> "Iq":
        '''(experimental) Grants permission to list existing conversations.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toListConversations", []))

    @jsii.member(jsii_name="toListListings")
    def to_list_listings(self) -> "Iq":
        '''(experimental) Grants permission to list listings.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toListListings", []))

    @jsii.member(jsii_name="toListPaymentRequests")
    def to_list_payment_requests(self) -> "Iq":
        '''(experimental) Grants permission to list payment requests.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toListPaymentRequests", []))

    @jsii.member(jsii_name="toListProposals")
    def to_list_proposals(self) -> "Iq":
        '''(experimental) Grants permission to list proposals.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toListProposals", []))

    @jsii.member(jsii_name="toListRequests")
    def to_list_requests(self) -> "Iq":
        '''(experimental) Grants permission to list requests that are created.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toListRequests", []))

    @jsii.member(jsii_name="toListReviews")
    def to_list_reviews(self) -> "Iq":
        '''(experimental) Grants permission to list reviews for an expert.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toListReviews", []))

    @jsii.member(jsii_name="toMarkChatMessageRead")
    def to_mark_chat_message_read(self) -> "Iq":
        '''(experimental) Grants permission to mark a message as read in a conversation.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toMarkChatMessageRead", []))

    @jsii.member(jsii_name="toRejectPaymentRequest")
    def to_reject_payment_request(self) -> "Iq":
        '''(experimental) Grants permission to reject a payment request.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toRejectPaymentRequest", []))

    @jsii.member(jsii_name="toRejectProposal")
    def to_reject_proposal(self) -> "Iq":
        '''(experimental) Grants permission to reject a proposal.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toRejectProposal", []))

    @jsii.member(jsii_name="toSendCompanyChatMessage")
    def to_send_company_chat_message(self) -> "Iq":
        '''(experimental) Grants permission to send a message in a conversation as a company.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toSendCompanyChatMessage", []))

    @jsii.member(jsii_name="toSendIndividualChatMessage")
    def to_send_individual_chat_message(self) -> "Iq":
        '''(experimental) Grants permission to send a message in a conversation as an individual.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toSendIndividualChatMessage", []))

    @jsii.member(jsii_name="toUnarchiveConversation")
    def to_unarchive_conversation(self) -> "Iq":
        '''(experimental) Grants permission to unarchive a conversation.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toUnarchiveConversation", []))

    @jsii.member(jsii_name="toUpdateCompanyProfile")
    def to_update_company_profile(self) -> "Iq":
        '''(experimental) Grants permission to update a company profile.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toUpdateCompanyProfile", []))

    @jsii.member(jsii_name="toUpdateConversationMembers")
    def to_update_conversation_members(self) -> "Iq":
        '''(experimental) Grants permission to add more participants into a conversation.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toUpdateConversationMembers", []))

    @jsii.member(jsii_name="toUpdateExpert")
    def to_update_expert(self) -> "Iq":
        '''(experimental) Grants permission to update an expert information.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toUpdateExpert", []))

    @jsii.member(jsii_name="toUpdateListing")
    def to_update_listing(self) -> "Iq":
        '''(experimental) Grants permission to update a listing.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toUpdateListing", []))

    @jsii.member(jsii_name="toUpdateRequest")
    def to_update_request(self) -> "Iq":
        '''(experimental) Grants permission to update a request.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toUpdateRequest", []))

    @jsii.member(jsii_name="toUploadAttachment")
    def to_upload_attachment(self) -> "Iq":
        '''(experimental) Grants permission to upload an attachment.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toUploadAttachment", []))

    @jsii.member(jsii_name="toWithdrawPaymentRequest")
    def to_withdraw_payment_request(self) -> "Iq":
        '''(experimental) Grants permission to withdraw a payment request.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toWithdrawPaymentRequest", []))

    @jsii.member(jsii_name="toWithdrawProposal")
    def to_withdraw_proposal(self) -> "Iq":
        '''(experimental) Grants permission to withdraw a proposal.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toWithdrawProposal", []))

    @jsii.member(jsii_name="toWriteReview")
    def to_write_review(self) -> "Iq":
        '''(experimental) Grants permission to write a review for an expert.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("Iq", jsii.invoke(self, "toWriteReview", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f20df699191055517186ca7c51da5434500665a3e6a4b30006eb7fb075a6e467)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__157dca5e6404bd10950b9f9e14c7b5f6ff7a63ccd34494d565fcfce56de3756f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class IqPermission(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.IqPermission",
):
    '''(experimental) Statement provider for service `iq-permission <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiqpermissions.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `iq-permission <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiqpermissions.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a962936f9a7fbaef60bb67fe60b605e78a955c211eb1c599032ca6793f5e82fd)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onPermission")
    def on_permission(
        self,
        permission_request_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "IqPermission":
        '''(experimental) Adds a resource of type permission to the statement.

        https://aws.amazon.com/iq/

        :param permission_request_id: - Identifier for the permissionRequestId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d1c2f5b5fa32b9c028b76532ab9967989457d9c26e87177e576aab2e273a5eb8)
            check_type(argname="argument permission_request_id", value=permission_request_id, expected_type=type_hints["permission_request_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("IqPermission", jsii.invoke(self, "onPermission", [permission_request_id, region, partition]))

    @jsii.member(jsii_name="toApproveAccessGrant")
    def to_approve_access_grant(self) -> "IqPermission":
        '''(experimental) Grants permission to approve a permission request.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("IqPermission", jsii.invoke(self, "toApproveAccessGrant", []))

    @jsii.member(jsii_name="toApprovePermissionRequest")
    def to_approve_permission_request(self) -> "IqPermission":
        '''(experimental) Grants permission to approve a permission request.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("IqPermission", jsii.invoke(self, "toApprovePermissionRequest", []))

    @jsii.member(jsii_name="toCreatePermissionRequest")
    def to_create_permission_request(self) -> "IqPermission":
        '''(experimental) Grants permission to create a permission request.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("IqPermission", jsii.invoke(self, "toCreatePermissionRequest", []))

    @jsii.member(jsii_name="toGetPermissionRequest")
    def to_get_permission_request(self) -> "IqPermission":
        '''(experimental) Grants permission to get a permission request.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("IqPermission", jsii.invoke(self, "toGetPermissionRequest", []))

    @jsii.member(jsii_name="toListPermissionRequests")
    def to_list_permission_requests(self) -> "IqPermission":
        '''(experimental) Grants permission to list permission requests.

        Access Level: Read

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("IqPermission", jsii.invoke(self, "toListPermissionRequests", []))

    @jsii.member(jsii_name="toRejectPermissionRequest")
    def to_reject_permission_request(self) -> "IqPermission":
        '''(experimental) Grants permission to reject a permission request.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("IqPermission", jsii.invoke(self, "toRejectPermissionRequest", []))

    @jsii.member(jsii_name="toRevokePermissionRequest")
    def to_revoke_permission_request(self) -> "IqPermission":
        '''(experimental) Grants permission to revoke a permission request which was previously approved.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("IqPermission", jsii.invoke(self, "toRevokePermissionRequest", []))

    @jsii.member(jsii_name="toWithdrawPermissionRequest")
    def to_withdraw_permission_request(self) -> "IqPermission":
        '''(experimental) Grants permission to withdraw a permission request that has not been approved or declined.

        Access Level: Write

        https://aws.amazon.com/iq/

        :stability: experimental
        '''
        return typing.cast("IqPermission", jsii.invoke(self, "toWithdrawPermissionRequest", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0b4bff070707ca4a3334f02f2a1b23809b45d7edc36b4d195f11e6fa2b64dffd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8f88ef694448d7768c7dd940afa6d2bb26440f4752038e30eb1e8005ff2797db)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Ivs(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ivs"):
    '''(experimental) Statement provider for service `ivs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoninteractivevideoservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ivs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoninteractivevideoservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__88b95d54890a3a231f46fb969988c7b90ef38b181cb1af5922fd35915c75cd2e)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onChannel")
    def on_channel(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ivs":
        '''(experimental) Adds a resource of type Channel to the statement.

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_Channel.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f6a9b684c69afea8b1c710a3ea3cae9fc5fb165298f74abc932de4a7f465f585)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ivs", jsii.invoke(self, "onChannel", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onPlaybackKeyPair")
    def on_playback_key_pair(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ivs":
        '''(experimental) Adds a resource of type Playback-Key-Pair to the statement.

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_PlaybackKeyPair.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7746971ea2c468002103369817ad75cc52e4a0c926dc19172bccdc2389734b9e)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ivs", jsii.invoke(self, "onPlaybackKeyPair", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onRecordingConfiguration")
    def on_recording_configuration(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ivs":
        '''(experimental) Adds a resource of type Recording-Configuration to the statement.

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_RecordingConfiguration.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dc431d6882ee488187d83e8a02a31a73898bd608013e11a6661adbe794c5e6f8)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ivs", jsii.invoke(self, "onRecordingConfiguration", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onStage")
    def on_stage(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ivs":
        '''(experimental) Adds a resource of type Stage to the statement.

        https://docs.aws.amazon.com/ivs/latest/RealTimeAPIReference/API_Stage.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ea77f410a012cbb44c65d239be8bb8eade9fc59eff4bae3c1b94c9e6004a2fc5)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ivs", jsii.invoke(self, "onStage", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onStreamKey")
    def on_stream_key(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ivs":
        '''(experimental) Adds a resource of type Stream-Key to the statement.

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_StreamKey.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f52bd275ac090e8137b189d49f3d3e7f409cb0791fa62c1c4c672c81e2281415)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ivs", jsii.invoke(self, "onStreamKey", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toBatchGetChannel")
    def to_batch_get_channel(self) -> "Ivs":
        '''(experimental) Grants permission to get multiple channels simultaneously by channel ARN.

        Access Level: Read

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_BatchGetChannel.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toBatchGetChannel", []))

    @jsii.member(jsii_name="toBatchGetStreamKey")
    def to_batch_get_stream_key(self) -> "Ivs":
        '''(experimental) Grants permission to get multiple stream keys simultaneously by stream key ARN.

        Access Level: Read

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_BatchGetStreamKey.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toBatchGetStreamKey", []))

    @jsii.member(jsii_name="toCreateChannel")
    def to_create_channel(self) -> "Ivs":
        '''(experimental) Grants permission to create a new channel and an associated stream key.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_CreateChannel.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toCreateChannel", []))

    @jsii.member(jsii_name="toCreateParticipantToken")
    def to_create_participant_token(self) -> "Ivs":
        '''(experimental) Grants permission to create a participant token.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ivs/latest/RealTimeAPIReference/API_CreateParticipantToken.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toCreateParticipantToken", []))

    @jsii.member(jsii_name="toCreateRecordingConfiguration")
    def to_create_recording_configuration(self) -> "Ivs":
        '''(experimental) Grants permission to create a a new recording configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_CreateRecordingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toCreateRecordingConfiguration", []))

    @jsii.member(jsii_name="toCreateStage")
    def to_create_stage(self) -> "Ivs":
        '''(experimental) Grants permission to create a stage.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ivs/latest/RealTimeAPIReference/API_CreateStage.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toCreateStage", []))

    @jsii.member(jsii_name="toCreateStreamKey")
    def to_create_stream_key(self) -> "Ivs":
        '''(experimental) Grants permission to create a stream key.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_CreateStreamKey.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toCreateStreamKey", []))

    @jsii.member(jsii_name="toDeleteChannel")
    def to_delete_channel(self) -> "Ivs":
        '''(experimental) Grants permission to delete a channel and channel's stream keys.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_DeleteChannel.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toDeleteChannel", []))

    @jsii.member(jsii_name="toDeletePlaybackKeyPair")
    def to_delete_playback_key_pair(self) -> "Ivs":
        '''(experimental) Grants permission to delete the playback key pair for a specified ARN.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_DeletePlaybackKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toDeletePlaybackKeyPair", []))

    @jsii.member(jsii_name="toDeleteRecordingConfiguration")
    def to_delete_recording_configuration(self) -> "Ivs":
        '''(experimental) Grants permission to delete a recording configuration for the specified ARN.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_DeleteRecordingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toDeleteRecordingConfiguration", []))

    @jsii.member(jsii_name="toDeleteStage")
    def to_delete_stage(self) -> "Ivs":
        '''(experimental) Grants permission to delete the stage for a specified ARN.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/RealTimeAPIReference/API_DeleteStage.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toDeleteStage", []))

    @jsii.member(jsii_name="toDeleteStreamKey")
    def to_delete_stream_key(self) -> "Ivs":
        '''(experimental) Grants permission to delete the stream key for a specified ARN.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_DeleteStreamKey.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toDeleteStreamKey", []))

    @jsii.member(jsii_name="toDisconnectParticipant")
    def to_disconnect_participant(self) -> "Ivs":
        '''(experimental) Grants permission to disconnect a participant from for the specified stage ARN.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/RealTimeAPIReference/API_DisconnectParticipant.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toDisconnectParticipant", []))

    @jsii.member(jsii_name="toGetChannel")
    def to_get_channel(self) -> "Ivs":
        '''(experimental) Grants permission to get the channel configuration for a specified channel ARN.

        Access Level: Read

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_GetChannel.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toGetChannel", []))

    @jsii.member(jsii_name="toGetPlaybackKeyPair")
    def to_get_playback_key_pair(self) -> "Ivs":
        '''(experimental) Grants permission to get the playback keypair information for a specified ARN.

        Access Level: Read

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_GetPlaybackKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toGetPlaybackKeyPair", []))

    @jsii.member(jsii_name="toGetRecordingConfiguration")
    def to_get_recording_configuration(self) -> "Ivs":
        '''(experimental) Grants permission to get the recording configuration for the specified ARN.

        Access Level: Read

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_GetRecordingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toGetRecordingConfiguration", []))

    @jsii.member(jsii_name="toGetStage")
    def to_get_stage(self) -> "Ivs":
        '''(experimental) Grants permission to get stage information for a specified ARN.

        Access Level: Read

        https://docs.aws.amazon.com/ivs/latest/RealTimeAPIReference/API_GetStage.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toGetStage", []))

    @jsii.member(jsii_name="toGetStream")
    def to_get_stream(self) -> "Ivs":
        '''(experimental) Grants permission to get information about the active (live) stream on a specified channel.

        Access Level: Read

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_GetStream.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toGetStream", []))

    @jsii.member(jsii_name="toGetStreamKey")
    def to_get_stream_key(self) -> "Ivs":
        '''(experimental) Grants permission to get stream-key information for a specified ARN.

        Access Level: Read

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_GetStreamKey.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toGetStreamKey", []))

    @jsii.member(jsii_name="toGetStreamSession")
    def to_get_stream_session(self) -> "Ivs":
        '''(experimental) Grants permission to get information about the stream session on a specified channel.

        Access Level: Read

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_GetStreamSession.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toGetStreamSession", []))

    @jsii.member(jsii_name="toImportPlaybackKeyPair")
    def to_import_playback_key_pair(self) -> "Ivs":
        '''(experimental) Grants permission to import the public key.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_ImportPlaybackKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toImportPlaybackKeyPair", []))

    @jsii.member(jsii_name="toListChannels")
    def to_list_channels(self) -> "Ivs":
        '''(experimental) Grants permission to get summary information about channels.

        Access Level: List

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_ListChannels.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toListChannels", []))

    @jsii.member(jsii_name="toListPlaybackKeyPairs")
    def to_list_playback_key_pairs(self) -> "Ivs":
        '''(experimental) Grants permission to get summary information about playback key pairs.

        Access Level: List

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_ListPlaybackKeyPairs.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toListPlaybackKeyPairs", []))

    @jsii.member(jsii_name="toListRecordingConfigurations")
    def to_list_recording_configurations(self) -> "Ivs":
        '''(experimental) Grants permission to get summary information about recording configurations.

        Access Level: List

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_ListRecordingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toListRecordingConfigurations", []))

    @jsii.member(jsii_name="toListStages")
    def to_list_stages(self) -> "Ivs":
        '''(experimental) Grants permission to get summary information about stages.

        Access Level: List

        https://docs.aws.amazon.com/ivs/latest/RealTimeAPIReference/API_ListStages.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toListStages", []))

    @jsii.member(jsii_name="toListStreamKeys")
    def to_list_stream_keys(self) -> "Ivs":
        '''(experimental) Grants permission to get summary information about stream keys.

        Access Level: List

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_ListStreamKeys.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toListStreamKeys", []))

    @jsii.member(jsii_name="toListStreams")
    def to_list_streams(self) -> "Ivs":
        '''(experimental) Grants permission to get summary information about live streams.

        Access Level: List

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_ListStreams.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toListStreams", []))

    @jsii.member(jsii_name="toListStreamSessions")
    def to_list_stream_sessions(self) -> "Ivs":
        '''(experimental) Grants permission to get summary information about streams sessions on a specified channel.

        Access Level: List

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_ListStreamSessions.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toListStreamSessions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Ivs":
        '''(experimental) Grants permission to get information about the tags for a specified ARN.

        Access Level: Read

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutMetadata")
    def to_put_metadata(self) -> "Ivs":
        '''(experimental) Grants permission to insert metadata into an RTMP stream for a specified channel.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_PutMetadata.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toPutMetadata", []))

    @jsii.member(jsii_name="toStopStream")
    def to_stop_stream(self) -> "Ivs":
        '''(experimental) Grants permission to disconnect a streamer on a specified channel.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_StopStream.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toStopStream", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Ivs":
        '''(experimental) Grants permission to add or update tags for a resource with a specified ARN.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Ivs":
        '''(experimental) Grants permission to remove tags for a resource with a specified ARN.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateChannel")
    def to_update_channel(self) -> "Ivs":
        '''(experimental) Grants permission to update a channel's configuration.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/APIReference/API_UpdateChannel.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toUpdateChannel", []))

    @jsii.member(jsii_name="toUpdateStage")
    def to_update_stage(self) -> "Ivs":
        '''(experimental) Grants permission to update a stage's configuration.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/RealTimeAPIReference/API_UpdateStage.html

        :stability: experimental
        '''
        return typing.cast("Ivs", jsii.invoke(self, "toUpdateStage", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__52799dffe0ddf59f2c4102d792eddb90f966ecd1b429bbefb159768bc96c5c47)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__19199d235ab9976a510749908c51653ac3a7b12de1be2d096a256b9c42487073)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Ivschat(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Ivschat"):
    '''(experimental) Statement provider for service `ivschat <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoninteractivevideoservicechat.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `ivschat <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoninteractivevideoservicechat.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9fcbc5eddfcf1267dc1da680cf7e33ed7198d42dc8421e0d217672030a8f1795)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onLoggingConfiguration")
    def on_logging_configuration(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ivschat":
        '''(experimental) Adds a resource of type Logging-Configuration to the statement.

        https://docs.aws.amazon.com/ivs/latest/ChatAPIReference/API_LoggingConfiguration.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__368b2ec3f4e1d23ab7335527048c231d9ebfb1e5b89753ac89b1ac4777a1b761)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ivschat", jsii.invoke(self, "onLoggingConfiguration", [resource_id, account, partition]))

    @jsii.member(jsii_name="onRoom")
    def on_room(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Ivschat":
        '''(experimental) Adds a resource of type Room to the statement.

        https://docs.aws.amazon.com/ivs/latest/ChatAPIReference/API_Room.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c5443d79675d1d1029bf174a9ea9471e132b8019af4db474f250e8b193c99624)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Ivschat", jsii.invoke(self, "onRoom", [resource_id, account, partition]))

    @jsii.member(jsii_name="toCreateChatToken")
    def to_create_chat_token(self) -> "Ivschat":
        '''(experimental) Grants permission to create an encrypted token that is used to establish an individual WebSocket connection to a room.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ivs/latest/ChatAPIReference/API_CreateChatToken.html

        :stability: experimental
        '''
        return typing.cast("Ivschat", jsii.invoke(self, "toCreateChatToken", []))

    @jsii.member(jsii_name="toCreateLoggingConfiguration")
    def to_create_logging_configuration(self) -> "Ivschat":
        '''(experimental) Grants permission to create a logging configuration that allows clients to record room messages.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ivs/latest/ChatAPIReference/API_CreateLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ivschat", jsii.invoke(self, "toCreateLoggingConfiguration", []))

    @jsii.member(jsii_name="toCreateRoom")
    def to_create_room(self) -> "Ivschat":
        '''(experimental) Grants permission to create a room that allows clients to connect and pass messages.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ivs/latest/ChatAPIReference/API_CreateRoom.html

        :stability: experimental
        '''
        return typing.cast("Ivschat", jsii.invoke(self, "toCreateRoom", []))

    @jsii.member(jsii_name="toDeleteLoggingConfiguration")
    def to_delete_logging_configuration(self) -> "Ivschat":
        '''(experimental) Grants permission to delete the logging configuration for a specified logging configuration ARN.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/ChatAPIReference/API_DeleteLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ivschat", jsii.invoke(self, "toDeleteLoggingConfiguration", []))

    @jsii.member(jsii_name="toDeleteMessage")
    def to_delete_message(self) -> "Ivschat":
        '''(experimental) Grants permission to send an event to a specific room which directs clients to delete a specific message.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/ChatAPIReference/API_DeleteMessage.html

        :stability: experimental
        '''
        return typing.cast("Ivschat", jsii.invoke(self, "toDeleteMessage", []))

    @jsii.member(jsii_name="toDeleteRoom")
    def to_delete_room(self) -> "Ivschat":
        '''(experimental) Grants permission to delete the room for a specified room ARN.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/ChatAPIReference/API_DeleteRoom.html

        :stability: experimental
        '''
        return typing.cast("Ivschat", jsii.invoke(self, "toDeleteRoom", []))

    @jsii.member(jsii_name="toDisconnectUser")
    def to_disconnect_user(self) -> "Ivschat":
        '''(experimental) Grants permission to disconnect all connections using a specified user ID from a room.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/ChatAPIReference/API_DisconnectUser.html

        :stability: experimental
        '''
        return typing.cast("Ivschat", jsii.invoke(self, "toDisconnectUser", []))

    @jsii.member(jsii_name="toGetLoggingConfiguration")
    def to_get_logging_configuration(self) -> "Ivschat":
        '''(experimental) Grants permission to get the logging configuration for a specified logging configuration ARN.

        Access Level: Read

        https://docs.aws.amazon.com/ivs/latest/ChatAPIReference/API_GetLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ivschat", jsii.invoke(self, "toGetLoggingConfiguration", []))

    @jsii.member(jsii_name="toGetRoom")
    def to_get_room(self) -> "Ivschat":
        '''(experimental) Grants permission to get the room configuration for a specified room ARN.

        Access Level: Read

        https://docs.aws.amazon.com/ivs/latest/ChatAPIReference/API_GetRoom.html

        :stability: experimental
        '''
        return typing.cast("Ivschat", jsii.invoke(self, "toGetRoom", []))

    @jsii.member(jsii_name="toListLoggingConfigurations")
    def to_list_logging_configurations(self) -> "Ivschat":
        '''(experimental) Grants permission to get summary information about logging configurations.

        Access Level: List

        https://docs.aws.amazon.com/ivs/latest/ChatAPIReference/API_ListLoggingConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Ivschat", jsii.invoke(self, "toListLoggingConfigurations", []))

    @jsii.member(jsii_name="toListRooms")
    def to_list_rooms(self) -> "Ivschat":
        '''(experimental) Grants permission to get summary information about rooms.

        Access Level: List

        https://docs.aws.amazon.com/ivs/latest/ChatAPIReference/API_ListRooms.html

        :stability: experimental
        '''
        return typing.cast("Ivschat", jsii.invoke(self, "toListRooms", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Ivschat":
        '''(experimental) Grants permission to get information about the tags for a specified ARN.

        Access Level: Read

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ivs/latest/ChatAPIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Ivschat", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toSendEvent")
    def to_send_event(self) -> "Ivschat":
        '''(experimental) Grants permission to send an event to a room.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/ChatAPIReference/API_SendEvent.html

        :stability: experimental
        '''
        return typing.cast("Ivschat", jsii.invoke(self, "toSendEvent", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Ivschat":
        '''(experimental) Grants permission to add or update tags for a resource with a specified ARN.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/ivs/latest/ChatAPIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Ivschat", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Ivschat":
        '''(experimental) Grants permission to remove tags for a resource with a specified ARN.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/ivs/latest/ChatAPIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Ivschat", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateLoggingConfiguration")
    def to_update_logging_configuration(self) -> "Ivschat":
        '''(experimental) Grants permission to update the logging configuration for a specified logging configuration ARN.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/ChatAPIReference/API_UpdateLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Ivschat", jsii.invoke(self, "toUpdateLoggingConfiguration", []))

    @jsii.member(jsii_name="toUpdateRoom")
    def to_update_room(self) -> "Ivschat":
        '''(experimental) Grants permission to update the room configuration for a specified room ARN.

        Access Level: Write

        https://docs.aws.amazon.com/ivs/latest/ChatAPIReference/API_UpdateRoom.html

        :stability: experimental
        '''
        return typing.cast("Ivschat", jsii.invoke(self, "toUpdateRoom", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__254e98140c320812f2222268315b70fff9769b3520bdcb7c65e4e3d80031decd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d26e0cc700ced16f620bb23451ad16048ffdc2a6b3d326ccf30460e6cb8892ab)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Kafka(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Kafka"):
    '''(experimental) Statement provider for service `kafka <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedstreamingforapachekafka.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `kafka <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedstreamingforapachekafka.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c526b41fa7f87b339eac08f7e988f255123529f999ab70cbb4df36aab39def8a)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        cluster_name: builtins.str,
        uuid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kafka":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn.html

        :param cluster_name: - Identifier for the clusterName.
        :param uuid: - Identifier for the uuid.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5ee1396315d4b304343daea16baa35a977ed7db971854c041b8ff8c0b920e346)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument uuid", value=uuid, expected_type=type_hints["uuid"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kafka", jsii.invoke(self, "onCluster", [cluster_name, uuid, account, region, partition]))

    @jsii.member(jsii_name="onConfiguration")
    def on_configuration(
        self,
        configuration_name: builtins.str,
        uuid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kafka":
        '''(experimental) Adds a resource of type configuration to the statement.

        https://docs.aws.amazon.com/msk/1.0/apireference/configurations-arn.html

        :param configuration_name: - Identifier for the configurationName.
        :param uuid: - Identifier for the uuid.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__aa4f341729822cd4afae81013b479f23325c05101173b8758bb7dc1851a099e5)
            check_type(argname="argument configuration_name", value=configuration_name, expected_type=type_hints["configuration_name"])
            check_type(argname="argument uuid", value=uuid, expected_type=type_hints["uuid"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kafka", jsii.invoke(self, "onConfiguration", [configuration_name, uuid, account, region, partition]))

    @jsii.member(jsii_name="onGroup")
    def on_group(
        self,
        cluster_name: builtins.str,
        cluster_uuid: builtins.str,
        group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kafka":
        '''(experimental) Adds a resource of type group to the statement.

        https://docs.aws.amazon.com/msk/latest/developerguide/groups

        :param cluster_name: - Identifier for the clusterName.
        :param cluster_uuid: - Identifier for the clusterUuid.
        :param group_name: - Identifier for the groupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ee7081e1e7b4bb0ea59308d1976b819b3fb7d13827c843ea3b4bf215c40e284d)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument cluster_uuid", value=cluster_uuid, expected_type=type_hints["cluster_uuid"])
            check_type(argname="argument group_name", value=group_name, expected_type=type_hints["group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kafka", jsii.invoke(self, "onGroup", [cluster_name, cluster_uuid, group_name, account, region, partition]))

    @jsii.member(jsii_name="onTopic")
    def on_topic(
        self,
        cluster_name: builtins.str,
        cluster_uuid: builtins.str,
        topic_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kafka":
        '''(experimental) Adds a resource of type topic to the statement.

        https://docs.aws.amazon.com/msk/latest/developerguide/topics

        :param cluster_name: - Identifier for the clusterName.
        :param cluster_uuid: - Identifier for the clusterUuid.
        :param topic_name: - Identifier for the topicName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f2c9a724ec96c8238e8e7c83e1f0bad32259a8de37a844bcdefe880316e66c4c)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument cluster_uuid", value=cluster_uuid, expected_type=type_hints["cluster_uuid"])
            check_type(argname="argument topic_name", value=topic_name, expected_type=type_hints["topic_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kafka", jsii.invoke(self, "onTopic", [cluster_name, cluster_uuid, topic_name, account, region, partition]))

    @jsii.member(jsii_name="onTransactionalId")
    def on_transactional_id(
        self,
        cluster_name: builtins.str,
        cluster_uuid: builtins.str,
        transactional_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kafka":
        '''(experimental) Adds a resource of type transactional-id to the statement.

        https://docs.aws.amazon.com/msk/latest/developerguide/transactional_ids

        :param cluster_name: - Identifier for the clusterName.
        :param cluster_uuid: - Identifier for the clusterUuid.
        :param transactional_id: - Identifier for the transactionalId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5a35a68b19046134e18e4d3072099abc5527dd95b8a5ddd13f635f429ce4a414)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument cluster_uuid", value=cluster_uuid, expected_type=type_hints["cluster_uuid"])
            check_type(argname="argument transactional_id", value=transactional_id, expected_type=type_hints["transactional_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kafka", jsii.invoke(self, "onTransactionalId", [cluster_name, cluster_uuid, transactional_id, account, region, partition]))

    @jsii.member(jsii_name="toBatchAssociateScramSecret")
    def to_batch_associate_scram_secret(self) -> "Kafka":
        '''(experimental) Grants permission to associate one or more Scram Secrets with an Amazon MSK cluster.

        Access Level: Write

        Dependent actions:

        - kms:CreateGrant
        - kms:RetireGrant

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-scram-secrets.html#BatchAssociateScramSecret

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toBatchAssociateScramSecret", []))

    @jsii.member(jsii_name="toBatchDisassociateScramSecret")
    def to_batch_disassociate_scram_secret(self) -> "Kafka":
        '''(experimental) Grants permission to disassociate one or more Scram Secrets from an Amazon MSK cluster.

        Access Level: Write

        Dependent actions:

        - kms:RetireGrant

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-scram-secrets.html#BatchDisassociateScramSecret

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toBatchDisassociateScramSecret", []))

    @jsii.member(jsii_name="toCreateCluster")
    def to_create_cluster(self) -> "Kafka":
        '''(experimental) Grants permission to create an MSK cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs
        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy
        - kms:CreateGrant
        - kms:DescribeKey

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters.html#CreateCluster

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toCreateCluster", []))

    @jsii.member(jsii_name="toCreateClusterV2")
    def to_create_cluster_v2(self) -> "Kafka":
        '''(experimental) Grants permission to create an MSK cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:CreateTags
        - ec2:CreateVpcEndpoint
        - ec2:DeleteVpcEndpoints
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:DescribeVpcAttribute
        - ec2:DescribeVpcEndpoints
        - ec2:DescribeVpcs
        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy
        - kms:CreateGrant
        - kms:DescribeKey

        https://docs.aws.amazon.com/MSK/2.0/APIReference/v2-clusters.html#CreateClusterV2

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toCreateClusterV2", []))

    @jsii.member(jsii_name="toCreateConfiguration")
    def to_create_configuration(self) -> "Kafka":
        '''(experimental) Grants permission to create an MSK configuration.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/configurations.html#CreateConfiguration

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toCreateConfiguration", []))

    @jsii.member(jsii_name="toDeleteCluster")
    def to_delete_cluster(self) -> "Kafka":
        '''(experimental) Grants permission to delete an MSK cluster.

        Access Level: Write

        Dependent actions:

        - ec2:DeleteVpcEndpoints
        - ec2:DescribeVpcAttribute
        - ec2:DescribeVpcEndpoints

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn.html#DeleteCluster

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toDeleteCluster", []))

    @jsii.member(jsii_name="toDeleteConfiguration")
    def to_delete_configuration(self) -> "Kafka":
        '''(experimental) Grants permission to delete the specified MSK configuration.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/configurations-arn.html#DeleteConfiguration

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toDeleteConfiguration", []))

    @jsii.member(jsii_name="toDescribeCluster")
    def to_describe_cluster(self) -> "Kafka":
        '''(experimental) Grants permission to describe an MSK cluster.

        Access Level: Read

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn.html#DescribeCluster

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toDescribeCluster", []))

    @jsii.member(jsii_name="toDescribeClusterOperation")
    def to_describe_cluster_operation(self) -> "Kafka":
        '''(experimental) Grants permission to describe the cluster operation that is specified by the given ARN.

        Access Level: Read

        https://docs.aws.amazon.com/msk/1.0/apireference/operations-clusteroperationarn.html#DescribeClusterOperation

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toDescribeClusterOperation", []))

    @jsii.member(jsii_name="toDescribeClusterV2")
    def to_describe_cluster_v2(self) -> "Kafka":
        '''(experimental) Grants permission to describe an MSK cluster.

        Access Level: Read

        https://docs.aws.amazon.com/MSK/2.0/APIReference/v2-clusters-clusterarn.html#DescribeClusterV2

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toDescribeClusterV2", []))

    @jsii.member(jsii_name="toDescribeConfiguration")
    def to_describe_configuration(self) -> "Kafka":
        '''(experimental) Grants permission to describe an MSK configuration.

        Access Level: Read

        https://docs.aws.amazon.com/msk/1.0/apireference/configurations-arn.html#DescribeConfiguration

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toDescribeConfiguration", []))

    @jsii.member(jsii_name="toDescribeConfigurationRevision")
    def to_describe_configuration_revision(self) -> "Kafka":
        '''(experimental) Grants permission to describe an MSK configuration revision.

        Access Level: Read

        https://docs.aws.amazon.com/msk/1.0/apireference/configurations-arn-revisions-revision.html#DescribeConfigurationRevision

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toDescribeConfigurationRevision", []))

    @jsii.member(jsii_name="toGetBootstrapBrokers")
    def to_get_bootstrap_brokers(self) -> "Kafka":
        '''(experimental) Grants permission to get connection details for the brokers in an MSK cluster.

        Access Level: Read

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-bootstrap-brokers.html#GetBootstrapBrokers

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toGetBootstrapBrokers", []))

    @jsii.member(jsii_name="toGetCompatibleKafkaVersions")
    def to_get_compatible_kafka_versions(self) -> "Kafka":
        '''(experimental) Grants permission to get a list of the Apache Kafka versions to which you can update an MSK cluster.

        Access Level: List

        https://docs.aws.amazon.com/msk/1.0/apireference/compatible-kafka-versions.html#GetCompatibleKafkaVersions

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toGetCompatibleKafkaVersions", []))

    @jsii.member(jsii_name="toListClusterOperations")
    def to_list_cluster_operations(self) -> "Kafka":
        '''(experimental) Grants permission to return a list of all the operations that have been performed on the specified MSK cluster.

        Access Level: List

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-operations.html#ListClusterOperations

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toListClusterOperations", []))

    @jsii.member(jsii_name="toListClusters")
    def to_list_clusters(self) -> "Kafka":
        '''(experimental) Grants permission to list all MSK clusters in this account.

        Access Level: List

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters.html#ListClusters

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toListClusters", []))

    @jsii.member(jsii_name="toListClustersV2")
    def to_list_clusters_v2(self) -> "Kafka":
        '''(experimental) Grants permission to list all MSK clusters in this account.

        Access Level: List

        https://docs.aws.amazon.com/MSK/2.0/APIReference/v2-clusters.html#ListClustersV2

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toListClustersV2", []))

    @jsii.member(jsii_name="toListConfigurationRevisions")
    def to_list_configuration_revisions(self) -> "Kafka":
        '''(experimental) Grants permission to list all revisions for an MSK configuration in this account.

        Access Level: List

        https://docs.aws.amazon.com/msk/1.0/apireference/configurations-arn-revisions.html#ListConfigurationRevisions

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toListConfigurationRevisions", []))

    @jsii.member(jsii_name="toListConfigurations")
    def to_list_configurations(self) -> "Kafka":
        '''(experimental) Grants permission to list all MSK configurations in this account.

        Access Level: List

        https://docs.aws.amazon.com/msk/1.0/apireference/configurations.html#ListConfigurations

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toListConfigurations", []))

    @jsii.member(jsii_name="toListKafkaVersions")
    def to_list_kafka_versions(self) -> "Kafka":
        '''(experimental) Grants permission to list all Apache Kafka versions supported by Amazon MSK.

        Access Level: List

        https://docs.aws.amazon.com/msk/1.0/apireference/kafka-versions.html#ListKafkaVersions

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toListKafkaVersions", []))

    @jsii.member(jsii_name="toListNodes")
    def to_list_nodes(self) -> "Kafka":
        '''(experimental) Grants permission to list brokers in an MSK cluster.

        Access Level: List

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-nodes.html#ListNodes

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toListNodes", []))

    @jsii.member(jsii_name="toListScramSecrets")
    def to_list_scram_secrets(self) -> "Kafka":
        '''(experimental) Grants permission to list the Scram Secrets associated with an Amazon MSK cluster.

        Access Level: List

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-scram-secrets.html#ListScramSecrets

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toListScramSecrets", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Kafka":
        '''(experimental) Grants permission to list tags of an MSK resource.

        Access Level: Read

        https://docs.aws.amazon.com/msk/1.0/apireference/tags-resourcearn.html#ListTagsForResource

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRebootBroker")
    def to_reboot_broker(self) -> "Kafka":
        '''(experimental) Grants permission to reboot broker.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-reboot-broker.html#RebootBroker

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toRebootBroker", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Kafka":
        '''(experimental) Grants permission to tag an MSK resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/msk/1.0/apireference/tags-resourcearn.html#TagResource

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Kafka":
        '''(experimental) Grants permission to remove tags from an MSK resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/msk/1.0/apireference/tags-resourcearn.html#UntagResource

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateBrokerCount")
    def to_update_broker_count(self) -> "Kafka":
        '''(experimental) Grants permission to update the number of brokers of the MSK cluster.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-nodes-count.html#UpdateBrokerCount

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toUpdateBrokerCount", []))

    @jsii.member(jsii_name="toUpdateBrokerStorage")
    def to_update_broker_storage(self) -> "Kafka":
        '''(experimental) Grants permission to update the storage size of the brokers of the MSK cluster.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-nodes-storage.html#UpdateBrokerStorage

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toUpdateBrokerStorage", []))

    @jsii.member(jsii_name="toUpdateBrokerType")
    def to_update_broker_type(self) -> "Kafka":
        '''(experimental) Grants permission to update the broker type of an Amazon MSK cluster.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-nodes-type.html#UpdateBrokerType

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toUpdateBrokerType", []))

    @jsii.member(jsii_name="toUpdateClusterConfiguration")
    def to_update_cluster_configuration(self) -> "Kafka":
        '''(experimental) Grants permission to update the configuration of the MSK cluster.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-configuration.html#UpdateClusterConfiguration

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toUpdateClusterConfiguration", []))

    @jsii.member(jsii_name="toUpdateClusterKafkaVersion")
    def to_update_cluster_kafka_version(self) -> "Kafka":
        '''(experimental) Grants permission to update the MSK cluster to the specified Apache Kafka version.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-version.html#UpdateClusterKafkaVersion

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toUpdateClusterKafkaVersion", []))

    @jsii.member(jsii_name="toUpdateConfiguration")
    def to_update_configuration(self) -> "Kafka":
        '''(experimental) Grants permission to create a new revision of the MSK configuration.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/configurations-arn.html#UpdateConfiguration

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toUpdateConfiguration", []))

    @jsii.member(jsii_name="toUpdateConnectivity")
    def to_update_connectivity(self) -> "Kafka":
        '''(experimental) Grants permission to update the connectivity settings for the MSK cluster.

        Access Level: Write

        Dependent actions:

        - ec2:DescribeRouteTables
        - ec2:DescribeSubnets

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-connectivity.html#UpdateConnectivity

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toUpdateConnectivity", []))

    @jsii.member(jsii_name="toUpdateMonitoring")
    def to_update_monitoring(self) -> "Kafka":
        '''(experimental) Grants permission to update the monitoring settings for the MSK cluster.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-monitoring.html#UpdateMonitoring

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toUpdateMonitoring", []))

    @jsii.member(jsii_name="toUpdateSecurity")
    def to_update_security(self) -> "Kafka":
        '''(experimental) Grants permission to update the security settings for the MSK cluster.

        Access Level: Write

        Dependent actions:

        - kms:RetireGrant

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-security.html#UpdateSecurity

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toUpdateSecurity", []))

    @jsii.member(jsii_name="toUpdateStorage")
    def to_update_storage(self) -> "Kafka":
        '''(experimental) Grants permission to update the EBS storage (size or provisioned throughput) associated with MSK brokers or set cluster storage mode to TIERED.

        Access Level: Write

        https://docs.aws.amazon.com/msk/1.0/apireference/clusters-clusterarn-storage.html#UpdateStorage

        :stability: experimental
        '''
        return typing.cast("Kafka", jsii.invoke(self, "toUpdateStorage", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__994eada0a75a8f4cd7404c872c9089a9f41a23c10a9a404ba2367bb5271f0a27)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5ae670dd4394886c4d1e50ad1d3537e0e850830d993c5a3de5883bdc0a2790d0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class KafkaCluster(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.KafkaCluster",
):
    '''(experimental) Statement provider for service `kafka-cluster <https://docs.aws.amazon.com/service-authorization/latest/reference/list_apachekafkaapisforamazonmskclusters.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `kafka-cluster <https://docs.aws.amazon.com/service-authorization/latest/reference/list_apachekafkaapisforamazonmskclusters.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__90995ba22e79775b0ca6627ebe3ec692bceed8f8561594c45eff985f48bf1401)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        cluster_name: builtins.str,
        cluster_uuid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "KafkaCluster":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#msk-iam-resources

        :param cluster_name: - Identifier for the clusterName.
        :param cluster_uuid: - Identifier for the clusterUuid.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c9ae8212f08793c90147a1f21b88319f8e5d631ad4c66ce65bd23cf95c5c55f0)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument cluster_uuid", value=cluster_uuid, expected_type=type_hints["cluster_uuid"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("KafkaCluster", jsii.invoke(self, "onCluster", [cluster_name, cluster_uuid, account, region, partition]))

    @jsii.member(jsii_name="onGroup")
    def on_group(
        self,
        cluster_name: builtins.str,
        cluster_uuid: builtins.str,
        group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "KafkaCluster":
        '''(experimental) Adds a resource of type group to the statement.

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#msk-iam-resources

        :param cluster_name: - Identifier for the clusterName.
        :param cluster_uuid: - Identifier for the clusterUuid.
        :param group_name: - Identifier for the groupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f3779472a25bc8ce0620a1ea79a4a3fbd84c90dd8f839fdeb352cc58f18cfbc5)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument cluster_uuid", value=cluster_uuid, expected_type=type_hints["cluster_uuid"])
            check_type(argname="argument group_name", value=group_name, expected_type=type_hints["group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("KafkaCluster", jsii.invoke(self, "onGroup", [cluster_name, cluster_uuid, group_name, account, region, partition]))

    @jsii.member(jsii_name="onTopic")
    def on_topic(
        self,
        cluster_name: builtins.str,
        cluster_uuid: builtins.str,
        topic_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "KafkaCluster":
        '''(experimental) Adds a resource of type topic to the statement.

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#msk-iam-resources

        :param cluster_name: - Identifier for the clusterName.
        :param cluster_uuid: - Identifier for the clusterUuid.
        :param topic_name: - Identifier for the topicName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__546c8c14739d40ab72be9f25be866822bbf0f2b3c0397e25b5313e619dfa4446)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument cluster_uuid", value=cluster_uuid, expected_type=type_hints["cluster_uuid"])
            check_type(argname="argument topic_name", value=topic_name, expected_type=type_hints["topic_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("KafkaCluster", jsii.invoke(self, "onTopic", [cluster_name, cluster_uuid, topic_name, account, region, partition]))

    @jsii.member(jsii_name="onTransactionalId")
    def on_transactional_id(
        self,
        cluster_name: builtins.str,
        cluster_uuid: builtins.str,
        transactional_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "KafkaCluster":
        '''(experimental) Adds a resource of type transactional-id to the statement.

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#msk-iam-resources

        :param cluster_name: - Identifier for the clusterName.
        :param cluster_uuid: - Identifier for the clusterUuid.
        :param transactional_id: - Identifier for the transactionalId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cf2d8cec3c9a626e0f13271c4678ae76324fecb0501d5bcd2018bae279de07d0)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument cluster_uuid", value=cluster_uuid, expected_type=type_hints["cluster_uuid"])
            check_type(argname="argument transactional_id", value=transactional_id, expected_type=type_hints["transactional_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("KafkaCluster", jsii.invoke(self, "onTransactionalId", [cluster_name, cluster_uuid, transactional_id, account, region, partition]))

    @jsii.member(jsii_name="toAlterCluster")
    def to_alter_cluster(self) -> "KafkaCluster":
        '''(experimental) Grants permission to alter various aspects of the cluster, equivalent to Apache Kafka's ALTER CLUSTER ACL.

        Access Level: Write

        Dependent actions:

        - kafka-cluster:Connect
        - kafka-cluster:DescribeCluster

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#actions

        :stability: experimental
        '''
        return typing.cast("KafkaCluster", jsii.invoke(self, "toAlterCluster", []))

    @jsii.member(jsii_name="toAlterClusterDynamicConfiguration")
    def to_alter_cluster_dynamic_configuration(self) -> "KafkaCluster":
        '''(experimental) Grants permission to alter the dynamic configuration of a cluster, equivalent to Apache Kafka's ALTER_CONFIGS CLUSTER ACL.

        Access Level: Write

        Dependent actions:

        - kafka-cluster:Connect
        - kafka-cluster:DescribeClusterDynamicConfiguration

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#actions

        :stability: experimental
        '''
        return typing.cast("KafkaCluster", jsii.invoke(self, "toAlterClusterDynamicConfiguration", []))

    @jsii.member(jsii_name="toAlterGroup")
    def to_alter_group(self) -> "KafkaCluster":
        '''(experimental) Grants permission to join groups on a cluster, equivalent to Apache Kafka's READ GROUP ACL.

        Access Level: Write

        Dependent actions:

        - kafka-cluster:Connect
        - kafka-cluster:DescribeGroup

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#actions

        :stability: experimental
        '''
        return typing.cast("KafkaCluster", jsii.invoke(self, "toAlterGroup", []))

    @jsii.member(jsii_name="toAlterTopic")
    def to_alter_topic(self) -> "KafkaCluster":
        '''(experimental) Grants permission to alter topics on a cluster, equivalent to Apache Kafka's ALTER TOPIC ACL.

        Access Level: Write

        Dependent actions:

        - kafka-cluster:Connect
        - kafka-cluster:DescribeTopic

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#actions

        :stability: experimental
        '''
        return typing.cast("KafkaCluster", jsii.invoke(self, "toAlterTopic", []))

    @jsii.member(jsii_name="toAlterTopicDynamicConfiguration")
    def to_alter_topic_dynamic_configuration(self) -> "KafkaCluster":
        '''(experimental) Grants permission to alter the dynamic configuration of topics on a cluster, equivalent to Apache Kafka's ALTER_CONFIGS TOPIC ACL.

        Access Level: Write

        Dependent actions:

        - kafka-cluster:Connect
        - kafka-cluster:DescribeTopicDynamicConfiguration

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#actions

        :stability: experimental
        '''
        return typing.cast("KafkaCluster", jsii.invoke(self, "toAlterTopicDynamicConfiguration", []))

    @jsii.member(jsii_name="toAlterTransactionalId")
    def to_alter_transactional_id(self) -> "KafkaCluster":
        '''(experimental) Grants permission to alter transactional IDs on a cluster, equivalent to Apache Kafka's WRITE TRANSACTIONAL_ID ACL.

        Access Level: Write

        Dependent actions:

        - kafka-cluster:Connect
        - kafka-cluster:DescribeTransactionalId
        - kafka-cluster:WriteData

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#actions

        :stability: experimental
        '''
        return typing.cast("KafkaCluster", jsii.invoke(self, "toAlterTransactionalId", []))

    @jsii.member(jsii_name="toConnect")
    def to_connect(self) -> "KafkaCluster":
        '''(experimental) Grants permission to connect and authenticate to the cluster.

        Access Level: Write

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#actions

        :stability: experimental
        '''
        return typing.cast("KafkaCluster", jsii.invoke(self, "toConnect", []))

    @jsii.member(jsii_name="toCreateTopic")
    def to_create_topic(self) -> "KafkaCluster":
        '''(experimental) Grants permission to create topics on a cluster, equivalent to Apache Kafka's CREATE CLUSTER/TOPIC ACL.

        Access Level: Write

        Dependent actions:

        - kafka-cluster:Connect

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#actions

        :stability: experimental
        '''
        return typing.cast("KafkaCluster", jsii.invoke(self, "toCreateTopic", []))

    @jsii.member(jsii_name="toDeleteGroup")
    def to_delete_group(self) -> "KafkaCluster":
        '''(experimental) Grants permission to delete groups on a cluster, equivalent to Apache Kafka's DELETE GROUP ACL.

        Access Level: Write

        Dependent actions:

        - kafka-cluster:Connect
        - kafka-cluster:DescribeGroup

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#actions

        :stability: experimental
        '''
        return typing.cast("KafkaCluster", jsii.invoke(self, "toDeleteGroup", []))

    @jsii.member(jsii_name="toDeleteTopic")
    def to_delete_topic(self) -> "KafkaCluster":
        '''(experimental) Grants permission to delete topics on a cluster, equivalent to Apache Kafka's DELETE TOPIC ACL.

        Access Level: Write

        Dependent actions:

        - kafka-cluster:Connect
        - kafka-cluster:DescribeTopic

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#actions

        :stability: experimental
        '''
        return typing.cast("KafkaCluster", jsii.invoke(self, "toDeleteTopic", []))

    @jsii.member(jsii_name="toDescribeCluster")
    def to_describe_cluster(self) -> "KafkaCluster":
        '''(experimental) Grants permission to describe various aspects of the cluster, equivalent to Apache Kafka's DESCRIBE CLUSTER ACL.

        Access Level: List

        Dependent actions:

        - kafka-cluster:Connect

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#actions

        :stability: experimental
        '''
        return typing.cast("KafkaCluster", jsii.invoke(self, "toDescribeCluster", []))

    @jsii.member(jsii_name="toDescribeClusterDynamicConfiguration")
    def to_describe_cluster_dynamic_configuration(self) -> "KafkaCluster":
        '''(experimental) Grants permission to describe the dynamic configuration of a cluster, equivalent to Apache Kafka's DESCRIBE_CONFIGS CLUSTER ACL.

        Access Level: List

        Dependent actions:

        - kafka-cluster:Connect

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#actions

        :stability: experimental
        '''
        return typing.cast("KafkaCluster", jsii.invoke(self, "toDescribeClusterDynamicConfiguration", []))

    @jsii.member(jsii_name="toDescribeGroup")
    def to_describe_group(self) -> "KafkaCluster":
        '''(experimental) Grants permission to describe groups on a cluster, equivalent to Apache Kafka's DESCRIBE GROUP ACL.

        Access Level: List

        Dependent actions:

        - kafka-cluster:Connect

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#actions

        :stability: experimental
        '''
        return typing.cast("KafkaCluster", jsii.invoke(self, "toDescribeGroup", []))

    @jsii.member(jsii_name="toDescribeTopic")
    def to_describe_topic(self) -> "KafkaCluster":
        '''(experimental) Grants permission to describe topics on a cluster, equivalent to Apache Kafka's DESCRIBE TOPIC ACL.

        Access Level: List

        Dependent actions:

        - kafka-cluster:Connect

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#actions

        :stability: experimental
        '''
        return typing.cast("KafkaCluster", jsii.invoke(self, "toDescribeTopic", []))

    @jsii.member(jsii_name="toDescribeTopicDynamicConfiguration")
    def to_describe_topic_dynamic_configuration(self) -> "KafkaCluster":
        '''(experimental) Grants permission to describe the dynamic configuration of topics on a cluster, equivalent to Apache Kafka's DESCRIBE_CONFIGS TOPIC ACL.

        Access Level: List

        Dependent actions:

        - kafka-cluster:Connect

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#actions

        :stability: experimental
        '''
        return typing.cast("KafkaCluster", jsii.invoke(self, "toDescribeTopicDynamicConfiguration", []))

    @jsii.member(jsii_name="toDescribeTransactionalId")
    def to_describe_transactional_id(self) -> "KafkaCluster":
        '''(experimental) Grants permission to describe transactional IDs on a cluster, equivalent to Apache Kafka's DESCRIBE TRANSACTIONAL_ID ACL.

        Access Level: List

        Dependent actions:

        - kafka-cluster:Connect

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#actions

        :stability: experimental
        '''
        return typing.cast("KafkaCluster", jsii.invoke(self, "toDescribeTransactionalId", []))

    @jsii.member(jsii_name="toReadData")
    def to_read_data(self) -> "KafkaCluster":
        '''(experimental) Grants permission to read data from topics on a cluster, equivalent to Apache Kafka's READ TOPIC ACL.

        Access Level: Read

        Dependent actions:

        - kafka-cluster:AlterGroup
        - kafka-cluster:Connect
        - kafka-cluster:DescribeTopic

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#actions

        :stability: experimental
        '''
        return typing.cast("KafkaCluster", jsii.invoke(self, "toReadData", []))

    @jsii.member(jsii_name="toWriteData")
    def to_write_data(self) -> "KafkaCluster":
        '''(experimental) Grants permission to write data to topics on a cluster, equivalent to Apache Kafka's WRITE TOPIC ACL.

        Access Level: Write

        Dependent actions:

        - kafka-cluster:Connect
        - kafka-cluster:DescribeTopic

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#actions

        :stability: experimental
        '''
        return typing.cast("KafkaCluster", jsii.invoke(self, "toWriteData", []))

    @jsii.member(jsii_name="toWriteDataIdempotently")
    def to_write_data_idempotently(self) -> "KafkaCluster":
        '''(experimental) Grants permission to write data idempotently on a cluster, equivalent to Apache Kafka's IDEMPOTENT_WRITE CLUSTER ACL.

        Access Level: Write

        Dependent actions:

        - kafka-cluster:Connect
        - kafka-cluster:WriteData

        https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#actions

        :stability: experimental
        '''
        return typing.cast("KafkaCluster", jsii.invoke(self, "toWriteDataIdempotently", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bf43cc9831d1d554d07d2098be21e65cf0f8628d05db209df486b144e60d662c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1a6159382bfa8da4b8a5ac8d4570a3e2555394fddcd5298bb364d9998ba4bd84)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Kafkaconnect(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Kafkaconnect",
):
    '''(experimental) Statement provider for service `kafkaconnect <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedstreamingforkafkaconnect.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `kafkaconnect <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedstreamingforkafkaconnect.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1b7e3155a82f6596490b8a8574f000d69bf8ed5a4f95d9082ff72e202042e5d0)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onConnector")
    def on_connector(
        self,
        connector_name: builtins.str,
        u_uid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kafkaconnect":
        '''(experimental) Adds a resource of type connector to the statement.

        https://docs.aws.amazon.com/MSKC/latest/mskc/API_ConnectorSummary.html

        :param connector_name: - Identifier for the connectorName.
        :param u_uid: - Identifier for the uUID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__79e0fadff41ae5e67c8967174515275d36cb16ee17c93316d489e21882d05407)
            check_type(argname="argument connector_name", value=connector_name, expected_type=type_hints["connector_name"])
            check_type(argname="argument u_uid", value=u_uid, expected_type=type_hints["u_uid"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kafkaconnect", jsii.invoke(self, "onConnector", [connector_name, u_uid, account, region, partition]))

    @jsii.member(jsii_name="onCustomPlugin")
    def on_custom_plugin(
        self,
        custom_plugin_name: builtins.str,
        u_uid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kafkaconnect":
        '''(experimental) Adds a resource of type custom plugin to the statement.

        https://docs.aws.amazon.com/MSKC/latest/mskc/API_CustomPlugin.html

        :param custom_plugin_name: - Identifier for the customPluginName.
        :param u_uid: - Identifier for the uUID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__912ebdf48aeb21ddd26ed2d838592ac2764192aee7aff80c1654a19dc84c3292)
            check_type(argname="argument custom_plugin_name", value=custom_plugin_name, expected_type=type_hints["custom_plugin_name"])
            check_type(argname="argument u_uid", value=u_uid, expected_type=type_hints["u_uid"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kafkaconnect", jsii.invoke(self, "onCustomPlugin", [custom_plugin_name, u_uid, account, region, partition]))

    @jsii.member(jsii_name="onWorkerConfiguration")
    def on_worker_configuration(
        self,
        worker_configuration_name: builtins.str,
        u_uid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kafkaconnect":
        '''(experimental) Adds a resource of type worker configuration to the statement.

        https://docs.aws.amazon.com/MSKC/latest/mskc/API_WorkerConfiguration.html

        :param worker_configuration_name: - Identifier for the workerConfigurationName.
        :param u_uid: - Identifier for the uUID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7adf2786ddfb200c0ae434b70f963c963a53074b89cf71ee8bd4737acae33aac)
            check_type(argname="argument worker_configuration_name", value=worker_configuration_name, expected_type=type_hints["worker_configuration_name"])
            check_type(argname="argument u_uid", value=u_uid, expected_type=type_hints["u_uid"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kafkaconnect", jsii.invoke(self, "onWorkerConfiguration", [worker_configuration_name, u_uid, account, region, partition]))

    @jsii.member(jsii_name="toCreateConnector")
    def to_create_connector(self) -> "Kafkaconnect":
        '''(experimental) Grants permission to create an MSK Connect connector.

        Access Level: Write

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs
        - firehose:TagDeliveryStream
        - iam:AttachRolePolicy
        - iam:CreateServiceLinkedRole
        - iam:PassRole
        - iam:PutRolePolicy
        - logs:CreateLogDelivery
        - logs:DescribeLogGroups
        - logs:DescribeResourcePolicies
        - logs:GetLogDelivery
        - logs:ListLogDeliveries
        - logs:PutResourcePolicy
        - s3:GetBucketPolicy
        - s3:PutBucketPolicy

        https://docs.aws.amazon.com/MSKC/latest/mskc/API_CreateConnector.html

        :stability: experimental
        '''
        return typing.cast("Kafkaconnect", jsii.invoke(self, "toCreateConnector", []))

    @jsii.member(jsii_name="toCreateCustomPlugin")
    def to_create_custom_plugin(self) -> "Kafkaconnect":
        '''(experimental) Grants permission to create an MSK Connect custom plugin.

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/MSKC/latest/mskc/API_CreateCustomPlugin.html

        :stability: experimental
        '''
        return typing.cast("Kafkaconnect", jsii.invoke(self, "toCreateCustomPlugin", []))

    @jsii.member(jsii_name="toCreateWorkerConfiguration")
    def to_create_worker_configuration(self) -> "Kafkaconnect":
        '''(experimental) Grants permission to create an MSK Connect worker configuration.

        Access Level: Write

        https://docs.aws.amazon.com/MSKC/latest/mskc/API_CreateWorkerConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Kafkaconnect", jsii.invoke(self, "toCreateWorkerConfiguration", []))

    @jsii.member(jsii_name="toDeleteConnector")
    def to_delete_connector(self) -> "Kafkaconnect":
        '''(experimental) Grants permission to delete an MSK Connect connector.

        Access Level: Write

        Dependent actions:

        - logs:DeleteLogDelivery
        - logs:ListLogDeliveries

        https://docs.aws.amazon.com/MSKC/latest/mskc/API_DeleteConnector.html

        :stability: experimental
        '''
        return typing.cast("Kafkaconnect", jsii.invoke(self, "toDeleteConnector", []))

    @jsii.member(jsii_name="toDeleteCustomPlugin")
    def to_delete_custom_plugin(self) -> "Kafkaconnect":
        '''(experimental) Grants permission to delete an MSK Connect custom plugin.

        Access Level: Write

        https://docs.aws.amazon.com/MSKC/latest/mskc/API_DeleteCustomPlugin.html

        :stability: experimental
        '''
        return typing.cast("Kafkaconnect", jsii.invoke(self, "toDeleteCustomPlugin", []))

    @jsii.member(jsii_name="toDescribeConnector")
    def to_describe_connector(self) -> "Kafkaconnect":
        '''(experimental) Grants permission to describe an MSK Connect connector.

        Access Level: Read

        https://docs.aws.amazon.com/MSKC/latest/mskc/API_DescribeConnector.html

        :stability: experimental
        '''
        return typing.cast("Kafkaconnect", jsii.invoke(self, "toDescribeConnector", []))

    @jsii.member(jsii_name="toDescribeCustomPlugin")
    def to_describe_custom_plugin(self) -> "Kafkaconnect":
        '''(experimental) Grants permission to describe an MSK Connect custom plugin.

        Access Level: Read

        https://docs.aws.amazon.com/MSKC/latest/mskc/API_DescribeCustomPlugin.html

        :stability: experimental
        '''
        return typing.cast("Kafkaconnect", jsii.invoke(self, "toDescribeCustomPlugin", []))

    @jsii.member(jsii_name="toDescribeWorkerConfiguration")
    def to_describe_worker_configuration(self) -> "Kafkaconnect":
        '''(experimental) Grants permission to describe an MSK Connect worker configuration.

        Access Level: Read

        https://docs.aws.amazon.com/MSKC/latest/mskc/API_DescribeWorkerConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Kafkaconnect", jsii.invoke(self, "toDescribeWorkerConfiguration", []))

    @jsii.member(jsii_name="toListConnectors")
    def to_list_connectors(self) -> "Kafkaconnect":
        '''(experimental) Grants permission to list all MSK Connect connectors in this account.

        Access Level: Read

        https://docs.aws.amazon.com/MSKC/latest/mskc/API_ListConnectors.html

        :stability: experimental
        '''
        return typing.cast("Kafkaconnect", jsii.invoke(self, "toListConnectors", []))

    @jsii.member(jsii_name="toListCustomPlugins")
    def to_list_custom_plugins(self) -> "Kafkaconnect":
        '''(experimental) Grants permission to list all MSK Connect custom plugins in this account.

        Access Level: Read

        https://docs.aws.amazon.com/MSKC/latest/mskc/API_ListCustomPlugins.html

        :stability: experimental
        '''
        return typing.cast("Kafkaconnect", jsii.invoke(self, "toListCustomPlugins", []))

    @jsii.member(jsii_name="toListWorkerConfigurations")
    def to_list_worker_configurations(self) -> "Kafkaconnect":
        '''(experimental) Grants permission to list all MSK Connect worker configurations in this account.

        Access Level: Read

        https://docs.aws.amazon.com/MSKC/latest/mskc/API_ListWorkerConfigurations.html

        :stability: experimental
        '''
        return typing.cast("Kafkaconnect", jsii.invoke(self, "toListWorkerConfigurations", []))

    @jsii.member(jsii_name="toUpdateConnector")
    def to_update_connector(self) -> "Kafkaconnect":
        '''(experimental) Grants permission to update an MSK Connect connector.

        Access Level: Write

        https://docs.aws.amazon.com/MSKC/latest/mskc/API_UpdateConnector.html

        :stability: experimental
        '''
        return typing.cast("Kafkaconnect", jsii.invoke(self, "toUpdateConnector", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__45a339984eb1a0ae3196e8f8cc965d4360b86f42ab764c8ead10b4a15f26303b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d2f5d22194420af613879c42a09ca68d7836e76616c0742eb0d7ea0e26d3fb8f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Kendra(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Kendra"):
    '''(experimental) Statement provider for service `kendra <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkendra.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `kendra <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkendra.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f4046cc86ec19ccce03f0f4a70a8bb7cf9f1e55d7cf71bb1de28463f4640b2e2)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDataSource")
    def on_data_source(
        self,
        index_id: builtins.str,
        data_source_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kendra":
        '''(experimental) Adds a resource of type data-source to the statement.

        https://docs.aws.amazon.com/kendra/latest/dg/data-source.html

        :param index_id: - Identifier for the indexId.
        :param data_source_id: - Identifier for the dataSourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__11a3b1cdbf9ed0e9ee6beb9e417b59ddb437f70b1a04351f443628bbdcff2c65)
            check_type(argname="argument index_id", value=index_id, expected_type=type_hints["index_id"])
            check_type(argname="argument data_source_id", value=data_source_id, expected_type=type_hints["data_source_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kendra", jsii.invoke(self, "onDataSource", [index_id, data_source_id, account, region, partition]))

    @jsii.member(jsii_name="onExperience")
    def on_experience(
        self,
        index_id: builtins.str,
        experience_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kendra":
        '''(experimental) Adds a resource of type experience to the statement.

        https://docs.aws.amazon.com/kendra/latest/dg/deploying-search-experience-no-code.html

        :param index_id: - Identifier for the indexId.
        :param experience_id: - Identifier for the experienceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d4db1189012c2cac7102cdafe71eb535f1a9ac8b32afce31ff546fd964003143)
            check_type(argname="argument index_id", value=index_id, expected_type=type_hints["index_id"])
            check_type(argname="argument experience_id", value=experience_id, expected_type=type_hints["experience_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kendra", jsii.invoke(self, "onExperience", [index_id, experience_id, account, region, partition]))

    @jsii.member(jsii_name="onFaq")
    def on_faq(
        self,
        index_id: builtins.str,
        faq_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kendra":
        '''(experimental) Adds a resource of type faq to the statement.

        https://docs.aws.amazon.com/kendra/latest/dg/faq.html

        :param index_id: - Identifier for the indexId.
        :param faq_id: - Identifier for the faqId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__690c543f96fb2f10850ac74530b1b6d5e71793d3950a51993553c9bf8a9eeb53)
            check_type(argname="argument index_id", value=index_id, expected_type=type_hints["index_id"])
            check_type(argname="argument faq_id", value=faq_id, expected_type=type_hints["faq_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kendra", jsii.invoke(self, "onFaq", [index_id, faq_id, account, region, partition]))

    @jsii.member(jsii_name="onIndex")
    def on_index(
        self,
        index_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kendra":
        '''(experimental) Adds a resource of type index to the statement.

        https://docs.aws.amazon.com/kendra/latest/dg/index.html

        :param index_id: - Identifier for the indexId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__55ae82531fddfcaebb52f1ce0f3b5b5154fa299f71899fe10cf1632ab5e9bec0)
            check_type(argname="argument index_id", value=index_id, expected_type=type_hints["index_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kendra", jsii.invoke(self, "onIndex", [index_id, account, region, partition]))

    @jsii.member(jsii_name="onQuerySuggestionsBlockList")
    def on_query_suggestions_block_list(
        self,
        index_id: builtins.str,
        query_suggestions_block_list_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kendra":
        '''(experimental) Adds a resource of type query-suggestions-block-list to the statement.

        https://docs.aws.amazon.com/kendra/latest/dg/query-suggestions-block-list.html

        :param index_id: - Identifier for the indexId.
        :param query_suggestions_block_list_id: - Identifier for the querySuggestionsBlockListId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ea75020c63efa89d06ad3bfd3ab71695b02e4eb56b66bc389c07b275ade03bd1)
            check_type(argname="argument index_id", value=index_id, expected_type=type_hints["index_id"])
            check_type(argname="argument query_suggestions_block_list_id", value=query_suggestions_block_list_id, expected_type=type_hints["query_suggestions_block_list_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kendra", jsii.invoke(self, "onQuerySuggestionsBlockList", [index_id, query_suggestions_block_list_id, account, region, partition]))

    @jsii.member(jsii_name="onThesaurus")
    def on_thesaurus(
        self,
        index_id: builtins.str,
        thesaurus_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kendra":
        '''(experimental) Adds a resource of type thesaurus to the statement.

        https://docs.aws.amazon.com/kendra/latest/dg/thesaurus.html

        :param index_id: - Identifier for the indexId.
        :param thesaurus_id: - Identifier for the thesaurusId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1c0c813329772255d723b1d891bfcb51baa61d66952dc3297559f383d4f347cf)
            check_type(argname="argument index_id", value=index_id, expected_type=type_hints["index_id"])
            check_type(argname="argument thesaurus_id", value=thesaurus_id, expected_type=type_hints["thesaurus_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kendra", jsii.invoke(self, "onThesaurus", [index_id, thesaurus_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateEntitiesToExperience")
    def to_associate_entities_to_experience(self) -> "Kendra":
        '''(experimental) Grants permission to put principal mapping in index.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_PutPrincipalMapping.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toAssociateEntitiesToExperience", []))

    @jsii.member(jsii_name="toAssociatePersonasToEntities")
    def to_associate_personas_to_entities(self) -> "Kendra":
        '''(experimental) Defines the specific permissions of users or groups in your AWS SSO identity source with access to your Amazon Kendra experience.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_AssociatePersonasToEntities.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toAssociatePersonasToEntities", []))

    @jsii.member(jsii_name="toBatchDeleteDocument")
    def to_batch_delete_document(self) -> "Kendra":
        '''(experimental) Grants permission to batch delete document.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_BatchDeleteDocument.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toBatchDeleteDocument", []))

    @jsii.member(jsii_name="toBatchGetDocumentStatus")
    def to_batch_get_document_status(self) -> "Kendra":
        '''(experimental) Grants permission to do batch get document status.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_BatchGetDocumentStatus.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toBatchGetDocumentStatus", []))

    @jsii.member(jsii_name="toBatchPutDocument")
    def to_batch_put_document(self) -> "Kendra":
        '''(experimental) Grants permission to batch put document.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_BatchPutDocument.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toBatchPutDocument", []))

    @jsii.member(jsii_name="toClearQuerySuggestions")
    def to_clear_query_suggestions(self) -> "Kendra":
        '''(experimental) Grants permission to clear out the suggestions for a given index, generated so far.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_ClearQuerySuggestions.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toClearQuerySuggestions", []))

    @jsii.member(jsii_name="toCreateDataSource")
    def to_create_data_source(self) -> "Kendra":
        '''(experimental) Grants permission to create a data source.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kendra/latest/dg/API_CreateDataSource.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toCreateDataSource", []))

    @jsii.member(jsii_name="toCreateExperience")
    def to_create_experience(self) -> "Kendra":
        '''(experimental) Creates an Amazon Kendra experience such as a search application.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_CreateExperience.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toCreateExperience", []))

    @jsii.member(jsii_name="toCreateFaq")
    def to_create_faq(self) -> "Kendra":
        '''(experimental) Grants permission to create an Faq.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kendra/latest/dg/API_CreateFaq.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toCreateFaq", []))

    @jsii.member(jsii_name="toCreateIndex")
    def to_create_index(self) -> "Kendra":
        '''(experimental) Grants permission to create an Index.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kendra/latest/dg/API_CreateIndex.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toCreateIndex", []))

    @jsii.member(jsii_name="toCreateQuerySuggestionsBlockList")
    def to_create_query_suggestions_block_list(self) -> "Kendra":
        '''(experimental) Grants permission to create a QuerySuggestions BlockList.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kendra/latest/dg/API_CreateQuerySuggestionsBlockList.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toCreateQuerySuggestionsBlockList", []))

    @jsii.member(jsii_name="toCreateThesaurus")
    def to_create_thesaurus(self) -> "Kendra":
        '''(experimental) Grants permission to create a Thesaurus.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kendra/latest/dg/API_CreateThesaurus.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toCreateThesaurus", []))

    @jsii.member(jsii_name="toDeleteDataSource")
    def to_delete_data_source(self) -> "Kendra":
        '''(experimental) Grants permission to delete a data source.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_DeleteDataSource.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDeleteDataSource", []))

    @jsii.member(jsii_name="toDeleteExperience")
    def to_delete_experience(self) -> "Kendra":
        '''(experimental) Deletes your Amazon Kendra experience such as a search application.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_DeleteExperience.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDeleteExperience", []))

    @jsii.member(jsii_name="toDeleteFaq")
    def to_delete_faq(self) -> "Kendra":
        '''(experimental) Grants permission to delete an Faq.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_DeleteFaq.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDeleteFaq", []))

    @jsii.member(jsii_name="toDeleteIndex")
    def to_delete_index(self) -> "Kendra":
        '''(experimental) Grants permission to delete an Index.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_DeleteIndex.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDeleteIndex", []))

    @jsii.member(jsii_name="toDeletePrincipalMapping")
    def to_delete_principal_mapping(self) -> "Kendra":
        '''(experimental) Grants permission to delete principal mapping from index.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_DeletePrincipalMapping.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDeletePrincipalMapping", []))

    @jsii.member(jsii_name="toDeleteQuerySuggestionsBlockList")
    def to_delete_query_suggestions_block_list(self) -> "Kendra":
        '''(experimental) Grants permission to delete a QuerySuggestions BlockList.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_DeleteQuerySuggestionsBlockList.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDeleteQuerySuggestionsBlockList", []))

    @jsii.member(jsii_name="toDeleteThesaurus")
    def to_delete_thesaurus(self) -> "Kendra":
        '''(experimental) Grants permission to delete a Thesaurus.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_DeleteThesaurus.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDeleteThesaurus", []))

    @jsii.member(jsii_name="toDescribeDataSource")
    def to_describe_data_source(self) -> "Kendra":
        '''(experimental) Grants permission to describe a data source.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_DescribeDataSource.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDescribeDataSource", []))

    @jsii.member(jsii_name="toDescribeExperience")
    def to_describe_experience(self) -> "Kendra":
        '''(experimental) Gets information about your Amazon Kendra experience such as a search application.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_DescribeExperience.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDescribeExperience", []))

    @jsii.member(jsii_name="toDescribeFaq")
    def to_describe_faq(self) -> "Kendra":
        '''(experimental) Grants permission to describe an Faq.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_DescribeFaq.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDescribeFaq", []))

    @jsii.member(jsii_name="toDescribeIndex")
    def to_describe_index(self) -> "Kendra":
        '''(experimental) Grants permission to describe an Index.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_DescribeIndex.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDescribeIndex", []))

    @jsii.member(jsii_name="toDescribePrincipalMapping")
    def to_describe_principal_mapping(self) -> "Kendra":
        '''(experimental) Grants permission to describe principal mapping from index.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_DescribePrincipalMapping.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDescribePrincipalMapping", []))

    @jsii.member(jsii_name="toDescribeQuerySuggestionsBlockList")
    def to_describe_query_suggestions_block_list(self) -> "Kendra":
        '''(experimental) Grants permission to describe a QuerySuggestions BlockList.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_DescribeQuerySuggestionsBlockList.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDescribeQuerySuggestionsBlockList", []))

    @jsii.member(jsii_name="toDescribeQuerySuggestionsConfig")
    def to_describe_query_suggestions_config(self) -> "Kendra":
        '''(experimental) Grants permission to describe the query suggestions configuration for an index.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_DescribeQuerySuggestionsConfig.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDescribeQuerySuggestionsConfig", []))

    @jsii.member(jsii_name="toDescribeThesaurus")
    def to_describe_thesaurus(self) -> "Kendra":
        '''(experimental) Grants permission to describe a Thesaurus.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_DescribeThesaurus.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDescribeThesaurus", []))

    @jsii.member(jsii_name="toDisassociateEntitiesFromExperience")
    def to_disassociate_entities_from_experience(self) -> "Kendra":
        '''(experimental) Prevents users or groups in your AWS SSO identity source from accessing your Amazon Kendra experience.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_DisassociateEntitiesFromExperience.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDisassociateEntitiesFromExperience", []))

    @jsii.member(jsii_name="toDisassociatePersonasFromEntities")
    def to_disassociate_personas_from_entities(self) -> "Kendra":
        '''(experimental) Removes the specific permissions of users or groups in your AWS SSO identity source with access to your Amazon Kendra experience.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_DisassociatePersonasFromEntities.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toDisassociatePersonasFromEntities", []))

    @jsii.member(jsii_name="toGetQuerySuggestions")
    def to_get_query_suggestions(self) -> "Kendra":
        '''(experimental) Grants permission to get suggestions for a query prefix.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_GetQuerySuggestions.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toGetQuerySuggestions", []))

    @jsii.member(jsii_name="toGetSnapshots")
    def to_get_snapshots(self) -> "Kendra":
        '''(experimental) Retrieves search metrics data.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_GetSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toGetSnapshots", []))

    @jsii.member(jsii_name="toListDataSources")
    def to_list_data_sources(self) -> "Kendra":
        '''(experimental) Grants permission to list the data sources.

        Access Level: List

        https://docs.aws.amazon.com/kendra/latest/dg/API_ListDataSources.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toListDataSources", []))

    @jsii.member(jsii_name="toListDataSourceSyncJobs")
    def to_list_data_source_sync_jobs(self) -> "Kendra":
        '''(experimental) Grants permission to get Data Source sync job history.

        Access Level: List

        https://docs.aws.amazon.com/kendra/latest/dg/API_ListDataSourceSyncJobs.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toListDataSourceSyncJobs", []))

    @jsii.member(jsii_name="toListEntityPersonas")
    def to_list_entity_personas(self) -> "Kendra":
        '''(experimental) Lists specific permissions of users and groups with access to your Amazon Kendra experience.

        Access Level: List

        https://docs.aws.amazon.com/kendra/latest/dg/API_ListEntityPersonas.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toListEntityPersonas", []))

    @jsii.member(jsii_name="toListExperienceEntities")
    def to_list_experience_entities(self) -> "Kendra":
        '''(experimental) Lists users or groups in your AWS SSO identity source that are granted access to your Amazon Kendra experience.

        Access Level: List

        https://docs.aws.amazon.com/kendra/latest/dg/API_ListExperienceEntities.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toListExperienceEntities", []))

    @jsii.member(jsii_name="toListExperiences")
    def to_list_experiences(self) -> "Kendra":
        '''(experimental) Lists one or more Amazon Kendra experiences. You can create an Amazon Kendra experience such as a search application.

        Access Level: List

        https://docs.aws.amazon.com/kendra/latest/dg/API_ListExperiences.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toListExperiences", []))

    @jsii.member(jsii_name="toListFaqs")
    def to_list_faqs(self) -> "Kendra":
        '''(experimental) Grants permission to list the Faqs.

        Access Level: List

        https://docs.aws.amazon.com/kendra/latest/dg/API_ListFaqs.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toListFaqs", []))

    @jsii.member(jsii_name="toListGroupsOlderThanOrderingId")
    def to_list_groups_older_than_ordering_id(self) -> "Kendra":
        '''(experimental) Grants permission to list groups that are older than an ordering id.

        Access Level: List

        https://docs.aws.amazon.com/kendra/latest/dg/API_ListGroupsOlderThanOrderingId.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toListGroupsOlderThanOrderingId", []))

    @jsii.member(jsii_name="toListIndices")
    def to_list_indices(self) -> "Kendra":
        '''(experimental) Grants permission to list the indexes.

        Access Level: List

        https://docs.aws.amazon.com/kendra/latest/dg/API_ListIndices.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toListIndices", []))

    @jsii.member(jsii_name="toListQuerySuggestionsBlockLists")
    def to_list_query_suggestions_block_lists(self) -> "Kendra":
        '''(experimental) Grants permission to list the QuerySuggestions BlockLists.

        Access Level: List

        https://docs.aws.amazon.com/kendra/latest/dg/API_ListQuerySuggestionsBlockLists.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toListQuerySuggestionsBlockLists", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Kendra":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListThesauri")
    def to_list_thesauri(self) -> "Kendra":
        '''(experimental) Grants permission to list the Thesauri.

        Access Level: List

        https://docs.aws.amazon.com/kendra/latest/dg/API_ListThesauri.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toListThesauri", []))

    @jsii.member(jsii_name="toPutPrincipalMapping")
    def to_put_principal_mapping(self) -> "Kendra":
        '''(experimental) Grants permission to put principal mapping in index.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_PutPrincipalMapping.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toPutPrincipalMapping", []))

    @jsii.member(jsii_name="toQuery")
    def to_query(self) -> "Kendra":
        '''(experimental) Grants permission to query documents and faqs.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_Query.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toQuery", []))

    @jsii.member(jsii_name="toStartDataSourceSyncJob")
    def to_start_data_source_sync_job(self) -> "Kendra":
        '''(experimental) Grants permission to start Data Source sync job.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_StartDataSourceSyncJob.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toStartDataSourceSyncJob", []))

    @jsii.member(jsii_name="toStopDataSourceSyncJob")
    def to_stop_data_source_sync_job(self) -> "Kendra":
        '''(experimental) Grants permission to stop Data Source sync job.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_StopDataSourceSyncJob.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toStopDataSourceSyncJob", []))

    @jsii.member(jsii_name="toSubmitFeedback")
    def to_submit_feedback(self) -> "Kendra":
        '''(experimental) Grants permission to send feedback about a query results.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_SubmitFeedback.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toSubmitFeedback", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Kendra":
        '''(experimental) Grants permission to tag a resource with given key value pairs.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kendra/latest/dg/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Kendra":
        '''(experimental) Grants permission to remove the tag with the given key from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kendra/latest/dg/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDataSource")
    def to_update_data_source(self) -> "Kendra":
        '''(experimental) Grants permission to update a data source.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_UpdateDataSource.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toUpdateDataSource", []))

    @jsii.member(jsii_name="toUpdateExperience")
    def to_update_experience(self) -> "Kendra":
        '''(experimental) Updates your Amazon Kendra experience such as a search application.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_UpdateExperience.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toUpdateExperience", []))

    @jsii.member(jsii_name="toUpdateIndex")
    def to_update_index(self) -> "Kendra":
        '''(experimental) Grants permission to update an Index.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_UpdateIndex.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toUpdateIndex", []))

    @jsii.member(jsii_name="toUpdateQuerySuggestionsBlockList")
    def to_update_query_suggestions_block_list(self) -> "Kendra":
        '''(experimental) Grants permission to update a QuerySuggestions BlockList.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_UpdateQuerySuggestionsBlockList.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toUpdateQuerySuggestionsBlockList", []))

    @jsii.member(jsii_name="toUpdateQuerySuggestionsConfig")
    def to_update_query_suggestions_config(self) -> "Kendra":
        '''(experimental) Grants permission to update the query suggestions configuration for an index.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_UpdateQuerySuggestionsConfig.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toUpdateQuerySuggestionsConfig", []))

    @jsii.member(jsii_name="toUpdateThesaurus")
    def to_update_thesaurus(self) -> "Kendra":
        '''(experimental) Grants permission to update a thesaurus.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_UpdateThesaurus.html

        :stability: experimental
        '''
        return typing.cast("Kendra", jsii.invoke(self, "toUpdateThesaurus", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__656c1565a0537933d58ea63ba6b6b050b1d139c1a45ac2e6b27cc5bda7b6b6ea)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a0b709fdd635cd30fe034171c699cb612ec815e16e3b173f05119f35fb008547)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class KendraRanking(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.KendraRanking",
):
    '''(experimental) Statement provider for service `kendra-ranking <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkendraintelligentranking.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `kendra-ranking <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkendraintelligentranking.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c113bd26ae8fac69b137c4f4601aaea8cd919ce751a76bbf17690e60f92f0106)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onRescoreExecutionPlan")
    def on_rescore_execution_plan(
        self,
        rescore_execution_plan_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "KendraRanking":
        '''(experimental) Adds a resource of type rescore-execution-plan to the statement.

        https://docs.aws.amazon.com/kendra/latest/dg/search-service-rerank.html

        :param rescore_execution_plan_id: - Identifier for the rescoreExecutionPlanId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__09b15f53b1addf7bcd0367c4de446c149068b014daa125f7a13d74f3bc9ed251)
            check_type(argname="argument rescore_execution_plan_id", value=rescore_execution_plan_id, expected_type=type_hints["rescore_execution_plan_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("KendraRanking", jsii.invoke(self, "onRescoreExecutionPlan", [rescore_execution_plan_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateRescoreExecutionPlan")
    def to_create_rescore_execution_plan(self) -> "KendraRanking":
        '''(experimental) Grants permission to create a RescoreExecutionPlan.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kendra/latest/dg/API_Ranking_CreateRescoreExecutionPlan.html

        :stability: experimental
        '''
        return typing.cast("KendraRanking", jsii.invoke(self, "toCreateRescoreExecutionPlan", []))

    @jsii.member(jsii_name="toDeleteRescoreExecutionPlan")
    def to_delete_rescore_execution_plan(self) -> "KendraRanking":
        '''(experimental) Grants permission to delete a RescoreExecutionPlan.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_Ranking_DeleteRescoreExecutionPlan.html

        :stability: experimental
        '''
        return typing.cast("KendraRanking", jsii.invoke(self, "toDeleteRescoreExecutionPlan", []))

    @jsii.member(jsii_name="toDescribeRescoreExecutionPlan")
    def to_describe_rescore_execution_plan(self) -> "KendraRanking":
        '''(experimental) Grants permission to describe a RescoreExecutionPlan.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_Ranking_DescribeRescoreExecutionPlan.html

        :stability: experimental
        '''
        return typing.cast("KendraRanking", jsii.invoke(self, "toDescribeRescoreExecutionPlan", []))

    @jsii.member(jsii_name="toListRescoreExecutionPlans")
    def to_list_rescore_execution_plans(self) -> "KendraRanking":
        '''(experimental) Grants permission to list all RescoreExecutionPlans.

        Access Level: List

        https://docs.aws.amazon.com/kendra/latest/dg/API_Ranking_ListRescoreExecutionPlans.html

        :stability: experimental
        '''
        return typing.cast("KendraRanking", jsii.invoke(self, "toListRescoreExecutionPlans", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "KendraRanking":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_Ranking_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("KendraRanking", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRescore")
    def to_rescore(self) -> "KendraRanking":
        '''(experimental) Grants permission to Rescore documents with Kendra Intelligent Ranking.

        Access Level: Read

        https://docs.aws.amazon.com/kendra/latest/dg/API_Ranking_Rescore.html

        :stability: experimental
        '''
        return typing.cast("KendraRanking", jsii.invoke(self, "toRescore", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "KendraRanking":
        '''(experimental) Grants permission to tag a resource with given key value pairs.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kendra/latest/dg/API_Ranking_TagResource.html

        :stability: experimental
        '''
        return typing.cast("KendraRanking", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "KendraRanking":
        '''(experimental) Grants permission to remove the tag with the given key from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kendra/latest/dg/API_Ranking_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("KendraRanking", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateRescoreExecutionPlan")
    def to_update_rescore_execution_plan(self) -> "KendraRanking":
        '''(experimental) Grants permission to update a RescoreExecutionPlan.

        Access Level: Write

        https://docs.aws.amazon.com/kendra/latest/dg/API_Ranking_UpdateRescoreExecutionPlan.html

        :stability: experimental
        '''
        return typing.cast("KendraRanking", jsii.invoke(self, "toUpdateRescoreExecutionPlan", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__62ea323e0eaef7b5f983bc5a79c3ebda2241a9ccb094b0c9a1d9464355cd7385)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6322cd4a58d6ab5892532bfdd8c1587c4919624c717d830efca18348866bd8c6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Kinesis(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Kinesis"):
    '''(experimental) Statement provider for service `kinesis <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesis.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `kinesis <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesis.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__39fa3ddbae0c20cadda3177606cadd1e76f451431fabd547a188185259b9788b)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onConsumer")
    def on_consumer(
        self,
        stream_type: builtins.str,
        stream_name: builtins.str,
        consumer_name: builtins.str,
        consumer_creation_timpstamp: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kinesis":
        '''(experimental) Adds a resource of type consumer to the statement.

        https://docs.aws.amazon.com/kinesis/latest/dev/amazon-kinesis-consumers.html

        :param stream_type: - Identifier for the streamType.
        :param stream_name: - Identifier for the streamName.
        :param consumer_name: - Identifier for the consumerName.
        :param consumer_creation_timpstamp: - Identifier for the consumerCreationTimpstamp.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8dd79fe7cb651ef016eeb367c9b97942769ab737b46c204d2aaee6c4f0decd07)
            check_type(argname="argument stream_type", value=stream_type, expected_type=type_hints["stream_type"])
            check_type(argname="argument stream_name", value=stream_name, expected_type=type_hints["stream_name"])
            check_type(argname="argument consumer_name", value=consumer_name, expected_type=type_hints["consumer_name"])
            check_type(argname="argument consumer_creation_timpstamp", value=consumer_creation_timpstamp, expected_type=type_hints["consumer_creation_timpstamp"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kinesis", jsii.invoke(self, "onConsumer", [stream_type, stream_name, consumer_name, consumer_creation_timpstamp, account, region, partition]))

    @jsii.member(jsii_name="onKmsKey")
    def on_kms_key(
        self,
        key_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kinesis":
        '''(experimental) Adds a resource of type kmsKey to the statement.

        https://docs.aws.amazon.com/kinesis/latest/dev/concepts.html#kms_keys

        :param key_id: - Identifier for the keyId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7ac2aa91434fdde6e9461992b77d4f7de4f2052eb30aba07300c0578552f9097)
            check_type(argname="argument key_id", value=key_id, expected_type=type_hints["key_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kinesis", jsii.invoke(self, "onKmsKey", [key_id, account, region, partition]))

    @jsii.member(jsii_name="onStream")
    def on_stream(
        self,
        stream_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kinesis":
        '''(experimental) Adds a resource of type stream to the statement.

        https://docs.aws.amazon.com/kinesis/latest/dev/amazon-kinesis-streams.html

        :param stream_name: - Identifier for the streamName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__37ade26ebf0c35e735f3abbeec71ffe9fd87ce2c3c39cb587beb656d2c19fb7f)
            check_type(argname="argument stream_name", value=stream_name, expected_type=type_hints["stream_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kinesis", jsii.invoke(self, "onStream", [stream_name, account, region, partition]))

    @jsii.member(jsii_name="toAddTagsToStream")
    def to_add_tags_to_stream(self) -> "Kinesis":
        '''(experimental) Grants permission to add or update tags for the specified Amazon Kinesis stream.

        Each stream can have up to 10 tags

        Access Level: Tagging

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_AddTagsToStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toAddTagsToStream", []))

    @jsii.member(jsii_name="toCreateStream")
    def to_create_stream(self) -> "Kinesis":
        '''(experimental) Grants permission to create a Amazon Kinesis stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_CreateStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toCreateStream", []))

    @jsii.member(jsii_name="toDecreaseStreamRetentionPeriod")
    def to_decrease_stream_retention_period(self) -> "Kinesis":
        '''(experimental) Grants permission to decrease the stream's retention period, which is the length of time data records are accessible after they are added to the stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_DecreaseStreamRetentionPeriod.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toDecreaseStreamRetentionPeriod", []))

    @jsii.member(jsii_name="toDeleteStream")
    def to_delete_stream(self) -> "Kinesis":
        '''(experimental) Grants permission to delete a stream and all its shards and data.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_DeleteStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toDeleteStream", []))

    @jsii.member(jsii_name="toDeregisterStreamConsumer")
    def to_deregister_stream_consumer(self) -> "Kinesis":
        '''(experimental) Grants permission to deregister a stream consumer with a Kinesis data stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_DeregisterStreamConsumer.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toDeregisterStreamConsumer", []))

    @jsii.member(jsii_name="toDescribeLimits")
    def to_describe_limits(self) -> "Kinesis":
        '''(experimental) Grants permission to describe the shard limits and usage for the account.

        Access Level: Read

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_DescribeLimits.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toDescribeLimits", []))

    @jsii.member(jsii_name="toDescribeStream")
    def to_describe_stream(self) -> "Kinesis":
        '''(experimental) Grants permission to describe the specified stream.

        Access Level: Read

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_DescribeStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toDescribeStream", []))

    @jsii.member(jsii_name="toDescribeStreamConsumer")
    def to_describe_stream_consumer(self) -> "Kinesis":
        '''(experimental) Grants permission to get the description of a registered stream consumer.

        Access Level: Read

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_DescribeStreamConsumer.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toDescribeStreamConsumer", []))

    @jsii.member(jsii_name="toDescribeStreamSummary")
    def to_describe_stream_summary(self) -> "Kinesis":
        '''(experimental) Grants permission to provide a summarized description of the specified Kinesis data stream without the shard list.

        Access Level: Read

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_DescribeStreamSummary.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toDescribeStreamSummary", []))

    @jsii.member(jsii_name="toDisableEnhancedMonitoring")
    def to_disable_enhanced_monitoring(self) -> "Kinesis":
        '''(experimental) Grants permission to disables enhanced monitoring.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_DisableEnhancedMonitoring.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toDisableEnhancedMonitoring", []))

    @jsii.member(jsii_name="toEnableEnhancedMonitoring")
    def to_enable_enhanced_monitoring(self) -> "Kinesis":
        '''(experimental) Grants permission to enable enhanced Kinesis data stream monitoring for shard-level metrics.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_EnableEnhancedMonitoring.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toEnableEnhancedMonitoring", []))

    @jsii.member(jsii_name="toGetRecords")
    def to_get_records(self) -> "Kinesis":
        '''(experimental) Grants permission to get data records from a shard.

        Access Level: Read

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_GetRecords.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toGetRecords", []))

    @jsii.member(jsii_name="toGetShardIterator")
    def to_get_shard_iterator(self) -> "Kinesis":
        '''(experimental) Grants permission to get a shard iterator.

        A shard iterator expires five minutes after it is returned to the requester

        Access Level: Read

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_GetShardIterator.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toGetShardIterator", []))

    @jsii.member(jsii_name="toIncreaseStreamRetentionPeriod")
    def to_increase_stream_retention_period(self) -> "Kinesis":
        '''(experimental) Grants permission to increase the stream's retention period, which is the length of time data records are accessible after they are added to the stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_IncreaseStreamRetentionPeriod.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toIncreaseStreamRetentionPeriod", []))

    @jsii.member(jsii_name="toListShards")
    def to_list_shards(self) -> "Kinesis":
        '''(experimental) Grants permission to list the shards in a stream and provides information about each shard.

        Access Level: List

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_ListShards.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toListShards", []))

    @jsii.member(jsii_name="toListStreamConsumers")
    def to_list_stream_consumers(self) -> "Kinesis":
        '''(experimental) Grants permission to list the stream consumers registered to receive data from a Kinesis stream using enhanced fan-out, and provides information about each consumer.

        Access Level: List

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_ListStreamConsumers.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toListStreamConsumers", []))

    @jsii.member(jsii_name="toListStreams")
    def to_list_streams(self) -> "Kinesis":
        '''(experimental) Grants permission to list your streams.

        Access Level: List

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_ListStreams.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toListStreams", []))

    @jsii.member(jsii_name="toListTagsForStream")
    def to_list_tags_for_stream(self) -> "Kinesis":
        '''(experimental) Grants permission to list the tags for the specified Amazon Kinesis stream.

        Access Level: Read

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_ListTagsForStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toListTagsForStream", []))

    @jsii.member(jsii_name="toMergeShards")
    def to_merge_shards(self) -> "Kinesis":
        '''(experimental) Grants permission to merge two adjacent shards in a stream and combines them into a single shard to reduce the stream's capacity to ingest and transport data.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_MergeShards.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toMergeShards", []))

    @jsii.member(jsii_name="toPutRecord")
    def to_put_record(self) -> "Kinesis":
        '''(experimental) Grants permission to write a single data record from a producer into an Amazon Kinesis stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_PutRecord.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toPutRecord", []))

    @jsii.member(jsii_name="toPutRecords")
    def to_put_records(self) -> "Kinesis":
        '''(experimental) Grants permission to write multiple data records from a producer into an Amazon Kinesis stream in a single call (also referred to as a PutRecords request).

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_PutRecords.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toPutRecords", []))

    @jsii.member(jsii_name="toRegisterStreamConsumer")
    def to_register_stream_consumer(self) -> "Kinesis":
        '''(experimental) Grants permission to register a stream consumer with a Kinesis data stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_RegisterStreamConsumer.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toRegisterStreamConsumer", []))

    @jsii.member(jsii_name="toRemoveTagsFromStream")
    def to_remove_tags_from_stream(self) -> "Kinesis":
        '''(experimental) Grants permission to remove tags from the specified Kinesis data stream.

        Removed tags are deleted and cannot be recovered after this operation successfully completes

        Access Level: Tagging

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_RemoveTagsFromStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toRemoveTagsFromStream", []))

    @jsii.member(jsii_name="toSplitShard")
    def to_split_shard(self) -> "Kinesis":
        '''(experimental) Grants permission to split a shard into two new shards in the Kinesis data stream, to increase the stream's capacity to ingest and transport data.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_SplitShard.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toSplitShard", []))

    @jsii.member(jsii_name="toStartStreamEncryption")
    def to_start_stream_encryption(self) -> "Kinesis":
        '''(experimental) Grants permission to enable or update server-side encryption using an AWS KMS key for a specified stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_StartStreamEncryption.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toStartStreamEncryption", []))

    @jsii.member(jsii_name="toStopStreamEncryption")
    def to_stop_stream_encryption(self) -> "Kinesis":
        '''(experimental) Grants permission to disable server-side encryption for a specified stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_StopStreamEncryption.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toStopStreamEncryption", []))

    @jsii.member(jsii_name="toSubscribeToShard")
    def to_subscribe_to_shard(self) -> "Kinesis":
        '''(experimental) Grants permission to listen to a specific shard with enhanced fan-out.

        Access Level: Read

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_SubscribeToShard.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toSubscribeToShard", []))

    @jsii.member(jsii_name="toUpdateShardCount")
    def to_update_shard_count(self) -> "Kinesis":
        '''(experimental) Grants permission to update the shard count of the specified stream to the specified number of shards.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_UpdateShardCount.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toUpdateShardCount", []))

    @jsii.member(jsii_name="toUpdateStreamMode")
    def to_update_stream_mode(self) -> "Kinesis":
        '''(experimental) Grants permission to update the capacity mode of the data stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesis/latest/APIReference/API_UpdateStreamMode.html

        :stability: experimental
        '''
        return typing.cast("Kinesis", jsii.invoke(self, "toUpdateStreamMode", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__419ad40f1445cdb7fa8fd25feb913ced8204cc0a7dcd022061da844049fff76c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4fe7877f2ca649ceaa3ff5c86c86a31d9fde2d72e52b815f50534b1ca1c5d4ed)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Kinesisanalytics(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Kinesisanalytics",
):
    '''(experimental) Statement provider for service `kinesisanalytics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesisanalytics.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `kinesisanalytics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesisanalytics.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cc2f78e650845b90fd90b3bb2ef703e973d4ece2d4d5083f6b2a84a7e707351f)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        application_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kinesisanalytics":
        '''(experimental) Adds a resource of type application to the statement.

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/how-it-works.html

        :param application_name: - Identifier for the applicationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__beff5f9c69af64acec934e2a9f3dd12060c963a45c9a593843ef815670c70e96)
            check_type(argname="argument application_name", value=application_name, expected_type=type_hints["application_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "onApplication", [application_name, account, region, partition]))

    @jsii.member(jsii_name="toAddApplicationInput")
    def to_add_application_input(self) -> "Kinesisanalytics":
        '''(experimental) Grants permission to add input to the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_AddApplicationInput.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toAddApplicationInput", []))

    @jsii.member(jsii_name="toAddApplicationOutput")
    def to_add_application_output(self) -> "Kinesisanalytics":
        '''(experimental) Grants permission to add output to the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_AddApplicationOutput.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toAddApplicationOutput", []))

    @jsii.member(jsii_name="toAddApplicationReferenceDataSource")
    def to_add_application_reference_data_source(self) -> "Kinesisanalytics":
        '''(experimental) Grants permission to add reference data source to the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_AddApplicationReferenceDataSource.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toAddApplicationReferenceDataSource", []))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "Kinesisanalytics":
        '''(experimental) Grants permission to create an application.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "Kinesisanalytics":
        '''(experimental) Grants permission to delete the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toDeleteApplicationOutput")
    def to_delete_application_output(self) -> "Kinesisanalytics":
        '''(experimental) Grants permission to delete the specified output of the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_DeleteApplicationOutput.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toDeleteApplicationOutput", []))

    @jsii.member(jsii_name="toDeleteApplicationReferenceDataSource")
    def to_delete_application_reference_data_source(self) -> "Kinesisanalytics":
        '''(experimental) Grants permission to delete the specified reference data source of the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_DeleteApplicationReferenceDataSource.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toDeleteApplicationReferenceDataSource", []))

    @jsii.member(jsii_name="toDescribeApplication")
    def to_describe_application(self) -> "Kinesisanalytics":
        '''(experimental) Grants permission to describe the specified application.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_DescribeApplication.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toDescribeApplication", []))

    @jsii.member(jsii_name="toDiscoverInputSchema")
    def to_discover_input_schema(self) -> "Kinesisanalytics":
        '''(experimental) Grants permission to discover the input schema for the application.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_DiscoverInputSchema.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toDiscoverInputSchema", []))

    @jsii.member(jsii_name="toGetApplicationState")
    def to_get_application_state(self) -> "Kinesisanalytics":
        '''(experimental) Grants permission to Kinesis Data Analytics console to display stream results for Kinesis Data Analytics SQL runtime applications.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/api-permissions-reference.html#api-permissions-reference-gas

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toGetApplicationState", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "Kinesisanalytics":
        '''(experimental) Grants permission to list applications for the account.

        Access Level: List

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_ListApplications.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Kinesisanalytics":
        '''(experimental) Grants permission to fetch the tags associated with the application.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartApplication")
    def to_start_application(self) -> "Kinesisanalytics":
        '''(experimental) Grants permission to start the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_StartApplication.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toStartApplication", []))

    @jsii.member(jsii_name="toStopApplication")
    def to_stop_application(self) -> "Kinesisanalytics":
        '''(experimental) Grants permission to stop the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_StopApplication.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toStopApplication", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Kinesisanalytics":
        '''(experimental) Grants permission to add tags to the application.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Kinesisanalytics":
        '''(experimental) Grants permission to remove the specified tags from the application.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "Kinesisanalytics":
        '''(experimental) Grants permission to update the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/dev/API_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("Kinesisanalytics", jsii.invoke(self, "toUpdateApplication", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e5d0c2cbb8608069093d2f7e1f877871c33140ebc91368ba55bf0a23f714eddb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3cad319d11fde60389919edd1adf19fc8397f8d9ef6399fc40f6fdd6e955e09c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class KinesisanalyticsV2(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.KinesisanalyticsV2",
):
    '''(experimental) Statement provider for service `kinesisanalytics-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesisanalyticsv2.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `kinesisanalytics-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesisanalyticsv2.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__76cd4824dab550ea1c13193610d632f1dc7405464f4481b25c676fa5c0a67dda)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        application_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "KinesisanalyticsV2":
        '''(experimental) Adds a resource of type application to the statement.

        https://docs.aws.amazon.com/kinesisanalytics/latest/java/how-it-works.html

        :param application_name: - Identifier for the applicationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6554e8ad6273152956dbde0684d1b72a8ccf6fc91e2e2d695923dc10ba46ad78)
            check_type(argname="argument application_name", value=application_name, expected_type=type_hints["application_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "onApplication", [application_name, account, region, partition]))

    @jsii.member(jsii_name="toAddApplicationCloudWatchLoggingOption")
    def to_add_application_cloud_watch_logging_option(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to add cloudwatch logging option to the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_AddApplicationCloudWatchLoggingOption.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toAddApplicationCloudWatchLoggingOption", []))

    @jsii.member(jsii_name="toAddApplicationInput")
    def to_add_application_input(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to add input to the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_AddApplicationInput.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toAddApplicationInput", []))

    @jsii.member(jsii_name="toAddApplicationInputProcessingConfiguration")
    def to_add_application_input_processing_configuration(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to add input processing configuration to the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_AddApplicationInputProcessingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toAddApplicationInputProcessingConfiguration", []))

    @jsii.member(jsii_name="toAddApplicationOutput")
    def to_add_application_output(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to add output to the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_AddApplicationOutput.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toAddApplicationOutput", []))

    @jsii.member(jsii_name="toAddApplicationReferenceDataSource")
    def to_add_application_reference_data_source(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to add reference data source to the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_AddApplicationReferenceDataSource.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toAddApplicationReferenceDataSource", []))

    @jsii.member(jsii_name="toAddApplicationVpcConfiguration")
    def to_add_application_vpc_configuration(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to add VPC configuration to the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_AddApplicationVpcConfiguration.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toAddApplicationVpcConfiguration", []))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to create an application.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toCreateApplicationPresignedUrl")
    def to_create_application_presigned_url(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to create and return a URL that you can use to connect to an application's extension.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_CreateApplicationPresignedUrl.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toCreateApplicationPresignedUrl", []))

    @jsii.member(jsii_name="toCreateApplicationSnapshot")
    def to_create_application_snapshot(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to create a snapshot for an application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_CreateApplicationSnapshot.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toCreateApplicationSnapshot", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to delete the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toDeleteApplicationCloudWatchLoggingOption")
    def to_delete_application_cloud_watch_logging_option(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to delete the specified cloudwatch logging option of the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DeleteApplicationCloudWatchLoggingOption.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDeleteApplicationCloudWatchLoggingOption", []))

    @jsii.member(jsii_name="toDeleteApplicationInputProcessingConfiguration")
    def to_delete_application_input_processing_configuration(
        self,
    ) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to delete the specified input processing configuration of the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DeleteApplicationInputProcessingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDeleteApplicationInputProcessingConfiguration", []))

    @jsii.member(jsii_name="toDeleteApplicationOutput")
    def to_delete_application_output(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to delete the specified output of the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DeleteApplicationOutput.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDeleteApplicationOutput", []))

    @jsii.member(jsii_name="toDeleteApplicationReferenceDataSource")
    def to_delete_application_reference_data_source(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to delete the specified reference data source of the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DeleteApplicationReferenceDataSource.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDeleteApplicationReferenceDataSource", []))

    @jsii.member(jsii_name="toDeleteApplicationSnapshot")
    def to_delete_application_snapshot(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to delete a snapshot for an application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DeleteApplicationSnapshot.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDeleteApplicationSnapshot", []))

    @jsii.member(jsii_name="toDeleteApplicationVpcConfiguration")
    def to_delete_application_vpc_configuration(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to delete the specified VPC configuration of the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DeleteApplicationVpcConfiguration.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDeleteApplicationVpcConfiguration", []))

    @jsii.member(jsii_name="toDescribeApplication")
    def to_describe_application(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to describe the specified application.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DescribeApplication.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDescribeApplication", []))

    @jsii.member(jsii_name="toDescribeApplicationSnapshot")
    def to_describe_application_snapshot(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to describe an application snapshot.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DescribeApplicationSnapshot.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDescribeApplicationSnapshot", []))

    @jsii.member(jsii_name="toDescribeApplicationVersion")
    def to_describe_application_version(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to describe the application version of an application.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DescribeApplicationVersion.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDescribeApplicationVersion", []))

    @jsii.member(jsii_name="toDiscoverInputSchema")
    def to_discover_input_schema(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to discover the input schema for the application.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_DiscoverInputSchema.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toDiscoverInputSchema", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to list applications for the account.

        Access Level: List

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_ListApplications.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListApplicationSnapshots")
    def to_list_application_snapshots(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to list the snapshots for an application.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_ListApplicationSnapshots.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toListApplicationSnapshots", []))

    @jsii.member(jsii_name="toListApplicationVersions")
    def to_list_application_versions(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to list application versions of an application.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_ListApplicationVersions.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toListApplicationVersions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to fetch the tags associated with the application.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRollbackApplication")
    def to_rollback_application(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to perform rollback operation on an application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_RollbackApplication.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toRollbackApplication", []))

    @jsii.member(jsii_name="toStartApplication")
    def to_start_application(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to start the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_StartApplication.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toStartApplication", []))

    @jsii.member(jsii_name="toStopApplication")
    def to_stop_application(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to stop the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_StopApplication.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toStopApplication", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to add tags to the application.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to remove the specified tags from the application.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to update the application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toUpdateApplication", []))

    @jsii.member(jsii_name="toUpdateApplicationMaintenanceConfiguration")
    def to_update_application_maintenance_configuration(self) -> "KinesisanalyticsV2":
        '''(experimental) Grants permission to update the maintenance configuration of an application.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisanalytics/latest/apiv2/API_UpdateApplicationMaintenanceConfiguration.html

        :stability: experimental
        '''
        return typing.cast("KinesisanalyticsV2", jsii.invoke(self, "toUpdateApplicationMaintenanceConfiguration", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__01c8105ebce963f3e95139d7ed8b91bc226ee9de7e3959b1639364c5131580cf)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0ae1b2b7d0cbccd7fc31bb670468d6658bdbe6c8880789c1c524346ee405fb52)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Kinesisvideo(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Kinesisvideo",
):
    '''(experimental) Statement provider for service `kinesisvideo <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesisvideostreams.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `kinesisvideo <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkinesisvideostreams.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__77ebc077da1d0f6d52235dca9e23d122df115d68f2800426964aa55cf7153bb1)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onChannel")
    def on_channel(
        self,
        channel_name: builtins.str,
        creation_time: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kinesisvideo":
        '''(experimental) Adds a resource of type channel to the statement.

        https://docs.aws.amazon.com/kinesisvideostreams-webrtc-dg/latest/devguide/kvswebrtc-how-it-works.html

        :param channel_name: - Identifier for the channelName.
        :param creation_time: - Identifier for the creationTime.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c8f67ea670058e5aed89fd22aa7c3471f3759233287101b8405bbedcb7ef7971)
            check_type(argname="argument channel_name", value=channel_name, expected_type=type_hints["channel_name"])
            check_type(argname="argument creation_time", value=creation_time, expected_type=type_hints["creation_time"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kinesisvideo", jsii.invoke(self, "onChannel", [channel_name, creation_time, account, region, partition]))

    @jsii.member(jsii_name="onStream")
    def on_stream(
        self,
        stream_name: builtins.str,
        creation_time: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kinesisvideo":
        '''(experimental) Adds a resource of type stream to the statement.

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/how-it-works.html

        :param stream_name: - Identifier for the streamName.
        :param creation_time: - Identifier for the creationTime.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1a251601935a455bbd75e815a10ac94df7f69b262de11b8c83803e688f955745)
            check_type(argname="argument stream_name", value=stream_name, expected_type=type_hints["stream_name"])
            check_type(argname="argument creation_time", value=creation_time, expected_type=type_hints["creation_time"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kinesisvideo", jsii.invoke(self, "onStream", [stream_name, creation_time, account, region, partition]))

    @jsii.member(jsii_name="toConnectAsMaster")
    def to_connect_as_master(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to connect as a master to the signaling channel specified by the endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_ConnectAsMaster.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toConnectAsMaster", []))

    @jsii.member(jsii_name="toConnectAsViewer")
    def to_connect_as_viewer(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to connect as a viewer to the signaling channel specified by the endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_ConnectAsViewer.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toConnectAsViewer", []))

    @jsii.member(jsii_name="toCreateSignalingChannel")
    def to_create_signaling_channel(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to create a signaling channel.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_CreateSignalingChannel.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toCreateSignalingChannel", []))

    @jsii.member(jsii_name="toCreateStream")
    def to_create_stream(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to create a Kinesis video stream.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_CreateStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toCreateStream", []))

    @jsii.member(jsii_name="toDeleteSignalingChannel")
    def to_delete_signaling_channel(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to delete an existing signaling channel.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_DeleteSignalingChannel.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toDeleteSignalingChannel", []))

    @jsii.member(jsii_name="toDeleteStream")
    def to_delete_stream(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to delete an existing Kinesis video stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_DeleteStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toDeleteStream", []))

    @jsii.member(jsii_name="toDescribeEdgeConfiguration")
    def to_describe_edge_configuration(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to describe the edge configuration of your Kinesis Video Stream.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_DescribeEdgeConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toDescribeEdgeConfiguration", []))

    @jsii.member(jsii_name="toDescribeImageGenerationConfiguration")
    def to_describe_image_generation_configuration(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to describe the image generation configuration of your Kinesis video stream.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_DescribeImageGenerationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toDescribeImageGenerationConfiguration", []))

    @jsii.member(jsii_name="toDescribeMappedResourceConfiguration")
    def to_describe_mapped_resource_configuration(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to describe the resource mapped to the Kinesis video stream.

        Access Level: List

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_DescribeMappedResourceConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toDescribeMappedResourceConfiguration", []))

    @jsii.member(jsii_name="toDescribeMediaStorageConfiguration")
    def to_describe_media_storage_configuration(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to describe the media storage configuration of a signaling channel.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_DescribeMediaStorageConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toDescribeMediaStorageConfiguration", []))

    @jsii.member(jsii_name="toDescribeNotificationConfiguration")
    def to_describe_notification_configuration(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to describe the notification configuration of your Kinesis video stream.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_DescribeNotificationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toDescribeNotificationConfiguration", []))

    @jsii.member(jsii_name="toDescribeSignalingChannel")
    def to_describe_signaling_channel(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to describe the specified signaling channel.

        Access Level: List

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_DescribeSignalingChannel.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toDescribeSignalingChannel", []))

    @jsii.member(jsii_name="toDescribeStream")
    def to_describe_stream(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to describe the specified Kinesis video stream.

        Access Level: List

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_DescribeStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toDescribeStream", []))

    @jsii.member(jsii_name="toGetClip")
    def to_get_clip(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to get a media clip from a video stream.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_reader_GetClip.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toGetClip", []))

    @jsii.member(jsii_name="toGetDASHStreamingSessionURL")
    def to_get_dash_streaming_session_url(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to create a URL for MPEG-DASH video streaming.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_reader_GetDASHStreamingSessionURL.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toGetDASHStreamingSessionURL", []))

    @jsii.member(jsii_name="toGetDataEndpoint")
    def to_get_data_endpoint(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to get an endpoint for a specified stream for either reading or writing media data to Kinesis Video Streams.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_GetDataEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toGetDataEndpoint", []))

    @jsii.member(jsii_name="toGetHLSStreamingSessionURL")
    def to_get_hls_streaming_session_url(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to create a URL for HLS video streaming.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_reader_GetHLSStreamingSessionURL.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toGetHLSStreamingSessionURL", []))

    @jsii.member(jsii_name="toGetIceServerConfig")
    def to_get_ice_server_config(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to get the ICE server configuration.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_AWSAcuitySignalingService_GetIceServerConfig.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toGetIceServerConfig", []))

    @jsii.member(jsii_name="toGetImages")
    def to_get_images(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to get generated images from your Kinesis video stream.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_reader_GetImages.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toGetImages", []))

    @jsii.member(jsii_name="toGetMedia")
    def to_get_media(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to return media content of a Kinesis video stream.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_dataplane_GetMedia.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toGetMedia", []))

    @jsii.member(jsii_name="toGetMediaForFragmentList")
    def to_get_media_for_fragment_list(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to read and return media data only from persisted storage.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_reader_GetMediaForFragmentList.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toGetMediaForFragmentList", []))

    @jsii.member(jsii_name="toGetSignalingChannelEndpoint")
    def to_get_signaling_channel_endpoint(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to get endpoints for a specified combination of protocol and role for a signaling channel.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_GetSignalingChannelEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toGetSignalingChannelEndpoint", []))

    @jsii.member(jsii_name="toJoinStorageSession")
    def to_join_storage_session(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to join a storage session for a channel.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_AWSAcuityRoutingServiceLambda_JoinStorageSession.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toJoinStorageSession", []))

    @jsii.member(jsii_name="toListFragments")
    def to_list_fragments(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to list the fragments from archival storage based on the pagination token or selector type with range specified.

        Access Level: List

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_reader_ListFragments.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toListFragments", []))

    @jsii.member(jsii_name="toListSignalingChannels")
    def to_list_signaling_channels(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to list your signaling channels.

        Access Level: List

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_ListSignalingChannels.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toListSignalingChannels", []))

    @jsii.member(jsii_name="toListStreams")
    def to_list_streams(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to list your Kinesis video streams.

        Access Level: List

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_ListStreams.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toListStreams", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to fetch the tags associated with your resource.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTagsForStream")
    def to_list_tags_for_stream(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to fetch the tags associated with Kinesis video stream.

        Access Level: Read

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_ListTagsForStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toListTagsForStream", []))

    @jsii.member(jsii_name="toPutMedia")
    def to_put_media(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to send media data to a Kinesis video stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_dataplane_PutMedia.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toPutMedia", []))

    @jsii.member(jsii_name="toSendAlexaOfferToMaster")
    def to_send_alexa_offer_to_master(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to send the Alexa SDP offer to the master.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_AWSAcuitySignalingService_SendAlexaOfferToMaster.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toSendAlexaOfferToMaster", []))

    @jsii.member(jsii_name="toStartEdgeConfigurationUpdate")
    def to_start_edge_configuration_update(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to start edge configuration update of your Kinesis Video Stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_StartEdgeConfigurationUpdate.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toStartEdgeConfigurationUpdate", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to attach set of tags to your resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTagStream")
    def to_tag_stream(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to attach set of tags to your Kinesis video streams.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_TagStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toTagStream", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to remove one or more tags from your resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUntagStream")
    def to_untag_stream(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to remove one or more tags from your Kinesis video streams.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_UntagStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toUntagStream", []))

    @jsii.member(jsii_name="toUpdateDataRetention")
    def to_update_data_retention(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to update the data retention period of your Kinesis video stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_UpdateDataRetention.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toUpdateDataRetention", []))

    @jsii.member(jsii_name="toUpdateImageGenerationConfiguration")
    def to_update_image_generation_configuration(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to update the image generation configuration of your Kinesis video stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_UpdateImageGenerationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toUpdateImageGenerationConfiguration", []))

    @jsii.member(jsii_name="toUpdateMediaStorageConfiguration")
    def to_update_media_storage_configuration(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to create or update an mapping between a signaling channel and stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_UpdateMediaStorageConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toUpdateMediaStorageConfiguration", []))

    @jsii.member(jsii_name="toUpdateNotificationConfiguration")
    def to_update_notification_configuration(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to update the notification configuration of your Kinesis video stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_UpdateNotificationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toUpdateNotificationConfiguration", []))

    @jsii.member(jsii_name="toUpdateSignalingChannel")
    def to_update_signaling_channel(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to update an existing signaling channel.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_UpdateSignalingChannel.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toUpdateSignalingChannel", []))

    @jsii.member(jsii_name="toUpdateStream")
    def to_update_stream(self) -> "Kinesisvideo":
        '''(experimental) Grants permission to update an existing Kinesis video stream.

        Access Level: Write

        https://docs.aws.amazon.com/kinesisvideostreams/latest/dg/API_UpdateStream.html

        :stability: experimental
        '''
        return typing.cast("Kinesisvideo", jsii.invoke(self, "toUpdateStream", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__38bf2cb6a9f40c5a85495fe35f813f9a4d015bbdc23bdd7a4823376537e53c28)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__698a424236128afc815c96de20288c42c3ea0ea881d7229d37591b000a37d0d0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Kms(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Kms"):
    '''(experimental) Statement provider for service `kms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awskeymanagementservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `kms <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awskeymanagementservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c1aa6ee570236293987b3df70da700d247debd3521291b6b34d08cd289037fd9)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifBypassPolicyLockoutSafetyCheck")
    def if_bypass_policy_lockout_safety_check(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the CreateKey and PutKeyPolicy operations based on the value of the BypassPolicyLockoutSafetyCheck parameter in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-bypass-policy-lockout-safety-check

        Applies to actions:

        - .toCreateKey()
        - .toPutKeyPolicy()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1590d1f22d639def4172f4aa5002cc5c9804caa36d2d772fd740cb976ed04cee)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Kms", jsii.invoke(self, "ifBypassPolicyLockoutSafetyCheck", [value]))

    @jsii.member(jsii_name="ifCallerAccount")
    def if_caller_account(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to specified AWS KMS operations based on the AWS account ID of the caller.

        You can use this condition key to allow or deny access to all IAM users and roles in an AWS account in a single policy statement

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-caller-account

        Applies to actions:

        - .toCancelKeyDeletion()
        - .toConnectCustomKeyStore()
        - .toCreateAlias()
        - .toCreateCustomKeyStore()
        - .toCreateGrant()
        - .toCreateKey()
        - .toDecrypt()
        - .toDeleteAlias()
        - .toDeleteCustomKeyStore()
        - .toDeleteImportedKeyMaterial()
        - .toDescribeCustomKeyStores()
        - .toDescribeKey()
        - .toDisableKey()
        - .toDisableKeyRotation()
        - .toDisconnectCustomKeyStore()
        - .toEnableKey()
        - .toEnableKeyRotation()
        - .toEncrypt()
        - .toGenerateDataKey()
        - .toGenerateDataKeyPair()
        - .toGenerateDataKeyPairWithoutPlaintext()
        - .toGenerateDataKeyWithoutPlaintext()
        - .toGenerateMac()
        - .toGetKeyPolicy()
        - .toGetKeyRotationStatus()
        - .toGetParametersForImport()
        - .toGetPublicKey()
        - .toImportKeyMaterial()
        - .toListGrants()
        - .toListKeyPolicies()
        - .toListResourceTags()
        - .toPutKeyPolicy()
        - .toReEncryptFrom()
        - .toReEncryptTo()
        - .toReplicateKey()
        - .toRevokeGrant()
        - .toScheduleKeyDeletion()
        - .toSign()
        - .toTagResource()
        - .toUntagResource()
        - .toUpdateAlias()
        - .toUpdateCustomKeyStore()
        - .toUpdateKeyDescription()
        - .toUpdatePrimaryRegion()
        - .toVerify()
        - .toVerifyMac()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__13d80b5be3b4ba9f6da56fd68c308641baa082f88709793b9ce92afd11f7fce1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifCallerAccount", [value, operator]))

    @jsii.member(jsii_name="ifCustomerMasterKeySpec")
    def if_customer_master_key_spec(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) The kms:CustomerMasterKeySpec condition key is deprecated. Instead, use the kms:KeySpec condition key.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-key-spec-replaced

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4a42ea0c2cf8d77300dff74b0d3b6896d118a5e92b1e998d8f07ad3def7ca5ac)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifCustomerMasterKeySpec", [value, operator]))

    @jsii.member(jsii_name="ifCustomerMasterKeyUsage")
    def if_customer_master_key_usage(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) The kms:CustomerMasterKeyUsage condition key is deprecated. Instead, use the kms:KeyUsage condition key.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-key-usage-replaced

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a7759bc4ec89bb74f15d0dfe61b86a067b55f80458a5c2d63fdf601ce8adf651)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifCustomerMasterKeyUsage", [value, operator]))

    @jsii.member(jsii_name="ifDataKeyPairSpec")
    def if_data_key_pair_spec(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to GenerateDataKeyPair and GenerateDataKeyPairWithoutPlaintext operations based on the value of the KeyPairSpec parameter in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-data-key-pair-spec

        Applies to actions:

        - .toGenerateDataKeyPair()
        - .toGenerateDataKeyPairWithoutPlaintext()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ab9d499f1c70537ec14b851054fba90fff57368eafcf823584f23482d4a43dfa)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifDataKeyPairSpec", [value, operator]))

    @jsii.member(jsii_name="ifEncryptionAlgorithm")
    def if_encryption_algorithm(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to encryption operations based on the value of the encryption algorithm in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-encryption-algorithm

        Applies to actions:

        - .toDecrypt()
        - .toEncrypt()
        - .toGenerateDataKey()
        - .toGenerateDataKeyPair()
        - .toGenerateDataKeyPairWithoutPlaintext()
        - .toGenerateDataKeyWithoutPlaintext()
        - .toReEncryptFrom()
        - .toReEncryptTo()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__90e01794d7db8a7259884106bfaa83dc2c85f4e1d9ae5cb426a06b7fa714a9dd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifEncryptionAlgorithm", [value, operator]))

    @jsii.member(jsii_name="ifEncryptionContext")
    def if_encryption_context(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to a symmetric AWS KMS key based on the encryption context in a cryptographic operation.

        This condition evaluates the key and value in each key-value encryption context pair

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-encryption-context

        Applies to actions:

        - .toCreateGrant()
        - .toDecrypt()
        - .toEncrypt()
        - .toGenerateDataKey()
        - .toGenerateDataKeyPair()
        - .toGenerateDataKeyPairWithoutPlaintext()
        - .toGenerateDataKeyWithoutPlaintext()
        - .toReEncryptFrom()
        - .toReEncryptTo()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cbfeb085da1663e18153ede3ba3e697183550d57d9ebbc80b7fd7a3dcbd62470)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifEncryptionContext", [value, operator]))

    @jsii.member(jsii_name="ifEncryptionContextKeys")
    def if_encryption_context_keys(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to a symmetric AWS KMS key based on the encryption context in a cryptographic operation.

        This condition key evaluates only the key in each key-value encryption context pair

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-encryption-context-keys

        Applies to actions:

        - .toCreateGrant()
        - .toDecrypt()
        - .toEncrypt()
        - .toGenerateDataKey()
        - .toGenerateDataKeyPair()
        - .toGenerateDataKeyPairWithoutPlaintext()
        - .toGenerateDataKeyWithoutPlaintext()
        - .toReEncryptFrom()
        - .toReEncryptTo()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__72fe404b4e061b8d4806c7c3ec0db804e3f029f9f520dfecd93ed3c36e2dbc77)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifEncryptionContextKeys", [value, operator]))

    @jsii.member(jsii_name="ifExpirationModel")
    def if_expiration_model(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the ImportKeyMaterial operation based on the value of the ExpirationModel parameter in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-expiration-model

        Applies to actions:

        - .toImportKeyMaterial()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__188514595dffdb5a885038b71f3ac56c1e47715a53d4d040ea47ec4991f0e758)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifExpirationModel", [value, operator]))

    @jsii.member(jsii_name="ifGrantConstraintType")
    def if_grant_constraint_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the CreateGrant operation based on the grant constraint in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-grant-constraint-type

        Applies to actions:

        - .toCreateGrant()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1ac22341b9a74ef7d911be4056dff43f05ca3192d13973c956fc35ad916af609)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifGrantConstraintType", [value, operator]))

    @jsii.member(jsii_name="ifGranteePrincipal")
    def if_grantee_principal(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the CreateGrant operation based on the grantee principal in the grant.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-grantee-principal

        Applies to actions:

        - .toCreateGrant()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3af162ef07b3656cfe5c395afd1409c3c1c502c4387f3f84b74db0532b5f1138)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifGranteePrincipal", [value, operator]))

    @jsii.member(jsii_name="ifGrantIsForAWSResource")
    def if_grant_is_for_aws_resource(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the CreateGrant operation when the request comes from a specified AWS service.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-grant-is-for-aws-resource

        Applies to actions:

        - .toCreateGrant()
        - .toListGrants()
        - .toRevokeGrant()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__81a299c2957698b3316591e334769b82a6727877311c118407c41634f3094dd3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Kms", jsii.invoke(self, "ifGrantIsForAWSResource", [value]))

    @jsii.member(jsii_name="ifGrantOperations")
    def if_grant_operations(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the CreateGrant operation based on the operations in the grant.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-grant-operations

        Applies to actions:

        - .toCreateGrant()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__53428520346ccc25526028499a54027b4392a1d6ab94eeb29961f08e4d794267)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifGrantOperations", [value, operator]))

    @jsii.member(jsii_name="ifKeyOrigin")
    def if_key_origin(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to an API operation based on the Origin property of the AWS KMS key created by or used in the operation.

        Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a KMS key

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-key-origin

        Applies to actions:

        - .toCreateKey()

        Applies to resource types:

        - key

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__23481cb561db8feb27d68baed4fb6bd3c047458955458adbf871c0d3feed0729)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifKeyOrigin", [value, operator]))

    @jsii.member(jsii_name="ifKeySpec")
    def if_key_spec(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to an API operation based on the KeySpec property of the AWS KMS key that is created by or used in the operation.

        Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a KMS key resource

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-key-spec

        Applies to actions:

        - .toCreateKey()

        Applies to resource types:

        - key

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4d01600747d8ef4fcf659cb54fbaea98136a2b2ac787261632e52cadc0fba6b8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifKeySpec", [value, operator]))

    @jsii.member(jsii_name="ifKeyUsage")
    def if_key_usage(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to an API operation based on the KeyUsage property of the AWS KMS key created by or used in the operation.

        Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a KMS key resource

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-key-usage

        Applies to actions:

        - .toCreateKey()

        Applies to resource types:

        - key

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__65ea8040fdc11010ccfdf86a4613b1af747ce28f0db6a1ec00354bc5a54c7428)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifKeyUsage", [value, operator]))

    @jsii.member(jsii_name="ifMacAlgorithm")
    def if_mac_algorithm(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the GenerateMac and VerifyMac operations based on the MacAlgorithm parameter in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-mac-algorithm

        Applies to actions:

        - .toGenerateMac()
        - .toVerifyMac()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__89fc9308984fe8444312c565012f9de2c25edc683d231d73485c60513d1a21bb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifMacAlgorithm", [value, operator]))

    @jsii.member(jsii_name="ifMessageType")
    def if_message_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the Sign and Verify operations based on the value of the MessageType parameter in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-message-type

        Applies to actions:

        - .toSign()
        - .toVerify()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eafdc89b3b621fe5fd177af8746e492da48f6b26fe4dab878d4198172372c2ec)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifMessageType", [value, operator]))

    @jsii.member(jsii_name="ifMultiRegion")
    def if_multi_region(self, value: typing.Optional[builtins.bool] = None) -> "Kms":
        '''(experimental) Filters access to an API operation based on the MultiRegion property of the AWS KMS key created by or used in the operation.

        Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a KMS key resource

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-multi-region

        Applies to actions:

        - .toCreateKey()

        Applies to resource types:

        - key

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2c9060963aabdcc838bd69e80973b44ab69dd492f3e515092d1a3c48ce514d72)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Kms", jsii.invoke(self, "ifMultiRegion", [value]))

    @jsii.member(jsii_name="ifMultiRegionKeyType")
    def if_multi_region_key_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to an API operation based on the MultiRegionKeyType property of the AWS KMS key created by or used in the operation.

        Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a KMS key resource

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-multi-region-key-type

        Applies to actions:

        - .toCreateKey()

        Applies to resource types:

        - key

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f7e048d945666f6df238d86c5a306fadd4a379a3b72280322eafa02b72e2b444)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifMultiRegionKeyType", [value, operator]))

    @jsii.member(jsii_name="ifPrimaryRegion")
    def if_primary_region(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the UpdatePrimaryRegion operation based on the value of the PrimaryRegion parameter in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-primary-region

        Applies to actions:

        - .toUpdatePrimaryRegion()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cc1cc0e1cde9c50861b9f90d037dbed62c60955d76423ea9b1f2db49907aa36e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifPrimaryRegion", [value, operator]))

    @jsii.member(jsii_name="ifRecipientAttestation")
    def if_recipient_attestation(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the Decrypt, GenerateDataKey, and GenerateRandom operations based on the platform configuration registers (PCRs) in the attestation document in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-nitro-enclaves.html#conditions-kms-recipient-pcrs

        Applies to actions:

        - .toDecrypt()
        - .toGenerateDataKey()
        - .toGenerateRandom()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e97bd2e0a93451f42957a2826bceb73c8e74679b1c5910e818a3f5505931ef90)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifRecipientAttestation", [value, operator]))

    @jsii.member(jsii_name="ifReEncryptOnSameKey")
    def if_re_encrypt_on_same_key(
        self,
        value: typing.Optional[builtins.bool] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the ReEncrypt operation when it uses the same AWS KMS key that was used for the Encrypt operation.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-reencrypt-on-same-key

        Applies to actions:

        - .toReEncryptFrom()
        - .toReEncryptTo()

        :param value: ``true`` or ``false``. **Default:** ``true``

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d2f05eacec66812e162b2549b9c51713517c9611107f598961d4aba14f09ed5a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        return typing.cast("Kms", jsii.invoke(self, "ifReEncryptOnSameKey", [value]))

    @jsii.member(jsii_name="ifReplicaRegion")
    def if_replica_region(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the ReplicateKey operation based on the value of the ReplicaRegion parameter in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-replica-region

        Applies to actions:

        - .toReplicateKey()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5e528aca2e734b66903907c524a1c0319edffb497680327373d8b57237832945)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifReplicaRegion", [value, operator]))

    @jsii.member(jsii_name="ifRequestAlias")
    def if_request_alias(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to cryptographic operations, DescribeKey, and GetPublicKey based on the alias in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-request-alias

        Applies to actions:

        - .toDecrypt()
        - .toDescribeKey()
        - .toEncrypt()
        - .toGenerateDataKey()
        - .toGenerateDataKeyPair()
        - .toGenerateDataKeyPairWithoutPlaintext()
        - .toGenerateDataKeyWithoutPlaintext()
        - .toGenerateMac()
        - .toGetPublicKey()
        - .toReEncryptFrom()
        - .toReEncryptTo()
        - .toSign()
        - .toVerify()
        - .toVerifyMac()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8fd3786b9f5e723b214b62fe81b72f4a92160febb8bc4632e7af2df956b894d8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifRequestAlias", [value, operator]))

    @jsii.member(jsii_name="ifResourceAliases")
    def if_resource_aliases(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to specified AWS KMS operations based on aliases associated with the AWS KMS key.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-resource-aliases

        Applies to resource types:

        - key

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__232f076fedf6eae69db40b5ce839120ffb46fa615c91ddb4bf1657d2c3f006ef)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifResourceAliases", [value, operator]))

    @jsii.member(jsii_name="ifRetiringPrincipal")
    def if_retiring_principal(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the CreateGrant operation based on the retiring principal in the grant.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-retiring-principal

        Applies to actions:

        - .toCreateGrant()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__451427fdaeb0c883a8f10a9c0e77b9d39df966705933e017d4200657ba1441e9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifRetiringPrincipal", [value, operator]))

    @jsii.member(jsii_name="ifSigningAlgorithm")
    def if_signing_algorithm(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the Sign and Verify operations based on the signing algorithm in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-signing-algorithm

        Applies to actions:

        - .toSign()
        - .toVerify()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d089853f0ff5667dbe92b7dfbae2d1ab12a255f41a1f58ff6ad49554270b0ea4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifSigningAlgorithm", [value, operator]))

    @jsii.member(jsii_name="ifValidTo")
    def if_valid_to(
        self,
        value: typing.Union[builtins.str, datetime.datetime, typing.Sequence[typing.Union[builtins.str, datetime.datetime]]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the ImportKeyMaterial operation based on the value of the ValidTo parameter in the request.

        You can use this condition key to allow users to import key material only when it expires by the specified date

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-valid-to

        Applies to actions:

        - .toImportKeyMaterial()

        :param value: The value(s) to check.
        :param operator: Works with `date operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Date>`_. **Default:** ``DateEquals``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a3a94e97cd0737afc82d0841b9f97bb066e6f8884bdc95d296a9d8eddf431a5c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifValidTo", [value, operator]))

    @jsii.member(jsii_name="ifViaService")
    def if_via_service(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access when a request made on the principal's behalf comes from a specified AWS service.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-via-service

        Applies to actions:

        - .toCancelKeyDeletion()
        - .toCreateAlias()
        - .toCreateGrant()
        - .toCreateKey()
        - .toDecrypt()
        - .toDeleteAlias()
        - .toDeleteImportedKeyMaterial()
        - .toDescribeKey()
        - .toDisableKey()
        - .toDisableKeyRotation()
        - .toEnableKey()
        - .toEnableKeyRotation()
        - .toEncrypt()
        - .toGenerateDataKey()
        - .toGenerateDataKeyPair()
        - .toGenerateDataKeyPairWithoutPlaintext()
        - .toGenerateDataKeyWithoutPlaintext()
        - .toGenerateMac()
        - .toGetKeyPolicy()
        - .toGetKeyRotationStatus()
        - .toGetParametersForImport()
        - .toGetPublicKey()
        - .toImportKeyMaterial()
        - .toListGrants()
        - .toListKeyPolicies()
        - .toListResourceTags()
        - .toPutKeyPolicy()
        - .toReEncryptFrom()
        - .toReEncryptTo()
        - .toReplicateKey()
        - .toRevokeGrant()
        - .toScheduleKeyDeletion()
        - .toSign()
        - .toTagResource()
        - .toUntagResource()
        - .toUpdateAlias()
        - .toUpdateKeyDescription()
        - .toUpdatePrimaryRegion()
        - .toVerify()
        - .toVerifyMac()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b26ccd7854eab592e53b87bf0041a4abc55040e52b91bd5df5b7e9fd9c838330)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifViaService", [value, operator]))

    @jsii.member(jsii_name="ifWrappingAlgorithm")
    def if_wrapping_algorithm(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the GetParametersForImport operation based on the value of the WrappingAlgorithm parameter in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-wrapping-algorithm

        Applies to actions:

        - .toGetParametersForImport()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ef32b42d980940a327622227809732776a920b0562aa473622a8890b3805531b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifWrappingAlgorithm", [value, operator]))

    @jsii.member(jsii_name="ifWrappingKeySpec")
    def if_wrapping_key_spec(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Kms":
        '''(experimental) Filters access to the GetParametersForImport operation based on the value of the WrappingKeySpec parameter in the request.

        https://docs.aws.amazon.com/kms/latest/developerguide/conditions-kms.html#conditions-kms-wrapping-key-spec

        Applies to actions:

        - .toGetParametersForImport()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fe3b22563e6e87e75e81135849609d051be743c2ec7e2f1d6c308a8e072c2f8a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Kms", jsii.invoke(self, "ifWrappingKeySpec", [value, operator]))

    @jsii.member(jsii_name="onAlias")
    def on_alias(
        self,
        alias: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kms":
        '''(experimental) Adds a resource of type alias to the statement.

        https://docs.aws.amazon.com/kms/latest/developerguide/programming-aliases.html

        :param alias: - Identifier for the alias.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8b56304c17bcfde39f402c9064895ed82b57a0d4affbe554bdcfdcea6659950f)
            check_type(argname="argument alias", value=alias, expected_type=type_hints["alias"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kms", jsii.invoke(self, "onAlias", [alias, account, region, partition]))

    @jsii.member(jsii_name="onKey")
    def on_key(
        self,
        key_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Kms":
        '''(experimental) Adds a resource of type key to the statement.

        https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#kms_keys

        :param key_id: - Identifier for the keyId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag() - .ifKeyOrigin() - .ifKeySpec() - .ifKeyUsage() - .ifMultiRegion() - .ifMultiRegionKeyType() - .ifResourceAliases()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__01b05735a35703074cde36ff31c4b0dd1edf34e939c5a56a759df1bfce352b36)
            check_type(argname="argument key_id", value=key_id, expected_type=type_hints["key_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Kms", jsii.invoke(self, "onKey", [key_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelKeyDeletion")
    def to_cancel_key_deletion(self) -> "Kms":
        '''(experimental) Controls permission to cancel the scheduled deletion of an AWS KMS key.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_CancelKeyDeletion.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toCancelKeyDeletion", []))

    @jsii.member(jsii_name="toConnectCustomKeyStore")
    def to_connect_custom_key_store(self) -> "Kms":
        '''(experimental) Controls permission to connect or reconnect a custom key store to its associated AWS CloudHSM cluster.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ConnectCustomKeyStore.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toConnectCustomKeyStore", []))

    @jsii.member(jsii_name="toCreateAlias")
    def to_create_alias(self) -> "Kms":
        '''(experimental) Controls permission to create an alias for an AWS KMS key.

        Aliases are optional friendly names that you can associate with KMS keys

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateAlias.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toCreateAlias", []))

    @jsii.member(jsii_name="toCreateCustomKeyStore")
    def to_create_custom_key_store(self) -> "Kms":
        '''(experimental) Controls permission to create a custom key store that is associated with an AWS CloudHSM cluster that you own and manage.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()

        Dependent actions:

        - cloudhsm:DescribeClusters
        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateCustomKeyStore.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toCreateCustomKeyStore", []))

    @jsii.member(jsii_name="toCreateGrant")
    def to_create_grant(self) -> "Kms":
        '''(experimental) Controls permission to add a grant to an AWS KMS key.

        You can use grants to add permissions without changing the key policy or IAM policy

        Access Level: Permissions management

        Possible conditions:

        - .ifCallerAccount()
        - .ifEncryptionContext()
        - .ifEncryptionContextKeys()
        - .ifGrantConstraintType()
        - .ifGranteePrincipal()
        - .ifGrantIsForAWSResource()
        - .ifGrantOperations()
        - .ifRetiringPrincipal()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateGrant.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toCreateGrant", []))

    @jsii.member(jsii_name="toCreateKey")
    def to_create_key(self) -> "Kms":
        '''(experimental) Controls permission to create an AWS KMS key that can be used to protect data keys and other sensitive information.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifBypassPolicyLockoutSafetyCheck()
        - .ifCallerAccount()
        - .ifKeySpec()
        - .ifKeyUsage()
        - .ifKeyOrigin()
        - .ifMultiRegion()
        - .ifMultiRegionKeyType()
        - .ifViaService()

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - kms:PutKeyPolicy
        - kms:TagResource

        https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateKey.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toCreateKey", []))

    @jsii.member(jsii_name="toDecrypt")
    def to_decrypt(self) -> "Kms":
        '''(experimental) Controls permission to decrypt ciphertext that was encrypted under an AWS KMS key.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifEncryptionAlgorithm()
        - .ifEncryptionContext()
        - .ifEncryptionContextKeys()
        - .ifRecipientAttestation()
        - .ifRequestAlias()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toDecrypt", []))

    @jsii.member(jsii_name="toDeleteAlias")
    def to_delete_alias(self) -> "Kms":
        '''(experimental) Controls permission to delete an alias. Aliases are optional friendly names that you can associate with AWS KMS keys.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteAlias.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toDeleteAlias", []))

    @jsii.member(jsii_name="toDeleteCustomKeyStore")
    def to_delete_custom_key_store(self) -> "Kms":
        '''(experimental) Controls permission to delete a custom key store.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteCustomKeyStore.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toDeleteCustomKeyStore", []))

    @jsii.member(jsii_name="toDeleteImportedKeyMaterial")
    def to_delete_imported_key_material(self) -> "Kms":
        '''(experimental) Controls permission to delete cryptographic material that you imported into an AWS KMS key.

        This action makes the key unusable

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_DeleteImportedKeyMaterial.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toDeleteImportedKeyMaterial", []))

    @jsii.member(jsii_name="toDescribeCustomKeyStores")
    def to_describe_custom_key_stores(self) -> "Kms":
        '''(experimental) Controls permission to view detailed information about custom key stores in the account and region.

        Access Level: Read

        Possible conditions:

        - .ifCallerAccount()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeCustomKeyStores.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toDescribeCustomKeyStores", []))

    @jsii.member(jsii_name="toDescribeKey")
    def to_describe_key(self) -> "Kms":
        '''(experimental) Controls permission to view detailed information about an AWS KMS key.

        Access Level: Read

        Possible conditions:

        - .ifCallerAccount()
        - .ifRequestAlias()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_DescribeKey.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toDescribeKey", []))

    @jsii.member(jsii_name="toDisableKey")
    def to_disable_key(self) -> "Kms":
        '''(experimental) Controls permission to disable an AWS KMS key, which prevents it from being used in cryptographic operations.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKey.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toDisableKey", []))

    @jsii.member(jsii_name="toDisableKeyRotation")
    def to_disable_key_rotation(self) -> "Kms":
        '''(experimental) Controls permission to disable automatic rotation of a customer managed AWS KMS key.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_DisableKeyRotation.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toDisableKeyRotation", []))

    @jsii.member(jsii_name="toDisconnectCustomKeyStore")
    def to_disconnect_custom_key_store(self) -> "Kms":
        '''(experimental) Controls permission to disconnect the custom key store from its associated AWS CloudHSM cluster.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_DisconnectCustomKeyStore.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toDisconnectCustomKeyStore", []))

    @jsii.member(jsii_name="toEnableKey")
    def to_enable_key(self) -> "Kms":
        '''(experimental) Controls permission to change the state of an AWS KMS key to enabled.

        This allows the KMS key to be used in cryptographic operations

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKey.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toEnableKey", []))

    @jsii.member(jsii_name="toEnableKeyRotation")
    def to_enable_key_rotation(self) -> "Kms":
        '''(experimental) Controls permission to enable automatic rotation of the cryptographic material in an AWS KMS key.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_EnableKeyRotation.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toEnableKeyRotation", []))

    @jsii.member(jsii_name="toEncrypt")
    def to_encrypt(self) -> "Kms":
        '''(experimental) Controls permission to use the specified AWS KMS key to encrypt data and data keys.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifEncryptionAlgorithm()
        - .ifEncryptionContext()
        - .ifEncryptionContextKeys()
        - .ifRequestAlias()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_Encrypt.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toEncrypt", []))

    @jsii.member(jsii_name="toGenerateDataKey")
    def to_generate_data_key(self) -> "Kms":
        '''(experimental) Controls permission to use the AWS KMS key to generate data keys.

        You can use the data keys to encrypt data outside of AWS KMS

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifEncryptionAlgorithm()
        - .ifEncryptionContext()
        - .ifEncryptionContextKeys()
        - .ifRecipientAttestation()
        - .ifRequestAlias()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toGenerateDataKey", []))

    @jsii.member(jsii_name="toGenerateDataKeyPair")
    def to_generate_data_key_pair(self) -> "Kms":
        '''(experimental) Controls permission to use the AWS KMS key to generate data key pairs.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifDataKeyPairSpec()
        - .ifEncryptionAlgorithm()
        - .ifEncryptionContext()
        - .ifEncryptionContextKeys()
        - .ifRequestAlias()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toGenerateDataKeyPair", []))

    @jsii.member(jsii_name="toGenerateDataKeyPairWithoutPlaintext")
    def to_generate_data_key_pair_without_plaintext(self) -> "Kms":
        '''(experimental) Controls permission to use the AWS KMS key to generate data key pairs.

        Unlike the GenerateDataKeyPair operation, this operation returns an encrypted private key without a plaintext copy

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifDataKeyPairSpec()
        - .ifEncryptionAlgorithm()
        - .ifEncryptionContext()
        - .ifEncryptionContextKeys()
        - .ifRequestAlias()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyPairWithoutPlaintext.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toGenerateDataKeyPairWithoutPlaintext", []))

    @jsii.member(jsii_name="toGenerateDataKeyWithoutPlaintext")
    def to_generate_data_key_without_plaintext(self) -> "Kms":
        '''(experimental) Controls permission to use the AWS KMS key to generate a data key.

        Unlike the GenerateDataKey operation, this operation returns an encrypted data key without a plaintext version of the data key

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifEncryptionAlgorithm()
        - .ifEncryptionContext()
        - .ifEncryptionContextKeys()
        - .ifRequestAlias()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKeyWithoutPlaintext.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toGenerateDataKeyWithoutPlaintext", []))

    @jsii.member(jsii_name="toGenerateMac")
    def to_generate_mac(self) -> "Kms":
        '''(experimental) Controls permission to use the AWS KMS key to generate message authentication codes.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifMacAlgorithm()
        - .ifRequestAlias()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateMac.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toGenerateMac", []))

    @jsii.member(jsii_name="toGenerateRandom")
    def to_generate_random(self) -> "Kms":
        '''(experimental) Controls permission to get a cryptographically secure random byte string from AWS KMS.

        Access Level: Write

        Possible conditions:

        - .ifRecipientAttestation()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateRandom.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toGenerateRandom", []))

    @jsii.member(jsii_name="toGetKeyPolicy")
    def to_get_key_policy(self) -> "Kms":
        '''(experimental) Controls permission to view the key policy for the specified AWS KMS key.

        Access Level: Read

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyPolicy.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toGetKeyPolicy", []))

    @jsii.member(jsii_name="toGetKeyRotationStatus")
    def to_get_key_rotation_status(self) -> "Kms":
        '''(experimental) Controls permission to determine whether automatic key rotation is enabled on the AWS KMS key.

        Access Level: Read

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_GetKeyRotationStatus.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toGetKeyRotationStatus", []))

    @jsii.member(jsii_name="toGetParametersForImport")
    def to_get_parameters_for_import(self) -> "Kms":
        '''(experimental) Controls permission to get data that is required to import cryptographic material into a customer managed key, including a public key and import token.

        Access Level: Read

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()
        - .ifWrappingAlgorithm()
        - .ifWrappingKeySpec()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_GetParametersForImport.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toGetParametersForImport", []))

    @jsii.member(jsii_name="toGetPublicKey")
    def to_get_public_key(self) -> "Kms":
        '''(experimental) Controls permission to download the public key of an asymmetric AWS KMS key.

        Access Level: Read

        Possible conditions:

        - .ifCallerAccount()
        - .ifRequestAlias()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_GetPublicKey.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toGetPublicKey", []))

    @jsii.member(jsii_name="toImportKeyMaterial")
    def to_import_key_material(self) -> "Kms":
        '''(experimental) Controls permission to import cryptographic material into an AWS KMS key.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifExpirationModel()
        - .ifValidTo()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ImportKeyMaterial.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toImportKeyMaterial", []))

    @jsii.member(jsii_name="toListAliases")
    def to_list_aliases(self) -> "Kms":
        '''(experimental) Controls permission to view the aliases that are defined in the account.

        Aliases are optional friendly names that you can associate with AWS KMS keys

        Access Level: List

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ListAliases.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toListAliases", []))

    @jsii.member(jsii_name="toListGrants")
    def to_list_grants(self) -> "Kms":
        '''(experimental) Controls permission to view all grants for an AWS KMS key.

        Access Level: List

        Possible conditions:

        - .ifCallerAccount()
        - .ifGrantIsForAWSResource()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ListGrants.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toListGrants", []))

    @jsii.member(jsii_name="toListKeyPolicies")
    def to_list_key_policies(self) -> "Kms":
        '''(experimental) Controls permission to view the names of key policies for an AWS KMS key.

        Access Level: List

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeyPolicies.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toListKeyPolicies", []))

    @jsii.member(jsii_name="toListKeys")
    def to_list_keys(self) -> "Kms":
        '''(experimental) Controls permission to view the key ID and Amazon Resource Name (ARN) of all AWS KMS keys in the account.

        Access Level: List

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ListKeys.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toListKeys", []))

    @jsii.member(jsii_name="toListResourceTags")
    def to_list_resource_tags(self) -> "Kms":
        '''(experimental) Controls permission to view all tags that are attached to an AWS KMS key.

        Access Level: List

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ListResourceTags.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toListResourceTags", []))

    @jsii.member(jsii_name="toListRetirableGrants")
    def to_list_retirable_grants(self) -> "Kms":
        '''(experimental) Controls permission to view grants in which the specified principal is the retiring principal.

        Other principals might be able to retire the grant and this principal might be able to retire other grants

        Access Level: List

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ListRetirableGrants.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toListRetirableGrants", []))

    @jsii.member(jsii_name="toPutKeyPolicy")
    def to_put_key_policy(self) -> "Kms":
        '''(experimental) Controls permission to replace the key policy for the specified AWS KMS key.

        Access Level: Permissions management

        Possible conditions:

        - .ifBypassPolicyLockoutSafetyCheck()
        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toPutKeyPolicy", []))

    @jsii.member(jsii_name="toReEncryptFrom")
    def to_re_encrypt_from(self) -> "Kms":
        '''(experimental) Controls permission to decrypt data as part of the process that decrypts and reencrypts the data within AWS KMS.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifEncryptionAlgorithm()
        - .ifEncryptionContext()
        - .ifEncryptionContextKeys()
        - .ifReEncryptOnSameKey()
        - .ifRequestAlias()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toReEncryptFrom", []))

    @jsii.member(jsii_name="toReEncryptTo")
    def to_re_encrypt_to(self) -> "Kms":
        '''(experimental) Controls permission to encrypt data as part of the process that decrypts and reencrypts the data within AWS KMS.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifEncryptionAlgorithm()
        - .ifEncryptionContext()
        - .ifEncryptionContextKeys()
        - .ifReEncryptOnSameKey()
        - .ifRequestAlias()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ReEncrypt.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toReEncryptTo", []))

    @jsii.member(jsii_name="toReplicateKey")
    def to_replicate_key(self) -> "Kms":
        '''(experimental) Controls permission to replicate a multi-Region primary key.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifReplicaRegion()
        - .ifViaService()

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - kms:CreateKey
        - kms:PutKeyPolicy
        - kms:TagResource

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ReplicateKey.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toReplicateKey", []))

    @jsii.member(jsii_name="toRetireGrant")
    def to_retire_grant(self) -> "Kms":
        '''(experimental) Controls permission to retire a grant.

        The RetireGrant operation is typically called by the grant user after they complete the tasks that the grant allowed them to perform

        Access Level: Permissions management

        https://docs.aws.amazon.com/kms/latest/APIReference/API_RetireGrant.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toRetireGrant", []))

    @jsii.member(jsii_name="toRevokeGrant")
    def to_revoke_grant(self) -> "Kms":
        '''(experimental) Controls permission to revoke a grant, which denies permission for all operations that depend on the grant.

        Access Level: Permissions management

        Possible conditions:

        - .ifCallerAccount()
        - .ifGrantIsForAWSResource()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_RevokeGrant.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toRevokeGrant", []))

    @jsii.member(jsii_name="toScheduleKeyDeletion")
    def to_schedule_key_deletion(self) -> "Kms":
        '''(experimental) Controls permission to schedule deletion of an AWS KMS key.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_ScheduleKeyDeletion.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toScheduleKeyDeletion", []))

    @jsii.member(jsii_name="toSign")
    def to_sign(self) -> "Kms":
        '''(experimental) Controls permission to produce a digital signature for a message.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifMessageType()
        - .ifRequestAlias()
        - .ifSigningAlgorithm()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toSign", []))

    @jsii.member(jsii_name="toSynchronizeMultiRegionKey")
    def to_synchronize_multi_region_key(self) -> "Kms":
        '''(experimental) Controls access to internal APIs that synchronize multi-Region keys.

        Access Level: Write

        https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-auth.html#multi-region-auth-slr

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toSynchronizeMultiRegionKey", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Kms":
        '''(experimental) Controls permission to create or update tags that are attached to an AWS KMS key.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Kms":
        '''(experimental) Controls permission to delete tags that are attached to an AWS KMS key.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAlias")
    def to_update_alias(self) -> "Kms":
        '''(experimental) Controls permission to associate an alias with a different AWS KMS key.

        An alias is an optional friendly name that you can associate with a KMS key

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateAlias.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toUpdateAlias", []))

    @jsii.member(jsii_name="toUpdateCustomKeyStore")
    def to_update_custom_key_store(self) -> "Kms":
        '''(experimental) Controls permission to change the properties of a custom key store.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateCustomKeyStore.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toUpdateCustomKeyStore", []))

    @jsii.member(jsii_name="toUpdateKeyDescription")
    def to_update_key_description(self) -> "Kms":
        '''(experimental) Controls permission to delete or change the description of an AWS KMS key.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdateKeyDescription.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toUpdateKeyDescription", []))

    @jsii.member(jsii_name="toUpdatePrimaryRegion")
    def to_update_primary_region(self) -> "Kms":
        '''(experimental) Controls permission to update the primary Region of a multi-Region primary key.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifPrimaryRegion()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_UpdatePrimaryRegion.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toUpdatePrimaryRegion", []))

    @jsii.member(jsii_name="toVerify")
    def to_verify(self) -> "Kms":
        '''(experimental) Controls permission to use the specified AWS KMS key to verify digital signatures.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifMessageType()
        - .ifRequestAlias()
        - .ifSigningAlgorithm()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_Verify.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toVerify", []))

    @jsii.member(jsii_name="toVerifyMac")
    def to_verify_mac(self) -> "Kms":
        '''(experimental) Controls permission to use the AWS KMS key to verify message authentication codes.

        Access Level: Write

        Possible conditions:

        - .ifCallerAccount()
        - .ifMacAlgorithm()
        - .ifRequestAlias()
        - .ifViaService()

        https://docs.aws.amazon.com/kms/latest/APIReference/API_VerifyMac.html

        :stability: experimental
        '''
        return typing.cast("Kms", jsii.invoke(self, "toVerifyMac", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1e78f31259dbdf3c66c6aaa6221bd771de50f1b3307b539379f08c3a1e95c03a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1ee93d10031e7e027a08df28f0cccafdfc35db80edf9c9c6d730b8295c6724d5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Lakeformation(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Lakeformation",
):
    '''(experimental) Statement provider for service `lakeformation <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awslakeformation.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `lakeformation <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awslakeformation.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6d6d68f1351c9cb81ca00bc77850cc83f4a8ceeafd68f91d6ab1dca819f41e48)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toAddLFTagsToResource")
    def to_add_lf_tags_to_resource(self) -> "Lakeformation":
        '''(experimental) Grants permission to attach Lake Formation tags to catalog resources.

        Access Level: Tagging

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-AddLFTagsToResource

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toAddLFTagsToResource", []))

    @jsii.member(jsii_name="toBatchGrantPermissions")
    def to_batch_grant_permissions(self) -> "Lakeformation":
        '''(experimental) Grants permission to data lake permissions to one or more principals in a batch.

        Access Level: Permissions management

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-BatchGrantPermissions

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toBatchGrantPermissions", []))

    @jsii.member(jsii_name="toBatchRevokePermissions")
    def to_batch_revoke_permissions(self) -> "Lakeformation":
        '''(experimental) Grants permission to revoke data lake permissions from one or more principals in a batch.

        Access Level: Permissions management

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-BatchRevokePermissions

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toBatchRevokePermissions", []))

    @jsii.member(jsii_name="toCancelTransaction")
    def to_cancel_transaction(self) -> "Lakeformation":
        '''(experimental) Grants permission to cancel the given transaction.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-transactions-api.html#aws-lake-formation-api-transactions-api-CancelTransaction

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toCancelTransaction", []))

    @jsii.member(jsii_name="toCommitTransaction")
    def to_commit_transaction(self) -> "Lakeformation":
        '''(experimental) Grants permission to commit the given transaction.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-transactions-api.html#aws-lake-formation-api-transactions-api-CommitTransaction

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toCommitTransaction", []))

    @jsii.member(jsii_name="toCreateDataCellsFilter")
    def to_create_data_cells_filter(self) -> "Lakeformation":
        '''(experimental) Grants permission to create a Lake Formation data cell filter.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-data-filter.html#aws-lake-formation-api-data-filter-CreateDataCellsFilter

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toCreateDataCellsFilter", []))

    @jsii.member(jsii_name="toCreateLFTag")
    def to_create_lf_tag(self) -> "Lakeformation":
        '''(experimental) Grants permission to create a Lake Formation tag.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-CreateLFTag

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toCreateLFTag", []))

    @jsii.member(jsii_name="toDeleteDataCellsFilter")
    def to_delete_data_cells_filter(self) -> "Lakeformation":
        '''(experimental) Grants permission to delete a Lake Formation data cell filter.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-data-filter.html#aws-lake-formation-api-data-filter-DeleteDataCellsFilter

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toDeleteDataCellsFilter", []))

    @jsii.member(jsii_name="toDeleteLFTag")
    def to_delete_lf_tag(self) -> "Lakeformation":
        '''(experimental) Grants permission to delete a Lake Formation tag.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-DeleteLFTag

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toDeleteLFTag", []))

    @jsii.member(jsii_name="toDeleteObjectsOnCancel")
    def to_delete_objects_on_cancel(self) -> "Lakeformation":
        '''(experimental) Grants permission to delete the specified objects if the transaction is canceled.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-transactions-api.html#aws-lake-formation-api-transactions-api-DeleteObjectsOnCancel

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toDeleteObjectsOnCancel", []))

    @jsii.member(jsii_name="toDeregisterResource")
    def to_deregister_resource(self) -> "Lakeformation":
        '''(experimental) Grants permission to deregister a registered location.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-DeregisterResource

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toDeregisterResource", []))

    @jsii.member(jsii_name="toDescribeResource")
    def to_describe_resource(self) -> "Lakeformation":
        '''(experimental) Grants permission to describe a registered location.

        Access Level: Read

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-DescribeResource

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toDescribeResource", []))

    @jsii.member(jsii_name="toDescribeTransaction")
    def to_describe_transaction(self) -> "Lakeformation":
        '''(experimental) Grants permission to get status of the given transaction.

        Access Level: Read

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-transactions-api.html#aws-lake-formation-api-transactions-api-DescribeTransaction

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toDescribeTransaction", []))

    @jsii.member(jsii_name="toExtendTransaction")
    def to_extend_transaction(self) -> "Lakeformation":
        '''(experimental) Grants permission to extend the timeout of the given transaction.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-transactions-api.html#aws-lake-formation-api-transactions-api-ExtendTransaction

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toExtendTransaction", []))

    @jsii.member(jsii_name="toGetDataAccess")
    def to_get_data_access(self) -> "Lakeformation":
        '''(experimental) Grants permission to virtual data lake access.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-GetDataAccess

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toGetDataAccess", []))

    @jsii.member(jsii_name="toGetDataCellsFilter")
    def to_get_data_cells_filter(self) -> "Lakeformation":
        '''(experimental) Grants permission to retrieve a Lake Formation data cell filter.

        Access Level: Read

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-data-filter.html#aws-lake-formation-api-data-filter-GetDataCellsFilter

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toGetDataCellsFilter", []))

    @jsii.member(jsii_name="toGetDataLakeSettings")
    def to_get_data_lake_settings(self) -> "Lakeformation":
        '''(experimental) Grants permission to retrieve data lake settings such as the list of data lake administrators and database and table default permissions.

        Access Level: Read

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-GetDataLakeSettings

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toGetDataLakeSettings", []))

    @jsii.member(jsii_name="toGetEffectivePermissionsForPath")
    def to_get_effective_permissions_for_path(self) -> "Lakeformation":
        '''(experimental) Grants permission to retrieve permissions attached to resources in the given path.

        Access Level: Read

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-GetEffectivePermissionsForPath

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toGetEffectivePermissionsForPath", []))

    @jsii.member(jsii_name="toGetLFTag")
    def to_get_lf_tag(self) -> "Lakeformation":
        '''(experimental) Grants permission to retrieve a Lake Formation tag.

        Access Level: Read

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-GetLFTag

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toGetLFTag", []))

    @jsii.member(jsii_name="toGetQueryState")
    def to_get_query_state(self) -> "Lakeformation":
        '''(experimental) Grants permission to retrieve the state of the given query.

        Access Level: Read

        Dependent actions:

        - lakeformation:StartQueryPlanning

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-querying.html#aws-lake-formation-api-querying-GetQueryState

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toGetQueryState", []))

    @jsii.member(jsii_name="toGetQueryStatistics")
    def to_get_query_statistics(self) -> "Lakeformation":
        '''(experimental) Grants permission to retrieve the statistics for the given query.

        Access Level: Read

        Dependent actions:

        - lakeformation:StartQueryPlanning

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-querying.html#aws-lake-formation-api-querying-GetQueryStatistics

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toGetQueryStatistics", []))

    @jsii.member(jsii_name="toGetResourceLFTags")
    def to_get_resource_lf_tags(self) -> "Lakeformation":
        '''(experimental) Grants permission to retrieve lakeformation tags on a catalog resource.

        Access Level: Read

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-GetResourceLFTags

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toGetResourceLFTags", []))

    @jsii.member(jsii_name="toGetTableObjects")
    def to_get_table_objects(self) -> "Lakeformation":
        '''(experimental) Grants permission to retrieve objects from a table.

        Access Level: Read

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-objects.html#aws-lake-formation-api-objects-GetTableObjects

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toGetTableObjects", []))

    @jsii.member(jsii_name="toGetWorkUnitResults")
    def to_get_work_unit_results(self) -> "Lakeformation":
        '''(experimental) Grants permission to retrieve the results for the given work units.

        Access Level: Read

        Dependent actions:

        - lakeformation:GetWorkUnits
        - lakeformation:StartQueryPlanning

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-querying.html#aws-lake-formation-api-querying-GetWorkUnitResults

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toGetWorkUnitResults", []))

    @jsii.member(jsii_name="toGetWorkUnits")
    def to_get_work_units(self) -> "Lakeformation":
        '''(experimental) Grants permission to retrieve the work units for the given query.

        Access Level: Read

        Dependent actions:

        - lakeformation:StartQueryPlanning

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-querying.html#aws-lake-formation-api-querying-GetWorkUnits

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toGetWorkUnits", []))

    @jsii.member(jsii_name="toGrantPermissions")
    def to_grant_permissions(self) -> "Lakeformation":
        '''(experimental) Grants permission to data lake permissions to a principal.

        Access Level: Permissions management

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-GrantPermissions

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toGrantPermissions", []))

    @jsii.member(jsii_name="toListDataCellsFilter")
    def to_list_data_cells_filter(self) -> "Lakeformation":
        '''(experimental) Grants permission to list cell filters.

        Access Level: List

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-data-filter.html#aws-lake-formation-api-data-filter-ListDataCellsFilter

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toListDataCellsFilter", []))

    @jsii.member(jsii_name="toListLFTags")
    def to_list_lf_tags(self) -> "Lakeformation":
        '''(experimental) Grants permission to list Lake Formation tags.

        Access Level: Read

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-ListLFTags

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toListLFTags", []))

    @jsii.member(jsii_name="toListPermissions")
    def to_list_permissions(self) -> "Lakeformation":
        '''(experimental) Grants permission to list permissions filtered by principal or resource.

        Access Level: List

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-ListPermissions

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toListPermissions", []))

    @jsii.member(jsii_name="toListResources")
    def to_list_resources(self) -> "Lakeformation":
        '''(experimental) Grants permission to List registered locations.

        Access Level: List

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-ListResources

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toListResources", []))

    @jsii.member(jsii_name="toListTableStorageOptimizers")
    def to_list_table_storage_optimizers(self) -> "Lakeformation":
        '''(experimental) Grants permission to list all the storage optimizers for the Governed table.

        Access Level: List

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-optimizers.html#aws-lake-formation-api-optimizers-ListTableStorageOptimizers

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toListTableStorageOptimizers", []))

    @jsii.member(jsii_name="toListTransactions")
    def to_list_transactions(self) -> "Lakeformation":
        '''(experimental) Grants permission to list all transactions in the system.

        Access Level: List

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-transactions-api.html#aws-lake-formation-api-transactions-api-ListTransactions

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toListTransactions", []))

    @jsii.member(jsii_name="toPutDataLakeSettings")
    def to_put_data_lake_settings(self) -> "Lakeformation":
        '''(experimental) Grants permission to overwrite data lake settings such as the list of data lake administrators and database and table default permissions.

        Access Level: Permissions management

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-PutDataLakeSettings

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toPutDataLakeSettings", []))

    @jsii.member(jsii_name="toRegisterResource")
    def to_register_resource(self) -> "Lakeformation":
        '''(experimental) Grants permission to register a new location to be managed by Lake Formation.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-RegisterResource

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toRegisterResource", []))

    @jsii.member(jsii_name="toRemoveLFTagsFromResource")
    def to_remove_lf_tags_from_resource(self) -> "Lakeformation":
        '''(experimental) Grants permission to remove lakeformation tags from catalog resources.

        Access Level: Tagging

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-RemoveLFTagsFromResource

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toRemoveLFTagsFromResource", []))

    @jsii.member(jsii_name="toRevokePermissions")
    def to_revoke_permissions(self) -> "Lakeformation":
        '''(experimental) Grants permission to revoke data lake permissions from a principal.

        Access Level: Permissions management

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-RevokePermissions

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toRevokePermissions", []))

    @jsii.member(jsii_name="toSearchDatabasesByLFTags")
    def to_search_databases_by_lf_tags(self) -> "Lakeformation":
        '''(experimental) Grants permission to list catalog databases with Lake Formation tags.

        Access Level: Read

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-SearchDatabasesByLFTags

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toSearchDatabasesByLFTags", []))

    @jsii.member(jsii_name="toSearchTablesByLFTags")
    def to_search_tables_by_lf_tags(self) -> "Lakeformation":
        '''(experimental) Grants permission to list catalog tables with Lake Formation tags.

        Access Level: Read

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-SearchTablesByLFTags

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toSearchTablesByLFTags", []))

    @jsii.member(jsii_name="toStartQueryPlanning")
    def to_start_query_planning(self) -> "Lakeformation":
        '''(experimental) Grants permission to initiate the planning of the given query.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-querying.html#aws-lake-formation-api-querying-StartQueryPlanning

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toStartQueryPlanning", []))

    @jsii.member(jsii_name="toStartTransaction")
    def to_start_transaction(self) -> "Lakeformation":
        '''(experimental) Grants permission to start a new transaction.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-transactions-api.html#aws-lake-formation-api-transactions-api-StartTransaction

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toStartTransaction", []))

    @jsii.member(jsii_name="toUpdateDataCellsFilter")
    def to_update_data_cells_filter(self) -> "Lakeformation":
        '''(experimental) Grants permission to update a Lake Formation data cell filter.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-data-filter.html#aws-lake-formation-api-data-filter-UpdateDataCellsFilter

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toUpdateDataCellsFilter", []))

    @jsii.member(jsii_name="toUpdateLFTag")
    def to_update_lf_tag(self) -> "Lakeformation":
        '''(experimental) Grants permission to update a Lake Formation tag.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-UpdateLFTag

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toUpdateLFTag", []))

    @jsii.member(jsii_name="toUpdateResource")
    def to_update_resource(self) -> "Lakeformation":
        '''(experimental) Grants permission to update a registered location.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-tagging-api.html#aws-lake-formation-api-tagging-api-UpdateResource

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toUpdateResource", []))

    @jsii.member(jsii_name="toUpdateTableObjects")
    def to_update_table_objects(self) -> "Lakeformation":
        '''(experimental) Grants permission to add or delete the specified objects to or from a table.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-objects.html#aws-lake-formation-api-objects-UpdateTableObjects

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toUpdateTableObjects", []))

    @jsii.member(jsii_name="toUpdateTableStorageOptimizer")
    def to_update_table_storage_optimizer(self) -> "Lakeformation":
        '''(experimental) Grants permission to update the configuration of the storage optimizer for the Governed table.

        Access Level: Write

        https://docs.aws.amazon.com/lake-formation/latest/dg/aws-lake-formation-api-optimizers.html#aws-lake-formation-api-optimizers-UpdateTableStorageOptimizer

        :stability: experimental
        '''
        return typing.cast("Lakeformation", jsii.invoke(self, "toUpdateTableStorageOptimizer", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5d34e11e007cae31c209e047db4cb804b72bc16c51de9cebf57b3cc9cebc4747)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eaffb39b570f3f8778572c195e511a8822c0105d57d899e7cbfd0f878a137c7c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Lambda(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Lambda"):
    '''(experimental) Statement provider for service `lambda <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awslambda.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `lambda <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awslambda.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cb8afeb7b0a5db6fc9e8e3e72db1c4924ba2b157cce3761dad675bbe4ed82438)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifCodeSigningConfigArn")
    def if_code_signing_config_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lambda":
        '''(experimental) Filters access by the ARN of an AWS Lambda code signing config.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        Applies to actions:

        - .toCreateFunction()
        - .toPutFunctionCodeSigningConfig()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8194de58ae245295d937f1ca995e08be81e63d5d0da1d52a1a991134f0add6b2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Lambda", jsii.invoke(self, "ifCodeSigningConfigArn", [value, operator]))

    @jsii.member(jsii_name="ifFunctionArn")
    def if_function_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lambda":
        '''(experimental) Filters access by the ARN of an AWS Lambda function.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        Applies to actions:

        - .toCreateEventSourceMapping()
        - .toCreateFunctionUrlConfig()
        - .toDeleteEventSourceMapping()
        - .toDeleteFunctionUrlConfig()
        - .toGetEventSourceMapping()
        - .toGetFunctionUrlConfig()
        - .toInvokeFunctionUrl()
        - .toUpdateEventSourceMapping()
        - .toUpdateFunctionUrlConfig()

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b5ee4fc0e400ff202e7c1fa4e6912036f3a692ceff6d4715b40b15bb00ffb13a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Lambda", jsii.invoke(self, "ifFunctionArn", [value, operator]))

    @jsii.member(jsii_name="ifFunctionUrlAuthType")
    def if_function_url_auth_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lambda":
        '''(experimental) Filters access by authorization type specified in request. Available during CreateFunctionUrlConfig, UpdateFunctionUrlConfig, DeleteFunctionUrlConfig, GetFunctionUrlConfig, ListFunctionUrlConfig, AddPermission and RemovePermission operations.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        Applies to actions:

        - .toAddPermission()
        - .toCreateFunctionUrlConfig()
        - .toDeleteFunctionUrlConfig()
        - .toGetFunctionUrlConfig()
        - .toInvokeFunctionUrl()
        - .toListFunctionUrlConfigs()
        - .toRemovePermission()
        - .toUpdateFunctionUrlConfig()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__77205dbf3554031030107e531d32e2edaeca6e6b25cb9e0eda8f1defaa978c0d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Lambda", jsii.invoke(self, "ifFunctionUrlAuthType", [value, operator]))

    @jsii.member(jsii_name="ifLayer")
    def if_layer(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lambda":
        '''(experimental) Filters access by the ARN of a version of an AWS Lambda layer.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        Applies to actions:

        - .toCreateFunction()
        - .toUpdateFunctionConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__db29a22d9fc884b290202a660610afbb1781a56b399286f894da4903dfa91b36)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Lambda", jsii.invoke(self, "ifLayer", [value, operator]))

    @jsii.member(jsii_name="ifPrincipal")
    def if_principal(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lambda":
        '''(experimental) Filters access by restricting the AWS service or account that can invoke a function.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        Applies to actions:

        - .toAddPermission()
        - .toRemovePermission()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cd49afc3212fc27c7e1d945817700f8b9635afc7e24d4402805ff5770642dbb4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Lambda", jsii.invoke(self, "ifPrincipal", [value, operator]))

    @jsii.member(jsii_name="ifSecurityGroupIds")
    def if_security_group_ids(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lambda":
        '''(experimental) Filters access by the ID of security groups configured for the AWS Lambda function.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        Applies to actions:

        - .toCreateFunction()
        - .toUpdateFunctionConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__590fdd867bba7b41db4f72031e56b029350b812fd83c1a05760b4826b588a697)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Lambda", jsii.invoke(self, "ifSecurityGroupIds", [value, operator]))

    @jsii.member(jsii_name="ifSourceFunctionArn")
    def if_source_function_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lambda":
        '''(experimental) Filters access by the ARN of the AWS Lambda function from which the request originated.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__62a695fffbf5ca8a5f4bac2a07562a7721143be337f654d70c46a245fada4c4a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Lambda", jsii.invoke(self, "ifSourceFunctionArn", [value, operator]))

    @jsii.member(jsii_name="ifSubnetIds")
    def if_subnet_ids(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lambda":
        '''(experimental) Filters access by the ID of subnets configured for the AWS Lambda function.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        Applies to actions:

        - .toCreateFunction()
        - .toUpdateFunctionConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__350817b42e809539cc612349e143264494d3570e6ebef016ce11f28f179fbc66)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Lambda", jsii.invoke(self, "ifSubnetIds", [value, operator]))

    @jsii.member(jsii_name="ifVpcIds")
    def if_vpc_ids(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lambda":
        '''(experimental) Filters access by the ID of the VPC configured for the AWS Lambda function.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        Applies to actions:

        - .toCreateFunction()
        - .toUpdateFunctionConfiguration()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__14e6208b702c339878d5360f8feb19cd9abc129672891fa142c4b1c611e58d31)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Lambda", jsii.invoke(self, "ifVpcIds", [value, operator]))

    @jsii.member(jsii_name="onCodeSigningConfig")
    def on_code_signing_config(
        self,
        code_signing_config_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lambda":
        '''(experimental) Adds a resource of type code signing config to the statement.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        :param code_signing_config_id: - Identifier for the codeSigningConfigId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3f211ba50062bcc4945e1eb1de99813dce3bcaf5c6abbb5777e8b57a3972d4a4)
            check_type(argname="argument code_signing_config_id", value=code_signing_config_id, expected_type=type_hints["code_signing_config_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lambda", jsii.invoke(self, "onCodeSigningConfig", [code_signing_config_id, account, region, partition]))

    @jsii.member(jsii_name="onEventSourceMapping")
    def on_event_source_mapping(
        self,
        u_uid: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lambda":
        '''(experimental) Adds a resource of type eventSourceMapping to the statement.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        :param u_uid: - Identifier for the uUID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__484c29b0ed6e71cefea1b08a7948718ed375c22e37ffe9a41775a2beefdaeed7)
            check_type(argname="argument u_uid", value=u_uid, expected_type=type_hints["u_uid"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lambda", jsii.invoke(self, "onEventSourceMapping", [u_uid, account, region, partition]))

    @jsii.member(jsii_name="onFunction")
    def on_function(
        self,
        function_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lambda":
        '''(experimental) Adds a resource of type function to the statement.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        :param function_name: - Identifier for the functionName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__76e71f9437e7eb794602a5230915829cf8841d7b125cc6b025e66bc883b949b0)
            check_type(argname="argument function_name", value=function_name, expected_type=type_hints["function_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lambda", jsii.invoke(self, "onFunction", [function_name, account, region, partition]))

    @jsii.member(jsii_name="onFunctionAlias")
    def on_function_alias(
        self,
        function_name: builtins.str,
        alias: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lambda":
        '''(experimental) Adds a resource of type function alias to the statement.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        :param function_name: - Identifier for the functionName.
        :param alias: - Identifier for the alias.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__844f964cb9c14511f08643e10d8dbc86afa1b1fd2228431a35fe14efb7829adb)
            check_type(argname="argument function_name", value=function_name, expected_type=type_hints["function_name"])
            check_type(argname="argument alias", value=alias, expected_type=type_hints["alias"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lambda", jsii.invoke(self, "onFunctionAlias", [function_name, alias, account, region, partition]))

    @jsii.member(jsii_name="onFunctionVersion")
    def on_function_version(
        self,
        function_name: builtins.str,
        version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lambda":
        '''(experimental) Adds a resource of type function version to the statement.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        :param function_name: - Identifier for the functionName.
        :param version: - Identifier for the version.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5b51a4889eb1efe743aad6d7dd4c3c83e8a5924da8f7d9ffcae5ce64fd71211f)
            check_type(argname="argument function_name", value=function_name, expected_type=type_hints["function_name"])
            check_type(argname="argument version", value=version, expected_type=type_hints["version"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lambda", jsii.invoke(self, "onFunctionVersion", [function_name, version, account, region, partition]))

    @jsii.member(jsii_name="onLayer")
    def on_layer(
        self,
        layer_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lambda":
        '''(experimental) Adds a resource of type layer to the statement.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        :param layer_name: - Identifier for the layerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8b9b5450e273fc7fc5af53d2d962ff79632be7b035346ead44a391949818cd50)
            check_type(argname="argument layer_name", value=layer_name, expected_type=type_hints["layer_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lambda", jsii.invoke(self, "onLayer", [layer_name, account, region, partition]))

    @jsii.member(jsii_name="onLayerVersion")
    def on_layer_version(
        self,
        layer_name: builtins.str,
        layer_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lambda":
        '''(experimental) Adds a resource of type layerVersion to the statement.

        https://docs.aws.amazon.com/lambda/latest/dg/lambda-api-permissions-ref.html

        :param layer_name: - Identifier for the layerName.
        :param layer_version: - Identifier for the layerVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bf6a03fc6f6863befa52088394424893117caa9582e1bf56355846b54cae93be)
            check_type(argname="argument layer_name", value=layer_name, expected_type=type_hints["layer_name"])
            check_type(argname="argument layer_version", value=layer_version, expected_type=type_hints["layer_version"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lambda", jsii.invoke(self, "onLayerVersion", [layer_name, layer_version, account, region, partition]))

    @jsii.member(jsii_name="toAddLayerVersionPermission")
    def to_add_layer_version_permission(self) -> "Lambda":
        '''(experimental) Grants permission to add permissions to the resource-based policy of a version of an AWS Lambda layer.

        Access Level: Permissions management

        https://docs.aws.amazon.com/lambda/latest/dg/API_AddLayerVersionPermission.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toAddLayerVersionPermission", []))

    @jsii.member(jsii_name="toAddPermission")
    def to_add_permission(self) -> "Lambda":
        '''(experimental) Grants permission to give an AWS service or another account permission to use an AWS Lambda function.

        Access Level: Permissions management

        Possible conditions:

        - .ifPrincipal()
        - .ifFunctionUrlAuthType()

        https://docs.aws.amazon.com/lambda/latest/dg/API_AddPermission.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toAddPermission", []))

    @jsii.member(jsii_name="toCreateAlias")
    def to_create_alias(self) -> "Lambda":
        '''(experimental) Grants permission to create an alias for a Lambda function version.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_CreateAlias.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toCreateAlias", []))

    @jsii.member(jsii_name="toCreateCodeSigningConfig")
    def to_create_code_signing_config(self) -> "Lambda":
        '''(experimental) Grants permission to create an AWS Lambda code signing config.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_CreateCodeSigningConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toCreateCodeSigningConfig", []))

    @jsii.member(jsii_name="toCreateEventSourceMapping")
    def to_create_event_source_mapping(self) -> "Lambda":
        '''(experimental) Grants permission to create a mapping between an event source and an AWS Lambda function.

        Access Level: Write

        Possible conditions:

        - .ifFunctionArn()

        https://docs.aws.amazon.com/lambda/latest/dg/API_CreateEventSourceMapping.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toCreateEventSourceMapping", []))

    @jsii.member(jsii_name="toCreateFunction")
    def to_create_function(self) -> "Lambda":
        '''(experimental) Grants permission to create an AWS Lambda function.

        Access Level: Write

        Possible conditions:

        - .ifLayer()
        - .ifVpcIds()
        - .ifSubnetIds()
        - .ifSecurityGroupIds()
        - .ifCodeSigningConfigArn()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunction.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toCreateFunction", []))

    @jsii.member(jsii_name="toCreateFunctionUrlConfig")
    def to_create_function_url_config(self) -> "Lambda":
        '''(experimental) Grants permission to create a function url configuration for a Lambda function.

        Access Level: Write

        Possible conditions:

        - .ifFunctionUrlAuthType()
        - .ifFunctionArn()

        https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunctionUrlConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toCreateFunctionUrlConfig", []))

    @jsii.member(jsii_name="toDeleteAlias")
    def to_delete_alias(self) -> "Lambda":
        '''(experimental) Grants permission to delete an AWS Lambda function alias.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteAlias.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDeleteAlias", []))

    @jsii.member(jsii_name="toDeleteCodeSigningConfig")
    def to_delete_code_signing_config(self) -> "Lambda":
        '''(experimental) Grants permission to delete an AWS Lambda code signing config.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteCodeSigningConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDeleteCodeSigningConfig", []))

    @jsii.member(jsii_name="toDeleteEventSourceMapping")
    def to_delete_event_source_mapping(self) -> "Lambda":
        '''(experimental) Grants permission to delete an AWS Lambda event source mapping.

        Access Level: Write

        Possible conditions:

        - .ifFunctionArn()

        https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteEventSourceMapping.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDeleteEventSourceMapping", []))

    @jsii.member(jsii_name="toDeleteFunction")
    def to_delete_function(self) -> "Lambda":
        '''(experimental) Grants permission to delete an AWS Lambda function.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteFunction.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDeleteFunction", []))

    @jsii.member(jsii_name="toDeleteFunctionCodeSigningConfig")
    def to_delete_function_code_signing_config(self) -> "Lambda":
        '''(experimental) Grants permission to detach a code signing config from an AWS Lambda function.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteFunctionCodeSigningConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDeleteFunctionCodeSigningConfig", []))

    @jsii.member(jsii_name="toDeleteFunctionConcurrency")
    def to_delete_function_concurrency(self) -> "Lambda":
        '''(experimental) Grants permission to remove a concurrent execution limit from an AWS Lambda function.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteFunctionConcurrency.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDeleteFunctionConcurrency", []))

    @jsii.member(jsii_name="toDeleteFunctionEventInvokeConfig")
    def to_delete_function_event_invoke_config(self) -> "Lambda":
        '''(experimental) Grants permission to delete the configuration for asynchronous invocation for an AWS Lambda function, version, or alias.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteFunctionEventInvokeConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDeleteFunctionEventInvokeConfig", []))

    @jsii.member(jsii_name="toDeleteFunctionUrlConfig")
    def to_delete_function_url_config(self) -> "Lambda":
        '''(experimental) Grants permission to delete function url configuration for a Lambda function.

        Access Level: Write

        Possible conditions:

        - .ifFunctionUrlAuthType()
        - .ifFunctionArn()

        https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteFunctionUrlConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDeleteFunctionUrlConfig", []))

    @jsii.member(jsii_name="toDeleteLayerVersion")
    def to_delete_layer_version(self) -> "Lambda":
        '''(experimental) Grants permission to delete a version of an AWS Lambda layer.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteLayerVersion.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDeleteLayerVersion", []))

    @jsii.member(jsii_name="toDeleteProvisionedConcurrencyConfig")
    def to_delete_provisioned_concurrency_config(self) -> "Lambda":
        '''(experimental) Grants permission to delete the provisioned concurrency configuration for an AWS Lambda function.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteProvisionedConcurrencyConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDeleteProvisionedConcurrencyConfig", []))

    @jsii.member(jsii_name="toDisableReplication")
    def to_disable_replication(self) -> "Lambda":
        '''(experimental) Grants permission to disable replication for a Lambda@Edge function.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-edge-permissions.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toDisableReplication", []))

    @jsii.member(jsii_name="toEnableReplication")
    def to_enable_replication(self) -> "Lambda":
        '''(experimental) Grants permission to enable replication for a Lambda@Edge function.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-edge-permissions.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toEnableReplication", []))

    @jsii.member(jsii_name="toGetAccountSettings")
    def to_get_account_settings(self) -> "Lambda":
        '''(experimental) Grants permission to view details about an account's limits and usage in an AWS Region.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetAccountSettings.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetAccountSettings", []))

    @jsii.member(jsii_name="toGetAlias")
    def to_get_alias(self) -> "Lambda":
        '''(experimental) Grants permission to view details about an AWS Lambda function alias.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetAlias.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetAlias", []))

    @jsii.member(jsii_name="toGetCodeSigningConfig")
    def to_get_code_signing_config(self) -> "Lambda":
        '''(experimental) Grants permission to view details about an AWS Lambda code signing config.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetCodeSigningConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetCodeSigningConfig", []))

    @jsii.member(jsii_name="toGetEventSourceMapping")
    def to_get_event_source_mapping(self) -> "Lambda":
        '''(experimental) Grants permission to view details about an AWS Lambda event source mapping.

        Access Level: Read

        Possible conditions:

        - .ifFunctionArn()

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetEventSourceMapping.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetEventSourceMapping", []))

    @jsii.member(jsii_name="toGetFunction")
    def to_get_function(self) -> "Lambda":
        '''(experimental) Grants permission to view details about an AWS Lambda function.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunction.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetFunction", []))

    @jsii.member(jsii_name="toGetFunctionCodeSigningConfig")
    def to_get_function_code_signing_config(self) -> "Lambda":
        '''(experimental) Grants permission to view the code signing config arn attached to an AWS Lambda function.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunctionCodeSigningConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetFunctionCodeSigningConfig", []))

    @jsii.member(jsii_name="toGetFunctionConcurrency")
    def to_get_function_concurrency(self) -> "Lambda":
        '''(experimental) Grants permission to view details about the reserved concurrency configuration for a function.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunctionConcurrency.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetFunctionConcurrency", []))

    @jsii.member(jsii_name="toGetFunctionConfiguration")
    def to_get_function_configuration(self) -> "Lambda":
        '''(experimental) Grants permission to view details about the version-specific settings of an AWS Lambda function or version.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunctionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetFunctionConfiguration", []))

    @jsii.member(jsii_name="toGetFunctionEventInvokeConfig")
    def to_get_function_event_invoke_config(self) -> "Lambda":
        '''(experimental) Grants permission to view the configuration for asynchronous invocation for a function, version, or alias.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunctionEventInvokeConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetFunctionEventInvokeConfig", []))

    @jsii.member(jsii_name="toGetFunctionUrlConfig")
    def to_get_function_url_config(self) -> "Lambda":
        '''(experimental) Grants permission to read function url configuration for a Lambda function.

        Access Level: Read

        Possible conditions:

        - .ifFunctionUrlAuthType()
        - .ifFunctionArn()

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunctionUrlConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetFunctionUrlConfig", []))

    @jsii.member(jsii_name="toGetLayerVersion")
    def to_get_layer_version(self) -> "Lambda":
        '''(experimental) Grants permission to view details about a version of an AWS Lambda layer.

        Note this action also supports GetLayerVersionByArn API

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetLayerVersion.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetLayerVersion", []))

    @jsii.member(jsii_name="toGetLayerVersionPolicy")
    def to_get_layer_version_policy(self) -> "Lambda":
        '''(experimental) Grants permission to view the resource-based policy for a version of an AWS Lambda layer.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetLayerVersionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetLayerVersionPolicy", []))

    @jsii.member(jsii_name="toGetPolicy")
    def to_get_policy(self) -> "Lambda":
        '''(experimental) Grants permission to view the resource-based policy for an AWS Lambda function, version, or alias.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetPolicy.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetPolicy", []))

    @jsii.member(jsii_name="toGetProvisionedConcurrencyConfig")
    def to_get_provisioned_concurrency_config(self) -> "Lambda":
        '''(experimental) Grants permission to view the provisioned concurrency configuration for an AWS Lambda function's alias or version.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetProvisionedConcurrencyConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetProvisionedConcurrencyConfig", []))

    @jsii.member(jsii_name="toGetRuntimeManagementConfig")
    def to_get_runtime_management_config(self) -> "Lambda":
        '''(experimental) Grants permission to view the runtime management configuration of an AWS Lambda function.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_GetRuntimeManagementConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toGetRuntimeManagementConfig", []))

    @jsii.member(jsii_name="toInvokeAsync")
    def to_invoke_async(self) -> "Lambda":
        '''(experimental) Grants permission to invoke a function asynchronously (Deprecated).

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_InvokeAsync.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toInvokeAsync", []))

    @jsii.member(jsii_name="toInvokeFunction")
    def to_invoke_function(self) -> "Lambda":
        '''(experimental) Grants permission to invoke an AWS Lambda function.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_Invoke.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toInvokeFunction", []))

    @jsii.member(jsii_name="toInvokeFunctionUrl")
    def to_invoke_function_url(self) -> "Lambda":
        '''(experimental) Grants permission to invoke an AWS Lambda function through url.

        Access Level: Write

        Possible conditions:

        - .ifFunctionUrlAuthType()
        - .ifFunctionArn()

        https://docs.aws.amazon.com/lambda/latest/dg/API_InvokeFunctionUrl.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toInvokeFunctionUrl", []))

    @jsii.member(jsii_name="toListAliases")
    def to_list_aliases(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of aliases for an AWS Lambda function.

        Access Level: List

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListAliases.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListAliases", []))

    @jsii.member(jsii_name="toListCodeSigningConfigs")
    def to_list_code_signing_configs(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of AWS Lambda code signing configs.

        Access Level: List

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListCodeSigningConfigs.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListCodeSigningConfigs", []))

    @jsii.member(jsii_name="toListEventSourceMappings")
    def to_list_event_source_mappings(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of AWS Lambda event source mappings.

        Access Level: List

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListEventSourceMappings.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListEventSourceMappings", []))

    @jsii.member(jsii_name="toListFunctionEventInvokeConfigs")
    def to_list_function_event_invoke_configs(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of configurations for asynchronous invocation for a function.

        Access Level: List

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListFunctionEventInvokeConfigs.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListFunctionEventInvokeConfigs", []))

    @jsii.member(jsii_name="toListFunctions")
    def to_list_functions(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of AWS Lambda functions, with the version-specific configuration of each function.

        Access Level: List

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListFunctions.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListFunctions", []))

    @jsii.member(jsii_name="toListFunctionsByCodeSigningConfig")
    def to_list_functions_by_code_signing_config(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of AWS Lambda functions by the code signing config assigned.

        Access Level: List

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListFunctionsByCodeSigningConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListFunctionsByCodeSigningConfig", []))

    @jsii.member(jsii_name="toListFunctionUrlConfigs")
    def to_list_function_url_configs(self) -> "Lambda":
        '''(experimental) Grants permission to read function url configurations for a function.

        Access Level: List

        Possible conditions:

        - .ifFunctionUrlAuthType()

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListFunctionUrlConfigs.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListFunctionUrlConfigs", []))

    @jsii.member(jsii_name="toListLayers")
    def to_list_layers(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of AWS Lambda layers, with details about the latest version of each layer.

        Access Level: List

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListLayers.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListLayers", []))

    @jsii.member(jsii_name="toListLayerVersions")
    def to_list_layer_versions(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of versions of an AWS Lambda layer.

        Access Level: List

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListLayerVersions.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListLayerVersions", []))

    @jsii.member(jsii_name="toListProvisionedConcurrencyConfigs")
    def to_list_provisioned_concurrency_configs(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of provisioned concurrency configurations for an AWS Lambda function.

        Access Level: List

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListProvisionedConcurrencyConfigs.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListProvisionedConcurrencyConfigs", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of tags for an AWS Lambda function.

        Access Level: Read

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListTags.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toListVersionsByFunction")
    def to_list_versions_by_function(self) -> "Lambda":
        '''(experimental) Grants permission to retrieve a list of versions for an AWS Lambda function.

        Access Level: List

        https://docs.aws.amazon.com/lambda/latest/dg/API_ListVersionsByFunction.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toListVersionsByFunction", []))

    @jsii.member(jsii_name="toPublishLayerVersion")
    def to_publish_layer_version(self) -> "Lambda":
        '''(experimental) Grants permission to create an AWS Lambda layer.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_PublishLayerVersion.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toPublishLayerVersion", []))

    @jsii.member(jsii_name="toPublishVersion")
    def to_publish_version(self) -> "Lambda":
        '''(experimental) Grants permission to create an AWS Lambda function version.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_PublishVersion.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toPublishVersion", []))

    @jsii.member(jsii_name="toPutFunctionCodeSigningConfig")
    def to_put_function_code_signing_config(self) -> "Lambda":
        '''(experimental) Grants permission to attach a code signing config to an AWS Lambda function.

        Access Level: Write

        Possible conditions:

        - .ifCodeSigningConfigArn()

        https://docs.aws.amazon.com/lambda/latest/dg/API_PutFunctionCodeSigningConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toPutFunctionCodeSigningConfig", []))

    @jsii.member(jsii_name="toPutFunctionConcurrency")
    def to_put_function_concurrency(self) -> "Lambda":
        '''(experimental) Grants permission to configure reserved concurrency for an AWS Lambda function.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_PutFunctionConcurrency.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toPutFunctionConcurrency", []))

    @jsii.member(jsii_name="toPutFunctionEventInvokeConfig")
    def to_put_function_event_invoke_config(self) -> "Lambda":
        '''(experimental) Grants permission to configures options for asynchronous invocation on an AWS Lambda function, version, or alias.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_PutFunctionEventInvokeConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toPutFunctionEventInvokeConfig", []))

    @jsii.member(jsii_name="toPutProvisionedConcurrencyConfig")
    def to_put_provisioned_concurrency_config(self) -> "Lambda":
        '''(experimental) Grants permission to configure provisioned concurrency for an AWS Lambda function's alias or version.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_PutProvisionedConcurrencyConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toPutProvisionedConcurrencyConfig", []))

    @jsii.member(jsii_name="toPutRuntimeManagementConfig")
    def to_put_runtime_management_config(self) -> "Lambda":
        '''(experimental) Grants permission to update the runtime management configuration of an AWS Lambda function.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_PutRuntimeManagementConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toPutRuntimeManagementConfig", []))

    @jsii.member(jsii_name="toRemoveLayerVersionPermission")
    def to_remove_layer_version_permission(self) -> "Lambda":
        '''(experimental) Grants permission to remove a statement from the permissions policy for a version of an AWS Lambda layer.

        Access Level: Permissions management

        https://docs.aws.amazon.com/lambda/latest/dg/API_RemoveLayerVersionPermission.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toRemoveLayerVersionPermission", []))

    @jsii.member(jsii_name="toRemovePermission")
    def to_remove_permission(self) -> "Lambda":
        '''(experimental) Grants permission to revoke function-use permission from an AWS service or another account.

        Access Level: Permissions management

        Possible conditions:

        - .ifPrincipal()
        - .ifFunctionUrlAuthType()

        https://docs.aws.amazon.com/lambda/latest/dg/API_RemovePermission.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toRemovePermission", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Lambda":
        '''(experimental) Grants permission to add tags to an AWS Lambda function.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lambda/latest/dg/API_TagResources.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Lambda":
        '''(experimental) Grants permission to remove tags from an AWS Lambda function.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lambda/latest/dg/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAlias")
    def to_update_alias(self) -> "Lambda":
        '''(experimental) Grants permission to update the configuration of an AWS Lambda function's alias.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateAlias.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toUpdateAlias", []))

    @jsii.member(jsii_name="toUpdateCodeSigningConfig")
    def to_update_code_signing_config(self) -> "Lambda":
        '''(experimental) Grants permission to update an AWS Lambda code signing config.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateCodeSigningConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toUpdateCodeSigningConfig", []))

    @jsii.member(jsii_name="toUpdateEventSourceMapping")
    def to_update_event_source_mapping(self) -> "Lambda":
        '''(experimental) Grants permission to update the configuration of an AWS Lambda event source mapping.

        Access Level: Write

        Possible conditions:

        - .ifFunctionArn()

        https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateEventSourceMapping.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toUpdateEventSourceMapping", []))

    @jsii.member(jsii_name="toUpdateFunctionCode")
    def to_update_function_code(self) -> "Lambda":
        '''(experimental) Grants permission to update the code of an AWS Lambda function.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionCode.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toUpdateFunctionCode", []))

    @jsii.member(jsii_name="toUpdateFunctionCodeSigningConfig")
    def to_update_function_code_signing_config(self) -> "Lambda":
        '''(experimental) Grants permission to update the code signing config of an AWS Lambda function.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionCodeSigningConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toUpdateFunctionCodeSigningConfig", []))

    @jsii.member(jsii_name="toUpdateFunctionConfiguration")
    def to_update_function_configuration(self) -> "Lambda":
        '''(experimental) Grants permission to modify the version-specific settings of an AWS Lambda function.

        Access Level: Write

        Possible conditions:

        - .ifLayer()
        - .ifVpcIds()
        - .ifSubnetIds()
        - .ifSecurityGroupIds()

        https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toUpdateFunctionConfiguration", []))

    @jsii.member(jsii_name="toUpdateFunctionEventInvokeConfig")
    def to_update_function_event_invoke_config(self) -> "Lambda":
        '''(experimental) Grants permission to modify the configuration for asynchronous invocation for an AWS Lambda function, version, or alias.

        Access Level: Write

        https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionEventInvokeConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toUpdateFunctionEventInvokeConfig", []))

    @jsii.member(jsii_name="toUpdateFunctionUrlConfig")
    def to_update_function_url_config(self) -> "Lambda":
        '''(experimental) Grants permission to update a function url configuration for a Lambda function.

        Access Level: Write

        Possible conditions:

        - .ifFunctionUrlAuthType()
        - .ifFunctionArn()

        https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionUrlConfig.html

        :stability: experimental
        '''
        return typing.cast("Lambda", jsii.invoke(self, "toUpdateFunctionUrlConfig", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b2e4c94194bc1e6b782f2ad5d28456bc6fed235c02e1ef4d7f7802e0d1d04403)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4ddbc6b6b15c50ff3597cfcd139cf5589f3e7127b5b13aac7efc647f5408e6fe)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Launchwizard(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Launchwizard",
):
    '''(experimental) Statement provider for service `launchwizard <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awslaunchwizard.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `launchwizard <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awslaunchwizard.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a7e269380314e832d1165ee72726722d4bc18b9bc3ac913b34875a95ed7ccf71)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toDeleteApp")
    def to_delete_app(self) -> "Launchwizard":
        '''(experimental) Grants permission to delete an application.

        Access Level: Write

        https://docs.aws.amazon.com/launchwizard/

        :stability: experimental
        '''
        return typing.cast("Launchwizard", jsii.invoke(self, "toDeleteApp", []))

    @jsii.member(jsii_name="toDescribeProvisionedApp")
    def to_describe_provisioned_app(self) -> "Launchwizard":
        '''(experimental) Grants permission to describe provisioning applications.

        Access Level: Read

        https://docs.aws.amazon.com/launchwizard/

        :stability: experimental
        '''
        return typing.cast("Launchwizard", jsii.invoke(self, "toDescribeProvisionedApp", []))

    @jsii.member(jsii_name="toDescribeProvisioningEvents")
    def to_describe_provisioning_events(self) -> "Launchwizard":
        '''(experimental) Grants permission to describe provisioning events.

        Access Level: Read

        https://docs.aws.amazon.com/launchwizard/

        :stability: experimental
        '''
        return typing.cast("Launchwizard", jsii.invoke(self, "toDescribeProvisioningEvents", []))

    @jsii.member(jsii_name="toGetInfrastructureSuggestion")
    def to_get_infrastructure_suggestion(self) -> "Launchwizard":
        '''(experimental) Grants permission to get infrastructure suggestion.

        Access Level: Read

        https://docs.aws.amazon.com/launchwizard/

        :stability: experimental
        '''
        return typing.cast("Launchwizard", jsii.invoke(self, "toGetInfrastructureSuggestion", []))

    @jsii.member(jsii_name="toGetIpAddress")
    def to_get_ip_address(self) -> "Launchwizard":
        '''(experimental) Grants permission to get customer's ip address.

        Access Level: Read

        https://docs.aws.amazon.com/launchwizard/

        :stability: experimental
        '''
        return typing.cast("Launchwizard", jsii.invoke(self, "toGetIpAddress", []))

    @jsii.member(jsii_name="toGetResourceCostEstimate")
    def to_get_resource_cost_estimate(self) -> "Launchwizard":
        '''(experimental) Grants permission to get resource cost estimate.

        Access Level: Read

        https://docs.aws.amazon.com/launchwizard/

        :stability: experimental
        '''
        return typing.cast("Launchwizard", jsii.invoke(self, "toGetResourceCostEstimate", []))

    @jsii.member(jsii_name="toListProvisionedApps")
    def to_list_provisioned_apps(self) -> "Launchwizard":
        '''(experimental) Grants permission to list provisioning applications.

        Access Level: List

        https://docs.aws.amazon.com/launchwizard/

        :stability: experimental
        '''
        return typing.cast("Launchwizard", jsii.invoke(self, "toListProvisionedApps", []))

    @jsii.member(jsii_name="toStartProvisioning")
    def to_start_provisioning(self) -> "Launchwizard":
        '''(experimental) Grants permission to start a provisioning.

        Access Level: Write

        https://docs.aws.amazon.com/launchwizard/

        :stability: experimental
        '''
        return typing.cast("Launchwizard", jsii.invoke(self, "toStartProvisioning", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__48e2528e6bc098685882a6335f107a63c7c3f9c494371309ae55c8593a8682ea)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c6cd291844759229b54fd99d39928188210df0af78ef1db9d103075506b4d76d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Lex(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Lex"):
    '''(experimental) Statement provider for service `lex <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlex.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `lex <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlex.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0ab7882a8e0f2f6113b8921a2753dd1447d71e3c566c771d3dacd0b89de5f65b)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAssociatedIntents")
    def if_associated_intents(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lex":
        '''(experimental) Enables you to control access based on the intents included in the request.

        https://docs.aws.amazon.com/lex/latest/dg/security_iam_service-with-iam.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__050c4bd7651416c62b42b80eac8e62b88e823730c4a234d7374a0265056711fe)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Lex", jsii.invoke(self, "ifAssociatedIntents", [value, operator]))

    @jsii.member(jsii_name="ifAssociatedSlotTypes")
    def if_associated_slot_types(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lex":
        '''(experimental) Enables you to control access based on the slot types included in the request.

        https://docs.aws.amazon.com/lex/latest/dg/security_iam_service-with-iam.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6729fee4c110f533a049cff4fd099d22370c4590588b2a7bbffa2c46cfc52176)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Lex", jsii.invoke(self, "ifAssociatedSlotTypes", [value, operator]))

    @jsii.member(jsii_name="ifChannelType")
    def if_channel_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Lex":
        '''(experimental) Enables you to control access based on the channel type included in the request.

        https://docs.aws.amazon.com/lex/latest/dg/security_iam_service-with-iam.html

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ff4e5a014979fe4ae7a76e4f1adbdb5d038e988e138b02cd13256b0f236b0349)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Lex", jsii.invoke(self, "ifChannelType", [value, operator]))

    @jsii.member(jsii_name="onBot")
    def on_bot(
        self,
        bot_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lex":
        '''(experimental) Adds a resource of type bot to the statement.

        https://docs.aws.amazon.com/lex/latest/dg/API_BotMetadata.html

        :param bot_name: - Identifier for the botName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ae7a6a566e41da3da16d9bf89c2330b9d347705d533c0a6edd2738baf099c904)
            check_type(argname="argument bot_name", value=bot_name, expected_type=type_hints["bot_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lex", jsii.invoke(self, "onBot", [bot_name, account, region, partition]))

    @jsii.member(jsii_name="onBotAlias")
    def on_bot_alias(
        self,
        bot_name: builtins.str,
        bot_alias: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lex":
        '''(experimental) Adds a resource of type bot alias to the statement.

        https://docs.aws.amazon.com/lex/latest/dg/API_BotAliasMetadata.html

        :param bot_name: - Identifier for the botName.
        :param bot_alias: - Identifier for the botAlias.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3a58698e67d35ab4fbddc80e9aceda4a996db7c34d3134213bccb3f9e30b1e5b)
            check_type(argname="argument bot_name", value=bot_name, expected_type=type_hints["bot_name"])
            check_type(argname="argument bot_alias", value=bot_alias, expected_type=type_hints["bot_alias"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lex", jsii.invoke(self, "onBotAlias", [bot_name, bot_alias, account, region, partition]))

    @jsii.member(jsii_name="onBotVersion")
    def on_bot_version(
        self,
        bot_name: builtins.str,
        bot_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lex":
        '''(experimental) Adds a resource of type bot version to the statement.

        https://docs.aws.amazon.com/lex/latest/dg/API_BotMetadata.html

        :param bot_name: - Identifier for the botName.
        :param bot_version: - Identifier for the botVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__88961695e77727bdd47bb9d6b4b46c14f2c26b5ea188c8d680c04b71fe4d955f)
            check_type(argname="argument bot_name", value=bot_name, expected_type=type_hints["bot_name"])
            check_type(argname="argument bot_version", value=bot_version, expected_type=type_hints["bot_version"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lex", jsii.invoke(self, "onBotVersion", [bot_name, bot_version, account, region, partition]))

    @jsii.member(jsii_name="onChannel")
    def on_channel(
        self,
        bot_name: builtins.str,
        bot_alias: builtins.str,
        channel_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lex":
        '''(experimental) Adds a resource of type channel to the statement.

        https://docs.aws.amazon.com/lex/latest/dg/API_BotChannelAssociation.html

        :param bot_name: - Identifier for the botName.
        :param bot_alias: - Identifier for the botAlias.
        :param channel_name: - Identifier for the channelName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e596475e0058e6aebccae49305c8335c845df26ece76a9933ae9bc6cf4bbe64a)
            check_type(argname="argument bot_name", value=bot_name, expected_type=type_hints["bot_name"])
            check_type(argname="argument bot_alias", value=bot_alias, expected_type=type_hints["bot_alias"])
            check_type(argname="argument channel_name", value=channel_name, expected_type=type_hints["channel_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lex", jsii.invoke(self, "onChannel", [bot_name, bot_alias, channel_name, account, region, partition]))

    @jsii.member(jsii_name="onIntentVersion")
    def on_intent_version(
        self,
        intent_name: builtins.str,
        intent_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lex":
        '''(experimental) Adds a resource of type intent version to the statement.

        https://docs.aws.amazon.com/lex/latest/dg/API_Intent.html

        :param intent_name: - Identifier for the intentName.
        :param intent_version: - Identifier for the intentVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ac60c38a422caf82785eaa705ad1db020bc8699a564f409e1caf72d321597736)
            check_type(argname="argument intent_name", value=intent_name, expected_type=type_hints["intent_name"])
            check_type(argname="argument intent_version", value=intent_version, expected_type=type_hints["intent_version"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lex", jsii.invoke(self, "onIntentVersion", [intent_name, intent_version, account, region, partition]))

    @jsii.member(jsii_name="onSlottypeVersion")
    def on_slottype_version(
        self,
        slot_name: builtins.str,
        slot_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lex":
        '''(experimental) Adds a resource of type slottype version to the statement.

        https://docs.aws.amazon.com/lex/latest/dg/API_SlotTypeMetadata.html

        :param slot_name: - Identifier for the slotName.
        :param slot_version: - Identifier for the slotVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e38ad56f824fc07e33e02699b0522d1649d1997a19c2b2ba96168e6a192cb96b)
            check_type(argname="argument slot_name", value=slot_name, expected_type=type_hints["slot_name"])
            check_type(argname="argument slot_version", value=slot_version, expected_type=type_hints["slot_version"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lex", jsii.invoke(self, "onSlottypeVersion", [slot_name, slot_version, account, region, partition]))

    @jsii.member(jsii_name="toCreateBotVersion")
    def to_create_bot_version(self) -> "Lex":
        '''(experimental) Creates a new version based on the $LATEST version of the specified bot.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_CreateBotVersion.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toCreateBotVersion", []))

    @jsii.member(jsii_name="toCreateIntentVersion")
    def to_create_intent_version(self) -> "Lex":
        '''(experimental) Creates a new version based on the $LATEST version of the specified intent.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_CreateIntentVersion.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toCreateIntentVersion", []))

    @jsii.member(jsii_name="toCreateSlotTypeVersion")
    def to_create_slot_type_version(self) -> "Lex":
        '''(experimental) Creates a new version based on the $LATEST version of the specified slot type.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_CreateSlotTypeVersion.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toCreateSlotTypeVersion", []))

    @jsii.member(jsii_name="toDeleteBot")
    def to_delete_bot(self) -> "Lex":
        '''(experimental) Deletes all versions of a bot.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_DeleteBot.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toDeleteBot", []))

    @jsii.member(jsii_name="toDeleteBotAlias")
    def to_delete_bot_alias(self) -> "Lex":
        '''(experimental) Deletes an alias for a specific bot.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_DeleteBotAlias.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toDeleteBotAlias", []))

    @jsii.member(jsii_name="toDeleteBotChannelAssociation")
    def to_delete_bot_channel_association(self) -> "Lex":
        '''(experimental) Deletes the association between a Amazon Lex bot alias and a messaging platform.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_DeleteBotChannelAssociation.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toDeleteBotChannelAssociation", []))

    @jsii.member(jsii_name="toDeleteBotVersion")
    def to_delete_bot_version(self) -> "Lex":
        '''(experimental) Deletes a specific version of a bot.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_DeleteBotVersion.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toDeleteBotVersion", []))

    @jsii.member(jsii_name="toDeleteIntent")
    def to_delete_intent(self) -> "Lex":
        '''(experimental) Deletes all versions of an intent.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_DeleteIntent.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toDeleteIntent", []))

    @jsii.member(jsii_name="toDeleteIntentVersion")
    def to_delete_intent_version(self) -> "Lex":
        '''(experimental) Deletes a specific version of an intent.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_DeleteIntentVersion.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toDeleteIntentVersion", []))

    @jsii.member(jsii_name="toDeleteSession")
    def to_delete_session(self) -> "Lex":
        '''(experimental) Removes session information for a specified bot, alias, and user ID.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_runtime_DeleteSession.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toDeleteSession", []))

    @jsii.member(jsii_name="toDeleteSlotType")
    def to_delete_slot_type(self) -> "Lex":
        '''(experimental) Deletes all versions of a slot type.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_DeleteSlotType.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toDeleteSlotType", []))

    @jsii.member(jsii_name="toDeleteSlotTypeVersion")
    def to_delete_slot_type_version(self) -> "Lex":
        '''(experimental) Deletes a specific version of a slot type.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_DeleteSlotTypeVersion.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toDeleteSlotTypeVersion", []))

    @jsii.member(jsii_name="toDeleteUtterances")
    def to_delete_utterances(self) -> "Lex":
        '''(experimental) Deletes the information Amazon Lex maintains for utterances on a specific bot and userId.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_DeleteUtterances.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toDeleteUtterances", []))

    @jsii.member(jsii_name="toGetBot")
    def to_get_bot(self) -> "Lex":
        '''(experimental) Returns information for a specific bot. In addition to the bot name, the bot version or alias is required.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetBot.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetBot", []))

    @jsii.member(jsii_name="toGetBotAlias")
    def to_get_bot_alias(self) -> "Lex":
        '''(experimental) Returns information about a Amazon Lex bot alias.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetBotAlias.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetBotAlias", []))

    @jsii.member(jsii_name="toGetBotAliases")
    def to_get_bot_aliases(self) -> "Lex":
        '''(experimental) Returns a list of aliases for a given Amazon Lex bot.

        Access Level: List

        https://docs.aws.amazon.com/lex/latest/dg/API_GetBotAliases.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetBotAliases", []))

    @jsii.member(jsii_name="toGetBotChannelAssociation")
    def to_get_bot_channel_association(self) -> "Lex":
        '''(experimental) Returns information about the association between a Amazon Lex bot and a messaging platform.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetBotChannelAssociation.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetBotChannelAssociation", []))

    @jsii.member(jsii_name="toGetBotChannelAssociations")
    def to_get_bot_channel_associations(self) -> "Lex":
        '''(experimental) Returns a list of all of the channels associated with a single bot.

        Access Level: List

        https://docs.aws.amazon.com/lex/latest/dg/API_GetBotChannelAssociations.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetBotChannelAssociations", []))

    @jsii.member(jsii_name="toGetBots")
    def to_get_bots(self) -> "Lex":
        '''(experimental) Returns information for the $LATEST version of all bots, subject to filters provided by the client.

        Access Level: List

        https://docs.aws.amazon.com/lex/latest/dg/API_GetBots.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetBots", []))

    @jsii.member(jsii_name="toGetBotVersions")
    def to_get_bot_versions(self) -> "Lex":
        '''(experimental) Returns information for all versions of a specific bot.

        Access Level: List

        https://docs.aws.amazon.com/lex/latest/dg/API_GetBotVersions.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetBotVersions", []))

    @jsii.member(jsii_name="toGetBuiltinIntent")
    def to_get_builtin_intent(self) -> "Lex":
        '''(experimental) Returns information about a built-in intent.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetBuiltinIntent.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetBuiltinIntent", []))

    @jsii.member(jsii_name="toGetBuiltinIntents")
    def to_get_builtin_intents(self) -> "Lex":
        '''(experimental) Gets a list of built-in intents that meet the specified criteria.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetBuiltinIntents.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetBuiltinIntents", []))

    @jsii.member(jsii_name="toGetBuiltinSlotTypes")
    def to_get_builtin_slot_types(self) -> "Lex":
        '''(experimental) Gets a list of built-in slot types that meet the specified criteria.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetBuiltinSlotTypes.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetBuiltinSlotTypes", []))

    @jsii.member(jsii_name="toGetExport")
    def to_get_export(self) -> "Lex":
        '''(experimental) Exports Amazon Lex Resource in a requested format.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetExport.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetExport", []))

    @jsii.member(jsii_name="toGetImport")
    def to_get_import(self) -> "Lex":
        '''(experimental) Gets information about an import job started with StartImport.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetImport.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetImport", []))

    @jsii.member(jsii_name="toGetIntent")
    def to_get_intent(self) -> "Lex":
        '''(experimental) Returns information for a specific intent. In addition to the intent name, you must also specify the intent version.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetIntent.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetIntent", []))

    @jsii.member(jsii_name="toGetIntents")
    def to_get_intents(self) -> "Lex":
        '''(experimental) Returns information for the $LATEST version of all intents, subject to filters provided by the client.

        Access Level: List

        https://docs.aws.amazon.com/lex/latest/dg/API_GetIntents.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetIntents", []))

    @jsii.member(jsii_name="toGetIntentVersions")
    def to_get_intent_versions(self) -> "Lex":
        '''(experimental) Returns information for all versions of a specific intent.

        Access Level: List

        https://docs.aws.amazon.com/lex/latest/dg/API_GetIntentVersions.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetIntentVersions", []))

    @jsii.member(jsii_name="toGetMigration")
    def to_get_migration(self) -> "Lex":
        '''(experimental) Grants permission to view an ongoing or completed migration.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetMigration.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetMigration", []))

    @jsii.member(jsii_name="toGetMigrations")
    def to_get_migrations(self) -> "Lex":
        '''(experimental) Grants permission to view list of migrations from Amazon Lex v1 to Amazon Lex v2.

        Access Level: List

        https://docs.aws.amazon.com/lex/latest/dg/API_GetMigrations.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetMigrations", []))

    @jsii.member(jsii_name="toGetSession")
    def to_get_session(self) -> "Lex":
        '''(experimental) Returns session information for a specified bot, alias, and user ID.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_runtime_GetSession.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetSession", []))

    @jsii.member(jsii_name="toGetSlotType")
    def to_get_slot_type(self) -> "Lex":
        '''(experimental) Returns information about a specific version of a slot type.

        In addition to specifying the slot type name, you must also specify the slot type version

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_GetSlotType.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetSlotType", []))

    @jsii.member(jsii_name="toGetSlotTypes")
    def to_get_slot_types(self) -> "Lex":
        '''(experimental) Returns information for the $LATEST version of all slot types, subject to filters provided by the client.

        Access Level: List

        https://docs.aws.amazon.com/lex/latest/dg/API_GetSlotTypes.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetSlotTypes", []))

    @jsii.member(jsii_name="toGetSlotTypeVersions")
    def to_get_slot_type_versions(self) -> "Lex":
        '''(experimental) Returns information for all versions of a specific slot type.

        Access Level: List

        https://docs.aws.amazon.com/lex/latest/dg/API_GetSlotTypeVersions.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetSlotTypeVersions", []))

    @jsii.member(jsii_name="toGetUtterancesView")
    def to_get_utterances_view(self) -> "Lex":
        '''(experimental) Returns a view of aggregate utterance data for versions of a bot for a recent time period.

        Access Level: List

        https://docs.aws.amazon.com/lex/latest/dg/API_GetUtterancesView.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toGetUtterancesView", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Lex":
        '''(experimental) Lists tags for a Lex resource.

        Access Level: Read

        https://docs.aws.amazon.com/lex/latest/dg/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPostContent")
    def to_post_content(self) -> "Lex":
        '''(experimental) Sends user input (text or speech) to Amazon Lex.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_runtime_PostContent.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toPostContent", []))

    @jsii.member(jsii_name="toPostText")
    def to_post_text(self) -> "Lex":
        '''(experimental) Sends user input (text-only) to Amazon Lex.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_runtime_PostText.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toPostText", []))

    @jsii.member(jsii_name="toPutBot")
    def to_put_bot(self) -> "Lex":
        '''(experimental) Creates or updates the $LATEST version of a Amazon Lex conversational bot.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/lex/latest/dg/API_PutBot.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toPutBot", []))

    @jsii.member(jsii_name="toPutBotAlias")
    def to_put_bot_alias(self) -> "Lex":
        '''(experimental) Creates or updates an alias for the specific bot.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/lex/latest/dg/API_PutBotAlias.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toPutBotAlias", []))

    @jsii.member(jsii_name="toPutIntent")
    def to_put_intent(self) -> "Lex":
        '''(experimental) Creates or updates the $LATEST version of an intent.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_PutIntent.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toPutIntent", []))

    @jsii.member(jsii_name="toPutSession")
    def to_put_session(self) -> "Lex":
        '''(experimental) Creates a new session or modifies an existing session with an Amazon Lex bot.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_runtime_PutSession.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toPutSession", []))

    @jsii.member(jsii_name="toPutSlotType")
    def to_put_slot_type(self) -> "Lex":
        '''(experimental) Creates or updates the $LATEST version of a slot type.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_PutSlotType.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toPutSlotType", []))

    @jsii.member(jsii_name="toStartImport")
    def to_start_import(self) -> "Lex":
        '''(experimental) Starts a job to import a resource to Amazon Lex.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_StartImport.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toStartImport", []))

    @jsii.member(jsii_name="toStartMigration")
    def to_start_migration(self) -> "Lex":
        '''(experimental) Grants permission to migrate a bot from Amazon Lex v1 to Amazon Lex v2.

        Access Level: Write

        https://docs.aws.amazon.com/lex/latest/dg/API_StartMigration.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toStartMigration", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Lex":
        '''(experimental) Adds or overwrites tags to a Lex resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/lex/latest/dg/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Lex":
        '''(experimental) Removes tags from a Lex resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/lex/latest/dg/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Lex", jsii.invoke(self, "toUntagResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8d1a146f50c61fea8c969498c1355c9e4b7b1a159651cb663f99c2253367404e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__161b30a572e976475decd87c34ee2903661ca3a9f77fc6f605da3848125c5042)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class LexV2(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.LexV2"):
    '''(experimental) Statement provider for service `lex-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlexv2.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `lex-v2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlexv2.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1ff1fb41f9c226b1e90eb3b74b6f01b25d4d58b38af2268ae2c423283b207d63)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onBot")
    def on_bot(
        self,
        bot_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "LexV2":
        '''(experimental) Adds a resource of type bot to the statement.

        https://docs.aws.amazon.com/lexv2/latest/dg/how-it-works.html

        :param bot_id: - Identifier for the botId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5b1062b2066b035849a480047b1e1b39865ffc343294599879910fc458493e59)
            check_type(argname="argument bot_id", value=bot_id, expected_type=type_hints["bot_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("LexV2", jsii.invoke(self, "onBot", [bot_id, account, region, partition]))

    @jsii.member(jsii_name="onBotAlias")
    def on_bot_alias(
        self,
        bot_id: builtins.str,
        bot_alias_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "LexV2":
        '''(experimental) Adds a resource of type bot alias to the statement.

        https://docs.aws.amazon.com/lexv2/latest/dg/how-it-works.html

        :param bot_id: - Identifier for the botId.
        :param bot_alias_id: - Identifier for the botAliasId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c5707833b9c341784cbd7ee927f5486495559d0009c8b98254c9a4b7828cc3e9)
            check_type(argname="argument bot_id", value=bot_id, expected_type=type_hints["bot_id"])
            check_type(argname="argument bot_alias_id", value=bot_alias_id, expected_type=type_hints["bot_alias_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("LexV2", jsii.invoke(self, "onBotAlias", [bot_id, bot_alias_id, account, region, partition]))

    @jsii.member(jsii_name="toBatchCreateCustomVocabularyItem")
    def to_batch_create_custom_vocabulary_item(self) -> "LexV2":
        '''(experimental) Grants permission to create new items in an existing custom vocabulary.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_BatchCreateCustomVocabularyItem.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toBatchCreateCustomVocabularyItem", []))

    @jsii.member(jsii_name="toBatchDeleteCustomVocabularyItem")
    def to_batch_delete_custom_vocabulary_item(self) -> "LexV2":
        '''(experimental) Grants permission to delete existing items in an existing custom vocabulary.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_BatchDeleteCustomVocabularyItem.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toBatchDeleteCustomVocabularyItem", []))

    @jsii.member(jsii_name="toBatchUpdateCustomVocabularyItem")
    def to_batch_update_custom_vocabulary_item(self) -> "LexV2":
        '''(experimental) Grants permission to update existing items in an existing custom vocabulary.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_BatchUpdateCustomVocabularyItem.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toBatchUpdateCustomVocabularyItem", []))

    @jsii.member(jsii_name="toBuildBotLocale")
    def to_build_bot_locale(self) -> "LexV2":
        '''(experimental) Grants permission to build an existing bot locale in a bot.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_BuildBotLocale.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toBuildBotLocale", []))

    @jsii.member(jsii_name="toCreateBot")
    def to_create_bot(self) -> "LexV2":
        '''(experimental) Grants permission to create a new bot and a test bot alias pointing to the DRAFT bot version.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/lexv2/latest/dg/API_CreateBot.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toCreateBot", []))

    @jsii.member(jsii_name="toCreateBotAlias")
    def to_create_bot_alias(self) -> "LexV2":
        '''(experimental) Grants permission to create a new bot alias in a bot.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/lexv2/latest/dg/API_CreateBotAlias.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toCreateBotAlias", []))

    @jsii.member(jsii_name="toCreateBotChannel")
    def to_create_bot_channel(self) -> "LexV2":
        '''(experimental) Grants permission to create a bot channel in an existing bot.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/deploying-messaging-platform.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toCreateBotChannel", []))

    @jsii.member(jsii_name="toCreateBotLocale")
    def to_create_bot_locale(self) -> "LexV2":
        '''(experimental) Grants permission to create a new bot locale in an existing bot.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_CreateBotLocale.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toCreateBotLocale", []))

    @jsii.member(jsii_name="toCreateBotVersion")
    def to_create_bot_version(self) -> "LexV2":
        '''(experimental) Grants permission to create a new version of an existing bot.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_CreateBotVersion.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toCreateBotVersion", []))

    @jsii.member(jsii_name="toCreateCustomVocabulary")
    def to_create_custom_vocabulary(self) -> "LexV2":
        '''(experimental) Grants permission to create a new custom vocabulary in an existing bot locale.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/vocab.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toCreateCustomVocabulary", []))

    @jsii.member(jsii_name="toCreateExport")
    def to_create_export(self) -> "LexV2":
        '''(experimental) Grants permission to create an export for an existing resource.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_CreateExport.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toCreateExport", []))

    @jsii.member(jsii_name="toCreateIntent")
    def to_create_intent(self) -> "LexV2":
        '''(experimental) Grants permission to create a new intent in an existing bot locale.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_CreateIntent.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toCreateIntent", []))

    @jsii.member(jsii_name="toCreateResourcePolicy")
    def to_create_resource_policy(self) -> "LexV2":
        '''(experimental) Grants permission to create a new resource policy for a Lex resource.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_CreateResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toCreateResourcePolicy", []))

    @jsii.member(jsii_name="toCreateSlot")
    def to_create_slot(self) -> "LexV2":
        '''(experimental) Grants permission to create a new slot in an intent.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_CreateSlot.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toCreateSlot", []))

    @jsii.member(jsii_name="toCreateSlotType")
    def to_create_slot_type(self) -> "LexV2":
        '''(experimental) Grants permission to create a new slot type in an existing bot locale.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_CreateSlotType.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toCreateSlotType", []))

    @jsii.member(jsii_name="toCreateUploadUrl")
    def to_create_upload_url(self) -> "LexV2":
        '''(experimental) Grants permission to create an upload url for import file.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_CreateUploadUrl.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toCreateUploadUrl", []))

    @jsii.member(jsii_name="toDeleteBot")
    def to_delete_bot(self) -> "LexV2":
        '''(experimental) Grants permission to delete an existing bot.

        Access Level: Write

        Dependent actions:

        - lex:DeleteBotAlias
        - lex:DeleteBotChannel
        - lex:DeleteBotLocale
        - lex:DeleteBotVersion
        - lex:DeleteIntent
        - lex:DeleteSlot
        - lex:DeleteSlotType

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DeleteBot.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteBot", []))

    @jsii.member(jsii_name="toDeleteBotAlias")
    def to_delete_bot_alias(self) -> "LexV2":
        '''(experimental) Grants permission to delete an existing bot alias in a bot.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DeleteBotAlias.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteBotAlias", []))

    @jsii.member(jsii_name="toDeleteBotChannel")
    def to_delete_bot_channel(self) -> "LexV2":
        '''(experimental) Grants permission to delete an existing bot channel.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/deploying-messaging-platform.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteBotChannel", []))

    @jsii.member(jsii_name="toDeleteBotLocale")
    def to_delete_bot_locale(self) -> "LexV2":
        '''(experimental) Grants permission to delete an existing bot locale in a bot.

        Access Level: Write

        Dependent actions:

        - lex:DeleteIntent
        - lex:DeleteSlot
        - lex:DeleteSlotType

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DeleteBotLocale.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteBotLocale", []))

    @jsii.member(jsii_name="toDeleteBotVersion")
    def to_delete_bot_version(self) -> "LexV2":
        '''(experimental) Grants permission to delete an existing bot version.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DeleteBotVersion.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteBotVersion", []))

    @jsii.member(jsii_name="toDeleteCustomVocabulary")
    def to_delete_custom_vocabulary(self) -> "LexV2":
        '''(experimental) Grants permission to delete an existing custom vocabulary in a bot locale.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DeleteCustomVocabulary.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteCustomVocabulary", []))

    @jsii.member(jsii_name="toDeleteExport")
    def to_delete_export(self) -> "LexV2":
        '''(experimental) Grants permission to delete an existing export.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DeleteExport.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteExport", []))

    @jsii.member(jsii_name="toDeleteImport")
    def to_delete_import(self) -> "LexV2":
        '''(experimental) Grants permission to delete an existing import.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DeleteImport.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteImport", []))

    @jsii.member(jsii_name="toDeleteIntent")
    def to_delete_intent(self) -> "LexV2":
        '''(experimental) Grants permission to delete an existing intent in a bot locale.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DeleteIntent.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteIntent", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "LexV2":
        '''(experimental) Grants permission to delete an existing resource policy for a Lex resource.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DeleteResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteSession")
    def to_delete_session(self) -> "LexV2":
        '''(experimental) Grants permission to delete session information for a bot alias and user ID.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_runtime_DeleteSession.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteSession", []))

    @jsii.member(jsii_name="toDeleteSlot")
    def to_delete_slot(self) -> "LexV2":
        '''(experimental) Grants permission to delete an existing slot in an intent.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DeleteSlot.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteSlot", []))

    @jsii.member(jsii_name="toDeleteSlotType")
    def to_delete_slot_type(self) -> "LexV2":
        '''(experimental) Grants permission to delete an existing slot type in a bot locale.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DeleteSlotType.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteSlotType", []))

    @jsii.member(jsii_name="toDeleteUtterances")
    def to_delete_utterances(self) -> "LexV2":
        '''(experimental) Grants permission to delete utterance data for a bot.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DeleteUtterances.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDeleteUtterances", []))

    @jsii.member(jsii_name="toDescribeBot")
    def to_describe_bot(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve an existing bot.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DescribeBot.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeBot", []))

    @jsii.member(jsii_name="toDescribeBotAlias")
    def to_describe_bot_alias(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve an existing bot alias.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DescribeBotAlias.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeBotAlias", []))

    @jsii.member(jsii_name="toDescribeBotChannel")
    def to_describe_bot_channel(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve an existing bot channel.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/deploying-messaging-platform.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeBotChannel", []))

    @jsii.member(jsii_name="toDescribeBotLocale")
    def to_describe_bot_locale(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve an existing bot locale.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DescribeBotLocale.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeBotLocale", []))

    @jsii.member(jsii_name="toDescribeBotRecommendation")
    def to_describe_bot_recommendation(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve metadata information about a bot recommendation.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DescribeBotRecommendation.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeBotRecommendation", []))

    @jsii.member(jsii_name="toDescribeBotVersion")
    def to_describe_bot_version(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve an existing bot version.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DescribeBotVersion.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeBotVersion", []))

    @jsii.member(jsii_name="toDescribeCustomVocabulary")
    def to_describe_custom_vocabulary(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve an existing custom vocabulary.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/vocab.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeCustomVocabulary", []))

    @jsii.member(jsii_name="toDescribeCustomVocabularyMetadata")
    def to_describe_custom_vocabulary_metadata(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve metadata of an existing custom vocabulary.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DescribeCustomVocabularyMetadata.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeCustomVocabularyMetadata", []))

    @jsii.member(jsii_name="toDescribeExport")
    def to_describe_export(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve an existing export.

        Access Level: Read

        Dependent actions:

        - lex:DescribeBot
        - lex:DescribeBotLocale
        - lex:DescribeIntent
        - lex:DescribeSlot
        - lex:DescribeSlotType
        - lex:ListBotLocales
        - lex:ListIntents
        - lex:ListSlotTypes
        - lex:ListSlots

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DescribeExport.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeExport", []))

    @jsii.member(jsii_name="toDescribeImport")
    def to_describe_import(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve an existing import.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DescribeImport.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeImport", []))

    @jsii.member(jsii_name="toDescribeIntent")
    def to_describe_intent(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve an existing intent.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DescribeIntent.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeIntent", []))

    @jsii.member(jsii_name="toDescribeResourcePolicy")
    def to_describe_resource_policy(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve an existing resource policy for a Lex resource.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DescribeResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeResourcePolicy", []))

    @jsii.member(jsii_name="toDescribeSlot")
    def to_describe_slot(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve an existing slot.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DescribeSlot.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeSlot", []))

    @jsii.member(jsii_name="toDescribeSlotType")
    def to_describe_slot_type(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve an existing slot type.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_DescribeSlotType.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toDescribeSlotType", []))

    @jsii.member(jsii_name="toGetSession")
    def to_get_session(self) -> "LexV2":
        '''(experimental) Grants permission to retrieve session information for a bot alias and user ID.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_runtime_GetSession.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toGetSession", []))

    @jsii.member(jsii_name="toListAggregatedUtterances")
    def to_list_aggregated_utterances(self) -> "LexV2":
        '''(experimental) Grants permission to list utterances and statistics for a bot.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListAggregatedUtterances.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListAggregatedUtterances", []))

    @jsii.member(jsii_name="toListBotAliases")
    def to_list_bot_aliases(self) -> "LexV2":
        '''(experimental) Grants permission to list bot aliases in an bot.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListBotAliases.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListBotAliases", []))

    @jsii.member(jsii_name="toListBotChannels")
    def to_list_bot_channels(self) -> "LexV2":
        '''(experimental) Grants permission to list bot channels.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/deploying-messaging-platform.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListBotChannels", []))

    @jsii.member(jsii_name="toListBotLocales")
    def to_list_bot_locales(self) -> "LexV2":
        '''(experimental) Grants permission to list bot locales in a bot.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListBotLocales.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListBotLocales", []))

    @jsii.member(jsii_name="toListBotRecommendations")
    def to_list_bot_recommendations(self) -> "LexV2":
        '''(experimental) Grants permission to get a list of bot recommendations that meet the specified criteria.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListBotRecommendations.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListBotRecommendations", []))

    @jsii.member(jsii_name="toListBots")
    def to_list_bots(self) -> "LexV2":
        '''(experimental) Grants permission to list existing bots.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListBots.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListBots", []))

    @jsii.member(jsii_name="toListBotVersions")
    def to_list_bot_versions(self) -> "LexV2":
        '''(experimental) Grants permission to list existing bot versions.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListBotVersions.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListBotVersions", []))

    @jsii.member(jsii_name="toListBuiltInIntents")
    def to_list_built_in_intents(self) -> "LexV2":
        '''(experimental) Grants permission to list built-in intents.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListBuiltInIntents.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListBuiltInIntents", []))

    @jsii.member(jsii_name="toListBuiltInSlotTypes")
    def to_list_built_in_slot_types(self) -> "LexV2":
        '''(experimental) Grants permission to list built-in slot types.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListBuiltInSlotTypes.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListBuiltInSlotTypes", []))

    @jsii.member(jsii_name="toListCustomVocabularyItems")
    def to_list_custom_vocabulary_items(self) -> "LexV2":
        '''(experimental) Grants permission to list items of an existing custom vocabulary.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListCustomVocabularyItems.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListCustomVocabularyItems", []))

    @jsii.member(jsii_name="toListExports")
    def to_list_exports(self) -> "LexV2":
        '''(experimental) Grants permission to list existing exports.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListExports.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListExports", []))

    @jsii.member(jsii_name="toListImports")
    def to_list_imports(self) -> "LexV2":
        '''(experimental) Grants permission to list existing imports.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListImports.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListImports", []))

    @jsii.member(jsii_name="toListIntents")
    def to_list_intents(self) -> "LexV2":
        '''(experimental) Grants permission to list intents in a bot.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListIntents.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListIntents", []))

    @jsii.member(jsii_name="toListRecommendedIntents")
    def to_list_recommended_intents(self) -> "LexV2":
        '''(experimental) Grants permission to get a list of recommended intents provided by the bot recommendation.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListRecommendedIntents.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListRecommendedIntents", []))

    @jsii.member(jsii_name="toListSlots")
    def to_list_slots(self) -> "LexV2":
        '''(experimental) Grants permission to list slots in an intent.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListSlots.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListSlots", []))

    @jsii.member(jsii_name="toListSlotTypes")
    def to_list_slot_types(self) -> "LexV2":
        '''(experimental) Grants permission to list slot types in a bot.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListSlotTypes.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListSlotTypes", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "LexV2":
        '''(experimental) Grants permission to lists tags for a Lex resource.

        Access Level: Read

        https://docs.aws.amazon.com/lexv2/latest/dg/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutSession")
    def to_put_session(self) -> "LexV2":
        '''(experimental) Grants permission to create a new session or modify an existing session for a bot alias and user ID.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_runtime_PutSession.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toPutSession", []))

    @jsii.member(jsii_name="toRecognizeText")
    def to_recognize_text(self) -> "LexV2":
        '''(experimental) Grants permission to send user input (text-only) to an bot alias.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_runtime_RecognizeText.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toRecognizeText", []))

    @jsii.member(jsii_name="toRecognizeUtterance")
    def to_recognize_utterance(self) -> "LexV2":
        '''(experimental) Grants permission to send user input (text or speech) to an bot alias.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_runtime_RecognizeUtterance.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toRecognizeUtterance", []))

    @jsii.member(jsii_name="toSearchAssociatedTranscripts")
    def to_search_associated_transcripts(self) -> "LexV2":
        '''(experimental) Grants permission to search for associated transcripts that meet the specified criteria.

        Access Level: List

        https://docs.aws.amazon.com/lexv2/latest/dg/API_SearchAssociatedTranscripts.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toSearchAssociatedTranscripts", []))

    @jsii.member(jsii_name="toStartBotRecommendation")
    def to_start_bot_recommendation(self) -> "LexV2":
        '''(experimental) Grants permission to start a bot recommendation for an existing bot locale.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_StartBotRecommendation.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toStartBotRecommendation", []))

    @jsii.member(jsii_name="toStartConversation")
    def to_start_conversation(self) -> "LexV2":
        '''(experimental) Grants permission to stream user input (speech/text/DTMF) to a bot alias.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_runtime_StartConversation.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toStartConversation", []))

    @jsii.member(jsii_name="toStartImport")
    def to_start_import(self) -> "LexV2":
        '''(experimental) Grants permission to start a new import with the uploaded import file.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - lex:CreateBot
        - lex:CreateBotLocale
        - lex:CreateIntent
        - lex:CreateSlot
        - lex:CreateSlotType
        - lex:DeleteBotLocale
        - lex:DeleteIntent
        - lex:DeleteSlot
        - lex:DeleteSlotType
        - lex:UpdateBot
        - lex:UpdateBotLocale
        - lex:UpdateIntent
        - lex:UpdateSlot
        - lex:UpdateSlotType

        https://docs.aws.amazon.com/lexv2/latest/dg/API_StartImport.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toStartImport", []))

    @jsii.member(jsii_name="toStopBotRecommendation")
    def to_stop_bot_recommendation(self) -> "LexV2":
        '''(experimental) Grants permission to stop a bot recommendation for an existing bot locale.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_StopBotRecommendation.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toStopBotRecommendation", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "LexV2":
        '''(experimental) Grants permission to add or overwrite tags of a Lex resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/lexv2/latest/dg/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "LexV2":
        '''(experimental) Grants permission to remove tags from a Lex resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/lexv2/latest/dg/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateBot")
    def to_update_bot(self) -> "LexV2":
        '''(experimental) Grants permission to update an existing bot.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_UpdateBot.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toUpdateBot", []))

    @jsii.member(jsii_name="toUpdateBotAlias")
    def to_update_bot_alias(self) -> "LexV2":
        '''(experimental) Grants permission to update an existing bot alias.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_UpdateBotAlias.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toUpdateBotAlias", []))

    @jsii.member(jsii_name="toUpdateBotLocale")
    def to_update_bot_locale(self) -> "LexV2":
        '''(experimental) Grants permission to update an existing bot locale.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_UpdateBotLocale.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toUpdateBotLocale", []))

    @jsii.member(jsii_name="toUpdateBotRecommendation")
    def to_update_bot_recommendation(self) -> "LexV2":
        '''(experimental) Grants permission to update an existing bot recommendation request.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_UpdateBotRecommendation.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toUpdateBotRecommendation", []))

    @jsii.member(jsii_name="toUpdateCustomVocabulary")
    def to_update_custom_vocabulary(self) -> "LexV2":
        '''(experimental) Grants permission to update an existing custom vocabulary.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/vocab.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toUpdateCustomVocabulary", []))

    @jsii.member(jsii_name="toUpdateExport")
    def to_update_export(self) -> "LexV2":
        '''(experimental) Grants permission to update an existing export.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_UpdateExport.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toUpdateExport", []))

    @jsii.member(jsii_name="toUpdateIntent")
    def to_update_intent(self) -> "LexV2":
        '''(experimental) Grants permission to update an existing intent.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_UpdateIntent.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toUpdateIntent", []))

    @jsii.member(jsii_name="toUpdateResourcePolicy")
    def to_update_resource_policy(self) -> "LexV2":
        '''(experimental) Grants permission to update an existing resource policy for a Lex resource.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_UpdateResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toUpdateResourcePolicy", []))

    @jsii.member(jsii_name="toUpdateSlot")
    def to_update_slot(self) -> "LexV2":
        '''(experimental) Grants permission to update an existing slot.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_UpdateSlot.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toUpdateSlot", []))

    @jsii.member(jsii_name="toUpdateSlotType")
    def to_update_slot_type(self) -> "LexV2":
        '''(experimental) Grants permission to update an existing slot type.

        Access Level: Write

        https://docs.aws.amazon.com/lexv2/latest/dg/API_UpdateSlotType.html

        :stability: experimental
        '''
        return typing.cast("LexV2", jsii.invoke(self, "toUpdateSlotType", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2da92dc890a67744f80c177dd96708ec40566143612f4b2787e787c186d28773)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d6b46e05cb0b430b0d8cdf4e62655103044ab1e049d64422df09a860b523a283)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class LicenseManager(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.LicenseManager",
):
    '''(experimental) Statement provider for service `license-manager <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awslicensemanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `license-manager <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awslicensemanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__94a7882c896e8092d85014715c4d205e92c3638c12e55ce0c87f9c5847068ce1)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifResourceTag")
    def if_resource_tag(
        self,
        tag_key: builtins.str,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "LicenseManager":
        '''(experimental) Filters access by the tag key-value pairs attached to the resource.

        https://docs.aws.amazon.com/license-manager/latest/userguide/identity-access-management.html

        Applies to resource types:

        - license-configuration
        - report-generator

        :param tag_key: The tag key to check.
        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f8801250f593a7c004f522bab78e709819ce6a2ffdf593999dbb947a3d1f7f83)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("LicenseManager", jsii.invoke(self, "ifResourceTag", [tag_key, value, operator]))

    @jsii.member(jsii_name="onGrant")
    def on_grant(
        self,
        grant_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "LicenseManager":
        '''(experimental) Adds a resource of type grant to the statement.

        https://docs.aws.amazon.com/license-manager/latest/userguide/granted-licenses.html

        :param grant_id: - Identifier for the grantId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fbdcef8137dc67f0667d2ccede59a23b6ab8a62e42fb5f58c3403fbbecaad0d4)
            check_type(argname="argument grant_id", value=grant_id, expected_type=type_hints["grant_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("LicenseManager", jsii.invoke(self, "onGrant", [grant_id, account, partition]))

    @jsii.member(jsii_name="onLicense")
    def on_license(
        self,
        license_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "LicenseManager":
        '''(experimental) Adds a resource of type license to the statement.

        https://docs.aws.amazon.com/license-manager/latest/userguide/seller-issued-licenses.html

        :param license_id: - Identifier for the licenseId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__34f669b697c0da4ca07a0e9c37ebf50b592461b9bf11466cea69801efc2274d1)
            check_type(argname="argument license_id", value=license_id, expected_type=type_hints["license_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("LicenseManager", jsii.invoke(self, "onLicense", [license_id, account, partition]))

    @jsii.member(jsii_name="onLicenseConfiguration")
    def on_license_configuration(
        self,
        license_configuration_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "LicenseManager":
        '''(experimental) Adds a resource of type license-configuration to the statement.

        https://docs.aws.amazon.com/license-manager/latest/userguide/license-configurations.html

        :param license_configuration_id: - Identifier for the licenseConfigurationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__91e4755e9685ab0a95eaac3e55438750a7aaaf11736c15a42fc60bc83a0c8a39)
            check_type(argname="argument license_configuration_id", value=license_configuration_id, expected_type=type_hints["license_configuration_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("LicenseManager", jsii.invoke(self, "onLicenseConfiguration", [license_configuration_id, account, region, partition]))

    @jsii.member(jsii_name="onReportGenerator")
    def on_report_generator(
        self,
        report_generator_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "LicenseManager":
        '''(experimental) Adds a resource of type report-generator to the statement.

        https://docs.aws.amazon.com/license-manager/latest/userguide/report-generators.html

        :param report_generator_id: - Identifier for the reportGeneratorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f6b2e9d4e2519883ab2c927541790df77e851e4b0185a2fdcba9f21ebbbd5fcb)
            check_type(argname="argument report_generator_id", value=report_generator_id, expected_type=type_hints["report_generator_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("LicenseManager", jsii.invoke(self, "onReportGenerator", [report_generator_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptGrant")
    def to_accept_grant(self) -> "LicenseManager":
        '''(experimental) Grants permission to accept a grant.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_AcceptGrant.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toAcceptGrant", []))

    @jsii.member(jsii_name="toCheckInLicense")
    def to_check_in_license(self) -> "LicenseManager":
        '''(experimental) Grants permission to check in license entitlements back to pool.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_CheckInLicense.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toCheckInLicense", []))

    @jsii.member(jsii_name="toCheckoutBorrowLicense")
    def to_checkout_borrow_license(self) -> "LicenseManager":
        '''(experimental) Grants permission to check out license entitlements for borrow use case.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_CheckoutBorrowLicense.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toCheckoutBorrowLicense", []))

    @jsii.member(jsii_name="toCheckoutLicense")
    def to_checkout_license(self) -> "LicenseManager":
        '''(experimental) Grants permission to check out license entitlements.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_CheckoutLicense.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toCheckoutLicense", []))

    @jsii.member(jsii_name="toCreateGrant")
    def to_create_grant(self) -> "LicenseManager":
        '''(experimental) Grants permission to create a new grant for license.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_CreateGrant.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toCreateGrant", []))

    @jsii.member(jsii_name="toCreateGrantVersion")
    def to_create_grant_version(self) -> "LicenseManager":
        '''(experimental) Grants permission to create new version of grant.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_CreateGrantVersion.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toCreateGrantVersion", []))

    @jsii.member(jsii_name="toCreateLicense")
    def to_create_license(self) -> "LicenseManager":
        '''(experimental) Grants permission to create a new license.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_CreateLicense.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toCreateLicense", []))

    @jsii.member(jsii_name="toCreateLicenseConfiguration")
    def to_create_license_configuration(self) -> "LicenseManager":
        '''(experimental) Grants permission to create a new license configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_CreateLicenseConfiguration.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toCreateLicenseConfiguration", []))

    @jsii.member(jsii_name="toCreateLicenseConversionTaskForResource")
    def to_create_license_conversion_task_for_resource(self) -> "LicenseManager":
        '''(experimental) Grants permission to create a license conversion task for a resource.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_CreateLicenseConversionTaskForResource.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toCreateLicenseConversionTaskForResource", []))

    @jsii.member(jsii_name="toCreateLicenseManagerReportGenerator")
    def to_create_license_manager_report_generator(self) -> "LicenseManager":
        '''(experimental) Grants permission to create a report generator for a license configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_CreateLicenseManagerReportGenerator.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toCreateLicenseManagerReportGenerator", []))

    @jsii.member(jsii_name="toCreateLicenseVersion")
    def to_create_license_version(self) -> "LicenseManager":
        '''(experimental) Grants permission to create new version of license.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_CreateLicenseVersion.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toCreateLicenseVersion", []))

    @jsii.member(jsii_name="toCreateToken")
    def to_create_token(self) -> "LicenseManager":
        '''(experimental) Grants permission to create a new token for license.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_CreateToken.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toCreateToken", []))

    @jsii.member(jsii_name="toDeleteGrant")
    def to_delete_grant(self) -> "LicenseManager":
        '''(experimental) Grants permission to delete a grant.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_DeleteGrant.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toDeleteGrant", []))

    @jsii.member(jsii_name="toDeleteLicense")
    def to_delete_license(self) -> "LicenseManager":
        '''(experimental) Grants permission to delete a license.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_DeleteLicense.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toDeleteLicense", []))

    @jsii.member(jsii_name="toDeleteLicenseConfiguration")
    def to_delete_license_configuration(self) -> "LicenseManager":
        '''(experimental) Grants permission to permanently delete a license configuration.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_DeleteLicenseConfiguration.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toDeleteLicenseConfiguration", []))

    @jsii.member(jsii_name="toDeleteLicenseManagerReportGenerator")
    def to_delete_license_manager_report_generator(self) -> "LicenseManager":
        '''(experimental) Grants permission to delete a report generator.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_DeleteLicenseManagerReportGenerator.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toDeleteLicenseManagerReportGenerator", []))

    @jsii.member(jsii_name="toDeleteToken")
    def to_delete_token(self) -> "LicenseManager":
        '''(experimental) Grants permission to delete token.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_DeleteToken.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toDeleteToken", []))

    @jsii.member(jsii_name="toExtendLicenseConsumption")
    def to_extend_license_consumption(self) -> "LicenseManager":
        '''(experimental) Grants permission to extend consumption period of already checkout license entitlements.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ExtendLicenseConsumption.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toExtendLicenseConsumption", []))

    @jsii.member(jsii_name="toGetAccessToken")
    def to_get_access_token(self) -> "LicenseManager":
        '''(experimental) Grants permission to get access token.

        Access Level: Read

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_GetAccessToken.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toGetAccessToken", []))

    @jsii.member(jsii_name="toGetGrant")
    def to_get_grant(self) -> "LicenseManager":
        '''(experimental) Grants permission to get a grant.

        Access Level: Read

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_GetGrant.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toGetGrant", []))

    @jsii.member(jsii_name="toGetLicense")
    def to_get_license(self) -> "LicenseManager":
        '''(experimental) Grants permission to get a license.

        Access Level: Read

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_GetLicense.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toGetLicense", []))

    @jsii.member(jsii_name="toGetLicenseConfiguration")
    def to_get_license_configuration(self) -> "LicenseManager":
        '''(experimental) Grants permission to get a license configuration.

        Access Level: Read

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_GetLicenseConfiguration.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toGetLicenseConfiguration", []))

    @jsii.member(jsii_name="toGetLicenseConversionTask")
    def to_get_license_conversion_task(self) -> "LicenseManager":
        '''(experimental) Grants permission to retrieve a license conversion task.

        Access Level: Read

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_GetLicenseConversionTask.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toGetLicenseConversionTask", []))

    @jsii.member(jsii_name="toGetLicenseManagerReportGenerator")
    def to_get_license_manager_report_generator(self) -> "LicenseManager":
        '''(experimental) Grants permission to get a report generator.

        Access Level: Read

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_GetLicenseManagerReportGenerator.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toGetLicenseManagerReportGenerator", []))

    @jsii.member(jsii_name="toGetLicenseUsage")
    def to_get_license_usage(self) -> "LicenseManager":
        '''(experimental) Grants permission to get a license usage.

        Access Level: Read

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_GetLicenseUsage.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toGetLicenseUsage", []))

    @jsii.member(jsii_name="toGetServiceSettings")
    def to_get_service_settings(self) -> "LicenseManager":
        '''(experimental) Grants permission to get service settings.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_GetServiceSettings.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toGetServiceSettings", []))

    @jsii.member(jsii_name="toListAssociationsForLicenseConfiguration")
    def to_list_associations_for_license_configuration(self) -> "LicenseManager":
        '''(experimental) Grants permission to list associations for a selected license configuration.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListAssociationsForLicenseConfiguration.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListAssociationsForLicenseConfiguration", []))

    @jsii.member(jsii_name="toListDistributedGrants")
    def to_list_distributed_grants(self) -> "LicenseManager":
        '''(experimental) Grants permission to list distributed grants.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListDistributedGrants.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListDistributedGrants", []))

    @jsii.member(jsii_name="toListFailuresForLicenseConfigurationOperations")
    def to_list_failures_for_license_configuration_operations(self) -> "LicenseManager":
        '''(experimental) Grants permission to list the license configuration operations that failed.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListFailuresForLicenseConfigurationOperations.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListFailuresForLicenseConfigurationOperations", []))

    @jsii.member(jsii_name="toListLicenseConfigurations")
    def to_list_license_configurations(self) -> "LicenseManager":
        '''(experimental) Grants permission to list license configurations.

        Access Level: Read

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListLicenseConfigurations.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListLicenseConfigurations", []))

    @jsii.member(jsii_name="toListLicenseConversionTasks")
    def to_list_license_conversion_tasks(self) -> "LicenseManager":
        '''(experimental) Grants permission to list license conversion tasks.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListLicenseConversionTasks.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListLicenseConversionTasks", []))

    @jsii.member(jsii_name="toListLicenseManagerReportGenerators")
    def to_list_license_manager_report_generators(self) -> "LicenseManager":
        '''(experimental) Grants permission to list report generators.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListLicenseManagerReportGenerators.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListLicenseManagerReportGenerators", []))

    @jsii.member(jsii_name="toListLicenses")
    def to_list_licenses(self) -> "LicenseManager":
        '''(experimental) Grants permission to list licenses.

        Access Level: Read

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListLicenses.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListLicenses", []))

    @jsii.member(jsii_name="toListLicenseSpecificationsForResource")
    def to_list_license_specifications_for_resource(self) -> "LicenseManager":
        '''(experimental) Grants permission to list license specifications associated with a selected resource.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListLicenseSpecificationsForResource.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListLicenseSpecificationsForResource", []))

    @jsii.member(jsii_name="toListLicenseVersions")
    def to_list_license_versions(self) -> "LicenseManager":
        '''(experimental) Grants permission to list license versions.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListLicenseVersions.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListLicenseVersions", []))

    @jsii.member(jsii_name="toListReceivedGrants")
    def to_list_received_grants(self) -> "LicenseManager":
        '''(experimental) Grants permission to list received grants.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListReceivedGrants.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListReceivedGrants", []))

    @jsii.member(jsii_name="toListReceivedGrantsForOrganization")
    def to_list_received_grants_for_organization(self) -> "LicenseManager":
        '''(experimental) Grants permission to list received grants for organization.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListReceivedGrantsForOrganization.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListReceivedGrantsForOrganization", []))

    @jsii.member(jsii_name="toListReceivedLicenses")
    def to_list_received_licenses(self) -> "LicenseManager":
        '''(experimental) Grants permission to list received licenses.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListReceivedLicenses.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListReceivedLicenses", []))

    @jsii.member(jsii_name="toListReceivedLicensesForOrganization")
    def to_list_received_licenses_for_organization(self) -> "LicenseManager":
        '''(experimental) Grants permission to list received licenses for organization.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListReceivedLicensesForOrganization.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListReceivedLicensesForOrganization", []))

    @jsii.member(jsii_name="toListResourceInventory")
    def to_list_resource_inventory(self) -> "LicenseManager":
        '''(experimental) Grants permission to list resource inventory.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListResourceInventory.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListResourceInventory", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "LicenseManager":
        '''(experimental) Grants permission to list tags for a selected resource.

        Access Level: Read

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTokens")
    def to_list_tokens(self) -> "LicenseManager":
        '''(experimental) Grants permission to list tokens.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListTokens.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListTokens", []))

    @jsii.member(jsii_name="toListUsageForLicenseConfiguration")
    def to_list_usage_for_license_configuration(self) -> "LicenseManager":
        '''(experimental) Grants permission to list usage records for selected license configuration.

        Access Level: List

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListUsageForLicenseConfiguration.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toListUsageForLicenseConfiguration", []))

    @jsii.member(jsii_name="toRejectGrant")
    def to_reject_grant(self) -> "LicenseManager":
        '''(experimental) Grants permission to reject a grant.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_RejectGrant.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toRejectGrant", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "LicenseManager":
        '''(experimental) Grants permission to tag a selected resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "LicenseManager":
        '''(experimental) Grants permission to untag a selected resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateLicenseConfiguration")
    def to_update_license_configuration(self) -> "LicenseManager":
        '''(experimental) Grants permission to update an existing license configuration.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_UpdateLicenseConfiguration.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toUpdateLicenseConfiguration", []))

    @jsii.member(jsii_name="toUpdateLicenseManagerReportGenerator")
    def to_update_license_manager_report_generator(self) -> "LicenseManager":
        '''(experimental) Grants permission to update a report generator for a license configuration.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_UpdateLicenseManagerReportGenerator.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toUpdateLicenseManagerReportGenerator", []))

    @jsii.member(jsii_name="toUpdateLicenseSpecificationsForResource")
    def to_update_license_specifications_for_resource(self) -> "LicenseManager":
        '''(experimental) Grants permission to updates license specifications for a selected resource.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_UpdateLicenseSpecificationsForResource.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toUpdateLicenseSpecificationsForResource", []))

    @jsii.member(jsii_name="toUpdateServiceSettings")
    def to_update_service_settings(self) -> "LicenseManager":
        '''(experimental) Grants permission to updates service settings.

        Access Level: Permissions management

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_UpdateServiceSettings.html

        :stability: experimental
        '''
        return typing.cast("LicenseManager", jsii.invoke(self, "toUpdateServiceSettings", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__604f64204ff65e354902be9cc2fad2ae01956a8f3d2f3366a030dbda3b8bff44)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__730769f7a22883f6d3d5613c29031eda8dff390282ddc363715d1ab077cbb7c1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class LicenseManagerLinuxSubscriptions(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.LicenseManagerLinuxSubscriptions",
):
    '''(experimental) Statement provider for service `license-manager-linux-subscriptions <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awslicensemanagerlinuxsubscriptionsmanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `license-manager-linux-subscriptions <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awslicensemanagerlinuxsubscriptionsmanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7284839c44c0d1a767726600624001905eace43c16d4a7181f5dfd436170871e)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toGetServiceSettings")
    def to_get_service_settings(self) -> "LicenseManagerLinuxSubscriptions":
        '''(experimental) Grants permission to get the service settings for Linux subscriptions in AWS License Manager.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_GetServiceSettings.html

        :stability: experimental
        '''
        return typing.cast("LicenseManagerLinuxSubscriptions", jsii.invoke(self, "toGetServiceSettings", []))

    @jsii.member(jsii_name="toListLinuxSubscriptionInstances")
    def to_list_linux_subscription_instances(
        self,
    ) -> "LicenseManagerLinuxSubscriptions":
        '''(experimental) Grants permission to list all instances with Linux subscriptions in AWS License Manager.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListLinuxSubscriptionInstances.html

        :stability: experimental
        '''
        return typing.cast("LicenseManagerLinuxSubscriptions", jsii.invoke(self, "toListLinuxSubscriptionInstances", []))

    @jsii.member(jsii_name="toListLinuxSubscriptions")
    def to_list_linux_subscriptions(self) -> "LicenseManagerLinuxSubscriptions":
        '''(experimental) Grants permission to list all Linux subscriptions in AWS License Manager.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_ListLinuxSubscriptions.html

        :stability: experimental
        '''
        return typing.cast("LicenseManagerLinuxSubscriptions", jsii.invoke(self, "toListLinuxSubscriptions", []))

    @jsii.member(jsii_name="toUpdateServiceSettings")
    def to_update_service_settings(self) -> "LicenseManagerLinuxSubscriptions":
        '''(experimental) Grants permission to update the service settings for Linux subscriptions in AWS License Manager.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager/latest/APIReference/API_UpdateServiceSettings.html

        :stability: experimental
        '''
        return typing.cast("LicenseManagerLinuxSubscriptions", jsii.invoke(self, "toUpdateServiceSettings", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__df634e1333011dc0f6f712cccda7ca1127c99acd52d1eebb8868acece6966704)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__738df27dc00f8bcba35baf0bebe9775f9d47c0d3ffb65e0f0cdf7c2b501f6f4b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class LicenseManagerUserSubscriptions(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.LicenseManagerUserSubscriptions",
):
    '''(experimental) Statement provider for service `license-manager-user-subscriptions <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awslicensemanagerusersubscriptions.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `license-manager-user-subscriptions <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awslicensemanagerusersubscriptions.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0d5656a8f693d63459cf050e418e8345f6423ee600124a211897976ff80fd896)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toAssociateUser")
    def to_associate_user(self) -> "LicenseManagerUserSubscriptions":
        '''(experimental) Grants permission to associate a subscribed user to an instance launched with license manager user subscriptions products.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager-user-subscriptions/latest/APIReference/API_AssociateUser.html

        :stability: experimental
        '''
        return typing.cast("LicenseManagerUserSubscriptions", jsii.invoke(self, "toAssociateUser", []))

    @jsii.member(jsii_name="toDeregisterIdentityProvider")
    def to_deregister_identity_provider(self) -> "LicenseManagerUserSubscriptions":
        '''(experimental) Grants permission to deregister Microsoft Active Directory with license-manager-user-subscriptions for a product.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager-user-subscriptions/latest/APIReference/API_DeregisterIdentityProvider.html

        :stability: experimental
        '''
        return typing.cast("LicenseManagerUserSubscriptions", jsii.invoke(self, "toDeregisterIdentityProvider", []))

    @jsii.member(jsii_name="toDisassociateUser")
    def to_disassociate_user(self) -> "LicenseManagerUserSubscriptions":
        '''(experimental) Grants permission to disassociate a subscribed user from an instance launched with license manager user subscriptions products.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager-user-subscriptions/latest/APIReference/API_DisassociateUser.html

        :stability: experimental
        '''
        return typing.cast("LicenseManagerUserSubscriptions", jsii.invoke(self, "toDisassociateUser", []))

    @jsii.member(jsii_name="toListIdentityProviders")
    def to_list_identity_providers(self) -> "LicenseManagerUserSubscriptions":
        '''(experimental) Grants permission to list all the identity providers on license manager user subscriptions.

        Access Level: List

        https://docs.aws.amazon.com/license-manager-user-subscriptions/latest/APIReference/API_ListIdentityProviders.html

        :stability: experimental
        '''
        return typing.cast("LicenseManagerUserSubscriptions", jsii.invoke(self, "toListIdentityProviders", []))

    @jsii.member(jsii_name="toListInstances")
    def to_list_instances(self) -> "LicenseManagerUserSubscriptions":
        '''(experimental) Grants permission to list all the instances launched with license manager user subscription products.

        Access Level: List

        https://docs.aws.amazon.com/license-manager-user-subscriptions/latest/APIReference/API_ListInstances.html

        :stability: experimental
        '''
        return typing.cast("LicenseManagerUserSubscriptions", jsii.invoke(self, "toListInstances", []))

    @jsii.member(jsii_name="toListProductSubscriptions")
    def to_list_product_subscriptions(self) -> "LicenseManagerUserSubscriptions":
        '''(experimental) Grants permission to lists all the product subscriptions for a product and identity provider.

        Access Level: List

        https://docs.aws.amazon.com/license-manager-user-subscriptions/latest/APIReference/API_ListProductSubscriptions.html

        :stability: experimental
        '''
        return typing.cast("LicenseManagerUserSubscriptions", jsii.invoke(self, "toListProductSubscriptions", []))

    @jsii.member(jsii_name="toListUserAssociations")
    def to_list_user_associations(self) -> "LicenseManagerUserSubscriptions":
        '''(experimental) Grants permission to list all the users associated to an instance launched for a product.

        Access Level: List

        https://docs.aws.amazon.com/license-manager-user-subscriptions/latest/APIReference/API_ListUserAssociations.html

        :stability: experimental
        '''
        return typing.cast("LicenseManagerUserSubscriptions", jsii.invoke(self, "toListUserAssociations", []))

    @jsii.member(jsii_name="toRegisterIdentityProvider")
    def to_register_identity_provider(self) -> "LicenseManagerUserSubscriptions":
        '''(experimental) Grants permission to registers Microsoft Active Directory with license-manager-user-subscriptions for a product.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager-user-subscriptions/latest/APIReference/API_RegisterIdentityProvider.html

        :stability: experimental
        '''
        return typing.cast("LicenseManagerUserSubscriptions", jsii.invoke(self, "toRegisterIdentityProvider", []))

    @jsii.member(jsii_name="toStartProductSubscription")
    def to_start_product_subscription(self) -> "LicenseManagerUserSubscriptions":
        '''(experimental) Grants permission to start product subscription for a user on a registered active directory for a product.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager-user-subscriptions/latest/APIReference/API_StartProductSubscription.html

        :stability: experimental
        '''
        return typing.cast("LicenseManagerUserSubscriptions", jsii.invoke(self, "toStartProductSubscription", []))

    @jsii.member(jsii_name="toStopProductSubscription")
    def to_stop_product_subscription(self) -> "LicenseManagerUserSubscriptions":
        '''(experimental) Grants permission to stop product subscription for a user on a registered active directory for a product.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager-user-subscriptions/latest/APIReference/API_StopProductSubscription.html

        :stability: experimental
        '''
        return typing.cast("LicenseManagerUserSubscriptions", jsii.invoke(self, "toStopProductSubscription", []))

    @jsii.member(jsii_name="toUpdateIdentityProviderSettings")
    def to_update_identity_provider_settings(self) -> "LicenseManagerUserSubscriptions":
        '''(experimental) Grants permission to update the identity provider configuration.

        Access Level: Write

        https://docs.aws.amazon.com/license-manager-user-subscriptions/latest/APIReference/API_UpdateIdentityProviderSettings.html

        :stability: experimental
        '''
        return typing.cast("LicenseManagerUserSubscriptions", jsii.invoke(self, "toUpdateIdentityProviderSettings", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0d4597447716293216ef9fabefe3db9ea7878c8221a8fddd6ceee7ac7ed7eeda)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__18085013861282184c7345dd967e3781eab62059f4dd705d80b77622c4c8af6b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Lightsail(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Lightsail",
):
    '''(experimental) Statement provider for service `lightsail <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlightsail.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `lightsail <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlightsail.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__20186be1a0d46bc6b22cd1bd27f73885d4981f82e3cf3fd1124e414cde135bfb)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAlarm")
    def on_alarm(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type Alarm to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_Alarm.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__49ea9cfa554d2eba94c82cedef04ff986b31eae6d357ddbf6700853e7dc71fb5)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lightsail", jsii.invoke(self, "onAlarm", [id, account, region, partition]))

    @jsii.member(jsii_name="onBucket")
    def on_bucket(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type Bucket to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_Bucket.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6cf5ec7c0e98cbc1172c7ff6fd875b4d716d469a0ac7012050329250afb0a220)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lightsail", jsii.invoke(self, "onBucket", [id, account, region, partition]))

    @jsii.member(jsii_name="onCertificate")
    def on_certificate(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type Certificate to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_Certificate.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__18cc76b0132cb4fd4754ac07c567fb354cc2a3f146778adb6bb86be51d968116)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lightsail", jsii.invoke(self, "onCertificate", [id, account, region, partition]))

    @jsii.member(jsii_name="onCloudFormationStackRecord")
    def on_cloud_formation_stack_record(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type CloudFormationStackRecord to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CloudFormationStackRecord.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__aefac45244b0e1a18322cbbef52c16724b8fa77534c6cff503ae3227e3c9cf39)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lightsail", jsii.invoke(self, "onCloudFormationStackRecord", [id, account, region, partition]))

    @jsii.member(jsii_name="onContactMethod")
    def on_contact_method(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type ContactMethod to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_ContactMethod.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2aa254f28a419d5dd963c6cc4ca6086a96282b17289136f63f2845d09211cbe0)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lightsail", jsii.invoke(self, "onContactMethod", [id, account, region, partition]))

    @jsii.member(jsii_name="onContainerService")
    def on_container_service(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type ContainerService to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_ContainerService.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__919850f0e9b06c72fa11806dd1fa3f1e225b99b114a92d9da3b29c93cb41b641)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lightsail", jsii.invoke(self, "onContainerService", [id, account, region, partition]))

    @jsii.member(jsii_name="onDisk")
    def on_disk(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type Disk to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_Disk.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__eeb31ce52f79fd243ee589dca41100d8a960be651b5633c852de6517fbf65157)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lightsail", jsii.invoke(self, "onDisk", [id, account, region, partition]))

    @jsii.member(jsii_name="onDiskSnapshot")
    def on_disk_snapshot(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type DiskSnapshot to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DiskSnapshot.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__39e2b75a42a1ce003f3aa0e671f571a040bebe8df4efca2f62b5b1eeb38546d1)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lightsail", jsii.invoke(self, "onDiskSnapshot", [id, account, region, partition]))

    @jsii.member(jsii_name="onDistribution")
    def on_distribution(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type Distribution to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_LightsailDistribution.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f1865ebdec10b2f778a4666a5cc56943065b6cb97f63120b3dffa36cf36c6b1b)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lightsail", jsii.invoke(self, "onDistribution", [id, account, region, partition]))

    @jsii.member(jsii_name="onDomain")
    def on_domain(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type Domain to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_Domain.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9a13ea42a35a226478e6e5bafca7c4b85f56f9c646baa3056f3a231d3e4257d8)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lightsail", jsii.invoke(self, "onDomain", [id, account, region, partition]))

    @jsii.member(jsii_name="onExportSnapshotRecord")
    def on_export_snapshot_record(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type ExportSnapshotRecord to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_ExportSnapshotRecord.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__70d81e1ef21a33340f27b13ba6d2b765ea906230b34946275621073e0b0bece6)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lightsail", jsii.invoke(self, "onExportSnapshotRecord", [id, account, region, partition]))

    @jsii.member(jsii_name="onInstance")
    def on_instance(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type Instance to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_Instance.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6feb07a5fb3353011b02dca212e55abe6ff6ecdcee9404a353acf60d06b3db4b)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lightsail", jsii.invoke(self, "onInstance", [id, account, region, partition]))

    @jsii.member(jsii_name="onInstanceSnapshot")
    def on_instance_snapshot(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type InstanceSnapshot to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_InstanceSnapshot.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3bbad275577588285b1fb0b9d1378e085472d70bc7167ff20882ed277e317179)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lightsail", jsii.invoke(self, "onInstanceSnapshot", [id, account, region, partition]))

    @jsii.member(jsii_name="onKeyPair")
    def on_key_pair(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type KeyPair to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_KeyPair.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5fcb9b1d753ad0c5cbb068d938930f01f36af9030d6f8bc0e8d05f2d58053255)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lightsail", jsii.invoke(self, "onKeyPair", [id, account, region, partition]))

    @jsii.member(jsii_name="onLoadBalancer")
    def on_load_balancer(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type LoadBalancer to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_LoadBalancer.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f19670f3fb7f6bb808253bda8a695a552cac73d7eb7855138b3d3bf3b2dd0cb8)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lightsail", jsii.invoke(self, "onLoadBalancer", [id, account, region, partition]))

    @jsii.member(jsii_name="onLoadBalancerTlsCertificate")
    def on_load_balancer_tls_certificate(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type LoadBalancerTlsCertificate to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_LoadBalancerTlsCertificate.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__60c892f0b9ea18e4b8138b6cedd920c8d1b907acf269303c5289c712617251c2)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lightsail", jsii.invoke(self, "onLoadBalancerTlsCertificate", [id, account, region, partition]))

    @jsii.member(jsii_name="onRelationalDatabase")
    def on_relational_database(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type RelationalDatabase to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_RelationalDatabase.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9672cb40bb6bca2abe4a2e87ea4f35411b2ed678714a7d6658be8da142606f5a)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lightsail", jsii.invoke(self, "onRelationalDatabase", [id, account, region, partition]))

    @jsii.member(jsii_name="onRelationalDatabaseSnapshot")
    def on_relational_database_snapshot(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type RelationalDatabaseSnapshot to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_RelationalDatabaseSnapshot.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3203196d3ceba255bcf876cd4c54cf49c4e088b5fddc40c9eddb861fca535a08)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lightsail", jsii.invoke(self, "onRelationalDatabaseSnapshot", [id, account, region, partition]))

    @jsii.member(jsii_name="onStaticIp")
    def on_static_ip(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lightsail":
        '''(experimental) Adds a resource of type StaticIp to the statement.

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_StaticIp.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7c80bf244f1e7f045c49c91a57d9a36c580174e394f3b3e9a1efe1d7007352d3)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lightsail", jsii.invoke(self, "onStaticIp", [id, account, region, partition]))

    @jsii.member(jsii_name="toAllocateStaticIp")
    def to_allocate_static_ip(self) -> "Lightsail":
        '''(experimental) Grants permission to create a static IP address that can be attached to an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_AllocateStaticIp.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toAllocateStaticIp", []))

    @jsii.member(jsii_name="toAttachCertificateToDistribution")
    def to_attach_certificate_to_distribution(self) -> "Lightsail":
        '''(experimental) Grants permission to attach an SSL/TLS certificate to your Amazon Lightsail content delivery network (CDN) distribution.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_AttachCertificateToDistribution.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toAttachCertificateToDistribution", []))

    @jsii.member(jsii_name="toAttachDisk")
    def to_attach_disk(self) -> "Lightsail":
        '''(experimental) Grants permission to attach a disk to an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_AttachDisk.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toAttachDisk", []))

    @jsii.member(jsii_name="toAttachInstancesToLoadBalancer")
    def to_attach_instances_to_load_balancer(self) -> "Lightsail":
        '''(experimental) Grants permission to attach one or more instances to a load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_AttachInstancesToLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toAttachInstancesToLoadBalancer", []))

    @jsii.member(jsii_name="toAttachLoadBalancerTlsCertificate")
    def to_attach_load_balancer_tls_certificate(self) -> "Lightsail":
        '''(experimental) Grants permission to attach a TLS certificate to a load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_AttachLoadBalancerTlsCertificate.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toAttachLoadBalancerTlsCertificate", []))

    @jsii.member(jsii_name="toAttachStaticIp")
    def to_attach_static_ip(self) -> "Lightsail":
        '''(experimental) Grants permission to attach a static IP address to an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_AttachStaticIp.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toAttachStaticIp", []))

    @jsii.member(jsii_name="toCloseInstancePublicPorts")
    def to_close_instance_public_ports(self) -> "Lightsail":
        '''(experimental) Grants permission to close a public port of an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CloseInstancePublicPorts.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCloseInstancePublicPorts", []))

    @jsii.member(jsii_name="toCopySnapshot")
    def to_copy_snapshot(self) -> "Lightsail":
        '''(experimental) Grants permission to copy a snapshot from one AWS Region to another in Amazon Lightsail.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CopySnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCopySnapshot", []))

    @jsii.member(jsii_name="toCreateBucket")
    def to_create_bucket(self) -> "Lightsail":
        '''(experimental) Grants permission to create an Amazon Lightsail bucket.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateBucket.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateBucket", []))

    @jsii.member(jsii_name="toCreateBucketAccessKey")
    def to_create_bucket_access_key(self) -> "Lightsail":
        '''(experimental) Grants permission to create a new access key for the specified bucket.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateBucketAccessKey.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateBucketAccessKey", []))

    @jsii.member(jsii_name="toCreateCertificate")
    def to_create_certificate(self) -> "Lightsail":
        '''(experimental) Grants permission to create an SSL/TLS certificate.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - lightsail:CreateDomainEntry
        - lightsail:GetDomains

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateCertificate.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateCertificate", []))

    @jsii.member(jsii_name="toCreateCloudFormationStack")
    def to_create_cloud_formation_stack(self) -> "Lightsail":
        '''(experimental) Grants permission to create a new Amazon EC2 instance from an exported Amazon Lightsail snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateCloudFormationStack.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateCloudFormationStack", []))

    @jsii.member(jsii_name="toCreateContactMethod")
    def to_create_contact_method(self) -> "Lightsail":
        '''(experimental) Grants permission to create an email or SMS text message contact method.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateContactMethod.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateContactMethod", []))

    @jsii.member(jsii_name="toCreateContainerService")
    def to_create_container_service(self) -> "Lightsail":
        '''(experimental) Grants permission to create an Amazon Lightsail container service.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateContainerService.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateContainerService", []))

    @jsii.member(jsii_name="toCreateContainerServiceDeployment")
    def to_create_container_service_deployment(self) -> "Lightsail":
        '''(experimental) Grants permission to create a deployment for your Amazon Lightsail container service.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateContainerServiceDeployment.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateContainerServiceDeployment", []))

    @jsii.member(jsii_name="toCreateContainerServiceRegistryLogin")
    def to_create_container_service_registry_login(self) -> "Lightsail":
        '''(experimental) Grants permission to create a temporary set of log in credentials that you can use to log in to the Docker process on your local machine.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateContainerServiceRegistryLogin.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateContainerServiceRegistryLogin", []))

    @jsii.member(jsii_name="toCreateDisk")
    def to_create_disk(self) -> "Lightsail":
        '''(experimental) Grants permission to create a disk.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateDisk.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateDisk", []))

    @jsii.member(jsii_name="toCreateDiskFromSnapshot")
    def to_create_disk_from_snapshot(self) -> "Lightsail":
        '''(experimental) Grants permission to create a disk from snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateDiskFromSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateDiskFromSnapshot", []))

    @jsii.member(jsii_name="toCreateDiskSnapshot")
    def to_create_disk_snapshot(self) -> "Lightsail":
        '''(experimental) Grants permission to create a disk snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateDiskSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateDiskSnapshot", []))

    @jsii.member(jsii_name="toCreateDistribution")
    def to_create_distribution(self) -> "Lightsail":
        '''(experimental) Grants permission to create an Amazon Lightsail content delivery network (CDN) distribution.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateDistribution.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateDistribution", []))

    @jsii.member(jsii_name="toCreateDomain")
    def to_create_domain(self) -> "Lightsail":
        '''(experimental) Grants permission to create a domain resource for the specified domain name.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - route53:DeleteHostedZone
        - route53:GetHostedZone
        - route53:ListHostedZonesByName
        - route53domains:GetDomainDetail
        - route53domains:GetOperationDetail
        - route53domains:ListDomains
        - route53domains:ListOperations
        - route53domains:UpdateDomainNameservers

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateDomain.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateDomain", []))

    @jsii.member(jsii_name="toCreateDomainEntry")
    def to_create_domain_entry(self) -> "Lightsail":
        '''(experimental) Grants permission to create one or more DNS record entries for a domain resource: Address (A), canonical name (CNAME), mail exchanger (MX), name server (NS), start of authority (SOA), service locator (SRV), or text (TXT).

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateDomainEntry.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateDomainEntry", []))

    @jsii.member(jsii_name="toCreateGUISessionAccessDetails")
    def to_create_gui_session_access_details(self) -> "Lightsail":
        '''(experimental) Grants permission to create URLs that are used to access an instance's graphical user interface (GUI) session.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateGUISessionAccessDetails.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateGUISessionAccessDetails", []))

    @jsii.member(jsii_name="toCreateInstances")
    def to_create_instances(self) -> "Lightsail":
        '''(experimental) Grants permission to create one or more instances.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateInstances.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateInstances", []))

    @jsii.member(jsii_name="toCreateInstancesFromSnapshot")
    def to_create_instances_from_snapshot(self) -> "Lightsail":
        '''(experimental) Grants permission to create one or more instances based on an instance snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateInstancesFromSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateInstancesFromSnapshot", []))

    @jsii.member(jsii_name="toCreateInstanceSnapshot")
    def to_create_instance_snapshot(self) -> "Lightsail":
        '''(experimental) Grants permission to create an instance snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateInstanceSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateInstanceSnapshot", []))

    @jsii.member(jsii_name="toCreateKeyPair")
    def to_create_key_pair(self) -> "Lightsail":
        '''(experimental) Grants permission to create a key pair used to authenticate and connect to an instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateKeyPair", []))

    @jsii.member(jsii_name="toCreateLoadBalancer")
    def to_create_load_balancer(self) -> "Lightsail":
        '''(experimental) Grants permission to create a load balancer.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - lightsail:CreateDomainEntry
        - lightsail:GetDomains

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateLoadBalancer", []))

    @jsii.member(jsii_name="toCreateLoadBalancerTlsCertificate")
    def to_create_load_balancer_tls_certificate(self) -> "Lightsail":
        '''(experimental) Grants permission to create a load balancer TLS certificate.

        Access Level: Write

        Dependent actions:

        - lightsail:CreateDomainEntry
        - lightsail:GetDomains

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateLoadBalancerTlsCertificate.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateLoadBalancerTlsCertificate", []))

    @jsii.member(jsii_name="toCreateRelationalDatabase")
    def to_create_relational_database(self) -> "Lightsail":
        '''(experimental) Grants permission to create a new relational database.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateRelationalDatabase.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateRelationalDatabase", []))

    @jsii.member(jsii_name="toCreateRelationalDatabaseFromSnapshot")
    def to_create_relational_database_from_snapshot(self) -> "Lightsail":
        '''(experimental) Grants permission to create a new relational database from a snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateRelationalDatabaseFromSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateRelationalDatabaseFromSnapshot", []))

    @jsii.member(jsii_name="toCreateRelationalDatabaseSnapshot")
    def to_create_relational_database_snapshot(self) -> "Lightsail":
        '''(experimental) Grants permission to create a relational database snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateRelationalDatabaseSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toCreateRelationalDatabaseSnapshot", []))

    @jsii.member(jsii_name="toDeleteAlarm")
    def to_delete_alarm(self) -> "Lightsail":
        '''(experimental) Grants permission to delete an alarm.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteAlarm.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteAlarm", []))

    @jsii.member(jsii_name="toDeleteAutoSnapshot")
    def to_delete_auto_snapshot(self) -> "Lightsail":
        '''(experimental) Grants permission to delete an automatic snapshot of an instance or disk.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteAutoSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteAutoSnapshot", []))

    @jsii.member(jsii_name="toDeleteBucket")
    def to_delete_bucket(self) -> "Lightsail":
        '''(experimental) Grants permission to delete an Amazon Lightsail bucket.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteBucket.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteBucket", []))

    @jsii.member(jsii_name="toDeleteBucketAccessKey")
    def to_delete_bucket_access_key(self) -> "Lightsail":
        '''(experimental) Grants permission to delete an access key for the specified Amazon Lightsail bucket.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteBucketAccessKey.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteBucketAccessKey", []))

    @jsii.member(jsii_name="toDeleteCertificate")
    def to_delete_certificate(self) -> "Lightsail":
        '''(experimental) Grants permission to delete an SSL/TLS certificate.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteCertificate.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteCertificate", []))

    @jsii.member(jsii_name="toDeleteContactMethod")
    def to_delete_contact_method(self) -> "Lightsail":
        '''(experimental) Grants permission to delete a contact method.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteContactMethod.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteContactMethod", []))

    @jsii.member(jsii_name="toDeleteContainerImage")
    def to_delete_container_image(self) -> "Lightsail":
        '''(experimental) Grants permission to delete a container image that is registered to your Amazon Lightsail container service.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteContainerImage.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteContainerImage", []))

    @jsii.member(jsii_name="toDeleteContainerService")
    def to_delete_container_service(self) -> "Lightsail":
        '''(experimental) Grants permission to delete your Amazon Lightsail container service.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteContainerService.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteContainerService", []))

    @jsii.member(jsii_name="toDeleteDisk")
    def to_delete_disk(self) -> "Lightsail":
        '''(experimental) Grants permission to delete a disk.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteDisk.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteDisk", []))

    @jsii.member(jsii_name="toDeleteDiskSnapshot")
    def to_delete_disk_snapshot(self) -> "Lightsail":
        '''(experimental) Grants permission to delete a disk snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteDiskSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteDiskSnapshot", []))

    @jsii.member(jsii_name="toDeleteDistribution")
    def to_delete_distribution(self) -> "Lightsail":
        '''(experimental) Grants permission to delete your Amazon Lightsail content delivery network (CDN) distribution.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteDistribution.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteDistribution", []))

    @jsii.member(jsii_name="toDeleteDomain")
    def to_delete_domain(self) -> "Lightsail":
        '''(experimental) Grants permission to delete a domain resource and all of its DNS records.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteDomain.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteDomain", []))

    @jsii.member(jsii_name="toDeleteDomainEntry")
    def to_delete_domain_entry(self) -> "Lightsail":
        '''(experimental) Grants permission to delete a DNS record entry for a domain resource.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteDomainEntry.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteDomainEntry", []))

    @jsii.member(jsii_name="toDeleteInstance")
    def to_delete_instance(self) -> "Lightsail":
        '''(experimental) Grants permission to delete an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteInstance.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteInstance", []))

    @jsii.member(jsii_name="toDeleteInstanceSnapshot")
    def to_delete_instance_snapshot(self) -> "Lightsail":
        '''(experimental) Grants permission to delete an instance snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteInstanceSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteInstanceSnapshot", []))

    @jsii.member(jsii_name="toDeleteKeyPair")
    def to_delete_key_pair(self) -> "Lightsail":
        '''(experimental) Grants permission to delete a key pair used to authenticate and connect to an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteKeyPair", []))

    @jsii.member(jsii_name="toDeleteKnownHostKeys")
    def to_delete_known_host_keys(self) -> "Lightsail":
        '''(experimental) Grants permission to delete the known host key or certificate used by the Amazon Lightsail browser-based SSH or RDP clients to authenticate an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteKnownHostKeys.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteKnownHostKeys", []))

    @jsii.member(jsii_name="toDeleteLoadBalancer")
    def to_delete_load_balancer(self) -> "Lightsail":
        '''(experimental) Grants permission to delete a load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteLoadBalancer", []))

    @jsii.member(jsii_name="toDeleteLoadBalancerTlsCertificate")
    def to_delete_load_balancer_tls_certificate(self) -> "Lightsail":
        '''(experimental) Grants permission to delete a load balancer TLS certificate.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteLoadBalancerTlsCertificate.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteLoadBalancerTlsCertificate", []))

    @jsii.member(jsii_name="toDeleteRelationalDatabase")
    def to_delete_relational_database(self) -> "Lightsail":
        '''(experimental) Grants permission to delete a relational database.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteRelationalDatabase.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteRelationalDatabase", []))

    @jsii.member(jsii_name="toDeleteRelationalDatabaseSnapshot")
    def to_delete_relational_database_snapshot(self) -> "Lightsail":
        '''(experimental) Grants permission to delete a relational database snapshot.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DeleteRelationalDatabaseSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDeleteRelationalDatabaseSnapshot", []))

    @jsii.member(jsii_name="toDetachCertificateFromDistribution")
    def to_detach_certificate_from_distribution(self) -> "Lightsail":
        '''(experimental) Grants permission to detach an SSL/TLS certificate from your Amazon Lightsail content delivery network (CDN) distribution.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DetachCertificateFromDistribution.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDetachCertificateFromDistribution", []))

    @jsii.member(jsii_name="toDetachDisk")
    def to_detach_disk(self) -> "Lightsail":
        '''(experimental) Grants permission to detach a disk from an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DetachDisk.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDetachDisk", []))

    @jsii.member(jsii_name="toDetachInstancesFromLoadBalancer")
    def to_detach_instances_from_load_balancer(self) -> "Lightsail":
        '''(experimental) Grants permission to detach one or more instances from a load balancer.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DetachInstancesFromLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDetachInstancesFromLoadBalancer", []))

    @jsii.member(jsii_name="toDetachStaticIp")
    def to_detach_static_ip(self) -> "Lightsail":
        '''(experimental) Grants permission to detach a static IP from an instance to which it is attached.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DetachStaticIp.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDetachStaticIp", []))

    @jsii.member(jsii_name="toDisableAddOn")
    def to_disable_add_on(self) -> "Lightsail":
        '''(experimental) Grants permission to disable an add-on for an Amazon Lightsail resource.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DisableAddOn.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDisableAddOn", []))

    @jsii.member(jsii_name="toDownloadDefaultKeyPair")
    def to_download_default_key_pair(self) -> "Lightsail":
        '''(experimental) Grants permission to download the default key pair used to authenticate and connect to instances in a specific AWS Region.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DownloadDefaultKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toDownloadDefaultKeyPair", []))

    @jsii.member(jsii_name="toEnableAddOn")
    def to_enable_add_on(self) -> "Lightsail":
        '''(experimental) Grants permission to enable or modify an add-on for an Amazon Lightsail resource.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_EnableAddOn.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toEnableAddOn", []))

    @jsii.member(jsii_name="toExportSnapshot")
    def to_export_snapshot(self) -> "Lightsail":
        '''(experimental) Grants permission to export an Amazon Lightsail snapshot to Amazon EC2.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - iam:PutRolePolicy

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_ExportSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toExportSnapshot", []))

    @jsii.member(jsii_name="toGetActiveNames")
    def to_get_active_names(self) -> "Lightsail":
        '''(experimental) Grants permission to get the names of all active (not deleted) resources.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetActiveNames.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetActiveNames", []))

    @jsii.member(jsii_name="toGetAlarms")
    def to_get_alarms(self) -> "Lightsail":
        '''(experimental) Grants permission to view information about the configured alarms.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetAlarms.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetAlarms", []))

    @jsii.member(jsii_name="toGetAutoSnapshots")
    def to_get_auto_snapshots(self) -> "Lightsail":
        '''(experimental) Grants permission to view the available automatic snapshots for an instance or disk.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetAutoSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetAutoSnapshots", []))

    @jsii.member(jsii_name="toGetBlueprints")
    def to_get_blueprints(self) -> "Lightsail":
        '''(experimental) Grants permission to get a list of instance images, or blueprints.

        You can use a blueprint to create a new instance already running a specific operating system, as well as a pre-installed application or development stack. The software that runs on your instance depends on the blueprint you define when creating the instance

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetBlueprints.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetBlueprints", []))

    @jsii.member(jsii_name="toGetBucketAccessKeys")
    def to_get_bucket_access_keys(self) -> "Lightsail":
        '''(experimental) Grants permission to get the existing access key IDs for the specified Amazon Lightsail bucket.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetBucketAccessKeys.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetBucketAccessKeys", []))

    @jsii.member(jsii_name="toGetBucketBundles")
    def to_get_bucket_bundles(self) -> "Lightsail":
        '''(experimental) Grants permission to get the bundles that can be applied to an Amazon Lightsail bucket.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetBucketBundles.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetBucketBundles", []))

    @jsii.member(jsii_name="toGetBucketMetricData")
    def to_get_bucket_metric_data(self) -> "Lightsail":
        '''(experimental) Grants permission to get the data points of a specific metric for an Amazon Lightsail bucket.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetBucketMetricData.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetBucketMetricData", []))

    @jsii.member(jsii_name="toGetBuckets")
    def to_get_buckets(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about one or more Amazon Lightsail buckets.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetBuckets.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetBuckets", []))

    @jsii.member(jsii_name="toGetBundles")
    def to_get_bundles(self) -> "Lightsail":
        '''(experimental) Grants permission to get a list of instance bundles.

        You can use a bundle to create a new instance with a set of performance specifications, such as CPU count, disk size, RAM size, and network transfer allowance. The cost of your instance depends on the bundle you define when creating the instance

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetBundles.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetBundles", []))

    @jsii.member(jsii_name="toGetCertificates")
    def to_get_certificates(self) -> "Lightsail":
        '''(experimental) Grants permission to view information about one or more Amazon Lightsail SSL/TLS certificates.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetCertificates.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetCertificates", []))

    @jsii.member(jsii_name="toGetCloudFormationStackRecords")
    def to_get_cloud_formation_stack_records(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about all CloudFormation stacks used to create Amazon EC2 resources from exported Amazon Lightsail snapshots.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetCloudFormationStackRecords.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetCloudFormationStackRecords", []))

    @jsii.member(jsii_name="toGetContactMethods")
    def to_get_contact_methods(self) -> "Lightsail":
        '''(experimental) Grants permission to view information about the configured contact methods.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetContactMethods.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetContactMethods", []))

    @jsii.member(jsii_name="toGetContainerAPIMetadata")
    def to_get_container_api_metadata(self) -> "Lightsail":
        '''(experimental) Grants permission to view information about Amazon Lightsail containers, such as the current version of the Lightsail Control (lightsailctl) plugin.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetContainerAPIMetadata.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetContainerAPIMetadata", []))

    @jsii.member(jsii_name="toGetContainerImages")
    def to_get_container_images(self) -> "Lightsail":
        '''(experimental) Grants permission to view the container images that are registered to your Amazon Lightsail container service.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetContainerImages.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetContainerImages", []))

    @jsii.member(jsii_name="toGetContainerLog")
    def to_get_container_log(self) -> "Lightsail":
        '''(experimental) Grants permission to view the log events of a container of your Amazon Lightsail container service.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetContainerLog.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetContainerLog", []))

    @jsii.member(jsii_name="toGetContainerServiceDeployments")
    def to_get_container_service_deployments(self) -> "Lightsail":
        '''(experimental) Grants permission to view the deployments for your Amazon Lightsail container service.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetContainerServiceDeployments.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetContainerServiceDeployments", []))

    @jsii.member(jsii_name="toGetContainerServiceMetricData")
    def to_get_container_service_metric_data(self) -> "Lightsail":
        '''(experimental) Grants permission to view the data points of a specific metric of your Amazon Lightsail container service.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetContainerServiceMetricData.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetContainerServiceMetricData", []))

    @jsii.member(jsii_name="toGetContainerServicePowers")
    def to_get_container_service_powers(self) -> "Lightsail":
        '''(experimental) Grants permission to view the list of powers that can be specified for your Amazon Lightsail container services.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetContainerServicePowers.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetContainerServicePowers", []))

    @jsii.member(jsii_name="toGetContainerServices")
    def to_get_container_services(self) -> "Lightsail":
        '''(experimental) Grants permission to view information about one or more of your Amazon Lightsail container services.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetContainerServices.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetContainerServices", []))

    @jsii.member(jsii_name="toGetCostEstimate")
    def to_get_cost_estimate(self) -> "Lightsail":
        '''(experimental) Grants permission to get the information about the cost estimate for a specified resource.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetCostEstimate.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetCostEstimate", []))

    @jsii.member(jsii_name="toGetDisk")
    def to_get_disk(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about a disk.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetDisk.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetDisk", []))

    @jsii.member(jsii_name="toGetDisks")
    def to_get_disks(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about all disks.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetDisks.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetDisks", []))

    @jsii.member(jsii_name="toGetDiskSnapshot")
    def to_get_disk_snapshot(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about a disk snapshot.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetDiskSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetDiskSnapshot", []))

    @jsii.member(jsii_name="toGetDiskSnapshots")
    def to_get_disk_snapshots(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about all disk snapshots.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetDiskSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetDiskSnapshots", []))

    @jsii.member(jsii_name="toGetDistributionBundles")
    def to_get_distribution_bundles(self) -> "Lightsail":
        '''(experimental) Grants permission to view the list of bundles that can be applied to you Amazon Lightsail content delivery network (CDN) distributions.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetDistributionBundles.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetDistributionBundles", []))

    @jsii.member(jsii_name="toGetDistributionLatestCacheReset")
    def to_get_distribution_latest_cache_reset(self) -> "Lightsail":
        '''(experimental) Grants permission to view the timestamp and status of the last cache reset of a specific Amazon Lightsail content delivery network (CDN) distribution.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetDistributionLatestCacheReset.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetDistributionLatestCacheReset", []))

    @jsii.member(jsii_name="toGetDistributionMetricData")
    def to_get_distribution_metric_data(self) -> "Lightsail":
        '''(experimental) Grants permission to view the data points of a specific metric for an Amazon Lightsail content delivery network (CDN) distribution.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetDistributionMetricData.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetDistributionMetricData", []))

    @jsii.member(jsii_name="toGetDistributions")
    def to_get_distributions(self) -> "Lightsail":
        '''(experimental) Grants permission to view information about one or more of your Amazon Lightsail content delivery network (CDN) distributions.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetDistributions.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetDistributions", []))

    @jsii.member(jsii_name="toGetDomain")
    def to_get_domain(self) -> "Lightsail":
        '''(experimental) Grants permission to get DNS records for a domain resource.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetDomain.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetDomain", []))

    @jsii.member(jsii_name="toGetDomains")
    def to_get_domains(self) -> "Lightsail":
        '''(experimental) Grants permission to get DNS records for all domain resources.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetDomains.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetDomains", []))

    @jsii.member(jsii_name="toGetExportSnapshotRecords")
    def to_get_export_snapshot_records(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about all records of exported Amazon Lightsail snapshots to Amazon EC2.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetExportSnapshotRecords.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetExportSnapshotRecords", []))

    @jsii.member(jsii_name="toGetInstance")
    def to_get_instance(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about an instance.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetInstance.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetInstance", []))

    @jsii.member(jsii_name="toGetInstanceAccessDetails")
    def to_get_instance_access_details(self) -> "Lightsail":
        '''(experimental) Grants permission to get temporary keys you can use to authenticate and connect to an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetInstanceAccessDetails.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetInstanceAccessDetails", []))

    @jsii.member(jsii_name="toGetInstanceMetricData")
    def to_get_instance_metric_data(self) -> "Lightsail":
        '''(experimental) Grants permission to get the data points for the specified metric of an instance.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetInstanceMetricData.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetInstanceMetricData", []))

    @jsii.member(jsii_name="toGetInstancePortStates")
    def to_get_instance_port_states(self) -> "Lightsail":
        '''(experimental) Grants permission to get the port states of an instance.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetInstancePortStates.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetInstancePortStates", []))

    @jsii.member(jsii_name="toGetInstances")
    def to_get_instances(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about all instances.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetInstances.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetInstances", []))

    @jsii.member(jsii_name="toGetInstanceSnapshot")
    def to_get_instance_snapshot(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about an instance snapshot.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetInstanceSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetInstanceSnapshot", []))

    @jsii.member(jsii_name="toGetInstanceSnapshots")
    def to_get_instance_snapshots(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about all instance snapshots.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetInstanceSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetInstanceSnapshots", []))

    @jsii.member(jsii_name="toGetInstanceState")
    def to_get_instance_state(self) -> "Lightsail":
        '''(experimental) Grants permission to get the state of an instance.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetInstanceState.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetInstanceState", []))

    @jsii.member(jsii_name="toGetKeyPair")
    def to_get_key_pair(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about a key pair.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetKeyPair", []))

    @jsii.member(jsii_name="toGetKeyPairs")
    def to_get_key_pairs(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about all key pairs.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetKeyPairs.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetKeyPairs", []))

    @jsii.member(jsii_name="toGetLoadBalancer")
    def to_get_load_balancer(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about a load balancer.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetLoadBalancer", []))

    @jsii.member(jsii_name="toGetLoadBalancerMetricData")
    def to_get_load_balancer_metric_data(self) -> "Lightsail":
        '''(experimental) Grants permission to get the data points for the specified metric of a load balancer.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetLoadBalancerMetricData.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetLoadBalancerMetricData", []))

    @jsii.member(jsii_name="toGetLoadBalancers")
    def to_get_load_balancers(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about load balancers.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetLoadBalancers.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetLoadBalancers", []))

    @jsii.member(jsii_name="toGetLoadBalancerTlsCertificates")
    def to_get_load_balancer_tls_certificates(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about a load balancer's TLS certificates.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetLoadBalancerTlsCertificates.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetLoadBalancerTlsCertificates", []))

    @jsii.member(jsii_name="toGetLoadBalancerTlsPolicies")
    def to_get_load_balancer_tls_policies(self) -> "Lightsail":
        '''(experimental) Grants permission to get a list of TLS security policies that you can apply to Lightsail load balancers.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetLoadBalancerTlsPolicies.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetLoadBalancerTlsPolicies", []))

    @jsii.member(jsii_name="toGetOperation")
    def to_get_operation(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about an operation.

        Operations include events such as when you create an instance, allocate a static IP, attach a static IP, and so on

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetOperation.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetOperation", []))

    @jsii.member(jsii_name="toGetOperations")
    def to_get_operations(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about all operations.

        Operations include events such as when you create an instance, allocate a static IP, attach a static IP, and so on

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetOperations.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetOperations", []))

    @jsii.member(jsii_name="toGetOperationsForResource")
    def to_get_operations_for_resource(self) -> "Lightsail":
        '''(experimental) Grants permission to get operations for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetOperationsForResource.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetOperationsForResource", []))

    @jsii.member(jsii_name="toGetRegions")
    def to_get_regions(self) -> "Lightsail":
        '''(experimental) Grants permission to get a list of all valid AWS Regions for Amazon Lightsail.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRegions.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRegions", []))

    @jsii.member(jsii_name="toGetRelationalDatabase")
    def to_get_relational_database(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about a relational database.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabase.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabase", []))

    @jsii.member(jsii_name="toGetRelationalDatabaseBlueprints")
    def to_get_relational_database_blueprints(self) -> "Lightsail":
        '''(experimental) Grants permission to get a list of relational database images, or blueprints.

        You can use a blueprint to create a new database running a specific database engine. The database engine that runs on your database depends on the blueprint you define when creating the relational database

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabaseBlueprints.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabaseBlueprints", []))

    @jsii.member(jsii_name="toGetRelationalDatabaseBundles")
    def to_get_relational_database_bundles(self) -> "Lightsail":
        '''(experimental) Grants permission to get a list of relational database bundles.

        You can use a bundle to create a new database with a set of performance specifications, such as CPU count, disk size, RAM size, network transfer allowance, and standard of high availability. The cost of your database depends on the bundle you define when creating the relational database

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabaseBundles.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabaseBundles", []))

    @jsii.member(jsii_name="toGetRelationalDatabaseEvents")
    def to_get_relational_database_events(self) -> "Lightsail":
        '''(experimental) Grants permission to get events for a relational database.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabaseEvents.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabaseEvents", []))

    @jsii.member(jsii_name="toGetRelationalDatabaseLogEvents")
    def to_get_relational_database_log_events(self) -> "Lightsail":
        '''(experimental) Grants permission to get events for the specified log stream of a relational database.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabaseLogEvents.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabaseLogEvents", []))

    @jsii.member(jsii_name="toGetRelationalDatabaseLogStreams")
    def to_get_relational_database_log_streams(self) -> "Lightsail":
        '''(experimental) Grants permission to get the log streams available for a relational database.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabaseLogStreams.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabaseLogStreams", []))

    @jsii.member(jsii_name="toGetRelationalDatabaseMasterUserPassword")
    def to_get_relational_database_master_user_password(self) -> "Lightsail":
        '''(experimental) Grants permission to get the master user password of a relational database.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabaseMasterUserPassword.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabaseMasterUserPassword", []))

    @jsii.member(jsii_name="toGetRelationalDatabaseMetricData")
    def to_get_relational_database_metric_data(self) -> "Lightsail":
        '''(experimental) Grants permission to get the data points for the specified metric of a relational database.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabaseMetricData.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabaseMetricData", []))

    @jsii.member(jsii_name="toGetRelationalDatabaseParameters")
    def to_get_relational_database_parameters(self) -> "Lightsail":
        '''(experimental) Grants permission to get the parameters of a relational database.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabaseParameters.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabaseParameters", []))

    @jsii.member(jsii_name="toGetRelationalDatabases")
    def to_get_relational_databases(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about all relational databases.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabases.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabases", []))

    @jsii.member(jsii_name="toGetRelationalDatabaseSnapshot")
    def to_get_relational_database_snapshot(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about a relational database snapshot.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabaseSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabaseSnapshot", []))

    @jsii.member(jsii_name="toGetRelationalDatabaseSnapshots")
    def to_get_relational_database_snapshots(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about all relational database snapshots.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetRelationalDatabaseSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetRelationalDatabaseSnapshots", []))

    @jsii.member(jsii_name="toGetStaticIp")
    def to_get_static_ip(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about a static IP.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetStaticIp.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetStaticIp", []))

    @jsii.member(jsii_name="toGetStaticIps")
    def to_get_static_ips(self) -> "Lightsail":
        '''(experimental) Grants permission to get information about all static IPs.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetStaticIps.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toGetStaticIps", []))

    @jsii.member(jsii_name="toImportKeyPair")
    def to_import_key_pair(self) -> "Lightsail":
        '''(experimental) Grants permission to import a public key from a key pair.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_ImportKeyPair.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toImportKeyPair", []))

    @jsii.member(jsii_name="toIsVpcPeered")
    def to_is_vpc_peered(self) -> "Lightsail":
        '''(experimental) Grants permission to get a boolean value indicating whether the Amazon Lightsail virtual private cloud (VPC) is peered.

        Access Level: Read

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_IsVpcPeered.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toIsVpcPeered", []))

    @jsii.member(jsii_name="toOpenInstancePublicPorts")
    def to_open_instance_public_ports(self) -> "Lightsail":
        '''(experimental) Grants permission to add, or open a public port of an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_OpenInstancePublicPorts.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toOpenInstancePublicPorts", []))

    @jsii.member(jsii_name="toPeerVpc")
    def to_peer_vpc(self) -> "Lightsail":
        '''(experimental) Grants permission to try to peer the Amazon Lightsail virtual private cloud (VPC) with the default VPC.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_PeerVpc.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toPeerVpc", []))

    @jsii.member(jsii_name="toPutAlarm")
    def to_put_alarm(self) -> "Lightsail":
        '''(experimental) Grants permission to creates or update an alarm, and associate it with the specified metric.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_PutAlarm.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toPutAlarm", []))

    @jsii.member(jsii_name="toPutInstancePublicPorts")
    def to_put_instance_public_ports(self) -> "Lightsail":
        '''(experimental) Grants permission to set the specified open ports for an instance, and closes all ports for every protocol not included in the request.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_PutInstancePublicPorts.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toPutInstancePublicPorts", []))

    @jsii.member(jsii_name="toRebootInstance")
    def to_reboot_instance(self) -> "Lightsail":
        '''(experimental) Grants permission to reboot an instance that is in a running state.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_RebootInstance.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toRebootInstance", []))

    @jsii.member(jsii_name="toRebootRelationalDatabase")
    def to_reboot_relational_database(self) -> "Lightsail":
        '''(experimental) Grants permission to reboot a relational database that is in a running state.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_RebootRelationalDatabase.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toRebootRelationalDatabase", []))

    @jsii.member(jsii_name="toRegisterContainerImage")
    def to_register_container_image(self) -> "Lightsail":
        '''(experimental) Grants permission to register a container image to your Amazon Lightsail container service.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_RegisterContainerImage.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toRegisterContainerImage", []))

    @jsii.member(jsii_name="toReleaseStaticIp")
    def to_release_static_ip(self) -> "Lightsail":
        '''(experimental) Grants permission to delete a static IP.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_ReleaseStaticIp.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toReleaseStaticIp", []))

    @jsii.member(jsii_name="toResetDistributionCache")
    def to_reset_distribution_cache(self) -> "Lightsail":
        '''(experimental) Grants permission to delete currently cached content from your Amazon Lightsail content delivery network (CDN) distribution.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_ResetDistributionCache.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toResetDistributionCache", []))

    @jsii.member(jsii_name="toSendContactMethodVerification")
    def to_send_contact_method_verification(self) -> "Lightsail":
        '''(experimental) Grants permission to send a verification request to an email contact method to ensure it's owned by the requester.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_SendContactMethodVerification.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toSendContactMethodVerification", []))

    @jsii.member(jsii_name="toSetIpAddressType")
    def to_set_ip_address_type(self) -> "Lightsail":
        '''(experimental) Grants permission to set the IP address type for a Amazon Lightsail resource.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_SetIpAddressType.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toSetIpAddressType", []))

    @jsii.member(jsii_name="toSetResourceAccessForBucket")
    def to_set_resource_access_for_bucket(self) -> "Lightsail":
        '''(experimental) Grants permission to set the Amazon Lightsail resources that can access the specified Amazon Lightsail bucket.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_SetResourceAccessForBucket.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toSetResourceAccessForBucket", []))

    @jsii.member(jsii_name="toStartGUISession")
    def to_start_gui_session(self) -> "Lightsail":
        '''(experimental) Grants permission to initiate a graphical user interface (GUI) session used to access an instance's operating system or application.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_StartGUISession.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toStartGUISession", []))

    @jsii.member(jsii_name="toStartInstance")
    def to_start_instance(self) -> "Lightsail":
        '''(experimental) Grants permission to start an instance that is in a stopped state.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_StartInstance.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toStartInstance", []))

    @jsii.member(jsii_name="toStartRelationalDatabase")
    def to_start_relational_database(self) -> "Lightsail":
        '''(experimental) Grants permission to start a relational database that is in a stopped state.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_StartRelationalDatabase.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toStartRelationalDatabase", []))

    @jsii.member(jsii_name="toStopGUISession")
    def to_stop_gui_session(self) -> "Lightsail":
        '''(experimental) Grants permission to terminate a graphical user interface (GUI) session used to access an instance's operating system or application.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_StopGUISession.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toStopGUISession", []))

    @jsii.member(jsii_name="toStopInstance")
    def to_stop_instance(self) -> "Lightsail":
        '''(experimental) Grants permission to stop an instance that is in a running state.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_StopInstance.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toStopInstance", []))

    @jsii.member(jsii_name="toStopRelationalDatabase")
    def to_stop_relational_database(self) -> "Lightsail":
        '''(experimental) Grants permission to stop a relational database that is in a running state.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_StopRelationalDatabase.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toStopRelationalDatabase", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Lightsail":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestAlarm")
    def to_test_alarm(self) -> "Lightsail":
        '''(experimental) Grants permission to test an alarm by displaying a banner on the Amazon Lightsail console or if a notification trigger is configured for the specified alarm, by sending a notification to the notification protocol.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_TestAlarm.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toTestAlarm", []))

    @jsii.member(jsii_name="toUnpeerVpc")
    def to_unpeer_vpc(self) -> "Lightsail":
        '''(experimental) Grants permission to try to unpeer the Amazon Lightsail virtual private cloud (VPC) from the default VPC.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UnpeerVpc.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUnpeerVpc", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Lightsail":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateBucket")
    def to_update_bucket(self) -> "Lightsail":
        '''(experimental) Grants permission to update an existing Amazon Lightsail bucket.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UpdateBucket.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUpdateBucket", []))

    @jsii.member(jsii_name="toUpdateBucketBundle")
    def to_update_bucket_bundle(self) -> "Lightsail":
        '''(experimental) Grants permission to update the bundle, or storage plan, of an existing Amazon Lightsail bucket.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UpdateBucketBundle.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUpdateBucketBundle", []))

    @jsii.member(jsii_name="toUpdateContainerService")
    def to_update_container_service(self) -> "Lightsail":
        '''(experimental) Grants permission to update the configuration of your Amazon Lightsail container service, such as its power, scale, and public domain names.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UpdateContainerService.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUpdateContainerService", []))

    @jsii.member(jsii_name="toUpdateDistribution")
    def to_update_distribution(self) -> "Lightsail":
        '''(experimental) Grants permission to update an existing Amazon Lightsail content delivery network (CDN) distribution or its configuration.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UpdateDistribution.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUpdateDistribution", []))

    @jsii.member(jsii_name="toUpdateDistributionBundle")
    def to_update_distribution_bundle(self) -> "Lightsail":
        '''(experimental) Grants permission to update the bundle of your Amazon Lightsail content delivery network (CDN) distribution.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UpdateDistributionBundle.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUpdateDistributionBundle", []))

    @jsii.member(jsii_name="toUpdateDomainEntry")
    def to_update_domain_entry(self) -> "Lightsail":
        '''(experimental) Grants permission to update a domain recordset after it is created.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UpdateDomainEntry.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUpdateDomainEntry", []))

    @jsii.member(jsii_name="toUpdateInstanceMetadataOptions")
    def to_update_instance_metadata_options(self) -> "Lightsail":
        '''(experimental) Grants permission to update metadata options for an instance.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UpdateInstanceMetadataOptions.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUpdateInstanceMetadataOptions", []))

    @jsii.member(jsii_name="toUpdateLoadBalancerAttribute")
    def to_update_load_balancer_attribute(self) -> "Lightsail":
        '''(experimental) Grants permission to update a load balancer attribute, such as the health check path and session stickiness.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_DetachInstancesFromLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUpdateLoadBalancerAttribute", []))

    @jsii.member(jsii_name="toUpdateRelationalDatabase")
    def to_update_relational_database(self) -> "Lightsail":
        '''(experimental) Grants permission to update a relational database.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UpdateRelationalDatabase.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUpdateRelationalDatabase", []))

    @jsii.member(jsii_name="toUpdateRelationalDatabaseParameters")
    def to_update_relational_database_parameters(self) -> "Lightsail":
        '''(experimental) Grants permission to update the parameters of a relational database.

        Access Level: Write

        https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UpdateRelationalDatabaseParameters.html

        :stability: experimental
        '''
        return typing.cast("Lightsail", jsii.invoke(self, "toUpdateRelationalDatabaseParameters", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d5e07b01fbb26c234e922e2bd4e3602c20abfab09b82b997ccd5d4557b03b52d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6eb5f79129bd8ff25b7f4a09381c37b6fc278098ba62108e3de699cc42828700)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Logs(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Logs"):
    '''(experimental) Statement provider for service `logs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchlogs.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `logs <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchlogs.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__44ca5927d61b841c74ccfd88733d26628a712c03d1806ae02bfab724142bef3b)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDestination")
    def on_destination(
        self,
        destination_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Logs":
        '''(experimental) Adds a resource of type destination to the statement.

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_Destination.html

        :param destination_name: - Identifier for the destinationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__234bf7d280485209f53be8da45b042bf1bb993f2be86b4880f50272a7757defa)
            check_type(argname="argument destination_name", value=destination_name, expected_type=type_hints["destination_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Logs", jsii.invoke(self, "onDestination", [destination_name, account, region, partition]))

    @jsii.member(jsii_name="onLogGroup")
    def on_log_group(
        self,
        log_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Logs":
        '''(experimental) Adds a resource of type log-group to the statement.

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_LogGroup.html

        :param log_group_name: - Identifier for the logGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2260dd3c2b82e8ce438e29fb809c165ff0ef74f2be8c2b063eeb2a3b0aadc140)
            check_type(argname="argument log_group_name", value=log_group_name, expected_type=type_hints["log_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Logs", jsii.invoke(self, "onLogGroup", [log_group_name, account, region, partition]))

    @jsii.member(jsii_name="onLogStream")
    def on_log_stream(
        self,
        log_group_name: builtins.str,
        log_stream_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Logs":
        '''(experimental) Adds a resource of type log-stream to the statement.

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_LogStream.html

        :param log_group_name: - Identifier for the logGroupName.
        :param log_stream_name: - Identifier for the logStreamName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6fcb55fa4f5e803b2d0c6e51f243e4097bedbd6cbe1fcec5f29a0ed2ce8a2ed8)
            check_type(argname="argument log_group_name", value=log_group_name, expected_type=type_hints["log_group_name"])
            check_type(argname="argument log_stream_name", value=log_stream_name, expected_type=type_hints["log_stream_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Logs", jsii.invoke(self, "onLogStream", [log_group_name, log_stream_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateKmsKey")
    def to_associate_kms_key(self) -> "Logs":
        '''(experimental) Grants permission to associate the specified AWS Key Management Service (AWS KMS) customer master key (CMK) with the specified log group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_AssociateKmsKey.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toAssociateKmsKey", []))

    @jsii.member(jsii_name="toCancelExportTask")
    def to_cancel_export_task(self) -> "Logs":
        '''(experimental) Grants permission to cancel an export task if it is in PENDING or RUNNING state.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CancelExportTask.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toCancelExportTask", []))

    @jsii.member(jsii_name="toCreateExportTask")
    def to_create_export_task(self) -> "Logs":
        '''(experimental) Grants permission to create an ExportTask which allows you to efficiently export data from a Log Group to your Amazon S3 bucket.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateExportTask.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toCreateExportTask", []))

    @jsii.member(jsii_name="toCreateLogDelivery")
    def to_create_log_delivery(self) -> "Logs":
        '''(experimental) Grants permission to create the log delivery.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toCreateLogDelivery", []))

    @jsii.member(jsii_name="toCreateLogGroup")
    def to_create_log_group(self) -> "Logs":
        '''(experimental) Grants permission to create a new log group with the specified name.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateLogGroup.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toCreateLogGroup", []))

    @jsii.member(jsii_name="toCreateLogStream")
    def to_create_log_stream(self) -> "Logs":
        '''(experimental) Grants permission to create a new log stream with the specified name.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateLogStream.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toCreateLogStream", []))

    @jsii.member(jsii_name="toDeleteDataProtectionPolicy")
    def to_delete_data_protection_policy(self) -> "Logs":
        '''(experimental) Grants permission to delete a data protection policy attached to a log group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteDataProtectionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDeleteDataProtectionPolicy", []))

    @jsii.member(jsii_name="toDeleteDestination")
    def to_delete_destination(self) -> "Logs":
        '''(experimental) Grants permission to delete the destination with the specified name.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteDestination.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDeleteDestination", []))

    @jsii.member(jsii_name="toDeleteLogDelivery")
    def to_delete_log_delivery(self) -> "Logs":
        '''(experimental) Grants permission to delete the log delivery information for specified log delivery.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDeleteLogDelivery", []))

    @jsii.member(jsii_name="toDeleteLogGroup")
    def to_delete_log_group(self) -> "Logs":
        '''(experimental) Grants permission to delete the log group with the specified name.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteLogGroup.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDeleteLogGroup", []))

    @jsii.member(jsii_name="toDeleteLogStream")
    def to_delete_log_stream(self) -> "Logs":
        '''(experimental) Grants permission to delete a log stream.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteLogStream.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDeleteLogStream", []))

    @jsii.member(jsii_name="toDeleteMetricFilter")
    def to_delete_metric_filter(self) -> "Logs":
        '''(experimental) Grants permission to delete a metric filter associated with the specified log group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteMetricFilter.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDeleteMetricFilter", []))

    @jsii.member(jsii_name="toDeleteQueryDefinition")
    def to_delete_query_definition(self) -> "Logs":
        '''(experimental) Grants permission to delete a saved CloudWatch Logs Insights query definition.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteQueryDefinition.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDeleteQueryDefinition", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "Logs":
        '''(experimental) Grants permission to delete a resource policy from this account.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteRetentionPolicy")
    def to_delete_retention_policy(self) -> "Logs":
        '''(experimental) Grants permission to delete the retention policy of the specified log group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteRetentionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDeleteRetentionPolicy", []))

    @jsii.member(jsii_name="toDeleteSubscriptionFilter")
    def to_delete_subscription_filter(self) -> "Logs":
        '''(experimental) Grants permission to delete a subscription filter associated with the specified log group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteSubscriptionFilter.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDeleteSubscriptionFilter", []))

    @jsii.member(jsii_name="toDescribeDestinations")
    def to_describe_destinations(self) -> "Logs":
        '''(experimental) Grants permission to return all the destinations that are associated with the AWS account making the request.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeDestinations.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDescribeDestinations", []))

    @jsii.member(jsii_name="toDescribeExportTasks")
    def to_describe_export_tasks(self) -> "Logs":
        '''(experimental) Grants permission to return all the export tasks that are associated with the AWS account making the request.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeExportTasks.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDescribeExportTasks", []))

    @jsii.member(jsii_name="toDescribeLogGroups")
    def to_describe_log_groups(self) -> "Logs":
        '''(experimental) Grants permission to return all the log groups that are associated with the AWS account making the request.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogGroups.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDescribeLogGroups", []))

    @jsii.member(jsii_name="toDescribeLogStreams")
    def to_describe_log_streams(self) -> "Logs":
        '''(experimental) Grants permission to return all the log streams that are associated with the specified log group.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogStreams.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDescribeLogStreams", []))

    @jsii.member(jsii_name="toDescribeMetricFilters")
    def to_describe_metric_filters(self) -> "Logs":
        '''(experimental) Grants permission to return all the metrics filters associated with the specified log group.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeMetricFilters.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDescribeMetricFilters", []))

    @jsii.member(jsii_name="toDescribeQueries")
    def to_describe_queries(self) -> "Logs":
        '''(experimental) Grants permission to return a list of CloudWatch Logs Insights queries that are scheduled, executing, or have been executed recently in this account.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeQueries.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDescribeQueries", []))

    @jsii.member(jsii_name="toDescribeQueryDefinitions")
    def to_describe_query_definitions(self) -> "Logs":
        '''(experimental) Grants permission to return a paginated list of your saved CloudWatch Logs Insights query definitions.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeQueryDefinitions.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDescribeQueryDefinitions", []))

    @jsii.member(jsii_name="toDescribeResourcePolicies")
    def to_describe_resource_policies(self) -> "Logs":
        '''(experimental) Grants permission to return all the resource policies in this account.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeResourcePolicies.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDescribeResourcePolicies", []))

    @jsii.member(jsii_name="toDescribeSubscriptionFilters")
    def to_describe_subscription_filters(self) -> "Logs":
        '''(experimental) Grants permission to return all the subscription filters associated with the specified log group.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeSubscriptionFilters.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDescribeSubscriptionFilters", []))

    @jsii.member(jsii_name="toDisassociateKmsKey")
    def to_disassociate_kms_key(self) -> "Logs":
        '''(experimental) Grants permission to disassociate the associated AWS Key Management Service (AWS KMS) customer master key (CMK) from the specified log group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DisassociateKmsKey.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toDisassociateKmsKey", []))

    @jsii.member(jsii_name="toFilterLogEvents")
    def to_filter_log_events(self) -> "Logs":
        '''(experimental) Grants permission to retrieve log events, optionally filtered by a filter pattern from the specified log group.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toFilterLogEvents", []))

    @jsii.member(jsii_name="toGetDataProtectionPolicy")
    def to_get_data_protection_policy(self) -> "Logs":
        '''(experimental) Grants permission to retrieve a data protection policy attached to a log group.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetDataProtectionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toGetDataProtectionPolicy", []))

    @jsii.member(jsii_name="toGetLogDelivery")
    def to_get_log_delivery(self) -> "Logs":
        '''(experimental) Grants permission to get the log delivery information for specified log delivery.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toGetLogDelivery", []))

    @jsii.member(jsii_name="toGetLogEvents")
    def to_get_log_events(self) -> "Logs":
        '''(experimental) Grants permission to retrieve log events from the specified log stream.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetLogEvents.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toGetLogEvents", []))

    @jsii.member(jsii_name="toGetLogGroupFields")
    def to_get_log_group_fields(self) -> "Logs":
        '''(experimental) Grants permission to return a list of the fields that are included in log events in the specified log group, along with the percentage of log events that contain each field.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetLogGroupFields.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toGetLogGroupFields", []))

    @jsii.member(jsii_name="toGetLogRecord")
    def to_get_log_record(self) -> "Logs":
        '''(experimental) Grants permission to retrieve all the fields and values of a single log event.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetLogRecord.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toGetLogRecord", []))

    @jsii.member(jsii_name="toGetQueryResults")
    def to_get_query_results(self) -> "Logs":
        '''(experimental) Grants permission to return the results from the specified query.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetQueryResults.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toGetQueryResults", []))

    @jsii.member(jsii_name="toLink")
    def to_link(self) -> "Logs":
        '''(experimental) Grants permission to share CloudWatch resources with a monitoring account.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Unified-Cross-Account-Setup.html#CloudWatch-Unified-Cross-Account-Setup-permissions

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toLink", []))

    @jsii.member(jsii_name="toListLogDeliveries")
    def to_list_log_deliveries(self) -> "Logs":
        '''(experimental) Grants permission to list all the log deliveries for specified account and/or log source.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toListLogDeliveries", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Logs":
        '''(experimental) Grants permission to list the tags for the specified resource.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTagsLogGroup")
    def to_list_tags_log_group(self) -> "Logs":
        '''(experimental) Grants permission to list the tags for the specified log group.

        Access Level: List

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_ListTagsLogGroup.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toListTagsLogGroup", []))

    @jsii.member(jsii_name="toPutDataProtectionPolicy")
    def to_put_data_protection_policy(self) -> "Logs":
        '''(experimental) Grants permission to attach a data protection policy to detect and redact sensitive information from log events.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDataProtectionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toPutDataProtectionPolicy", []))

    @jsii.member(jsii_name="toPutDestination")
    def to_put_destination(self) -> "Logs":
        '''(experimental) Grants permission to create or update a Destination.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDestination.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toPutDestination", []))

    @jsii.member(jsii_name="toPutDestinationPolicy")
    def to_put_destination_policy(self) -> "Logs":
        '''(experimental) Grants permission to create or update an access policy associated with an existing Destination.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDestinationPolicy.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toPutDestinationPolicy", []))

    @jsii.member(jsii_name="toPutLogEvents")
    def to_put_log_events(self) -> "Logs":
        '''(experimental) Grants permission to upload a batch of log events to the specified log stream.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutLogEvents.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toPutLogEvents", []))

    @jsii.member(jsii_name="toPutMetricFilter")
    def to_put_metric_filter(self) -> "Logs":
        '''(experimental) Grants permission to create or update a metric filter and associates it with the specified log group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutMetricFilter.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toPutMetricFilter", []))

    @jsii.member(jsii_name="toPutQueryDefinition")
    def to_put_query_definition(self) -> "Logs":
        '''(experimental) Grants permission to create or update a query definition.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutQueryDefinition.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toPutQueryDefinition", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "Logs":
        '''(experimental) Grants permission to create or update a resource policy allowing other AWS services to put log events to this account.

        Access Level: Permissions management

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toPutRetentionPolicy")
    def to_put_retention_policy(self) -> "Logs":
        '''(experimental) Grants permission to set the retention of the specified log group.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutRetentionPolicy.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toPutRetentionPolicy", []))

    @jsii.member(jsii_name="toPutSubscriptionFilter")
    def to_put_subscription_filter(self) -> "Logs":
        '''(experimental) Grants permission to create or update a subscription filter and associates it with the specified log group.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutSubscriptionFilter.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toPutSubscriptionFilter", []))

    @jsii.member(jsii_name="toStartQuery")
    def to_start_query(self) -> "Logs":
        '''(experimental) Grants permission to schedule a query of a log group using CloudWatch Logs Insights.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_StartQuery.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toStartQuery", []))

    @jsii.member(jsii_name="toStopQuery")
    def to_stop_query(self) -> "Logs":
        '''(experimental) Grants permission to stop a CloudWatch Logs Insights query that is in progress.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_StopQuery.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toStopQuery", []))

    @jsii.member(jsii_name="toTagLogGroup")
    def to_tag_log_group(self) -> "Logs":
        '''(experimental) Grants permission to add or update the specified tags for the specified log group.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_TagLogGroup.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toTagLogGroup", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Logs":
        '''(experimental) Grants permission to add or update the specified tags for the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestMetricFilter")
    def to_test_metric_filter(self) -> "Logs":
        '''(experimental) Grants permission to test the filter pattern of a metric filter against a sample of log event messages.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_TestMetricFilter.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toTestMetricFilter", []))

    @jsii.member(jsii_name="toUnmask")
    def to_unmask(self) -> "Logs":
        '''(experimental) Grants permission to fetch unmasked log events that have been redacted with a data protection policy.

        Access Level: Read

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toUnmask", []))

    @jsii.member(jsii_name="toUntagLogGroup")
    def to_untag_log_group(self) -> "Logs":
        '''(experimental) Grants permission to remove the specified tags from the specified log group.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_UntagLogGroup.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toUntagLogGroup", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Logs":
        '''(experimental) Grants permission to remove the specified tags from the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateLogDelivery")
    def to_update_log_delivery(self) -> "Logs":
        '''(experimental) Grants permission to update the log delivery information for specified log delivery.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html

        :stability: experimental
        '''
        return typing.cast("Logs", jsii.invoke(self, "toUpdateLogDelivery", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__30f31efd3151a2119a9c83d7075bc6ef1c34112b1a34fa67f8b7800799ebd7e8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c4fba9c64f1de77e0612fa242234f95b8aca082403ae292b803cf7d98e68d50e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Lookoutequipment(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Lookoutequipment",
):
    '''(experimental) Statement provider for service `lookoutequipment <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlookoutforequipment.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `lookoutequipment <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlookoutforequipment.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9575415cf751f365080379f2a83d5cea4933f54496e4ccb617f4a4fdb7d04663)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onDataset")
    def on_dataset(
        self,
        dataset_name: builtins.str,
        dataset_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lookoutequipment":
        '''(experimental) Adds a resource of type dataset to the statement.

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/dataset.html

        :param dataset_name: - Identifier for the datasetName.
        :param dataset_id: - Identifier for the datasetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c5a312a37f4966c9acc2828d36305d43cd34de0a17d65eadf6c5eeda41e41505)
            check_type(argname="argument dataset_name", value=dataset_name, expected_type=type_hints["dataset_name"])
            check_type(argname="argument dataset_id", value=dataset_id, expected_type=type_hints["dataset_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lookoutequipment", jsii.invoke(self, "onDataset", [dataset_name, dataset_id, account, region, partition]))

    @jsii.member(jsii_name="onInferenceScheduler")
    def on_inference_scheduler(
        self,
        inference_scheduler_name: builtins.str,
        inference_scheduler_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lookoutequipment":
        '''(experimental) Adds a resource of type inference-scheduler to the statement.

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/inference-scheduler.html

        :param inference_scheduler_name: - Identifier for the inferenceSchedulerName.
        :param inference_scheduler_id: - Identifier for the inferenceSchedulerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d39677c488e15812ed37177de4b3f0971e42654b31902626d3bc11b40b835dba)
            check_type(argname="argument inference_scheduler_name", value=inference_scheduler_name, expected_type=type_hints["inference_scheduler_name"])
            check_type(argname="argument inference_scheduler_id", value=inference_scheduler_id, expected_type=type_hints["inference_scheduler_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lookoutequipment", jsii.invoke(self, "onInferenceScheduler", [inference_scheduler_name, inference_scheduler_id, account, region, partition]))

    @jsii.member(jsii_name="onLabelGroup")
    def on_label_group(
        self,
        label_group_name: builtins.str,
        label_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lookoutequipment":
        '''(experimental) Adds a resource of type label-group to the statement.

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/label-group.html

        :param label_group_name: - Identifier for the labelGroupName.
        :param label_group_id: - Identifier for the labelGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a7b62b776f4b80909f66806d5a9b04545d86de99026106fb709fe5d27bbc70e2)
            check_type(argname="argument label_group_name", value=label_group_name, expected_type=type_hints["label_group_name"])
            check_type(argname="argument label_group_id", value=label_group_id, expected_type=type_hints["label_group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lookoutequipment", jsii.invoke(self, "onLabelGroup", [label_group_name, label_group_id, account, region, partition]))

    @jsii.member(jsii_name="onModel")
    def on_model(
        self,
        model_name: builtins.str,
        model_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lookoutequipment":
        '''(experimental) Adds a resource of type model to the statement.

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/model.html

        :param model_name: - Identifier for the modelName.
        :param model_id: - Identifier for the modelId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a0a34cd34302957ab71f1ec5a5b981df740bff826346d05f6196e5b21c31f240)
            check_type(argname="argument model_name", value=model_name, expected_type=type_hints["model_name"])
            check_type(argname="argument model_id", value=model_id, expected_type=type_hints["model_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lookoutequipment", jsii.invoke(self, "onModel", [model_name, model_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateDataset")
    def to_create_dataset(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to create a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_CreateDataset.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toCreateDataset", []))

    @jsii.member(jsii_name="toCreateInferenceScheduler")
    def to_create_inference_scheduler(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to create an inference scheduler for a trained model.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_CreateInferenceScheduler.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toCreateInferenceScheduler", []))

    @jsii.member(jsii_name="toCreateLabel")
    def to_create_label(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to create a label.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_CreateLabel.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toCreateLabel", []))

    @jsii.member(jsii_name="toCreateLabelGroup")
    def to_create_label_group(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to create a label group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_CreateLabelGroup.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toCreateLabelGroup", []))

    @jsii.member(jsii_name="toCreateModel")
    def to_create_model(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to create a model that is trained on a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_CreateModel.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toCreateModel", []))

    @jsii.member(jsii_name="toDeleteDataset")
    def to_delete_dataset(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to delete a dataset.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_DeleteDataset.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toDeleteDataset", []))

    @jsii.member(jsii_name="toDeleteInferenceScheduler")
    def to_delete_inference_scheduler(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to delete an inference scheduler.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_DeleteInferenceScheduler.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toDeleteInferenceScheduler", []))

    @jsii.member(jsii_name="toDeleteLabel")
    def to_delete_label(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to delete a label.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_DeleteLabel.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toDeleteLabel", []))

    @jsii.member(jsii_name="toDeleteLabelGroup")
    def to_delete_label_group(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to delete a label group.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_DeleteLabelGroup.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toDeleteLabelGroup", []))

    @jsii.member(jsii_name="toDeleteModel")
    def to_delete_model(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to delete a model.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_DeleteModel.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toDeleteModel", []))

    @jsii.member(jsii_name="toDescribeDataIngestionJob")
    def to_describe_data_ingestion_job(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to describe a data ingestion job.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_DescribeDataIngestionJob

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toDescribeDataIngestionJob", []))

    @jsii.member(jsii_name="toDescribeDataset")
    def to_describe_dataset(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to describe a dataset.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_DescribeDataset.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toDescribeDataset", []))

    @jsii.member(jsii_name="toDescribeInferenceScheduler")
    def to_describe_inference_scheduler(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to describe an inference scheduler.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_DescribeInferenceScheduler.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toDescribeInferenceScheduler", []))

    @jsii.member(jsii_name="toDescribelabel")
    def to_describelabel(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to describe a label.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_DescribeLabel.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toDescribelabel", []))

    @jsii.member(jsii_name="toDescribeLabelGroup")
    def to_describe_label_group(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to describe a label group.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_DescribeLabelGroup.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toDescribeLabelGroup", []))

    @jsii.member(jsii_name="toDescribeModel")
    def to_describe_model(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to describe a model.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_DescribeModel.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toDescribeModel", []))

    @jsii.member(jsii_name="toListDataIngestionJobs")
    def to_list_data_ingestion_jobs(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to list the data ingestion jobs in your account or for a particular dataset.

        Access Level: List

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_ListDataIngestionJobs.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toListDataIngestionJobs", []))

    @jsii.member(jsii_name="toListDatasets")
    def to_list_datasets(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to list the datasets in your account.

        Access Level: List

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_ListDatasets.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toListDatasets", []))

    @jsii.member(jsii_name="toListInferenceEvents")
    def to_list_inference_events(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to list the inference events for an inference scheduler.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_ListInferenceEvents.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toListInferenceEvents", []))

    @jsii.member(jsii_name="toListInferenceExecutions")
    def to_list_inference_executions(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to list the inference executions for an inference scheduler.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_ListInferenceExecutions.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toListInferenceExecutions", []))

    @jsii.member(jsii_name="toListInferenceSchedulers")
    def to_list_inference_schedulers(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to list the inference schedulers in your account.

        Access Level: List

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_ListInferenceSchedulers.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toListInferenceSchedulers", []))

    @jsii.member(jsii_name="toListLabelGroups")
    def to_list_label_groups(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to list the label groups in your account.

        Access Level: List

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_ListLabelGroups.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toListLabelGroups", []))

    @jsii.member(jsii_name="toListLabels")
    def to_list_labels(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to list the labels in your account.

        Access Level: List

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_ListLabels.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toListLabels", []))

    @jsii.member(jsii_name="toListModels")
    def to_list_models(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to list the models in your account.

        Access Level: List

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_ListModels.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toListModels", []))

    @jsii.member(jsii_name="toListSensorStatistics")
    def to_list_sensor_statistics(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to list the sensor statistics for a particular dataset or an ingestion job.

        Access Level: List

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_ListSensorStatistics.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toListSensorStatistics", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to list the tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartDataIngestionJob")
    def to_start_data_ingestion_job(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to start a data ingestion job for a dataset.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_StartDataIngestionJob.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toStartDataIngestionJob", []))

    @jsii.member(jsii_name="toStartInferenceScheduler")
    def to_start_inference_scheduler(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to start an inference scheduler.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_StartInferenceScheduler.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toStartInferenceScheduler", []))

    @jsii.member(jsii_name="toStopInferenceScheduler")
    def to_stop_inference_scheduler(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to stop an inference scheduler.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_StopInferenceScheduler.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toStopInferenceScheduler", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateInferenceScheduler")
    def to_update_inference_scheduler(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to update an inference scheduler.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_UpdateInferenceScheduler.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toUpdateInferenceScheduler", []))

    @jsii.member(jsii_name="toUpdateLabelGroup")
    def to_update_label_group(self) -> "Lookoutequipment":
        '''(experimental) Grants permission to update a label group.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-equipment/latest/ug/API_UpdateLabelGroup.html

        :stability: experimental
        '''
        return typing.cast("Lookoutequipment", jsii.invoke(self, "toUpdateLabelGroup", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__48ae0764c6908a4e937583822498f37e2cab60aac0b74098d3255c8478636578)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5e46803297fac2b6e8e59ab877ce8578f3118eecb1e02a2546088284f52624f4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Lookoutmetrics(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Lookoutmetrics",
):
    '''(experimental) Statement provider for service `lookoutmetrics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlookoutformetrics.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `lookoutmetrics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlookoutformetrics.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__874571572f3e837cd4cec067649cb96c7100bf9dd37228a2bbec51479fa35824)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAlert")
    def on_alert(
        self,
        alert_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lookoutmetrics":
        '''(experimental) Adds a resource of type Alert to the statement.

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_AlertSummary.html

        :param alert_name: - Identifier for the alertName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__351b8b5228250e57da83169ae2d4c03ed7846695534d2217d2dfaf5d55085b4d)
            check_type(argname="argument alert_name", value=alert_name, expected_type=type_hints["alert_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "onAlert", [alert_name, account, region, partition]))

    @jsii.member(jsii_name="onAnomalyDetector")
    def on_anomaly_detector(
        self,
        anomaly_detector_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lookoutmetrics":
        '''(experimental) Adds a resource of type AnomalyDetector to the statement.

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_AnomalyDetectorSummary.html

        :param anomaly_detector_name: - Identifier for the anomalyDetectorName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6865b614510994d970050d4023dcd4ab4fb43ebda093c08fc7d67012b1046837)
            check_type(argname="argument anomaly_detector_name", value=anomaly_detector_name, expected_type=type_hints["anomaly_detector_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "onAnomalyDetector", [anomaly_detector_name, account, region, partition]))

    @jsii.member(jsii_name="onMetricSet")
    def on_metric_set(
        self,
        anomaly_detector_name: builtins.str,
        metric_set_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lookoutmetrics":
        '''(experimental) Adds a resource of type MetricSet to the statement.

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_MetricSetSummary.html

        :param anomaly_detector_name: - Identifier for the anomalyDetectorName.
        :param metric_set_name: - Identifier for the metricSetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4fb01247959da2e1b503594b2a653b2b1bad302704fd2ad43ec70eb37dda732a)
            check_type(argname="argument anomaly_detector_name", value=anomaly_detector_name, expected_type=type_hints["anomaly_detector_name"])
            check_type(argname="argument metric_set_name", value=metric_set_name, expected_type=type_hints["metric_set_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "onMetricSet", [anomaly_detector_name, metric_set_name, account, region, partition]))

    @jsii.member(jsii_name="toActivateAnomalyDetector")
    def to_activate_anomaly_detector(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to activate an anomaly detector.

        Access Level: Write

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_ActivateAnomalyDetector.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toActivateAnomalyDetector", []))

    @jsii.member(jsii_name="toBackTestAnomalyDetector")
    def to_back_test_anomaly_detector(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to run a backtest with an anomaly detector.

        Access Level: Write

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_BackTestAnomalyDetector.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toBackTestAnomalyDetector", []))

    @jsii.member(jsii_name="toCreateAlert")
    def to_create_alert(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to create an alert for an anomaly detector.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_CreateAlert.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toCreateAlert", []))

    @jsii.member(jsii_name="toCreateAnomalyDetector")
    def to_create_anomaly_detector(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to create an anomaly detector.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_CreateAnomalyDetector.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toCreateAnomalyDetector", []))

    @jsii.member(jsii_name="toCreateMetricSet")
    def to_create_metric_set(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to create a dataset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_CreateMetricSet.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toCreateMetricSet", []))

    @jsii.member(jsii_name="toDeactivateAnomalyDetector")
    def to_deactivate_anomaly_detector(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to deactivate an anomaly detector.

        Access Level: Write

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_DeactivateAnomalyDetector.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toDeactivateAnomalyDetector", []))

    @jsii.member(jsii_name="toDeleteAlert")
    def to_delete_alert(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to delete an alert.

        Access Level: Write

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_DeleteAlert.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toDeleteAlert", []))

    @jsii.member(jsii_name="toDeleteAnomalyDetector")
    def to_delete_anomaly_detector(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to delete an anomaly detector.

        Access Level: Write

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_DeleteAnomalyDetector.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toDeleteAnomalyDetector", []))

    @jsii.member(jsii_name="toDescribeAlert")
    def to_describe_alert(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get details about an alert.

        Access Level: Read

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_DescribeAlert.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toDescribeAlert", []))

    @jsii.member(jsii_name="toDescribeAnomalyDetectionExecutions")
    def to_describe_anomaly_detection_executions(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get information about an anomaly detection job.

        Access Level: Read

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_DescribeAnomalyDetectionExecutions.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toDescribeAnomalyDetectionExecutions", []))

    @jsii.member(jsii_name="toDescribeAnomalyDetector")
    def to_describe_anomaly_detector(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get details about an anomaly detector.

        Access Level: Read

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_DescribeAnomalyDetector.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toDescribeAnomalyDetector", []))

    @jsii.member(jsii_name="toDescribeMetricSet")
    def to_describe_metric_set(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get details about a dataset.

        Access Level: Read

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_DescribeMetricSet.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toDescribeMetricSet", []))

    @jsii.member(jsii_name="toDetectMetricSetConfig")
    def to_detect_metric_set_config(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to detect metric set config from data source.

        Access Level: Write

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_DetectMetricSetConfig.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toDetectMetricSetConfig", []))

    @jsii.member(jsii_name="toGetAnomalyGroup")
    def to_get_anomaly_group(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get details about a group of affected metrics.

        Access Level: Read

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_GetAnomalyGroup.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toGetAnomalyGroup", []))

    @jsii.member(jsii_name="toGetDataQualityMetrics")
    def to_get_data_quality_metrics(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get data quality metrics for an anomaly detector.

        Access Level: Read

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_GetDataQualityMetrics.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toGetDataQualityMetrics", []))

    @jsii.member(jsii_name="toGetFeedback")
    def to_get_feedback(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get feedback on affected metrics for an anomaly group.

        Access Level: Read

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_GetFeedback.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toGetFeedback", []))

    @jsii.member(jsii_name="toGetSampleData")
    def to_get_sample_data(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get a selection of sample records from an Amazon S3 datasource.

        Access Level: Read

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_GetSampleData.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toGetSampleData", []))

    @jsii.member(jsii_name="toListAlerts")
    def to_list_alerts(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get a list of alerts for a detector.

        Access Level: List

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_ListAlerts.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toListAlerts", []))

    @jsii.member(jsii_name="toListAnomalyDetectors")
    def to_list_anomaly_detectors(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get a list of anomaly detectors.

        Access Level: List

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_ListAnomalyDetectors.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toListAnomalyDetectors", []))

    @jsii.member(jsii_name="toListAnomalyGroupRelatedMetrics")
    def to_list_anomaly_group_related_metrics(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get a list of related measures in an anomaly group.

        Access Level: List

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_ListAnomalyGroupRelatedMetrics.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toListAnomalyGroupRelatedMetrics", []))

    @jsii.member(jsii_name="toListAnomalyGroupSummaries")
    def to_list_anomaly_group_summaries(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get a list of anomaly groups.

        Access Level: List

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_ListAnomalyGroupSummaries.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toListAnomalyGroupSummaries", []))

    @jsii.member(jsii_name="toListAnomalyGroupTimeSeries")
    def to_list_anomaly_group_time_series(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get a list of affected metrics for a measure in an anomaly group.

        Access Level: List

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_ListAnomalyGroupTimeSeries.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toListAnomalyGroupTimeSeries", []))

    @jsii.member(jsii_name="toListMetricSets")
    def to_list_metric_sets(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get a list of datasets.

        Access Level: List

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_ListMetricSets.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toListMetricSets", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to get a list of tags for a detector, dataset, or alert.

        Access Level: Read

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutFeedback")
    def to_put_feedback(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to add feedback for an affected metric in an anomaly group.

        Access Level: Write

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_PutFeedback.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toPutFeedback", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to add tags to a detector, dataset, or alert.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to remove tags from a detector, dataset, or alert.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAlert")
    def to_update_alert(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to update an alert for an anomaly detector.

        Access Level: Write

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_UpdateAlert.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toUpdateAlert", []))

    @jsii.member(jsii_name="toUpdateAnomalyDetector")
    def to_update_anomaly_detector(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to update an anomaly detector.

        Access Level: Write

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_UpdateAnomalyDetector.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toUpdateAnomalyDetector", []))

    @jsii.member(jsii_name="toUpdateMetricSet")
    def to_update_metric_set(self) -> "Lookoutmetrics":
        '''(experimental) Grants permission to update a dataset.

        Access Level: Write

        https://docs.aws.amazon.com/lookoutmetrics/latest/api/API_UpdateMetricSet.html

        :stability: experimental
        '''
        return typing.cast("Lookoutmetrics", jsii.invoke(self, "toUpdateMetricSet", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2405798fef94234240b5ff012a26495f08babe39fd863bfe9cbd7f8a19215f29)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ee72b822a7207713b1fd1b7e6f9190852d8c337d4430f9257e5904a56f8b42dc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Lookoutvision(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Lookoutvision",
):
    '''(experimental) Statement provider for service `lookoutvision <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlookoutforvision.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `lookoutvision <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonlookoutforvision.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4da5d1952b93d56e771645cfbbf55c563aa2a829e52dd5bc5efb71f0def9be6f)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onModel")
    def on_model(
        self,
        project_name: builtins.str,
        model_version: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lookoutvision":
        '''(experimental) Adds a resource of type model to the statement.

        https://docs.aws.amazon.com/lookout-for-vision/latest/developer-guide/model-create-project.html

        :param project_name: - Identifier for the projectName.
        :param model_version: - Identifier for the modelVersion.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9c3a10d554e91b855109e49d12f847cbe3dcaa0861b8c6b53e44a2ee48be400e)
            check_type(argname="argument project_name", value=project_name, expected_type=type_hints["project_name"])
            check_type(argname="argument model_version", value=model_version, expected_type=type_hints["model_version"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lookoutvision", jsii.invoke(self, "onModel", [project_name, model_version, account, region, partition]))

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Lookoutvision":
        '''(experimental) Adds a resource of type project to the statement.

        https://docs.aws.amazon.com/lookout-for-vision/latest/developer-guide/model-create-project.html

        :param project_name: - Identifier for the projectName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b703e7f00963df656dff82c4e6d39371b6cf23520838aae0484ce37d3450cbc9)
            check_type(argname="argument project_name", value=project_name, expected_type=type_hints["project_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Lookoutvision", jsii.invoke(self, "onProject", [project_name, account, region, partition]))

    @jsii.member(jsii_name="toCreateDataset")
    def to_create_dataset(self) -> "Lookoutvision":
        '''(experimental) Grants permission to create a dataset manifest.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_CreateDataset.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toCreateDataset", []))

    @jsii.member(jsii_name="toCreateModel")
    def to_create_model(self) -> "Lookoutvision":
        '''(experimental) Grants permission to create a new anomaly detection model.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_CreateModel.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toCreateModel", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Lookoutvision":
        '''(experimental) Grants permission to create a new project.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_CreateProject.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toDeleteDataset")
    def to_delete_dataset(self) -> "Lookoutvision":
        '''(experimental) Grants permission to delete a dataset.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_DeleteDataset.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toDeleteDataset", []))

    @jsii.member(jsii_name="toDeleteModel")
    def to_delete_model(self) -> "Lookoutvision":
        '''(experimental) Grants permission to delete a model and all associated assets.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_DeleteModel.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toDeleteModel", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Lookoutvision":
        '''(experimental) Grants permission to permanently remove a project.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_DeleteProject.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDescribeDataset")
    def to_describe_dataset(self) -> "Lookoutvision":
        '''(experimental) Grants permission to show detailed information about dataset manifest.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_DescribeDataset.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toDescribeDataset", []))

    @jsii.member(jsii_name="toDescribeModel")
    def to_describe_model(self) -> "Lookoutvision":
        '''(experimental) Grants permission to show detailed information about a model.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_DescribeModel.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toDescribeModel", []))

    @jsii.member(jsii_name="toDescribeModelPackagingJob")
    def to_describe_model_packaging_job(self) -> "Lookoutvision":
        '''(experimental) Grants permission to show detailed information about a model packaging job.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_DescribeModelPackagingJob.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toDescribeModelPackagingJob", []))

    @jsii.member(jsii_name="toDescribeProject")
    def to_describe_project(self) -> "Lookoutvision":
        '''(experimental) Grants permission to show detailed information about a project.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_DescribeProject.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toDescribeProject", []))

    @jsii.member(jsii_name="toDescribeTrialDetection")
    def to_describe_trial_detection(self) -> "Lookoutvision":
        '''(experimental) Grants permission to provides state information about a running anomaly detection job.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-vision/latest/developer-guide/trial-detection.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toDescribeTrialDetection", []))

    @jsii.member(jsii_name="toDetectAnomalies")
    def to_detect_anomalies(self) -> "Lookoutvision":
        '''(experimental) Grants permission to invoke detection of anomalies.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_DetectAnomalies.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toDetectAnomalies", []))

    @jsii.member(jsii_name="toListDatasetEntries")
    def to_list_dataset_entries(self) -> "Lookoutvision":
        '''(experimental) Grants permission to list the contents of dataset manifest.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_ListDatasetEntries.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toListDatasetEntries", []))

    @jsii.member(jsii_name="toListModelPackagingJobs")
    def to_list_model_packaging_jobs(self) -> "Lookoutvision":
        '''(experimental) Grants permission to list all model packaging jobs associated with a project.

        Access Level: List

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_ListModelPackagingJobs.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toListModelPackagingJobs", []))

    @jsii.member(jsii_name="toListModels")
    def to_list_models(self) -> "Lookoutvision":
        '''(experimental) Grants permission to list all models associated with a project.

        Access Level: List

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_ListModels.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toListModels", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Lookoutvision":
        '''(experimental) Grants permission to list all projects.

        Access Level: List

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_ListProjects.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Lookoutvision":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTrialDetections")
    def to_list_trial_detections(self) -> "Lookoutvision":
        '''(experimental) Grants permission to list all anomaly detection jobs.

        Access Level: List

        https://docs.aws.amazon.com/lookout-for-vision/latest/developer-guide/trial-detection.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toListTrialDetections", []))

    @jsii.member(jsii_name="toStartModel")
    def to_start_model(self) -> "Lookoutvision":
        '''(experimental) Grants permission to start anomaly detection model.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_StartModel.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toStartModel", []))

    @jsii.member(jsii_name="toStartModelPackagingJob")
    def to_start_model_packaging_job(self) -> "Lookoutvision":
        '''(experimental) Grants permission to start a model packaging job.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_StartModelPackagingJob.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toStartModelPackagingJob", []))

    @jsii.member(jsii_name="toStartTrialDetection")
    def to_start_trial_detection(self) -> "Lookoutvision":
        '''(experimental) Grants permission to start bulk detection of anomalies for a set of images stored in an S3 bucket.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/developer-guide/trial-detection.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toStartTrialDetection", []))

    @jsii.member(jsii_name="toStopModel")
    def to_stop_model(self) -> "Lookoutvision":
        '''(experimental) Grants permission to stop anomaly detection model.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_StopModel.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toStopModel", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Lookoutvision":
        '''(experimental) Grants permission to tag a resource with given key value pairs.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Lookoutvision":
        '''(experimental) Grants permission to remove the tag with the given key from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDatasetEntries")
    def to_update_dataset_entries(self) -> "Lookoutvision":
        '''(experimental) Grants permission to update a training or test dataset manifest.

        Access Level: Write

        https://docs.aws.amazon.com/lookout-for-vision/latest/APIReference/API_UpdateDatasetEntries.html

        :stability: experimental
        '''
        return typing.cast("Lookoutvision", jsii.invoke(self, "toUpdateDatasetEntries", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cd47cdc3b9f52b3eab3aac6d506dc47e1d68c4c46c2e143f7960a330d476e130)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__674dbf490100bb21274b6b4bddf18c3167a1efdc4d2f9cbd919ca862f4a103da)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class M2(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.M2"):
    '''(experimental) Statement provider for service `m2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmainframemodernizationservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `m2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmainframemodernizationservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e46072ba9a31456ca604a4153cea5a28f07bb67acbf2080f1217d43f513efb95)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onApplication")
    def on_application(
        self,
        application_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "M2":
        '''(experimental) Adds a resource of type Application to the statement.

        https://docs.aws.amazon.com/m2/latest/userguide/concept-m2.html#application-concept

        :param application_id: - Identifier for the applicationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4c3a7d3ec2fc1f1e69b477c828a6769dc6d104393183f8d2b3d3344dcbd2b6af)
            check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("M2", jsii.invoke(self, "onApplication", [application_id, account, region, partition]))

    @jsii.member(jsii_name="onEnvironment")
    def on_environment(
        self,
        environment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "M2":
        '''(experimental) Adds a resource of type Environment to the statement.

        https://docs.aws.amazon.com/m2/latest/userguide/concept-m2.html#environment-concept

        :param environment_id: - Identifier for the environmentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bfb09b0c683cb9a09b7b22fccf2bacf454b384fb59f94d17fef2fcb26e92a83f)
            check_type(argname="argument environment_id", value=environment_id, expected_type=type_hints["environment_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("M2", jsii.invoke(self, "onEnvironment", [environment_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelBatchJobExecution")
    def to_cancel_batch_job_execution(self) -> "M2":
        '''(experimental) Grants permission to cancel the execution of a batch job.

        Access Level: Write

        https://docs.aws.amazon.com/m2/latest/APIReference/API_CancelBatchJobExecution.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toCancelBatchJobExecution", []))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "M2":
        '''(experimental) Grants permission to create an application.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - s3:GetObject
        - s3:ListBucket

        https://docs.aws.amazon.com/m2/latest/APIReference/API_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toCreateDataSetImportTask")
    def to_create_data_set_import_task(self) -> "M2":
        '''(experimental) Grants permission to create a data set import task.

        Access Level: Write

        Dependent actions:

        - s3:GetObject

        https://docs.aws.amazon.com/m2/latest/APIReference/API_CreateDataSetImportTask.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toCreateDataSetImportTask", []))

    @jsii.member(jsii_name="toCreateDeployment")
    def to_create_deployment(self) -> "M2":
        '''(experimental) Grants permission to create a deployment.

        Access Level: Write

        Dependent actions:

        - elasticloadbalancing:CreateListener
        - elasticloadbalancing:CreateTargetGroup
        - elasticloadbalancing:RegisterTargets

        https://docs.aws.amazon.com/m2/latest/APIReference/API_CreateDeployment.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toCreateDeployment", []))

    @jsii.member(jsii_name="toCreateEnvironment")
    def to_create_environment(self) -> "M2":
        '''(experimental) Grants permission to Create an environment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:CreateNetworkInterfacePermission
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:DescribeVpcAttribute
        - ec2:DescribeVpcs
        - ec2:ModifyNetworkInterfaceAttribute
        - elasticfilesystem:DescribeMountTargets
        - elasticloadbalancing:CreateLoadBalancer
        - fsx:DescribeFileSystems
        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/m2/latest/APIReference/API_CreateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toCreateEnvironment", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "M2":
        '''(experimental) Grants permission to delete an application.

        Access Level: Write

        Dependent actions:

        - elasticloadbalancing:DeleteListener
        - elasticloadbalancing:DeleteTargetGroup

        https://docs.aws.amazon.com/m2/latest/APIReference/API_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toDeleteApplicationFromEnvironment")
    def to_delete_application_from_environment(self) -> "M2":
        '''(experimental) Grants permission to delete an application from a runtime environment.

        Access Level: Write

        Dependent actions:

        - elasticloadbalancing:DeleteListener
        - elasticloadbalancing:DeleteTargetGroup

        https://docs.aws.amazon.com/m2/latest/APIReference/API_DeleteApplicationFromEnvironment.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toDeleteApplicationFromEnvironment", []))

    @jsii.member(jsii_name="toDeleteEnvironment")
    def to_delete_environment(self) -> "M2":
        '''(experimental) Grants permission to delete a runtime environment.

        Access Level: Write

        Dependent actions:

        - elasticloadbalancing:DeleteLoadBalancer

        https://docs.aws.amazon.com/m2/latest/APIReference/API_DeleteEnvironment.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toDeleteEnvironment", []))

    @jsii.member(jsii_name="toGetApplication")
    def to_get_application(self) -> "M2":
        '''(experimental) Grants permission to retrieve an application.

        Access Level: Read

        https://docs.aws.amazon.com/m2/latest/APIReference/API_GetApplication.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toGetApplication", []))

    @jsii.member(jsii_name="toGetApplicationVersion")
    def to_get_application_version(self) -> "M2":
        '''(experimental) Grants permission to retrieve an application version.

        Access Level: Read

        https://docs.aws.amazon.com/m2/latest/APIReference/API_GetApplicationVersion.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toGetApplicationVersion", []))

    @jsii.member(jsii_name="toGetBatchJobExecution")
    def to_get_batch_job_execution(self) -> "M2":
        '''(experimental) Grants permission to retrieve a batch job execution.

        Access Level: Read

        https://docs.aws.amazon.com/m2/latest/APIReference/API_GetBatchJobExecution.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toGetBatchJobExecution", []))

    @jsii.member(jsii_name="toGetDataSetDetails")
    def to_get_data_set_details(self) -> "M2":
        '''(experimental) Grants permission to retrieve data set details.

        Access Level: Read

        https://docs.aws.amazon.com/m2/latest/APIReference/API_GetDataSetDetails.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toGetDataSetDetails", []))

    @jsii.member(jsii_name="toGetDataSetImportTask")
    def to_get_data_set_import_task(self) -> "M2":
        '''(experimental) Grants permission to retrieve a data set import task.

        Access Level: Read

        https://docs.aws.amazon.com/m2/latest/APIReference/API_GetDataSetImportTask.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toGetDataSetImportTask", []))

    @jsii.member(jsii_name="toGetDeployment")
    def to_get_deployment(self) -> "M2":
        '''(experimental) Grants permission to retrieve a deployment.

        Access Level: Read

        https://docs.aws.amazon.com/m2/latest/APIReference/API_GetDeployment.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toGetDeployment", []))

    @jsii.member(jsii_name="toGetEnvironment")
    def to_get_environment(self) -> "M2":
        '''(experimental) Grants permission to retrieve a runtime environment.

        Access Level: Read

        https://docs.aws.amazon.com/m2/latest/APIReference/API_GetEnvironment.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toGetEnvironment", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "M2":
        '''(experimental) Grants permission to list applications.

        Access Level: List

        https://docs.aws.amazon.com/m2/latest/APIReference/API_ListApplications.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListApplicationVersions")
    def to_list_application_versions(self) -> "M2":
        '''(experimental) Grants permission to list the versions of an application.

        Access Level: Read

        https://docs.aws.amazon.com/m2/latest/APIReference/API_ListApplicationVersions.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toListApplicationVersions", []))

    @jsii.member(jsii_name="toListBatchJobDefinitions")
    def to_list_batch_job_definitions(self) -> "M2":
        '''(experimental) Grants permission to list batch job definitions.

        Access Level: Read

        https://docs.aws.amazon.com/m2/latest/APIReference/API_ListBatchJobDefinitions.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toListBatchJobDefinitions", []))

    @jsii.member(jsii_name="toListBatchJobExecutions")
    def to_list_batch_job_executions(self) -> "M2":
        '''(experimental) Grants permission to list executions for a batch job.

        Access Level: Read

        https://docs.aws.amazon.com/m2/latest/APIReference/API_ListBatchJobExecutions.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toListBatchJobExecutions", []))

    @jsii.member(jsii_name="toListDataSetImportHistory")
    def to_list_data_set_import_history(self) -> "M2":
        '''(experimental) Grants permission to list data set import history.

        Access Level: Read

        https://docs.aws.amazon.com/m2/latest/APIReference/API_ListDataSetImportHistory.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toListDataSetImportHistory", []))

    @jsii.member(jsii_name="toListDataSets")
    def to_list_data_sets(self) -> "M2":
        '''(experimental) Grants permission to list data sets.

        Access Level: Read

        https://docs.aws.amazon.com/m2/latest/APIReference/API_ListDataSets.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toListDataSets", []))

    @jsii.member(jsii_name="toListDeployments")
    def to_list_deployments(self) -> "M2":
        '''(experimental) Grants permission to list deployments.

        Access Level: Read

        https://docs.aws.amazon.com/m2/latest/APIReference/API_ListDeployments.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toListDeployments", []))

    @jsii.member(jsii_name="toListEngineVersions")
    def to_list_engine_versions(self) -> "M2":
        '''(experimental) Grants permission to list engine versions.

        Access Level: Read

        https://docs.aws.amazon.com/m2/latest/APIReference/API_ListEngineVersions.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toListEngineVersions", []))

    @jsii.member(jsii_name="toListEnvironments")
    def to_list_environments(self) -> "M2":
        '''(experimental) Grants permission to list runtime environments.

        Access Level: List

        https://docs.aws.amazon.com/m2/latest/APIReference/API_ListEnvironments.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toListEnvironments", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "M2":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/m2/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartApplication")
    def to_start_application(self) -> "M2":
        '''(experimental) Grants permission to start an application.

        Access Level: Write

        https://docs.aws.amazon.com/m2/latest/APIReference/API_StartApplication.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toStartApplication", []))

    @jsii.member(jsii_name="toStartBatchJob")
    def to_start_batch_job(self) -> "M2":
        '''(experimental) Grants permission to start a batch job.

        Access Level: Write

        https://docs.aws.amazon.com/m2/latest/APIReference/API_StartBatchJob.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toStartBatchJob", []))

    @jsii.member(jsii_name="toStopApplication")
    def to_stop_application(self) -> "M2":
        '''(experimental) Grants permission to stop an application.

        Access Level: Write

        https://docs.aws.amazon.com/m2/latest/APIReference/API_StopApplication.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toStopApplication", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "M2":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/m2/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "M2":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/m2/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "M2":
        '''(experimental) Grants permission to update an application.

        Access Level: Write

        Dependent actions:

        - s3:GetObject
        - s3:ListBucket

        https://docs.aws.amazon.com/m2/latest/APIReference/API_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toUpdateApplication", []))

    @jsii.member(jsii_name="toUpdateEnvironment")
    def to_update_environment(self) -> "M2":
        '''(experimental) Grants permission to update a runtime environment.

        Access Level: Write

        https://docs.aws.amazon.com/m2/latest/APIReference/API_UpdateEnvironment.html

        :stability: experimental
        '''
        return typing.cast("M2", jsii.invoke(self, "toUpdateEnvironment", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__595bdb1ef984f2640cc5bd7bb30bf04fa15acf33547c4e8624945a4311694a4e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__46e32e43dfac0bd9613cbc892ccd221bfab4dffe3332685f9bf6530c23a83e1d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Machinelearning(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Machinelearning",
):
    '''(experimental) Statement provider for service `machinelearning <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmachinelearning.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `machinelearning <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmachinelearning.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8523580e111b78da831b5d89a9a3630ce1f83f35088fb952f83ed2033086a240)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onBatchprediction")
    def on_batchprediction(
        self,
        batch_prediction_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Machinelearning":
        '''(experimental) Adds a resource of type batchprediction to the statement.

        https://docs.aws.amazon.com/machine-learning/latest/dg/amazon-machine-learning-key-concepts.html#batch-predictions

        :param batch_prediction_id: - Identifier for the batchPredictionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__540514a6089f07d4f7490450ba469ec5d813e39d107d284392fecc44cc435d9e)
            check_type(argname="argument batch_prediction_id", value=batch_prediction_id, expected_type=type_hints["batch_prediction_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Machinelearning", jsii.invoke(self, "onBatchprediction", [batch_prediction_id, account, region, partition]))

    @jsii.member(jsii_name="onDatasource")
    def on_datasource(
        self,
        datasource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Machinelearning":
        '''(experimental) Adds a resource of type datasource to the statement.

        https://docs.aws.amazon.com/machine-learning/latest/dg/amazon-machine-learning-key-concepts.html#datasources

        :param datasource_id: - Identifier for the datasourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__de40daed64983fb5bfc00ac3edd08d50d0b42734c8750cffaa2b3c7e4c1a4255)
            check_type(argname="argument datasource_id", value=datasource_id, expected_type=type_hints["datasource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Machinelearning", jsii.invoke(self, "onDatasource", [datasource_id, account, region, partition]))

    @jsii.member(jsii_name="onEvaluation")
    def on_evaluation(
        self,
        evaluation_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Machinelearning":
        '''(experimental) Adds a resource of type evaluation to the statement.

        https://docs.aws.amazon.com/machine-learning/latest/dg/amazon-machine-learning-key-concepts.html#evaluations

        :param evaluation_id: - Identifier for the evaluationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dfa9e2f068fe3fbde1a0e857172e492f1e29ce76bf60b803365104ffce235c97)
            check_type(argname="argument evaluation_id", value=evaluation_id, expected_type=type_hints["evaluation_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Machinelearning", jsii.invoke(self, "onEvaluation", [evaluation_id, account, region, partition]))

    @jsii.member(jsii_name="onMlmodel")
    def on_mlmodel(
        self,
        ml_model_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Machinelearning":
        '''(experimental) Adds a resource of type mlmodel to the statement.

        https://docs.aws.amazon.com/machine-learning/latest/dg/amazon-machine-learning-key-concepts.html#ml-models

        :param ml_model_id: - Identifier for the mlModelId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6fe159afc10ef19eeb6c5094fb030f2f915d4b8bda1fb2f639e8e1e74a72afdf)
            check_type(argname="argument ml_model_id", value=ml_model_id, expected_type=type_hints["ml_model_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Machinelearning", jsii.invoke(self, "onMlmodel", [ml_model_id, account, region, partition]))

    @jsii.member(jsii_name="toAddTags")
    def to_add_tags(self) -> "Machinelearning":
        '''(experimental) Adds one or more tags to an object, up to a limit of 10.

        Each tag consists of a key and an optional value

        Access Level: Tagging

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_AddTags.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toAddTags", []))

    @jsii.member(jsii_name="toCreateBatchPrediction")
    def to_create_batch_prediction(self) -> "Machinelearning":
        '''(experimental) Generates predictions for a group of observations.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_CreateBatchPrediction.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toCreateBatchPrediction", []))

    @jsii.member(jsii_name="toCreateDataSourceFromRDS")
    def to_create_data_source_from_rds(self) -> "Machinelearning":
        '''(experimental) Creates a DataSource object from an Amazon RDS.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_CreateDataSourceFromRDS.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toCreateDataSourceFromRDS", []))

    @jsii.member(jsii_name="toCreateDataSourceFromRedshift")
    def to_create_data_source_from_redshift(self) -> "Machinelearning":
        '''(experimental) Creates a DataSource from a database hosted on an Amazon Redshift cluster.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_CreateDataSourceFromRedshift.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toCreateDataSourceFromRedshift", []))

    @jsii.member(jsii_name="toCreateDataSourceFromS3")
    def to_create_data_source_from_s3(self) -> "Machinelearning":
        '''(experimental) Creates a DataSource object from S3.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_CreateDataSourceFromS3.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toCreateDataSourceFromS3", []))

    @jsii.member(jsii_name="toCreateEvaluation")
    def to_create_evaluation(self) -> "Machinelearning":
        '''(experimental) Creates a new Evaluation of an MLModel.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_CreateEvaluation.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toCreateEvaluation", []))

    @jsii.member(jsii_name="toCreateMLModel")
    def to_create_ml_model(self) -> "Machinelearning":
        '''(experimental) Creates a new MLModel.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_CreateMLModel.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toCreateMLModel", []))

    @jsii.member(jsii_name="toCreateRealtimeEndpoint")
    def to_create_realtime_endpoint(self) -> "Machinelearning":
        '''(experimental) Creates a real-time endpoint for the MLModel.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_CreateRealtimeEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toCreateRealtimeEndpoint", []))

    @jsii.member(jsii_name="toDeleteBatchPrediction")
    def to_delete_batch_prediction(self) -> "Machinelearning":
        '''(experimental) Assigns the DELETED status to a BatchPrediction, rendering it unusable.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DeleteBatchPrediction.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDeleteBatchPrediction", []))

    @jsii.member(jsii_name="toDeleteDataSource")
    def to_delete_data_source(self) -> "Machinelearning":
        '''(experimental) Assigns the DELETED status to a DataSource, rendering it unusable.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DeleteDataSource.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDeleteDataSource", []))

    @jsii.member(jsii_name="toDeleteEvaluation")
    def to_delete_evaluation(self) -> "Machinelearning":
        '''(experimental) Assigns the DELETED status to an Evaluation, rendering it unusable.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DeleteEvaluation.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDeleteEvaluation", []))

    @jsii.member(jsii_name="toDeleteMLModel")
    def to_delete_ml_model(self) -> "Machinelearning":
        '''(experimental) Assigns the DELETED status to an MLModel, rendering it unusable.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DeleteMLModel.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDeleteMLModel", []))

    @jsii.member(jsii_name="toDeleteRealtimeEndpoint")
    def to_delete_realtime_endpoint(self) -> "Machinelearning":
        '''(experimental) Deletes a real time endpoint of an MLModel.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DeleteRealtimeEndpoint.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDeleteRealtimeEndpoint", []))

    @jsii.member(jsii_name="toDeleteTags")
    def to_delete_tags(self) -> "Machinelearning":
        '''(experimental) Deletes the specified tags associated with an ML object. After this operation is complete, you can't recover deleted tags.

        Access Level: Tagging

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DeleteTags.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDeleteTags", []))

    @jsii.member(jsii_name="toDescribeBatchPredictions")
    def to_describe_batch_predictions(self) -> "Machinelearning":
        '''(experimental) Returns a list of BatchPrediction operations that match the search criteria in the request.

        Access Level: List

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DescribeBatchPredictions.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDescribeBatchPredictions", []))

    @jsii.member(jsii_name="toDescribeDataSources")
    def to_describe_data_sources(self) -> "Machinelearning":
        '''(experimental) Returns a list of DataSource that match the search criteria in the request.

        Access Level: List

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DescribeDataSources.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDescribeDataSources", []))

    @jsii.member(jsii_name="toDescribeEvaluations")
    def to_describe_evaluations(self) -> "Machinelearning":
        '''(experimental) Returns a list of DescribeEvaluations that match the search criteria in the request.

        Access Level: List

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DescribeEvaluations.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDescribeEvaluations", []))

    @jsii.member(jsii_name="toDescribeMLModels")
    def to_describe_ml_models(self) -> "Machinelearning":
        '''(experimental) Returns a list of MLModel that match the search criteria in the request.

        Access Level: List

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DescribeMLModels.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDescribeMLModels", []))

    @jsii.member(jsii_name="toDescribeTags")
    def to_describe_tags(self) -> "Machinelearning":
        '''(experimental) Describes one or more of the tags for your Amazon ML object.

        Access Level: List

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_DescribeTags.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toDescribeTags", []))

    @jsii.member(jsii_name="toGetBatchPrediction")
    def to_get_batch_prediction(self) -> "Machinelearning":
        '''(experimental) Returns a BatchPrediction that includes detailed metadata, status, and data file information.

        Access Level: Read

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_GetBatchPrediction.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toGetBatchPrediction", []))

    @jsii.member(jsii_name="toGetDataSource")
    def to_get_data_source(self) -> "Machinelearning":
        '''(experimental) Returns a DataSource that includes metadata and data file information, as well as the current status of the DataSource.

        Access Level: Read

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_GetDataSource.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toGetDataSource", []))

    @jsii.member(jsii_name="toGetEvaluation")
    def to_get_evaluation(self) -> "Machinelearning":
        '''(experimental) Returns an Evaluation that includes metadata as well as the current status of the Evaluation.

        Access Level: Read

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_GetEvaluation.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toGetEvaluation", []))

    @jsii.member(jsii_name="toGetMLModel")
    def to_get_ml_model(self) -> "Machinelearning":
        '''(experimental) Returns an MLModel that includes detailed metadata, and data source information as well as the current status of the MLModel.

        Access Level: Read

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_GetMLModel.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toGetMLModel", []))

    @jsii.member(jsii_name="toPredict")
    def to_predict(self) -> "Machinelearning":
        '''(experimental) Generates a prediction for the observation using the specified ML Model.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_Predict.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toPredict", []))

    @jsii.member(jsii_name="toUpdateBatchPrediction")
    def to_update_batch_prediction(self) -> "Machinelearning":
        '''(experimental) Updates the BatchPredictionName of a BatchPrediction.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_UpdateBatchPrediction.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toUpdateBatchPrediction", []))

    @jsii.member(jsii_name="toUpdateDataSource")
    def to_update_data_source(self) -> "Machinelearning":
        '''(experimental) Updates the DataSourceName of a DataSource.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_UpdateDataSource.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toUpdateDataSource", []))

    @jsii.member(jsii_name="toUpdateEvaluation")
    def to_update_evaluation(self) -> "Machinelearning":
        '''(experimental) Updates the EvaluationName of an Evaluation.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_UpdateEvaluation.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toUpdateEvaluation", []))

    @jsii.member(jsii_name="toUpdateMLModel")
    def to_update_ml_model(self) -> "Machinelearning":
        '''(experimental) Updates the MLModelName and the ScoreThreshold of an MLModel.

        Access Level: Write

        https://docs.aws.amazon.com/machine-learning/latest/APIReference/API_UpdateMLModel.html

        :stability: experimental
        '''
        return typing.cast("Machinelearning", jsii.invoke(self, "toUpdateMLModel", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a20d8eea30c8a59f4defbbb0b6cb01ccec9f7122ca7343462b70601cc65355f8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fb021ac19b8f4469e781483d7dc80ed3c9ec3300e85dddab09fb09c189957569)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Macie2(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Macie2"):
    '''(experimental) Statement provider for service `macie2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmacie.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `macie2 <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmacie.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7d85c85d0b05b2c0e9c8cc7b034513e6879a0ac576014059b6fbe760e2a9e2cf)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAllowList")
    def on_allow_list(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Macie2":
        '''(experimental) Adds a resource of type AllowList to the statement.

        https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0f8d54593c2a18bb3058a4986ba8c1fdc61fc22ee21946420c28e02cea9abc4c)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Macie2", jsii.invoke(self, "onAllowList", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onClassificationJob")
    def on_classification_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Macie2":
        '''(experimental) Adds a resource of type ClassificationJob to the statement.

        https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4d8d3004a85048c4a6cd423ccbdbbdc7bbfb75d21f616ea4a974c45b7df2a150)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Macie2", jsii.invoke(self, "onClassificationJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onCustomDataIdentifier")
    def on_custom_data_identifier(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Macie2":
        '''(experimental) Adds a resource of type CustomDataIdentifier to the statement.

        https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d0089b5b857bd616e4da0bafb67cc712794243ae03a2e2dd8538f5f74b91c6da)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Macie2", jsii.invoke(self, "onCustomDataIdentifier", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onFindingsFilter")
    def on_findings_filter(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Macie2":
        '''(experimental) Adds a resource of type FindingsFilter to the statement.

        https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7026540c6fa7ab6af3c7c6a24b08a0a323a653f0b1e6eab99e5cc67bdee3eb4c)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Macie2", jsii.invoke(self, "onFindingsFilter", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onMember")
    def on_member(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Macie2":
        '''(experimental) Adds a resource of type Member to the statement.

        https://docs.aws.amazon.com/macie/latest/user/what-is-macie.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d38044f1d9ff558cbbce8f3bfd6f14f9f67bd46af94df82c5fea0b58028496b5)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Macie2", jsii.invoke(self, "onMember", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptInvitation")
    def to_accept_invitation(self) -> "Macie2":
        '''(experimental) Grants permission to accept an Amazon Macie membership invitation.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/invitations-accept.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toAcceptInvitation", []))

    @jsii.member(jsii_name="toBatchGetCustomDataIdentifiers")
    def to_batch_get_custom_data_identifiers(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about one or more custom data identifiers.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/custom-data-identifiers-get.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toBatchGetCustomDataIdentifiers", []))

    @jsii.member(jsii_name="toCreateAllowList")
    def to_create_allow_list(self) -> "Macie2":
        '''(experimental) Grants permission to create and define the settings for an allow list.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/macie/latest/APIReference/allow-lists.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toCreateAllowList", []))

    @jsii.member(jsii_name="toCreateClassificationJob")
    def to_create_classification_job(self) -> "Macie2":
        '''(experimental) Grants permission to create and define the settings for a sensitive data discovery job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/macie/latest/APIReference/jobs.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toCreateClassificationJob", []))

    @jsii.member(jsii_name="toCreateCustomDataIdentifier")
    def to_create_custom_data_identifier(self) -> "Macie2":
        '''(experimental) Grants permission to create and define the settings for a custom data identifier.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/macie/latest/APIReference/custom-data-identifiers.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toCreateCustomDataIdentifier", []))

    @jsii.member(jsii_name="toCreateFindingsFilter")
    def to_create_findings_filter(self) -> "Macie2":
        '''(experimental) Grants permission to create and define the settings for a findings filter.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/macie/latest/APIReference/findingsfilters.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toCreateFindingsFilter", []))

    @jsii.member(jsii_name="toCreateInvitations")
    def to_create_invitations(self) -> "Macie2":
        '''(experimental) Grants permission to send an Amazon Macie membership invitation.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/invitations.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toCreateInvitations", []))

    @jsii.member(jsii_name="toCreateMember")
    def to_create_member(self) -> "Macie2":
        '''(experimental) Grants permission to associate an account with an Amazon Macie administrator account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/macie/latest/APIReference/members.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toCreateMember", []))

    @jsii.member(jsii_name="toCreateSampleFindings")
    def to_create_sample_findings(self) -> "Macie2":
        '''(experimental) Grants permission to create sample findings.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/findings-sample.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toCreateSampleFindings", []))

    @jsii.member(jsii_name="toDeclineInvitations")
    def to_decline_invitations(self) -> "Macie2":
        '''(experimental) Grants permission to decline Amazon Macie membership invitations.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/invitations-decline.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDeclineInvitations", []))

    @jsii.member(jsii_name="toDeleteAllowList")
    def to_delete_allow_list(self) -> "Macie2":
        '''(experimental) Grants permission to delete an allow list.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/allow-lists-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDeleteAllowList", []))

    @jsii.member(jsii_name="toDeleteCustomDataIdentifier")
    def to_delete_custom_data_identifier(self) -> "Macie2":
        '''(experimental) Grants permission to delete a custom data identifier.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/custom-data-identifiers-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDeleteCustomDataIdentifier", []))

    @jsii.member(jsii_name="toDeleteFindingsFilter")
    def to_delete_findings_filter(self) -> "Macie2":
        '''(experimental) Grants permission to delete a findings filter.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/findingsfilters-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDeleteFindingsFilter", []))

    @jsii.member(jsii_name="toDeleteInvitations")
    def to_delete_invitations(self) -> "Macie2":
        '''(experimental) Grants permission to delete Amazon Macie membership invitations.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/invitations-delete.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDeleteInvitations", []))

    @jsii.member(jsii_name="toDeleteMember")
    def to_delete_member(self) -> "Macie2":
        '''(experimental) Grants permission to delete the association between an Amazon Macie administrator account and an account.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/members-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDeleteMember", []))

    @jsii.member(jsii_name="toDescribeBuckets")
    def to_describe_buckets(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve statistical data and other information about S3 buckets that Amazon Macie monitors and analyzes.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/datasources-s3.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDescribeBuckets", []))

    @jsii.member(jsii_name="toDescribeClassificationJob")
    def to_describe_classification_job(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about the status and settings for a sensitive data discovery job.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/jobs-jobid.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDescribeClassificationJob", []))

    @jsii.member(jsii_name="toDescribeOrganizationConfiguration")
    def to_describe_organization_configuration(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about the Amazon Macie configuration settings for an AWS organization.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/admin-configuration.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDescribeOrganizationConfiguration", []))

    @jsii.member(jsii_name="toDisableMacie")
    def to_disable_macie(self) -> "Macie2":
        '''(experimental) Grants permission to disable an Amazon Macie account, which also deletes Macie resources for the account.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/macie.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDisableMacie", []))

    @jsii.member(jsii_name="toDisableOrganizationAdminAccount")
    def to_disable_organization_admin_account(self) -> "Macie2":
        '''(experimental) Grants permission to disable an account as the delegated Amazon Macie administrator account for an AWS organization.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/admin.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDisableOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toDisassociateFromAdministratorAccount")
    def to_disassociate_from_administrator_account(self) -> "Macie2":
        '''(experimental) Grants permission to an Amazon Macie member account to disassociate from its Macie administrator account.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/administrator-disassociate.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDisassociateFromAdministratorAccount", []))

    @jsii.member(jsii_name="toDisassociateFromMasterAccount")
    def to_disassociate_from_master_account(self) -> "Macie2":
        '''(experimental) Grants permission to an Amazon Macie member account to disassociate from its Macie administrator account.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/master-disassociate.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDisassociateFromMasterAccount", []))

    @jsii.member(jsii_name="toDisassociateMember")
    def to_disassociate_member(self) -> "Macie2":
        '''(experimental) Grants permission to an Amazon Macie administrator account to disassociate from a Macie member account.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/members-disassociate-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toDisassociateMember", []))

    @jsii.member(jsii_name="toEnableMacie")
    def to_enable_macie(self) -> "Macie2":
        '''(experimental) Grants permission to enable and specify the configuration settings for a new Amazon Macie account.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/macie.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toEnableMacie", []))

    @jsii.member(jsii_name="toEnableOrganizationAdminAccount")
    def to_enable_organization_admin_account(self) -> "Macie2":
        '''(experimental) Grants permission to enable an account as the delegated Amazon Macie administrator account for an AWS organization.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/admin.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toEnableOrganizationAdminAccount", []))

    @jsii.member(jsii_name="toGetAdministratorAccount")
    def to_get_administrator_account(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about the Amazon Macie administrator account for an account.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/administrator.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetAdministratorAccount", []))

    @jsii.member(jsii_name="toGetAllowList")
    def to_get_allow_list(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve the settings and status of an allow list.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/allow-lists-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetAllowList", []))

    @jsii.member(jsii_name="toGetAutomatedDiscoveryConfiguration")
    def to_get_automated_discovery_configuration(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve the configuration settings and status of automated sensitive data discovery for an account.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/automated-discovery-configuration.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetAutomatedDiscoveryConfiguration", []))

    @jsii.member(jsii_name="toGetBucketStatistics")
    def to_get_bucket_statistics(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve aggregated statistical data for all the S3 buckets that Amazon Macie monitors and analyzes.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/datasources-s3-statistics.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetBucketStatistics", []))

    @jsii.member(jsii_name="toGetClassificationExportConfiguration")
    def to_get_classification_export_configuration(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve the settings for exporting sensitive data discovery results.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/classification-export-configuration.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetClassificationExportConfiguration", []))

    @jsii.member(jsii_name="toGetClassificationScope")
    def to_get_classification_scope(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve the classification scope settings for an account.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/classification-scopes-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetClassificationScope", []))

    @jsii.member(jsii_name="toGetCustomDataIdentifier")
    def to_get_custom_data_identifier(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about the settings for a custom data identifier.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/custom-data-identifiers-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetCustomDataIdentifier", []))

    @jsii.member(jsii_name="toGetFindings")
    def to_get_findings(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve the details of one or more findings.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/findings-describe.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetFindings", []))

    @jsii.member(jsii_name="toGetFindingsFilter")
    def to_get_findings_filter(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about the settings for a findings filter.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/findingsfilters-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetFindingsFilter", []))

    @jsii.member(jsii_name="toGetFindingsPublicationConfiguration")
    def to_get_findings_publication_configuration(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve the configuration settings for publishing findings to AWS Security Hub.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/findings-publication-configuration.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetFindingsPublicationConfiguration", []))

    @jsii.member(jsii_name="toGetFindingStatistics")
    def to_get_finding_statistics(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve aggregated statistical data about findings.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/findings-statistics.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetFindingStatistics", []))

    @jsii.member(jsii_name="toGetInvitationsCount")
    def to_get_invitations_count(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve the count of Amazon Macie membership invitations that were received by an account.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/invitations-count.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetInvitationsCount", []))

    @jsii.member(jsii_name="toGetMacieSession")
    def to_get_macie_session(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about the status and configuration settings for an Amazon Macie account.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/macie.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetMacieSession", []))

    @jsii.member(jsii_name="toGetMasterAccount")
    def to_get_master_account(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about the Amazon Macie administrator account for an account.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/master.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetMasterAccount", []))

    @jsii.member(jsii_name="toGetMember")
    def to_get_member(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about an account that's associated with an Amazon Macie administrator account.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/members-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetMember", []))

    @jsii.member(jsii_name="toGetResourceProfile")
    def to_get_resource_profile(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve sensitive data discovery statistics and the sensitivity score for an S3 bucket.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/resource-profiles.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetResourceProfile", []))

    @jsii.member(jsii_name="toGetRevealConfiguration")
    def to_get_reveal_configuration(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve the status and configuration settings for retrieving occurrences of sensitive data reported by findings.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/reveal-configuration.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetRevealConfiguration", []))

    @jsii.member(jsii_name="toGetSensitiveDataOccurrences")
    def to_get_sensitive_data_occurrences(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve occurrences of sensitive data reported by a finding.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/findings-findingid-reveal.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetSensitiveDataOccurrences", []))

    @jsii.member(jsii_name="toGetSensitiveDataOccurrencesAvailability")
    def to_get_sensitive_data_occurrences_availability(self) -> "Macie2":
        '''(experimental) Grants permission to check whether occurrences of sensitive data can be retrieved for a finding.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/findings-findingid-reveal-availability.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetSensitiveDataOccurrencesAvailability", []))

    @jsii.member(jsii_name="toGetSensitivityInspectionTemplate")
    def to_get_sensitivity_inspection_template(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve the sensitivity inspection template settings for an account.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/templates-sensitivity-inspections-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetSensitivityInspectionTemplate", []))

    @jsii.member(jsii_name="toGetUsageStatistics")
    def to_get_usage_statistics(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve quotas and aggregated usage data for one or more accounts.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/usage-statistics.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetUsageStatistics", []))

    @jsii.member(jsii_name="toGetUsageTotals")
    def to_get_usage_totals(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve aggregated usage data for an account.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/usage.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toGetUsageTotals", []))

    @jsii.member(jsii_name="toListAllowLists")
    def to_list_allow_lists(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve a subset of information about all the allow lists for an account.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/allow-lists.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListAllowLists", []))

    @jsii.member(jsii_name="toListClassificationJobs")
    def to_list_classification_jobs(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve a subset of information about the status and settings for one or more sensitive data discovery jobs.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/jobs-list.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListClassificationJobs", []))

    @jsii.member(jsii_name="toListClassificationScopes")
    def to_list_classification_scopes(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve a subset of information about the classification scope for an account.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/classification-scopes.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListClassificationScopes", []))

    @jsii.member(jsii_name="toListCustomDataIdentifiers")
    def to_list_custom_data_identifiers(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about all custom data identifiers.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/custom-data-identifiers-list.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListCustomDataIdentifiers", []))

    @jsii.member(jsii_name="toListFindings")
    def to_list_findings(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve a subset of information about one or more findings.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/findings.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListFindings", []))

    @jsii.member(jsii_name="toListFindingsFilters")
    def to_list_findings_filters(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about all findings filters.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/findingsfilters.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListFindingsFilters", []))

    @jsii.member(jsii_name="toListInvitations")
    def to_list_invitations(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about all the Amazon Macie membership invitations that were received by an account.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/invitations.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListInvitations", []))

    @jsii.member(jsii_name="toListManagedDataIdentifiers")
    def to_list_managed_data_identifiers(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about managed data identifiers.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/managed-data-identifiers-list.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListManagedDataIdentifiers", []))

    @jsii.member(jsii_name="toListMembers")
    def to_list_members(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about the Amazon Macie member accounts that are associated with a Macie administrator account.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/members.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListMembers", []))

    @jsii.member(jsii_name="toListOrganizationAdminAccounts")
    def to_list_organization_admin_accounts(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about the delegated, Amazon Macie administrator account for an AWS organization.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/admin.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListOrganizationAdminAccounts", []))

    @jsii.member(jsii_name="toListResourceProfileArtifacts")
    def to_list_resource_profile_artifacts(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about objects that were selected from an S3 bucket for automated sensitive data discovery.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/resource-profiles-artifacts.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListResourceProfileArtifacts", []))

    @jsii.member(jsii_name="toListResourceProfileDetections")
    def to_list_resource_profile_detections(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve information about the types and amount of sensitive data that Amazon Macie found in an S3 bucket.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/resource-profiles-detections.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListResourceProfileDetections", []))

    @jsii.member(jsii_name="toListSensitivityInspectionTemplates")
    def to_list_sensitivity_inspection_templates(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve a subset of information about the sensitivity inspection template for an account.

        Access Level: List

        https://docs.aws.amazon.com/macie/latest/APIReference/templates-sensitivity-inspections.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListSensitivityInspectionTemplates", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve the tags for an Amazon Macie resource.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/tags-resourcearn.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutClassificationExportConfiguration")
    def to_put_classification_export_configuration(self) -> "Macie2":
        '''(experimental) Grants permission to create or update the settings for storing sensitive data discovery results.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/classification-export-configuration.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toPutClassificationExportConfiguration", []))

    @jsii.member(jsii_name="toPutFindingsPublicationConfiguration")
    def to_put_findings_publication_configuration(self) -> "Macie2":
        '''(experimental) Grants permission to update the configuration settings for publishing findings to AWS Security Hub.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/findings-publication-configuration.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toPutFindingsPublicationConfiguration", []))

    @jsii.member(jsii_name="toSearchResources")
    def to_search_resources(self) -> "Macie2":
        '''(experimental) Grants permission to retrieve statistical data and other information about AWS resources that Amazon Macie monitors and analyzes.

        Access Level: Read

        https://docs.aws.amazon.com/macie/latest/APIReference/datasources-search-resources.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toSearchResources", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Macie2":
        '''(experimental) Grants permission to add or update the tags for an Amazon Macie resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/macie/latest/APIReference/tags-resourcearn.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTestCustomDataIdentifier")
    def to_test_custom_data_identifier(self) -> "Macie2":
        '''(experimental) Grants permission to test a custom data identifier.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/custom-data-identifiers-test.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toTestCustomDataIdentifier", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Macie2":
        '''(experimental) Grants permission to remove tags from an Amazon Macie resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/macie/latest/APIReference/tags-resourcearn.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAllowList")
    def to_update_allow_list(self) -> "Macie2":
        '''(experimental) Grants permission to update the settings for an allow list.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/allow-lists-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toUpdateAllowList", []))

    @jsii.member(jsii_name="toUpdateAutomatedDiscoveryConfiguration")
    def to_update_automated_discovery_configuration(self) -> "Macie2":
        '''(experimental) Grants permission to enable or disable automated sensitive data discovery for an account.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/automated-discovery-configuration.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toUpdateAutomatedDiscoveryConfiguration", []))

    @jsii.member(jsii_name="toUpdateClassificationJob")
    def to_update_classification_job(self) -> "Macie2":
        '''(experimental) Grants permission to change the status of a sensitive data discovery job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/macie/latest/APIReference/jobs-jobid.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toUpdateClassificationJob", []))

    @jsii.member(jsii_name="toUpdateClassificationScope")
    def to_update_classification_scope(self) -> "Macie2":
        '''(experimental) Grants permission to update the classification scope settings for an account.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/classification-scopes-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toUpdateClassificationScope", []))

    @jsii.member(jsii_name="toUpdateFindingsFilter")
    def to_update_findings_filter(self) -> "Macie2":
        '''(experimental) Grants permission to update the settings for a findings filter.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/macie/latest/APIReference/findingsfilters-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toUpdateFindingsFilter", []))

    @jsii.member(jsii_name="toUpdateMacieSession")
    def to_update_macie_session(self) -> "Macie2":
        '''(experimental) Grants permission to suspend or re-enable an Amazon Macie account, or update the configuration settings for a Macie account.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/macie.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toUpdateMacieSession", []))

    @jsii.member(jsii_name="toUpdateMemberSession")
    def to_update_member_session(self) -> "Macie2":
        '''(experimental) Grants permission to an Amazon Macie administrator account to suspend or re-enable a Macie member account.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/macie-members-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toUpdateMemberSession", []))

    @jsii.member(jsii_name="toUpdateOrganizationConfiguration")
    def to_update_organization_configuration(self) -> "Macie2":
        '''(experimental) Grants permission to update Amazon Macie configuration settings for an AWS organization.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/admin-configuration.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toUpdateOrganizationConfiguration", []))

    @jsii.member(jsii_name="toUpdateResourceProfile")
    def to_update_resource_profile(self) -> "Macie2":
        '''(experimental) Grants permission to update the sensitivity score for an S3 bucket.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/resource-profiles.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toUpdateResourceProfile", []))

    @jsii.member(jsii_name="toUpdateResourceProfileDetections")
    def to_update_resource_profile_detections(self) -> "Macie2":
        '''(experimental) Grants permission to update the sensitivity scoring settings for an S3 bucket.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/resource-profiles-detections.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toUpdateResourceProfileDetections", []))

    @jsii.member(jsii_name="toUpdateRevealConfiguration")
    def to_update_reveal_configuration(self) -> "Macie2":
        '''(experimental) Grants permission to update the status and configuration settings for retrieving occurrences of sensitive data reported by findings.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/reveal-configuration.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toUpdateRevealConfiguration", []))

    @jsii.member(jsii_name="toUpdateSensitivityInspectionTemplate")
    def to_update_sensitivity_inspection_template(self) -> "Macie2":
        '''(experimental) Grants permission to update the sensitivity inspection template settings for an account.

        Access Level: Write

        https://docs.aws.amazon.com/macie/latest/APIReference/templates-sensitivity-inspections-id.html

        :stability: experimental
        '''
        return typing.cast("Macie2", jsii.invoke(self, "toUpdateSensitivityInspectionTemplate", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__020d88f772c512a2132dcccc74a181063eb56b70cd403eca61dae6788a472c6f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cb624db236a1e50f90c8f1fada977a3c9344eca5b416f3d2ef7faf501c81e80a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Managedblockchain(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Managedblockchain",
):
    '''(experimental) Statement provider for service `managedblockchain <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedblockchain.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `managedblockchain <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmanagedblockchain.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8635627d2f51d0088bcfd2f394b4afebe2756a264cea4f76fb125673059e9d71)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAccessor")
    def on_accessor(
        self,
        accessor_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Managedblockchain":
        '''(experimental) Adds a resource of type accessor to the statement.

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_Accessor.html

        :param accessor_id: - Identifier for the accessorId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d7be59c9211d788142b507dca6fa480b687f354f9769c3705b1a9359c103f72a)
            check_type(argname="argument accessor_id", value=accessor_id, expected_type=type_hints["accessor_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Managedblockchain", jsii.invoke(self, "onAccessor", [accessor_id, account, region, partition]))

    @jsii.member(jsii_name="onInvitation")
    def on_invitation(
        self,
        invitation_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Managedblockchain":
        '''(experimental) Adds a resource of type invitation to the statement.

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_Invitation.html

        :param invitation_id: - Identifier for the invitationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__30f4c211a5a5a96bd9504566c4c7302fcf0e7e53bce0513c63467967c4e35990)
            check_type(argname="argument invitation_id", value=invitation_id, expected_type=type_hints["invitation_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Managedblockchain", jsii.invoke(self, "onInvitation", [invitation_id, account, region, partition]))

    @jsii.member(jsii_name="onMember")
    def on_member(
        self,
        member_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Managedblockchain":
        '''(experimental) Adds a resource of type member to the statement.

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_Member.html

        :param member_id: - Identifier for the memberId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d8d3282ce8bc36b8e94a6523976f531749f1930c50db836a6c0718c78ef268b2)
            check_type(argname="argument member_id", value=member_id, expected_type=type_hints["member_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Managedblockchain", jsii.invoke(self, "onMember", [member_id, account, region, partition]))

    @jsii.member(jsii_name="onNetwork")
    def on_network(
        self,
        network_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Managedblockchain":
        '''(experimental) Adds a resource of type network to the statement.

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_Network.html

        :param network_id: - Identifier for the networkId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__226aace4eb179384d759941cee29f9ecaa616d63d7081c89734b6a7e0a803882)
            check_type(argname="argument network_id", value=network_id, expected_type=type_hints["network_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Managedblockchain", jsii.invoke(self, "onNetwork", [network_id, region, partition]))

    @jsii.member(jsii_name="onNode")
    def on_node(
        self,
        node_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Managedblockchain":
        '''(experimental) Adds a resource of type node to the statement.

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_Node.html

        :param node_id: - Identifier for the nodeId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__afe8f7bf7926bbbba4d6c10086aaac6e55dc8a34bba7c1a7e1b4d49766ad10ee)
            check_type(argname="argument node_id", value=node_id, expected_type=type_hints["node_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Managedblockchain", jsii.invoke(self, "onNode", [node_id, account, region, partition]))

    @jsii.member(jsii_name="onProposal")
    def on_proposal(
        self,
        proposal_id: builtins.str,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Managedblockchain":
        '''(experimental) Adds a resource of type proposal to the statement.

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_Proposal.html

        :param proposal_id: - Identifier for the proposalId.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9832d53798bffa93e81673b409ce8ccb8c75a91d7ade9191f59e567f6f787fb6)
            check_type(argname="argument proposal_id", value=proposal_id, expected_type=type_hints["proposal_id"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Managedblockchain", jsii.invoke(self, "onProposal", [proposal_id, region, partition]))

    @jsii.member(jsii_name="toCreateAccessor")
    def to_create_accessor(self) -> "Managedblockchain":
        '''(experimental) Grants permission to create an Amazon Managed Blockchain accessor.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_CreateAccessor.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toCreateAccessor", []))

    @jsii.member(jsii_name="toCreateMember")
    def to_create_member(self) -> "Managedblockchain":
        '''(experimental) Grants permission to create a member of an Amazon Managed Blockchain network.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_CreateMember.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toCreateMember", []))

    @jsii.member(jsii_name="toCreateNetwork")
    def to_create_network(self) -> "Managedblockchain":
        '''(experimental) Grants permission to create an Amazon Managed Blockchain network.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_CreateNetwork.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toCreateNetwork", []))

    @jsii.member(jsii_name="toCreateNode")
    def to_create_node(self) -> "Managedblockchain":
        '''(experimental) Grants permission to create a node within a member of an Amazon Managed Blockchain network.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_CreateNode.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toCreateNode", []))

    @jsii.member(jsii_name="toCreateProposal")
    def to_create_proposal(self) -> "Managedblockchain":
        '''(experimental) Grants permission to create a proposal that other blockchain network members can vote on to add or remove a member in an Amazon Managed Blockchain network.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_CreateProposal.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toCreateProposal", []))

    @jsii.member(jsii_name="toDeleteAccessor")
    def to_delete_accessor(self) -> "Managedblockchain":
        '''(experimental) Grants permission to delete an Amazon Managed Blockchain accessor.

        Access Level: Write

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_DeleteAccessor.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toDeleteAccessor", []))

    @jsii.member(jsii_name="toDeleteMember")
    def to_delete_member(self) -> "Managedblockchain":
        '''(experimental) Grants permission to delete a member and all associated resources from an Amazon Managed Blockchain network.

        Access Level: Write

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_DeleteMember.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toDeleteMember", []))

    @jsii.member(jsii_name="toDeleteNode")
    def to_delete_node(self) -> "Managedblockchain":
        '''(experimental) Grants permission to delete a node from a member of an Amazon Managed Blockchain network.

        Access Level: Write

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_DeleteNode.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toDeleteNode", []))

    @jsii.member(jsii_name="toGET")
    def to_get(self) -> "Managedblockchain":
        '''(experimental) Grants permission to send HTTP GET requests to an Ethereum node.

        Access Level: Permissions management

        https://docs.aws.amazon.com/managed-blockchain/latest/ethereum-dev/security_iam_id-based-policy-examples.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toGET", []))

    @jsii.member(jsii_name="toGetAccessor")
    def to_get_accessor(self) -> "Managedblockchain":
        '''(experimental) Grants permission to return detailed information about an Amazon Managed Blockchain accessor.

        Access Level: Read

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_GetAccessor.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toGetAccessor", []))

    @jsii.member(jsii_name="toGetMember")
    def to_get_member(self) -> "Managedblockchain":
        '''(experimental) Grants permission to return detailed information about a member of an Amazon Managed Blockchain network.

        Access Level: Read

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_GetMember.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toGetMember", []))

    @jsii.member(jsii_name="toGetNetwork")
    def to_get_network(self) -> "Managedblockchain":
        '''(experimental) Grants permission to return detailed information about an Amazon Managed Blockchain network.

        Access Level: Read

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_GetNetwork.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toGetNetwork", []))

    @jsii.member(jsii_name="toGetNode")
    def to_get_node(self) -> "Managedblockchain":
        '''(experimental) Grants permission to return detailed information about a node within a member of an Amazon Managed Blockchain network.

        Access Level: Read

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_GetNode.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toGetNode", []))

    @jsii.member(jsii_name="toGetProposal")
    def to_get_proposal(self) -> "Managedblockchain":
        '''(experimental) Grants permission to return detailed information about a proposal of an Amazon Managed Blockchain network.

        Access Level: Read

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_GetProposal.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toGetProposal", []))

    @jsii.member(jsii_name="toInvoke")
    def to_invoke(self) -> "Managedblockchain":
        '''(experimental) Grants permission to create WebSocket connections to an Ethereum node.

        Access Level: Permissions management

        https://docs.aws.amazon.com/managed-blockchain/latest/ethereum-dev/security_iam_id-based-policy-examples.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toInvoke", []))

    @jsii.member(jsii_name="toListAccessors")
    def to_list_accessors(self) -> "Managedblockchain":
        '''(experimental) Grants permission to list the Amazon Managed Blockchain accessors owned by the current AWS account.

        Access Level: List

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_ListAccessors.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toListAccessors", []))

    @jsii.member(jsii_name="toListInvitations")
    def to_list_invitations(self) -> "Managedblockchain":
        '''(experimental) Grants permission to list the invitations extended to the active AWS account from any Managed Blockchain network.

        Access Level: List

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_ListInvitations.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toListInvitations", []))

    @jsii.member(jsii_name="toListMembers")
    def to_list_members(self) -> "Managedblockchain":
        '''(experimental) Grants permission to list the members of an Amazon Managed Blockchain network and the properties of their memberships.

        Access Level: List

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_ListMembers.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toListMembers", []))

    @jsii.member(jsii_name="toListNetworks")
    def to_list_networks(self) -> "Managedblockchain":
        '''(experimental) Grants permission to list the Amazon Managed Blockchain networks in which the current AWS account participates.

        Access Level: List

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_ListNetworks.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toListNetworks", []))

    @jsii.member(jsii_name="toListNodes")
    def to_list_nodes(self) -> "Managedblockchain":
        '''(experimental) Grants permission to list the nodes within a member of an Amazon Managed Blockchain network.

        Access Level: List

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_ListNodes.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toListNodes", []))

    @jsii.member(jsii_name="toListProposals")
    def to_list_proposals(self) -> "Managedblockchain":
        '''(experimental) Grants permission to list proposals for the given Amazon Managed Blockchain network.

        Access Level: List

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_ListProposals.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toListProposals", []))

    @jsii.member(jsii_name="toListProposalVotes")
    def to_list_proposal_votes(self) -> "Managedblockchain":
        '''(experimental) Grants permission to list all votes for a proposal, including the value of the vote and the unique identifier of the member that cast the vote for the given Amazon Managed Blockchain network.

        Access Level: Read

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_ListProposalVotes.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toListProposalVotes", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Managedblockchain":
        '''(experimental) Grants permission to view tags associated with an Amazon Managed Blockchain resource.

        Access Level: Read

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPOST")
    def to_post(self) -> "Managedblockchain":
        '''(experimental) Grants permission to send HTTP POST requests to an Ethereum node.

        Access Level: Permissions management

        https://docs.aws.amazon.com/managed-blockchain/latest/ethereum-dev/security_iam_id-based-policy-examples.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toPOST", []))

    @jsii.member(jsii_name="toRejectInvitation")
    def to_reject_invitation(self) -> "Managedblockchain":
        '''(experimental) Grants permission to reject the invitation to join the blockchain network.

        Access Level: Write

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_RejectInvitation.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toRejectInvitation", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Managedblockchain":
        '''(experimental) Grants permission to add tags to an Amazon Managed Blockchain resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Managedblockchain":
        '''(experimental) Grants permission to remove tags from an Amazon Managed Blockchain resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateMember")
    def to_update_member(self) -> "Managedblockchain":
        '''(experimental) Grants permission to update a member of an Amazon Managed Blockchain network.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_UpdateMember.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toUpdateMember", []))

    @jsii.member(jsii_name="toUpdateNode")
    def to_update_node(self) -> "Managedblockchain":
        '''(experimental) Grants permission to update a node from a member of an Amazon Managed Blockchain network.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_UpdateNode.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toUpdateNode", []))

    @jsii.member(jsii_name="toVoteOnProposal")
    def to_vote_on_proposal(self) -> "Managedblockchain":
        '''(experimental) Grants permission to cast a vote for a proposal on behalf of the blockchain network member specified.

        Access Level: Write

        https://docs.aws.amazon.com/managed-blockchain/latest/APIReference/API_VoteOnProposal.html

        :stability: experimental
        '''
        return typing.cast("Managedblockchain", jsii.invoke(self, "toVoteOnProposal", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__188e29cd1e3a78424f5e0dc77843405003b867209be476eec343a505f32f0bf4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fd9d8a2ff88bd71cb985aec822b26635f8eda65636edd4e85ba66ccde07ef73e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Marketplacecommerceanalytics(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Marketplacecommerceanalytics",
):
    '''(experimental) Statement provider for service `marketplacecommerceanalytics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacecommerceanalyticsservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `marketplacecommerceanalytics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmarketplacecommerceanalyticsservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c81b28f6b7c59c3ba213d34fe632063cb873e6c996084656c08ed8580712205f)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toGenerateDataSet")
    def to_generate_data_set(self) -> "Marketplacecommerceanalytics":
        '''(experimental) Request a data set to be published to your Amazon S3 bucket.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Marketplacecommerceanalytics", jsii.invoke(self, "toGenerateDataSet", []))

    @jsii.member(jsii_name="toStartSupportDataExport")
    def to_start_support_data_export(self) -> "Marketplacecommerceanalytics":
        '''(experimental) Request a support data set to be published to your Amazon S3 bucket.

        Access Level: Write

        :stability: experimental
        '''
        return typing.cast("Marketplacecommerceanalytics", jsii.invoke(self, "toStartSupportDataExport", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5d58abc32342f16471e8e4239ed5c1ecfc6e67adec17d20dd907e97cd08158e8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2f8887ea2722d90d9ea975fc4cdd9457242608338cb60c0e6001859dd899a441)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Mechanicalturk(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Mechanicalturk",
):
    '''(experimental) Statement provider for service `mechanicalturk <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmechanicalturk.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mechanicalturk <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmechanicalturk.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3a26341c5fd04b1be92c59c7461f23fe3ad308ed615d3b9b9841795393b4f139)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toAcceptQualificationRequest")
    def to_accept_qualification_request(self) -> "Mechanicalturk":
        '''(experimental) The AcceptQualificationRequest operation grants a Worker's request for a Qualification.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_AcceptQualificationRequestOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toAcceptQualificationRequest", []))

    @jsii.member(jsii_name="toApproveAssignment")
    def to_approve_assignment(self) -> "Mechanicalturk":
        '''(experimental) The ApproveAssignment operation approves the results of a completed assignment.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ApproveAssignmentOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toApproveAssignment", []))

    @jsii.member(jsii_name="toAssociateQualificationWithWorker")
    def to_associate_qualification_with_worker(self) -> "Mechanicalturk":
        '''(experimental) The AssociateQualificationWithWorker operation gives a Worker a Qualification.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_AssociateQualificationWithWorkerOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toAssociateQualificationWithWorker", []))

    @jsii.member(jsii_name="toCreateAdditionalAssignmentsForHIT")
    def to_create_additional_assignments_for_hit(self) -> "Mechanicalturk":
        '''(experimental) The CreateAdditionalAssignmentsForHIT operation increases the maximum number of assignments of an existing HIT.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_CreateAdditionalAssignmentsForHITOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toCreateAdditionalAssignmentsForHIT", []))

    @jsii.member(jsii_name="toCreateHIT")
    def to_create_hit(self) -> "Mechanicalturk":
        '''(experimental) The CreateHIT operation creates a new HIT (Human Intelligence Task).

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_CreateHITOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toCreateHIT", []))

    @jsii.member(jsii_name="toCreateHITType")
    def to_create_hit_type(self) -> "Mechanicalturk":
        '''(experimental) The CreateHITType operation creates a new HIT type.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_CreateHITTypeOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toCreateHITType", []))

    @jsii.member(jsii_name="toCreateHITWithHITType")
    def to_create_hit_with_hit_type(self) -> "Mechanicalturk":
        '''(experimental) The CreateHITWithHITType operation creates a new Human Intelligence Task (HIT) using an existing HITTypeID generated by the CreateHITType operation.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_CreateHITWithHITTypeOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toCreateHITWithHITType", []))

    @jsii.member(jsii_name="toCreateQualificationType")
    def to_create_qualification_type(self) -> "Mechanicalturk":
        '''(experimental) The CreateQualificationType operation creates a new Qualification type, which is represented by a QualificationType data structure.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_CreateQualificationTypeOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toCreateQualificationType", []))

    @jsii.member(jsii_name="toCreateWorkerBlock")
    def to_create_worker_block(self) -> "Mechanicalturk":
        '''(experimental) The CreateWorkerBlock operation allows you to prevent a Worker from working on your HITs.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_CreateWorkerBlockOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toCreateWorkerBlock", []))

    @jsii.member(jsii_name="toDeleteHIT")
    def to_delete_hit(self) -> "Mechanicalturk":
        '''(experimental) The DeleteHIT operation disposes of a HIT that is no longer needed.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_DeleteHITOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toDeleteHIT", []))

    @jsii.member(jsii_name="toDeleteQualificationType")
    def to_delete_qualification_type(self) -> "Mechanicalturk":
        '''(experimental) The DeleteQualificationType disposes a Qualification type and disposes any HIT types that are associated with the Qualification type.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_DeleteQualificationTypeOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toDeleteQualificationType", []))

    @jsii.member(jsii_name="toDeleteWorkerBlock")
    def to_delete_worker_block(self) -> "Mechanicalturk":
        '''(experimental) The DeleteWorkerBlock operation allows you to reinstate a blocked Worker to work on your HITs.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_DeleteWorkerBlockOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toDeleteWorkerBlock", []))

    @jsii.member(jsii_name="toDisassociateQualificationFromWorker")
    def to_disassociate_qualification_from_worker(self) -> "Mechanicalturk":
        '''(experimental) The DisassociateQualificationFromWorker revokes a previously granted Qualification from a user.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_DisassociateQualificationFromWorkerOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toDisassociateQualificationFromWorker", []))

    @jsii.member(jsii_name="toGetAccountBalance")
    def to_get_account_balance(self) -> "Mechanicalturk":
        '''(experimental) The GetAccountBalance operation retrieves the amount of money in your Amazon Mechanical Turk account.

        Access Level: Read

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_GetAccountBalanceOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toGetAccountBalance", []))

    @jsii.member(jsii_name="toGetAssignment")
    def to_get_assignment(self) -> "Mechanicalturk":
        '''(experimental) The GetAssignment retrieves an assignment with an AssignmentStatus value of Submitted, Approved, or Rejected, using the assignment's ID.

        Access Level: Read

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_GetAssignmentOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toGetAssignment", []))

    @jsii.member(jsii_name="toGetFileUploadURL")
    def to_get_file_upload_url(self) -> "Mechanicalturk":
        '''(experimental) The GetFileUploadURL operation generates and returns a temporary URL.

        Access Level: Read

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_GetFileUploadURLOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toGetFileUploadURL", []))

    @jsii.member(jsii_name="toGetHIT")
    def to_get_hit(self) -> "Mechanicalturk":
        '''(experimental) The GetHIT operation retrieves the details of the specified HIT.

        Access Level: Read

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_GetHITOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toGetHIT", []))

    @jsii.member(jsii_name="toGetQualificationScore")
    def to_get_qualification_score(self) -> "Mechanicalturk":
        '''(experimental) The GetQualificationScore operation returns the value of a Worker's Qualification for a given Qualification type.

        Access Level: Read

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_GetQualificationScoreOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toGetQualificationScore", []))

    @jsii.member(jsii_name="toGetQualificationType")
    def to_get_qualification_type(self) -> "Mechanicalturk":
        '''(experimental) The GetQualificationType operation retrieves information about a Qualification type using its ID.

        Access Level: Read

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_GetQualificationTypeOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toGetQualificationType", []))

    @jsii.member(jsii_name="toListAssignmentsForHIT")
    def to_list_assignments_for_hit(self) -> "Mechanicalturk":
        '''(experimental) The ListAssignmentsForHIT operation retrieves completed assignments for a HIT.

        Access Level: List

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ListAssignmentsForHITOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toListAssignmentsForHIT", []))

    @jsii.member(jsii_name="toListBonusPayments")
    def to_list_bonus_payments(self) -> "Mechanicalturk":
        '''(experimental) The ListBonusPayments operation retrieves the amounts of bonuses you have paid to Workers for a given HIT or assignment.

        Access Level: List

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ListBonusPaymentsOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toListBonusPayments", []))

    @jsii.member(jsii_name="toListHITs")
    def to_list_hi_ts(self) -> "Mechanicalturk":
        '''(experimental) The ListHITs operation returns all of a Requester's HITs.

        Access Level: List

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ListHITsOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toListHITs", []))

    @jsii.member(jsii_name="toListHITsForQualificationType")
    def to_list_hi_ts_for_qualification_type(self) -> "Mechanicalturk":
        '''(experimental) The ListHITsForQualificationType operation returns the HITs that use the given QualififcationType for a QualificationRequirement.

        Access Level: List

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ListHITsForQualificationTypeOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toListHITsForQualificationType", []))

    @jsii.member(jsii_name="toListQualificationRequests")
    def to_list_qualification_requests(self) -> "Mechanicalturk":
        '''(experimental) The ListQualificationRequests operation retrieves requests for Qualifications of a particular Qualification type.

        Access Level: List

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ListQualificationRequestsOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toListQualificationRequests", []))

    @jsii.member(jsii_name="toListQualificationTypes")
    def to_list_qualification_types(self) -> "Mechanicalturk":
        '''(experimental) The ListQualificationTypes operation searches for Qualification types using the specified search query, and returns a list of Qualification types.

        Access Level: List

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ListQualificationTypesOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toListQualificationTypes", []))

    @jsii.member(jsii_name="toListReviewableHITs")
    def to_list_reviewable_hi_ts(self) -> "Mechanicalturk":
        '''(experimental) The ListReviewableHITs operation returns all of a Requester's HITs that have not been approved or rejected.

        Access Level: List

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ListReviewableHITsOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toListReviewableHITs", []))

    @jsii.member(jsii_name="toListReviewPolicyResultsForHIT")
    def to_list_review_policy_results_for_hit(self) -> "Mechanicalturk":
        '''(experimental) The ListReviewPolicyResultsForHIT operation retrieves the computed results and the actions taken in the course of executing your Review Policies during a CreateHIT operation.

        Access Level: List

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ListReviewPolicyResultsForHITOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toListReviewPolicyResultsForHIT", []))

    @jsii.member(jsii_name="toListWorkerBlocks")
    def to_list_worker_blocks(self) -> "Mechanicalturk":
        '''(experimental) The ListWorkersBlocks operation retrieves a list of Workers who are blocked from working on your HITs.

        Access Level: List

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ListWorkerBlocksOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toListWorkerBlocks", []))

    @jsii.member(jsii_name="toListWorkersWithQualificationType")
    def to_list_workers_with_qualification_type(self) -> "Mechanicalturk":
        '''(experimental) The ListWorkersWithQualificationType operation returns all of the Workers with a given Qualification type.

        Access Level: List

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_ListWorkersWithQualificationTypeOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toListWorkersWithQualificationType", []))

    @jsii.member(jsii_name="toNotifyWorkers")
    def to_notify_workers(self) -> "Mechanicalturk":
        '''(experimental) The NotifyWorkers operation sends an email to one or more Workers that you specify with the Worker ID.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_NotifyWorkersOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toNotifyWorkers", []))

    @jsii.member(jsii_name="toRejectAssignment")
    def to_reject_assignment(self) -> "Mechanicalturk":
        '''(experimental) The RejectAssignment operation rejects the results of a completed assignment.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_RejectAssignmentOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toRejectAssignment", []))

    @jsii.member(jsii_name="toRejectQualificationRequest")
    def to_reject_qualification_request(self) -> "Mechanicalturk":
        '''(experimental) The RejectQualificationRequest operation rejects a user's request for a Qualification.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_RejectQualificationRequestOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toRejectQualificationRequest", []))

    @jsii.member(jsii_name="toSendBonus")
    def to_send_bonus(self) -> "Mechanicalturk":
        '''(experimental) The SendBonus operation issues a payment of money from your account to a Worker.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_SendBonusOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toSendBonus", []))

    @jsii.member(jsii_name="toSendTestEventNotification")
    def to_send_test_event_notification(self) -> "Mechanicalturk":
        '''(experimental) The SendTestEventNotification operation causes Amazon Mechanical Turk to send a notification message as if a HIT event occurred, according to the provided notification specification.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_SendTestEventNotificationOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toSendTestEventNotification", []))

    @jsii.member(jsii_name="toUpdateExpirationForHIT")
    def to_update_expiration_for_hit(self) -> "Mechanicalturk":
        '''(experimental) The UpdateExpirationForHIT operation allows you extend the expiration time of a HIT beyond is current expiration or expire a HIT immediately.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_UpdateExpirationForHITOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toUpdateExpirationForHIT", []))

    @jsii.member(jsii_name="toUpdateHITReviewStatus")
    def to_update_hit_review_status(self) -> "Mechanicalturk":
        '''(experimental) The UpdateHITReviewStatus operation toggles the status of a HIT.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_UpdateHITReviewStatusOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toUpdateHITReviewStatus", []))

    @jsii.member(jsii_name="toUpdateHITTypeOfHIT")
    def to_update_hit_type_of_hit(self) -> "Mechanicalturk":
        '''(experimental) The UpdateHITTypeOfHIT operation allows you to change the HITType properties of a HIT.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_UpdateHITTypeOfHITOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toUpdateHITTypeOfHIT", []))

    @jsii.member(jsii_name="toUpdateNotificationSettings")
    def to_update_notification_settings(self) -> "Mechanicalturk":
        '''(experimental) The UpdateNotificationSettings operation creates, updates, disables or re-enables notifications for a HIT type.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_UpdateNotificationSettingsOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toUpdateNotificationSettings", []))

    @jsii.member(jsii_name="toUpdateQualificationType")
    def to_update_qualification_type(self) -> "Mechanicalturk":
        '''(experimental) The UpdateQualificationType operation modifies the attributes of an existing Qualification type, which is represented by a QualificationType data structure.

        Access Level: Write

        https://docs.aws.amazon.com/AWSMechTurk/latest/AWSMturkAPI/ApiReference_UpdateQualificationTypeOperation.html

        :stability: experimental
        '''
        return typing.cast("Mechanicalturk", jsii.invoke(self, "toUpdateQualificationType", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a87fd26ee770b29b7cdfebdd63cf3d0f5007e5f4e7cb3c1deca32e3852a51bd2)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c0cba8153034884f8ec8f98a4b8c61d1b0ac9e06dc98f4d6a6d468d9a702030e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Mediaconnect(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Mediaconnect",
):
    '''(experimental) Statement provider for service `mediaconnect <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediaconnect.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mediaconnect <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediaconnect.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__56650be382a3a69ae2b709697a4f6e448b5f3e0c8021ff45cf63f2dd159135f6)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onEntitlement")
    def on_entitlement(
        self,
        flow_id: builtins.str,
        entitlement_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediaconnect":
        '''(experimental) Adds a resource of type Entitlement to the statement.

        https://docs.aws.amazon.com/mediaconnect/latest/ug/entitlements.html

        :param flow_id: - Identifier for the flowId.
        :param entitlement_name: - Identifier for the entitlementName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__834925e7145e16ef7b538583a3e908be25f4bb1fb1ec16dc92937f492b12fab1)
            check_type(argname="argument flow_id", value=flow_id, expected_type=type_hints["flow_id"])
            check_type(argname="argument entitlement_name", value=entitlement_name, expected_type=type_hints["entitlement_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediaconnect", jsii.invoke(self, "onEntitlement", [flow_id, entitlement_name, account, region, partition]))

    @jsii.member(jsii_name="onFlow")
    def on_flow(
        self,
        flow_id: builtins.str,
        flow_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediaconnect":
        '''(experimental) Adds a resource of type Flow to the statement.

        https://docs.aws.amazon.com/mediaconnect/latest/ug/flows.html

        :param flow_id: - Identifier for the flowId.
        :param flow_name: - Identifier for the flowName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bd30a51e2bf200238f5313994814455dd0f82900b0284ae4b8a6376a265855c7)
            check_type(argname="argument flow_id", value=flow_id, expected_type=type_hints["flow_id"])
            check_type(argname="argument flow_name", value=flow_name, expected_type=type_hints["flow_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediaconnect", jsii.invoke(self, "onFlow", [flow_id, flow_name, account, region, partition]))

    @jsii.member(jsii_name="onOutput")
    def on_output(
        self,
        output_id: builtins.str,
        output_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediaconnect":
        '''(experimental) Adds a resource of type Output to the statement.

        https://docs.aws.amazon.com/mediaconnect/latest/ug/outputs.html

        :param output_id: - Identifier for the outputId.
        :param output_name: - Identifier for the outputName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5829e77e346996b8685a58a05f8b77c43b560315a83497e55a89210bc76bb779)
            check_type(argname="argument output_id", value=output_id, expected_type=type_hints["output_id"])
            check_type(argname="argument output_name", value=output_name, expected_type=type_hints["output_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediaconnect", jsii.invoke(self, "onOutput", [output_id, output_name, account, region, partition]))

    @jsii.member(jsii_name="onSource")
    def on_source(
        self,
        source_id: builtins.str,
        source_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediaconnect":
        '''(experimental) Adds a resource of type Source to the statement.

        https://docs.aws.amazon.com/mediaconnect/latest/ug/sources.html

        :param source_id: - Identifier for the sourceId.
        :param source_name: - Identifier for the sourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4056fc2b152b883c2cd14505251fabbb009104b5483f09076458801ed315d9a2)
            check_type(argname="argument source_id", value=source_id, expected_type=type_hints["source_id"])
            check_type(argname="argument source_name", value=source_name, expected_type=type_hints["source_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediaconnect", jsii.invoke(self, "onSource", [source_id, source_name, account, region, partition]))

    @jsii.member(jsii_name="toAddFlowMediaStreams")
    def to_add_flow_media_streams(self) -> "Mediaconnect":
        '''(experimental) Grants permission to add media streams to any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-mediastreams.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toAddFlowMediaStreams", []))

    @jsii.member(jsii_name="toAddFlowOutputs")
    def to_add_flow_outputs(self) -> "Mediaconnect":
        '''(experimental) Grants permission to add outputs to any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-outputs.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toAddFlowOutputs", []))

    @jsii.member(jsii_name="toAddFlowSources")
    def to_add_flow_sources(self) -> "Mediaconnect":
        '''(experimental) Grants permission to add sources to any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-source.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toAddFlowSources", []))

    @jsii.member(jsii_name="toAddFlowVpcInterfaces")
    def to_add_flow_vpc_interfaces(self) -> "Mediaconnect":
        '''(experimental) Grants permission to add VPC interfaces to any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-vpcinterfaces.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toAddFlowVpcInterfaces", []))

    @jsii.member(jsii_name="toCreateFlow")
    def to_create_flow(self) -> "Mediaconnect":
        '''(experimental) Grants permission to create flows.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toCreateFlow", []))

    @jsii.member(jsii_name="toDeleteFlow")
    def to_delete_flow(self) -> "Mediaconnect":
        '''(experimental) Grants permission to delete flows.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toDeleteFlow", []))

    @jsii.member(jsii_name="toDescribeFlow")
    def to_describe_flow(self) -> "Mediaconnect":
        '''(experimental) Grants permission to display the details of a flow including the flow ARN, name, and Availability Zone, as well as details about the source, outputs, and entitlements.

        Access Level: Read

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toDescribeFlow", []))

    @jsii.member(jsii_name="toDescribeOffering")
    def to_describe_offering(self) -> "Mediaconnect":
        '''(experimental) Grants permission to display the details of an offering.

        Access Level: Read

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-offerings-offeringarn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toDescribeOffering", []))

    @jsii.member(jsii_name="toDescribeReservation")
    def to_describe_reservation(self) -> "Mediaconnect":
        '''(experimental) Grants permission to display the details of a reservation.

        Access Level: Read

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-reservations-reservationarn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toDescribeReservation", []))

    @jsii.member(jsii_name="toGrantFlowEntitlements")
    def to_grant_flow_entitlements(self) -> "Mediaconnect":
        '''(experimental) Grants permission to grant entitlements on any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-entitlements.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toGrantFlowEntitlements", []))

    @jsii.member(jsii_name="toListEntitlements")
    def to_list_entitlements(self) -> "Mediaconnect":
        '''(experimental) Grants permission to display a list of all entitlements that have been granted to the account.

        Access Level: List

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-entitlements.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toListEntitlements", []))

    @jsii.member(jsii_name="toListFlows")
    def to_list_flows(self) -> "Mediaconnect":
        '''(experimental) Grants permission to display a list of flows that are associated with this account.

        Access Level: List

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toListFlows", []))

    @jsii.member(jsii_name="toListOfferings")
    def to_list_offerings(self) -> "Mediaconnect":
        '''(experimental) Grants permission to display a list of all offerings that are available to the account in the current AWS Region.

        Access Level: List

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-offerings.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toListOfferings", []))

    @jsii.member(jsii_name="toListReservations")
    def to_list_reservations(self) -> "Mediaconnect":
        '''(experimental) Grants permission to display a list of all reservations that have been purchased by the account in the current AWS Region.

        Access Level: List

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-reservations.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toListReservations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Mediaconnect":
        '''(experimental) Grants permission to display a list of all tags associated with a resource.

        Access Level: Read

        https://docs.aws.amazon.com/mediaconnect/latest/api/tags-resourcearn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPurchaseOffering")
    def to_purchase_offering(self) -> "Mediaconnect":
        '''(experimental) Grants permission to purchase an offering.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-offerings-offeringarn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toPurchaseOffering", []))

    @jsii.member(jsii_name="toRemoveFlowMediaStream")
    def to_remove_flow_media_stream(self) -> "Mediaconnect":
        '''(experimental) Grants permission to remove media streams from any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-mediastreams-mediastreamname.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toRemoveFlowMediaStream", []))

    @jsii.member(jsii_name="toRemoveFlowOutput")
    def to_remove_flow_output(self) -> "Mediaconnect":
        '''(experimental) Grants permission to remove outputs from any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-outputs-outputarn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toRemoveFlowOutput", []))

    @jsii.member(jsii_name="toRemoveFlowSource")
    def to_remove_flow_source(self) -> "Mediaconnect":
        '''(experimental) Grants permission to remove sources from any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-source-sourcearn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toRemoveFlowSource", []))

    @jsii.member(jsii_name="toRemoveFlowVpcInterface")
    def to_remove_flow_vpc_interface(self) -> "Mediaconnect":
        '''(experimental) Grants permission to remove VPC interfaces from any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-vpcinterfaces-vpcinterfacename.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toRemoveFlowVpcInterface", []))

    @jsii.member(jsii_name="toRevokeFlowEntitlement")
    def to_revoke_flow_entitlement(self) -> "Mediaconnect":
        '''(experimental) Grants permission to revoke entitlements on any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-entitlements-entitlementarn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toRevokeFlowEntitlement", []))

    @jsii.member(jsii_name="toStartFlow")
    def to_start_flow(self) -> "Mediaconnect":
        '''(experimental) Grants permission to start flows.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-start-flowarn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toStartFlow", []))

    @jsii.member(jsii_name="toStopFlow")
    def to_stop_flow(self) -> "Mediaconnect":
        '''(experimental) Grants permission to stop flows.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-stop-flowarn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toStopFlow", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Mediaconnect":
        '''(experimental) Grants permission to associate tags with resources.

        Access Level: Tagging

        https://docs.aws.amazon.com/mediaconnect/latest/api/tags-resourcearn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Mediaconnect":
        '''(experimental) Grants permission to remove tags from resources.

        Access Level: Tagging

        https://docs.aws.amazon.com/mediaconnect/latest/api/tags-resourcearn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateFlow")
    def to_update_flow(self) -> "Mediaconnect":
        '''(experimental) Grants permission to update flows.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toUpdateFlow", []))

    @jsii.member(jsii_name="toUpdateFlowEntitlement")
    def to_update_flow_entitlement(self) -> "Mediaconnect":
        '''(experimental) Grants permission to update entitlements on any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-entitlements-entitlementarn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toUpdateFlowEntitlement", []))

    @jsii.member(jsii_name="toUpdateFlowMediaStream")
    def to_update_flow_media_stream(self) -> "Mediaconnect":
        '''(experimental) Grants permission to update media streams on any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-mediastreams-mediastreamname.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toUpdateFlowMediaStream", []))

    @jsii.member(jsii_name="toUpdateFlowOutput")
    def to_update_flow_output(self) -> "Mediaconnect":
        '''(experimental) Grants permission to update outputs on any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-outputs-outputarn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toUpdateFlowOutput", []))

    @jsii.member(jsii_name="toUpdateFlowSource")
    def to_update_flow_source(self) -> "Mediaconnect":
        '''(experimental) Grants permission to update the source of any flow.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconnect/latest/api/v1-flows-flowarn-source-sourcearn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconnect", jsii.invoke(self, "toUpdateFlowSource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c3aee1e9524f40b04438af5689e94d4fb8b1502d8d5f1cc0b70e62ec3007910d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ca3824764ca5ee8f473810962a9bd73bbb0c421a32a69851c575fc8f16ef513a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Mediaconvert(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Mediaconvert",
):
    '''(experimental) Statement provider for service `mediaconvert <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediaconvert.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mediaconvert <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediaconvert.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5540ef5907815fa49d046d3afd4bdad567304e491e37ad557e33c9c1c43b6ab7)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onCertificateAssociation")
    def on_certificate_association(
        self,
        certificate_arn: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediaconvert":
        '''(experimental) Adds a resource of type CertificateAssociation to the statement.

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/certificates.html

        :param certificate_arn: - Identifier for the certificateArn.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d2ada7be15ba1dea262ff99c6d9d47e292ab3161e2ac3872ad18429798d8c32f)
            check_type(argname="argument certificate_arn", value=certificate_arn, expected_type=type_hints["certificate_arn"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediaconvert", jsii.invoke(self, "onCertificateAssociation", [certificate_arn, account, region, partition]))

    @jsii.member(jsii_name="onJob")
    def on_job(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediaconvert":
        '''(experimental) Adds a resource of type Job to the statement.

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobs.html

        :param job_id: - Identifier for the jobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f8c0793b556d1b659d624cbdfbef0973fd7e31d6102d20d450dbccf297d1ed83)
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediaconvert", jsii.invoke(self, "onJob", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onJobTemplate")
    def on_job_template(
        self,
        job_template_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediaconvert":
        '''(experimental) Adds a resource of type JobTemplate to the statement.

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobtemplates.html

        :param job_template_name: - Identifier for the jobTemplateName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1ce6b32c9b2730ba7c14e8bc31dd98e142869f0355563778f1930d37ce9ff2c5)
            check_type(argname="argument job_template_name", value=job_template_name, expected_type=type_hints["job_template_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediaconvert", jsii.invoke(self, "onJobTemplate", [job_template_name, account, region, partition]))

    @jsii.member(jsii_name="onPreset")
    def on_preset(
        self,
        preset_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediaconvert":
        '''(experimental) Adds a resource of type Preset to the statement.

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/presets.html

        :param preset_name: - Identifier for the presetName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__376cf9119c9118dac30dae8160d8e5168822d572a3738aaf237abd7dd38dbd48)
            check_type(argname="argument preset_name", value=preset_name, expected_type=type_hints["preset_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediaconvert", jsii.invoke(self, "onPreset", [preset_name, account, region, partition]))

    @jsii.member(jsii_name="onQueue")
    def on_queue(
        self,
        queue_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediaconvert":
        '''(experimental) Adds a resource of type Queue to the statement.

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/queues.html

        :param queue_name: - Identifier for the queueName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7946c525eb41440356013e6bdd0fabd73bb661f83b837e84fb5ef36173fd6b8a)
            check_type(argname="argument queue_name", value=queue_name, expected_type=type_hints["queue_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediaconvert", jsii.invoke(self, "onQueue", [queue_name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateCertificate")
    def to_associate_certificate(self) -> "Mediaconvert":
        '''(experimental) Grants permission to associate an AWS Certificate Manager (ACM) Amazon Resource Name (ARN) with AWS Elemental MediaConvert.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/certificates.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toAssociateCertificate", []))

    @jsii.member(jsii_name="toCancelJob")
    def to_cancel_job(self) -> "Mediaconvert":
        '''(experimental) Grants permission to cancel an AWS Elemental MediaConvert job that is waiting in queue.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobs-id.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toCancelJob", []))

    @jsii.member(jsii_name="toCreateJob")
    def to_create_job(self) -> "Mediaconvert":
        '''(experimental) Grants permission to create and submit an AWS Elemental MediaConvert job.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobs.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toCreateJob", []))

    @jsii.member(jsii_name="toCreateJobTemplate")
    def to_create_job_template(self) -> "Mediaconvert":
        '''(experimental) Grants permission to create an AWS Elemental MediaConvert custom job template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobs-id.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toCreateJobTemplate", []))

    @jsii.member(jsii_name="toCreatePreset")
    def to_create_preset(self) -> "Mediaconvert":
        '''(experimental) Grants permission to create an AWS Elemental MediaConvert custom output preset.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/presets.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toCreatePreset", []))

    @jsii.member(jsii_name="toCreateQueue")
    def to_create_queue(self) -> "Mediaconvert":
        '''(experimental) Grants permission to create an AWS Elemental MediaConvert job queue.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/queues.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toCreateQueue", []))

    @jsii.member(jsii_name="toDeleteJobTemplate")
    def to_delete_job_template(self) -> "Mediaconvert":
        '''(experimental) Grants permission to delete an AWS Elemental MediaConvert custom job template.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobtemplates-name.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toDeleteJobTemplate", []))

    @jsii.member(jsii_name="toDeletePolicy")
    def to_delete_policy(self) -> "Mediaconvert":
        '''(experimental) Grants permission to delete an AWS Elemental MediaConvert policy.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/policy.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toDeletePolicy", []))

    @jsii.member(jsii_name="toDeletePreset")
    def to_delete_preset(self) -> "Mediaconvert":
        '''(experimental) Grants permission to delete an AWS Elemental MediaConvert custom output preset.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/presets-name.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toDeletePreset", []))

    @jsii.member(jsii_name="toDeleteQueue")
    def to_delete_queue(self) -> "Mediaconvert":
        '''(experimental) Grants permission to delete an AWS Elemental MediaConvert job queue.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/queues-name.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toDeleteQueue", []))

    @jsii.member(jsii_name="toDescribeEndpoints")
    def to_describe_endpoints(self) -> "Mediaconvert":
        '''(experimental) Grants permission to subscribe to the AWS Elemental MediaConvert service, by sending a request for an account-specific endpoint.

        All transcoding requests must be sent to the endpoint that the service returns

        Access Level: List

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/endpoints.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toDescribeEndpoints", []))

    @jsii.member(jsii_name="toDisassociateCertificate")
    def to_disassociate_certificate(self) -> "Mediaconvert":
        '''(experimental) Grants permission to remove an association between the Amazon Resource Name (ARN) of an AWS Certificate Manager (ACM) certificate and an AWS Elemental MediaConvert resource.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/certificates-arn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toDisassociateCertificate", []))

    @jsii.member(jsii_name="toGetJob")
    def to_get_job(self) -> "Mediaconvert":
        '''(experimental) Grants permission to get an AWS Elemental MediaConvert job.

        Access Level: Read

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobs-id.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toGetJob", []))

    @jsii.member(jsii_name="toGetJobTemplate")
    def to_get_job_template(self) -> "Mediaconvert":
        '''(experimental) Grants permission to get an AWS Elemental MediaConvert job template.

        Access Level: Read

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobtemplates-name.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toGetJobTemplate", []))

    @jsii.member(jsii_name="toGetPolicy")
    def to_get_policy(self) -> "Mediaconvert":
        '''(experimental) Grants permission to get an AWS Elemental MediaConvert policy.

        Access Level: Read

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/policy.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toGetPolicy", []))

    @jsii.member(jsii_name="toGetPreset")
    def to_get_preset(self) -> "Mediaconvert":
        '''(experimental) Grants permission to get an AWS Elemental MediaConvert output preset.

        Access Level: Read

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/presets-name.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toGetPreset", []))

    @jsii.member(jsii_name="toGetQueue")
    def to_get_queue(self) -> "Mediaconvert":
        '''(experimental) Grants permission to get an AWS Elemental MediaConvert job queue.

        Access Level: Read

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/queues-name.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toGetQueue", []))

    @jsii.member(jsii_name="toListJobs")
    def to_list_jobs(self) -> "Mediaconvert":
        '''(experimental) Grants permission to list AWS Elemental MediaConvert jobs.

        Access Level: List

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobs.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toListJobs", []))

    @jsii.member(jsii_name="toListJobTemplates")
    def to_list_job_templates(self) -> "Mediaconvert":
        '''(experimental) Grants permission to list AWS Elemental MediaConvert job templates.

        Access Level: List

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobtemplates.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toListJobTemplates", []))

    @jsii.member(jsii_name="toListPresets")
    def to_list_presets(self) -> "Mediaconvert":
        '''(experimental) Grants permission to list AWS Elemental MediaConvert output presets.

        Access Level: List

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/presets.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toListPresets", []))

    @jsii.member(jsii_name="toListQueues")
    def to_list_queues(self) -> "Mediaconvert":
        '''(experimental) Grants permission to list AWS Elemental MediaConvert job queues.

        Access Level: List

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/queues.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toListQueues", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Mediaconvert":
        '''(experimental) Grants permission to retrieve the tags for a MediaConvert queue, preset, or job template.

        Access Level: Read

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/tags-arn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutPolicy")
    def to_put_policy(self) -> "Mediaconvert":
        '''(experimental) Grants permission to put an AWS Elemental MediaConvert policy.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/policy.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toPutPolicy", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Mediaconvert":
        '''(experimental) Grants permission to add tags to a MediaConvert queue, preset, or job template.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/tags.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Mediaconvert":
        '''(experimental) Grants permission to remove tags from a MediaConvert queue, preset, or job template.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/tags-arn.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateJobTemplate")
    def to_update_job_template(self) -> "Mediaconvert":
        '''(experimental) Grants permission to update an AWS Elemental MediaConvert custom job template.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/jobtemplates-name.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toUpdateJobTemplate", []))

    @jsii.member(jsii_name="toUpdatePreset")
    def to_update_preset(self) -> "Mediaconvert":
        '''(experimental) Grants permission to update an AWS Elemental MediaConvert custom output preset.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/presets-name.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toUpdatePreset", []))

    @jsii.member(jsii_name="toUpdateQueue")
    def to_update_queue(self) -> "Mediaconvert":
        '''(experimental) Grants permission to update an AWS Elemental MediaConvert job queue.

        Access Level: Write

        https://docs.aws.amazon.com/mediaconvert/latest/apireference/queues-name.html

        :stability: experimental
        '''
        return typing.cast("Mediaconvert", jsii.invoke(self, "toUpdateQueue", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2e03a708cf8e89e464abc9f1fb1e62d1a9032107d2e69e0fe318fe56fd8c6446)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__86ab35a7e83662445f6e9c1082bd6a0b403da3b3816f7d269a8beb9ec763aa6e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Mediaimport(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Mediaimport",
):
    '''(experimental) Statement provider for service `mediaimport <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmediaimport.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mediaimport <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmediaimport.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8395334cfe317051014661b7ea8e1f147cad2370cd7fb9bc599f3c55f984c02e)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toCreateDatabaseBinarySnapshot")
    def to_create_database_binary_snapshot(self) -> "Mediaimport":
        '''(experimental) Grants permission to create a database binary snapshot on the customer's aws account.

        Access Level: Write

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/custom-cev.html

        :stability: experimental
        '''
        return typing.cast("Mediaimport", jsii.invoke(self, "toCreateDatabaseBinarySnapshot", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__677ff29ec5a560cd3ca6eefdeccae684908fcca9e6a183d005511f456905ca05)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0e582cf0d9ad569f30fbb798faeec839ea5226c7a6c74cea4a1c72a9bce32bff)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Medialive(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Medialive",
):
    '''(experimental) Statement provider for service `medialive <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmedialive.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `medialive <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmedialive.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9061cf3410064c5c1869f65c963b468d390f64707f26257e8a88bdb7bb3653a0)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onChannel")
    def on_channel(
        self,
        channel_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Medialive":
        '''(experimental) Adds a resource of type channel to the statement.

        https://docs.aws.amazon.com/medialive/latest/ug/channels.html

        :param channel_id: - Identifier for the channelId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__64d65dd2d1ecc1a3f9a3fed2e246b2b3d6e917c00539f54b413ef6ad48e11f73)
            check_type(argname="argument channel_id", value=channel_id, expected_type=type_hints["channel_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Medialive", jsii.invoke(self, "onChannel", [channel_id, account, region, partition]))

    @jsii.member(jsii_name="onInput")
    def on_input(
        self,
        input_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Medialive":
        '''(experimental) Adds a resource of type input to the statement.

        https://docs.aws.amazon.com/medialive/latest/ug/inputs.html

        :param input_id: - Identifier for the inputId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9559846a17e49edce5c0cf3d5c92b0b3afcce854b0e3f2dfafff9b96ac163069)
            check_type(argname="argument input_id", value=input_id, expected_type=type_hints["input_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Medialive", jsii.invoke(self, "onInput", [input_id, account, region, partition]))

    @jsii.member(jsii_name="onInputDevice")
    def on_input_device(
        self,
        device_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Medialive":
        '''(experimental) Adds a resource of type input-device to the statement.

        https://docs.aws.amazon.com/medialive/latest/ug/eml-devices.html

        :param device_id: - Identifier for the deviceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__62f95aee8b706706610c86999699148cd0e2c3e46e728a43d4490b405285591d)
            check_type(argname="argument device_id", value=device_id, expected_type=type_hints["device_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Medialive", jsii.invoke(self, "onInputDevice", [device_id, account, region, partition]))

    @jsii.member(jsii_name="onInputSecurityGroup")
    def on_input_security_group(
        self,
        input_security_group_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Medialive":
        '''(experimental) Adds a resource of type input-security-group to the statement.

        https://docs.aws.amazon.com/medialive/latest/ug/inputsecuritygroups.html

        :param input_security_group_id: - Identifier for the inputSecurityGroupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8bda018c85ac1c3a43dfeccb6b1868ac25ac7b93acb71b1cfb6cc11e26d9220a)
            check_type(argname="argument input_security_group_id", value=input_security_group_id, expected_type=type_hints["input_security_group_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Medialive", jsii.invoke(self, "onInputSecurityGroup", [input_security_group_id, account, region, partition]))

    @jsii.member(jsii_name="onMultiplex")
    def on_multiplex(
        self,
        multiplex_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Medialive":
        '''(experimental) Adds a resource of type multiplex to the statement.

        https://docs.aws.amazon.com/medialive/latest/ug/eml-multiplex.html

        :param multiplex_id: - Identifier for the multiplexId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8b00a5495b84cb35d608243a3de1939191355b749bed96371e38d90e626aa75c)
            check_type(argname="argument multiplex_id", value=multiplex_id, expected_type=type_hints["multiplex_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Medialive", jsii.invoke(self, "onMultiplex", [multiplex_id, account, region, partition]))

    @jsii.member(jsii_name="onOffering")
    def on_offering(
        self,
        offering_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Medialive":
        '''(experimental) Adds a resource of type offering to the statement.

        https://docs.aws.amazon.com/medialive/latest/ug/input-output-reservations.html

        :param offering_id: - Identifier for the offeringId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8ca33d2448559d81c09d182b22ed3d47c273862fd82eac6f708875cf9ff49863)
            check_type(argname="argument offering_id", value=offering_id, expected_type=type_hints["offering_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Medialive", jsii.invoke(self, "onOffering", [offering_id, account, region, partition]))

    @jsii.member(jsii_name="onReservation")
    def on_reservation(
        self,
        reservation_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Medialive":
        '''(experimental) Adds a resource of type reservation to the statement.

        https://docs.aws.amazon.com/medialive/latest/ug/reservations.html

        :param reservation_id: - Identifier for the reservationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dc90655d6b6773b5243b7481fe3ac9a6c193e90e9c62464a5ff8e552f34d1b29)
            check_type(argname="argument reservation_id", value=reservation_id, expected_type=type_hints["reservation_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Medialive", jsii.invoke(self, "onReservation", [reservation_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptInputDeviceTransfer")
    def to_accept_input_device_transfer(self) -> "Medialive":
        '''(experimental) Grants permission to accept an input device transfer.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/eml-devices.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toAcceptInputDeviceTransfer", []))

    @jsii.member(jsii_name="toBatchDelete")
    def to_batch_delete(self) -> "Medialive":
        '''(experimental) Grants permission to delete channels, inputs, input security groups, and multiplexes.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/editing-deleting-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toBatchDelete", []))

    @jsii.member(jsii_name="toBatchStart")
    def to_batch_start(self) -> "Medialive":
        '''(experimental) Grants permission to start channels and multiplexes.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/starting-stopping-deleting-a-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toBatchStart", []))

    @jsii.member(jsii_name="toBatchStop")
    def to_batch_stop(self) -> "Medialive":
        '''(experimental) Grants permission to stop channels and multiplexes.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/starting-stopping-deleting-a-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toBatchStop", []))

    @jsii.member(jsii_name="toBatchUpdateSchedule")
    def to_batch_update_schedule(self) -> "Medialive":
        '''(experimental) Grants permission to add and remove actions from a channel's schedule.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/submitting-batch-command.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toBatchUpdateSchedule", []))

    @jsii.member(jsii_name="toCancelInputDeviceTransfer")
    def to_cancel_input_device_transfer(self) -> "Medialive":
        '''(experimental) Grants permission to cancel an input device transfer.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/eml-devices.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toCancelInputDeviceTransfer", []))

    @jsii.member(jsii_name="toClaimDevice")
    def to_claim_device(self) -> "Medialive":
        '''(experimental) Grants permission to claim an input device.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/eml-devices.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toClaimDevice", []))

    @jsii.member(jsii_name="toCreateChannel")
    def to_create_channel(self) -> "Medialive":
        '''(experimental) Grants permission to create a channel.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/medialive/latest/ug/creating-channel-scratch.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toCreateChannel", []))

    @jsii.member(jsii_name="toCreateInput")
    def to_create_input(self) -> "Medialive":
        '''(experimental) Grants permission to create an input.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/medialive/latest/ug/creating-input.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toCreateInput", []))

    @jsii.member(jsii_name="toCreateInputSecurityGroup")
    def to_create_input_security_group(self) -> "Medialive":
        '''(experimental) Grants permission to create an input security group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/medialive/latest/ug/working-with-input-security-groups.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toCreateInputSecurityGroup", []))

    @jsii.member(jsii_name="toCreateMultiplex")
    def to_create_multiplex(self) -> "Medialive":
        '''(experimental) Grants permission to create a multiplex.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/medialive/latest/ug/multiplex-create.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toCreateMultiplex", []))

    @jsii.member(jsii_name="toCreateMultiplexProgram")
    def to_create_multiplex_program(self) -> "Medialive":
        '''(experimental) Grants permission to create a multiplex program.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/multiplex-create.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toCreateMultiplexProgram", []))

    @jsii.member(jsii_name="toCreatePartnerInput")
    def to_create_partner_input(self) -> "Medialive":
        '''(experimental) Grants permission to create a partner input.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/medialive/latest/ug/input-create-cdi-partners.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toCreatePartnerInput", []))

    @jsii.member(jsii_name="toCreateTags")
    def to_create_tags(self) -> "Medialive":
        '''(experimental) Grants permission to create tags for channels, inputs, input security groups, multiplexes, and reservations.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/medialive/latest/ug/tagging.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toCreateTags", []))

    @jsii.member(jsii_name="toDeleteChannel")
    def to_delete_channel(self) -> "Medialive":
        '''(experimental) Grants permission to delete a channel.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/editing-deleting-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDeleteChannel", []))

    @jsii.member(jsii_name="toDeleteInput")
    def to_delete_input(self) -> "Medialive":
        '''(experimental) Grants permission to delete an input.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/delete-input.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDeleteInput", []))

    @jsii.member(jsii_name="toDeleteInputSecurityGroup")
    def to_delete_input_security_group(self) -> "Medialive":
        '''(experimental) Grants permission to delete an input security group.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/delete-input-security-group.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDeleteInputSecurityGroup", []))

    @jsii.member(jsii_name="toDeleteMultiplex")
    def to_delete_multiplex(self) -> "Medialive":
        '''(experimental) Grants permission to delete a multiplex.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/delete-multiplex-program.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDeleteMultiplex", []))

    @jsii.member(jsii_name="toDeleteMultiplexProgram")
    def to_delete_multiplex_program(self) -> "Medialive":
        '''(experimental) Grants permission to delete a multiplex program.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/delete-multiplex-program.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDeleteMultiplexProgram", []))

    @jsii.member(jsii_name="toDeleteReservation")
    def to_delete_reservation(self) -> "Medialive":
        '''(experimental) Grants permission to delete an expired reservation.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/deleting-reservations.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDeleteReservation", []))

    @jsii.member(jsii_name="toDeleteSchedule")
    def to_delete_schedule(self) -> "Medialive":
        '''(experimental) Grants permission to delete all schedule actions for a channel.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/schedule-using-console-delete.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDeleteSchedule", []))

    @jsii.member(jsii_name="toDeleteTags")
    def to_delete_tags(self) -> "Medialive":
        '''(experimental) Grants permission to delete tags from channels, inputs, input security groups, multiplexes, and reservations.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/medialive/latest/ug/tagging.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDeleteTags", []))

    @jsii.member(jsii_name="toDescribeChannel")
    def to_describe_channel(self) -> "Medialive":
        '''(experimental) Grants permission to get details about a channel.

        Access Level: Read

        https://docs.aws.amazon.com/medialive/latest/ug/viewing-channel-configuration.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDescribeChannel", []))

    @jsii.member(jsii_name="toDescribeInput")
    def to_describe_input(self) -> "Medialive":
        '''(experimental) Grants permission to describe an input.

        Access Level: Read

        https://docs.aws.amazon.com/medialive/latest/ug/edit-input.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDescribeInput", []))

    @jsii.member(jsii_name="toDescribeInputDevice")
    def to_describe_input_device(self) -> "Medialive":
        '''(experimental) Grants permission to describe an input device.

        Access Level: Read

        https://docs.aws.amazon.com/medialive/latest/ug/device-edit.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDescribeInputDevice", []))

    @jsii.member(jsii_name="toDescribeInputDeviceThumbnail")
    def to_describe_input_device_thumbnail(self) -> "Medialive":
        '''(experimental) Grants permission to describe an input device thumbnail.

        Access Level: Read

        https://docs.aws.amazon.com/medialive/latest/ug/device-edit.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDescribeInputDeviceThumbnail", []))

    @jsii.member(jsii_name="toDescribeInputSecurityGroup")
    def to_describe_input_security_group(self) -> "Medialive":
        '''(experimental) Grants permission to describe an input security group.

        Access Level: Read

        https://docs.aws.amazon.com/medialive/latest/ug/edit-input-security-group.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDescribeInputSecurityGroup", []))

    @jsii.member(jsii_name="toDescribeMultiplex")
    def to_describe_multiplex(self) -> "Medialive":
        '''(experimental) Grants permission to describe a multiplex.

        Access Level: Read

        https://docs.aws.amazon.com/medialive/latest/ug/edit-multiplex-program-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDescribeMultiplex", []))

    @jsii.member(jsii_name="toDescribeMultiplexProgram")
    def to_describe_multiplex_program(self) -> "Medialive":
        '''(experimental) Grants permission to describe a multiplex program.

        Access Level: Read

        https://docs.aws.amazon.com/medialive/latest/ug/monitoring-multiplex-console.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDescribeMultiplexProgram", []))

    @jsii.member(jsii_name="toDescribeOffering")
    def to_describe_offering(self) -> "Medialive":
        '''(experimental) Grants permission to get details about a reservation offering.

        Access Level: Read

        https://docs.aws.amazon.com/medialive/latest/ug/purchasing-reservations.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDescribeOffering", []))

    @jsii.member(jsii_name="toDescribeReservation")
    def to_describe_reservation(self) -> "Medialive":
        '''(experimental) Grants permission to get details about a reservation.

        Access Level: Read

        https://docs.aws.amazon.com/medialive/latest/ug/view-reservations.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDescribeReservation", []))

    @jsii.member(jsii_name="toDescribeSchedule")
    def to_describe_schedule(self) -> "Medialive":
        '''(experimental) Grants permission to view a list of actions scheduled on a channel.

        Access Level: Read

        https://docs.aws.amazon.com/medialive/latest/ug/schedule-using-console-view.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toDescribeSchedule", []))

    @jsii.member(jsii_name="toListChannels")
    def to_list_channels(self) -> "Medialive":
        '''(experimental) Grants permission to list channels.

        Access Level: List

        https://docs.aws.amazon.com/medialive/latest/ug/viewing-channel-configuration.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toListChannels", []))

    @jsii.member(jsii_name="toListInputDevices")
    def to_list_input_devices(self) -> "Medialive":
        '''(experimental) Grants permission to list input devices.

        Access Level: List

        https://docs.aws.amazon.com/medialive/latest/ug/device-edit.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toListInputDevices", []))

    @jsii.member(jsii_name="toListInputDeviceTransfers")
    def to_list_input_device_transfers(self) -> "Medialive":
        '''(experimental) Grants permission to list input device transfers.

        Access Level: List

        https://docs.aws.amazon.com/medialive/latest/ug/eml-devices.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toListInputDeviceTransfers", []))

    @jsii.member(jsii_name="toListInputs")
    def to_list_inputs(self) -> "Medialive":
        '''(experimental) Grants permission to list inputs.

        Access Level: List

        https://docs.aws.amazon.com/medialive/latest/ug/edit-input.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toListInputs", []))

    @jsii.member(jsii_name="toListInputSecurityGroups")
    def to_list_input_security_groups(self) -> "Medialive":
        '''(experimental) Grants permission to list input security groups.

        Access Level: List

        https://docs.aws.amazon.com/medialive/latest/ug/edit-input-security-group.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toListInputSecurityGroups", []))

    @jsii.member(jsii_name="toListMultiplexes")
    def to_list_multiplexes(self) -> "Medialive":
        '''(experimental) Grants permission to list multiplexes.

        Access Level: List

        https://docs.aws.amazon.com/medialive/latest/ug/edit-multiplex-program-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toListMultiplexes", []))

    @jsii.member(jsii_name="toListMultiplexPrograms")
    def to_list_multiplex_programs(self) -> "Medialive":
        '''(experimental) Grants permission to list multiplex programs.

        Access Level: List

        https://docs.aws.amazon.com/medialive/latest/ug/monitoring-multiplex-console.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toListMultiplexPrograms", []))

    @jsii.member(jsii_name="toListOfferings")
    def to_list_offerings(self) -> "Medialive":
        '''(experimental) Grants permission to list reservation offerings.

        Access Level: List

        https://docs.aws.amazon.com/medialive/latest/ug/purchasing-reservations.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toListOfferings", []))

    @jsii.member(jsii_name="toListReservations")
    def to_list_reservations(self) -> "Medialive":
        '''(experimental) Grants permission to list reservations.

        Access Level: List

        https://docs.aws.amazon.com/medialive/latest/ug/view-reservations.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toListReservations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Medialive":
        '''(experimental) Grants permission to list tags for channels, inputs, input security groups, multiplexes, and reservations.

        Access Level: List

        https://docs.aws.amazon.com/medialive/latest/ug/tagging.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPurchaseOffering")
    def to_purchase_offering(self) -> "Medialive":
        '''(experimental) Grants permission to purchase a reservation offering.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/medialive/latest/ug/purchasing-reservations.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toPurchaseOffering", []))

    @jsii.member(jsii_name="toRebootInputDevice")
    def to_reboot_input_device(self) -> "Medialive":
        '''(experimental) Grants permission to reboot an input device.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/eml-devices.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toRebootInputDevice", []))

    @jsii.member(jsii_name="toRejectInputDeviceTransfer")
    def to_reject_input_device_transfer(self) -> "Medialive":
        '''(experimental) Grants permission to reject an input device transfer.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/eml-devices.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toRejectInputDeviceTransfer", []))

    @jsii.member(jsii_name="toStartChannel")
    def to_start_channel(self) -> "Medialive":
        '''(experimental) Grants permission to start a channel.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/starting-stopping-deleting-a-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toStartChannel", []))

    @jsii.member(jsii_name="toStartInputDeviceMaintenanceWindow")
    def to_start_input_device_maintenance_window(self) -> "Medialive":
        '''(experimental) Grants permission to start a maintenance window for an input device.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/eml-devices.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toStartInputDeviceMaintenanceWindow", []))

    @jsii.member(jsii_name="toStartMultiplex")
    def to_start_multiplex(self) -> "Medialive":
        '''(experimental) Grants permission to start a multiplex.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/start-multiplex.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toStartMultiplex", []))

    @jsii.member(jsii_name="toStopChannel")
    def to_stop_channel(self) -> "Medialive":
        '''(experimental) Grants permission to stop a channel.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/starting-stopping-deleting-a-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toStopChannel", []))

    @jsii.member(jsii_name="toStopMultiplex")
    def to_stop_multiplex(self) -> "Medialive":
        '''(experimental) Grants permission to stop a multiplex.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/stop-multiplex.title.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toStopMultiplex", []))

    @jsii.member(jsii_name="toTransferInputDevice")
    def to_transfer_input_device(self) -> "Medialive":
        '''(experimental) Grants permission to transfer an input device.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/eml-devices.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toTransferInputDevice", []))

    @jsii.member(jsii_name="toUpdateChannel")
    def to_update_channel(self) -> "Medialive":
        '''(experimental) Grants permission to update a channel.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/editing-deleting-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toUpdateChannel", []))

    @jsii.member(jsii_name="toUpdateChannelClass")
    def to_update_channel_class(self) -> "Medialive":
        '''(experimental) Grants permission to update the class of a channel.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/editing-deleting-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toUpdateChannelClass", []))

    @jsii.member(jsii_name="toUpdateInput")
    def to_update_input(self) -> "Medialive":
        '''(experimental) Grants permission to update an input.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/edit-input.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toUpdateInput", []))

    @jsii.member(jsii_name="toUpdateInputDevice")
    def to_update_input_device(self) -> "Medialive":
        '''(experimental) Grants permission to update an input device.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/device-edit.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toUpdateInputDevice", []))

    @jsii.member(jsii_name="toUpdateInputSecurityGroup")
    def to_update_input_security_group(self) -> "Medialive":
        '''(experimental) Grants permission to update an input security group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/medialive/latest/ug/edit-input-security-group.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toUpdateInputSecurityGroup", []))

    @jsii.member(jsii_name="toUpdateMultiplex")
    def to_update_multiplex(self) -> "Medialive":
        '''(experimental) Grants permission to update a multiplex.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/edit-multiplex-program-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toUpdateMultiplex", []))

    @jsii.member(jsii_name="toUpdateMultiplexProgram")
    def to_update_multiplex_program(self) -> "Medialive":
        '''(experimental) Grants permission to update a multiplex program.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/edit-multiplex-program-channel.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toUpdateMultiplexProgram", []))

    @jsii.member(jsii_name="toUpdateReservation")
    def to_update_reservation(self) -> "Medialive":
        '''(experimental) Grants permission to update a reservation.

        Access Level: Write

        https://docs.aws.amazon.com/medialive/latest/ug/reservations.html

        :stability: experimental
        '''
        return typing.cast("Medialive", jsii.invoke(self, "toUpdateReservation", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__95e7f444cb2da1990a9c52ce3775583a3dd5aea0d9124f17d446a5ce6820b59d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4a1bb617bb2cc0325da5bc4fac174cf279e82a0b18164b0ebcc593eafb6a0ac7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Mediapackage(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Mediapackage",
):
    '''(experimental) Statement provider for service `mediapackage <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediapackage.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mediapackage <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediapackage.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a686cc8bddaa22f6d4118cc457ba55e8a9f9d4b1ab43acdb08647ebfc7775dcf)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onChannels")
    def on_channels(
        self,
        channel_identifier: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediapackage":
        '''(experimental) Adds a resource of type channels to the statement.

        https://docs.aws.amazon.com/mediapackage/latest/ug/channels.html

        :param channel_identifier: - Identifier for the channelIdentifier.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__492d29125644d522c441b12ae97fc7fa6873a53d271e05960c2ced1253b66e89)
            check_type(argname="argument channel_identifier", value=channel_identifier, expected_type=type_hints["channel_identifier"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediapackage", jsii.invoke(self, "onChannels", [channel_identifier, account, region, partition]))

    @jsii.member(jsii_name="onHarvestJobs")
    def on_harvest_jobs(
        self,
        harvest_job_identifier: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediapackage":
        '''(experimental) Adds a resource of type harvest_jobs to the statement.

        https://docs.aws.amazon.com/mediapackage/latest/ug/harvest-jobs.html

        :param harvest_job_identifier: - Identifier for the harvestJobIdentifier.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4499ed274014696bf0fb06eefa635e2369631e61f589a8e5c706189d8ecd0eb0)
            check_type(argname="argument harvest_job_identifier", value=harvest_job_identifier, expected_type=type_hints["harvest_job_identifier"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediapackage", jsii.invoke(self, "onHarvestJobs", [harvest_job_identifier, account, region, partition]))

    @jsii.member(jsii_name="onOriginEndpoints")
    def on_origin_endpoints(
        self,
        origin_endpoint_identifier: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediapackage":
        '''(experimental) Adds a resource of type origin_endpoints to the statement.

        https://docs.aws.amazon.com/mediapackage/latest/ug/endpoints.html

        :param origin_endpoint_identifier: - Identifier for the originEndpointIdentifier.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5545c51254d2bc82427753ccbca676e67758ad41d94afd9e829a3b16bcc7a16f)
            check_type(argname="argument origin_endpoint_identifier", value=origin_endpoint_identifier, expected_type=type_hints["origin_endpoint_identifier"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediapackage", jsii.invoke(self, "onOriginEndpoints", [origin_endpoint_identifier, account, region, partition]))

    @jsii.member(jsii_name="toConfigureLogs")
    def to_configure_logs(self) -> "Mediapackage":
        '''(experimental) Grants permission to configure access logs for a Channel.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/mediapackage/latest/apireference/channels-id-configure_logs.html#channels-id-configure_logsput

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toConfigureLogs", []))

    @jsii.member(jsii_name="toCreateChannel")
    def to_create_channel(self) -> "Mediapackage":
        '''(experimental) Grants permission to create a channel in AWS Elemental MediaPackage.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediapackage/latest/apireference/channels.html#channelspost

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toCreateChannel", []))

    @jsii.member(jsii_name="toCreateHarvestJob")
    def to_create_harvest_job(self) -> "Mediapackage":
        '''(experimental) Grants permission to create a harvest job in AWS Elemental MediaPackage.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediapackage/latest/apireference/harvest_jobs.html#harvest_jobspost

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toCreateHarvestJob", []))

    @jsii.member(jsii_name="toCreateOriginEndpoint")
    def to_create_origin_endpoint(self) -> "Mediapackage":
        '''(experimental) Grants permission to create an endpoint in AWS Elemental MediaPackage.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediapackage/latest/apireference/origin_endpoints.html#origin_endpointspost

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toCreateOriginEndpoint", []))

    @jsii.member(jsii_name="toDeleteChannel")
    def to_delete_channel(self) -> "Mediapackage":
        '''(experimental) Grants permission to delete a channel in AWS Elemental MediaPackage.

        Access Level: Write

        https://docs.aws.amazon.com/mediapackage/latest/apireference/channels-id.html#channels-iddelete

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toDeleteChannel", []))

    @jsii.member(jsii_name="toDeleteOriginEndpoint")
    def to_delete_origin_endpoint(self) -> "Mediapackage":
        '''(experimental) Grants permission to delete an endpoint in AWS Elemental MediaPackage.

        Access Level: Write

        https://docs.aws.amazon.com/mediapackage/latest/apireference/origin_endpoints-id.html#origin_endpoints-iddelete

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toDeleteOriginEndpoint", []))

    @jsii.member(jsii_name="toDescribeChannel")
    def to_describe_channel(self) -> "Mediapackage":
        '''(experimental) Grants permission to view the details of a channel in AWS Elemental MediaPackage.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage/latest/apireference/channels-id.html#channels-idget

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toDescribeChannel", []))

    @jsii.member(jsii_name="toDescribeHarvestJob")
    def to_describe_harvest_job(self) -> "Mediapackage":
        '''(experimental) Grants permission to view the details of a harvest job in AWS Elemental MediaPackage.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage/latest/apireference/harvest_jobs-id.html#harvest_jobs-idget

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toDescribeHarvestJob", []))

    @jsii.member(jsii_name="toDescribeOriginEndpoint")
    def to_describe_origin_endpoint(self) -> "Mediapackage":
        '''(experimental) Grants permission to view the details of an endpoint in AWS Elemental MediaPackage.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage/latest/apireference/origin_endpoints-id.html#origin_endpoints-idget

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toDescribeOriginEndpoint", []))

    @jsii.member(jsii_name="toListChannels")
    def to_list_channels(self) -> "Mediapackage":
        '''(experimental) Grants permission to view a list of channels in AWS Elemental MediaPackage.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage/latest/apireference/channels.html#channelsget

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toListChannels", []))

    @jsii.member(jsii_name="toListHarvestJobs")
    def to_list_harvest_jobs(self) -> "Mediapackage":
        '''(experimental) Grants permission to view a list of harvest jobs in AWS Elemental MediaPackage.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage/latest/apireference/harvest_jobs.html#harvest_jobsget

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toListHarvestJobs", []))

    @jsii.member(jsii_name="toListOriginEndpoints")
    def to_list_origin_endpoints(self) -> "Mediapackage":
        '''(experimental) Grants permission to view a list of endpoints in AWS Elemental MediaPackage.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage/latest/apireference/origin_endpoints.html#origin_endpointsget

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toListOriginEndpoints", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Mediapackage":
        '''(experimental) Grants permission to list the tags assigned to a Channel or OriginEndpoint.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage/latest/apireference/tags-resource-arn.html#tags-resource-arnget

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRotateChannelCredentials")
    def to_rotate_channel_credentials(self) -> "Mediapackage":
        '''(experimental) Grants permission to rotate credentials for the first IngestEndpoint of a Channel in AWS Elemental MediaPackage.

        Access Level: Write

        https://docs.aws.amazon.com/mediapackage/latest/apireference/channels-id-credentials.html#channels-id-credentialsput

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toRotateChannelCredentials", []))

    @jsii.member(jsii_name="toRotateIngestEndpointCredentials")
    def to_rotate_ingest_endpoint_credentials(self) -> "Mediapackage":
        '''(experimental) Grants permission to rotate IngestEndpoint credentials for a Channel in AWS Elemental MediaPackage.

        Access Level: Write

        https://docs.aws.amazon.com/mediapackage/latest/apireference/channels-id-ingest_endpoints-ingest_endpoint_id-credentials.html#channels-id-ingest_endpoints-ingest_endpoint_id-credentialsput

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toRotateIngestEndpointCredentials", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Mediapackage":
        '''(experimental) Grants permission to tag a MediaPackage resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediapackage/latest/apireference/hj-create.html

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Mediapackage":
        '''(experimental) Grants permission to delete tags to a Channel or OriginEndpoint.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediapackage/latest/apireference/tags-resource-arn.html#tags-resource-arndelete

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateChannel")
    def to_update_channel(self) -> "Mediapackage":
        '''(experimental) Grants permission to make changes to a channel in AWS Elemental MediaPackage.

        Access Level: Write

        https://docs.aws.amazon.com/mediapackage/latest/apireference/channels-id.html#channels-idput

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toUpdateChannel", []))

    @jsii.member(jsii_name="toUpdateOriginEndpoint")
    def to_update_origin_endpoint(self) -> "Mediapackage":
        '''(experimental) Grants permission to make changes to an endpoint in AWS Elemental MediaPackage.

        Access Level: Write

        https://docs.aws.amazon.com/mediapackage/latest/apireference/origin_endpoints-id.html#origin_endpoints-idput

        :stability: experimental
        '''
        return typing.cast("Mediapackage", jsii.invoke(self, "toUpdateOriginEndpoint", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8fdb609110ffa19ac5027d4df69c2703246e92b2dc6aa82892c8db925ffe23c7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2cbb993fd3632e5009f41fc7eec3b59977830a6660b3a0cd096190644e2d9b51)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class MediapackageVod(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.MediapackageVod",
):
    '''(experimental) Statement provider for service `mediapackage-vod <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediapackagevod.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mediapackage-vod <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediapackagevod.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4edd42f5eae4834613f9779578eaec50ec050d815bb5aa6a91644799567d527d)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAssets")
    def on_assets(
        self,
        asset_identifier: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "MediapackageVod":
        '''(experimental) Adds a resource of type assets to the statement.

        https://docs.aws.amazon.com/mediapackage/latest/ug/asset.html

        :param asset_identifier: - Identifier for the assetIdentifier.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__efd8169d4c291f5c801e6a050112dceaa4819476c2746d7be0f5b6e56597fd69)
            check_type(argname="argument asset_identifier", value=asset_identifier, expected_type=type_hints["asset_identifier"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("MediapackageVod", jsii.invoke(self, "onAssets", [asset_identifier, account, region, partition]))

    @jsii.member(jsii_name="onPackagingConfigurations")
    def on_packaging_configurations(
        self,
        packaging_configuration_identifier: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "MediapackageVod":
        '''(experimental) Adds a resource of type packaging-configurations to the statement.

        https://docs.aws.amazon.com/mediapackage/latest/ug/pkg-cfig.html

        :param packaging_configuration_identifier: - Identifier for the packagingConfigurationIdentifier.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dc0ff65c7a15397439228e71e0e055d9215f3327a65ba974faf2606664fb8f33)
            check_type(argname="argument packaging_configuration_identifier", value=packaging_configuration_identifier, expected_type=type_hints["packaging_configuration_identifier"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("MediapackageVod", jsii.invoke(self, "onPackagingConfigurations", [packaging_configuration_identifier, account, region, partition]))

    @jsii.member(jsii_name="onPackagingGroups")
    def on_packaging_groups(
        self,
        packaging_group_identifier: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "MediapackageVod":
        '''(experimental) Adds a resource of type packaging-groups to the statement.

        https://docs.aws.amazon.com/mediapackage/latest/ug/pkg-group.html

        :param packaging_group_identifier: - Identifier for the packagingGroupIdentifier.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bd25aaeacaf01ae9e410fc92a25517e90cbc9958cc299a419641b76f537d4f2a)
            check_type(argname="argument packaging_group_identifier", value=packaging_group_identifier, expected_type=type_hints["packaging_group_identifier"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("MediapackageVod", jsii.invoke(self, "onPackagingGroups", [packaging_group_identifier, account, region, partition]))

    @jsii.member(jsii_name="toConfigureLogs")
    def to_configure_logs(self) -> "MediapackageVod":
        '''(experimental) Grants permission to configure egress access logs for a PackagingGroup.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/packaging_groups-id-configure_logs.html#packaging_groups-id-configure_logsput

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toConfigureLogs", []))

    @jsii.member(jsii_name="toCreateAsset")
    def to_create_asset(self) -> "MediapackageVod":
        '''(experimental) Grants permission to create an asset in AWS Elemental MediaPackage.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/assets.html#assetspost

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toCreateAsset", []))

    @jsii.member(jsii_name="toCreatePackagingConfiguration")
    def to_create_packaging_configuration(self) -> "MediapackageVod":
        '''(experimental) Grants permission to create a packaging configuration in AWS Elemental MediaPackage.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/packaging_configurations.html#packaging_configurationspost

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toCreatePackagingConfiguration", []))

    @jsii.member(jsii_name="toCreatePackagingGroup")
    def to_create_packaging_group(self) -> "MediapackageVod":
        '''(experimental) Grants permission to create a packaging group in AWS Elemental MediaPackage.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/packaging_groups.html#packaging_groupspost

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toCreatePackagingGroup", []))

    @jsii.member(jsii_name="toDeleteAsset")
    def to_delete_asset(self) -> "MediapackageVod":
        '''(experimental) Grants permission to delete an asset in AWS Elemental MediaPackage.

        Access Level: Write

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/assets-id.html#assets-iddelete

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toDeleteAsset", []))

    @jsii.member(jsii_name="toDeletePackagingConfiguration")
    def to_delete_packaging_configuration(self) -> "MediapackageVod":
        '''(experimental) Grants permission to delete a packaging configuration in AWS Elemental MediaPackage.

        Access Level: Write

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/packaging_configurations-id.html#packaging_configurations-iddelete

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toDeletePackagingConfiguration", []))

    @jsii.member(jsii_name="toDeletePackagingGroup")
    def to_delete_packaging_group(self) -> "MediapackageVod":
        '''(experimental) Grants permission to delete a packaging group in AWS Elemental MediaPackage.

        Access Level: Write

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/packaging_groups-id.html#packaging_groups-iddelete

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toDeletePackagingGroup", []))

    @jsii.member(jsii_name="toDescribeAsset")
    def to_describe_asset(self) -> "MediapackageVod":
        '''(experimental) Grants permission to view the details of an asset in AWS Elemental MediaPackage.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/assets-id.html#assets-idget

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toDescribeAsset", []))

    @jsii.member(jsii_name="toDescribePackagingConfiguration")
    def to_describe_packaging_configuration(self) -> "MediapackageVod":
        '''(experimental) Grants permission to view the details of a packaging configuration in AWS Elemental MediaPackage.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/packaging_configurations-id.html#packaging_configurations-idget

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toDescribePackagingConfiguration", []))

    @jsii.member(jsii_name="toDescribePackagingGroup")
    def to_describe_packaging_group(self) -> "MediapackageVod":
        '''(experimental) Grants permission to view the details of a packaging group in AWS Elemental MediaPackage.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/packaging_groups-id.html#packaging_groups-idget

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toDescribePackagingGroup", []))

    @jsii.member(jsii_name="toListAssets")
    def to_list_assets(self) -> "MediapackageVod":
        '''(experimental) Grants permission to view a list of assets in AWS Elemental MediaPackage.

        Access Level: List

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/assets.html#assetsget

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toListAssets", []))

    @jsii.member(jsii_name="toListPackagingConfigurations")
    def to_list_packaging_configurations(self) -> "MediapackageVod":
        '''(experimental) Grants permission to view a list of packaging configurations in AWS Elemental MediaPackage.

        Access Level: List

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/packaging_configurations.html#packaging_configurationsget

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toListPackagingConfigurations", []))

    @jsii.member(jsii_name="toListPackagingGroups")
    def to_list_packaging_groups(self) -> "MediapackageVod":
        '''(experimental) Grants permission to view a list of packaging groups in AWS Elemental MediaPackage.

        Access Level: List

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/packaging_groups.html#packaging_groupsget

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toListPackagingGroups", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "MediapackageVod":
        '''(experimental) Grants permission to list the tags assigned to a PackagingGroup, PackagingConfiguration, or Asset.

        Access Level: Read

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/tags-resource-arn.html#tags-resource-arnget

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "MediapackageVod":
        '''(experimental) Grants permission to assign tags to a PackagingGroup, PackagingConfiguration, or Asset.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/tags-resource-arn.html#tags-resource-arnpost

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "MediapackageVod":
        '''(experimental) Grants permission to delete tags from a PackagingGroup, PackagingConfiguration, or Asset.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/tags-resource-arn.html#tags-resource-arndelete

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdatePackagingGroup")
    def to_update_packaging_group(self) -> "MediapackageVod":
        '''(experimental) Grants permission to update a packaging group in AWS Elemental MediaPackage.

        Access Level: Write

        https://docs.aws.amazon.com/mediapackage-vod/latest/apireference/packaging_groups-id.html#packaging_groups-idput

        :stability: experimental
        '''
        return typing.cast("MediapackageVod", jsii.invoke(self, "toUpdatePackagingGroup", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__084f3150aa3f8f3d58d391e691805df1bd63b2a34e6f212084f62e41bcf8894a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__231db539e63a0b51265cd96cbf5370066c217110518b4128e566e0ab10b5bf94)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Mediastore(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Mediastore",
):
    '''(experimental) Statement provider for service `mediastore <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediastore.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mediastore <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediastore.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ad76fbf577d9cd0213f59d162abb96368d553f460d5de52dd1601664ad515547)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onContainer")
    def on_container(
        self,
        container_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediastore":
        '''(experimental) Adds a resource of type container to the statement.

        https://docs.aws.amazon.com/mediastore/latest/ug/containers.html

        :param container_name: - Identifier for the containerName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bd2749cf263aebb862ab6d572a1c5cf5c0a913af3fc13f776656e6acb17883e4)
            check_type(argname="argument container_name", value=container_name, expected_type=type_hints["container_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediastore", jsii.invoke(self, "onContainer", [container_name, account, region, partition]))

    @jsii.member(jsii_name="onFolder")
    def on_folder(
        self,
        container_name: builtins.str,
        folder_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediastore":
        '''(experimental) Adds a resource of type folder to the statement.

        https://docs.aws.amazon.com/mediastore/latest/ug/folders.html

        :param container_name: - Identifier for the containerName.
        :param folder_path: - Identifier for the folderPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__06ecda77bfc81e463cdfe68a11708810c8dae196dd4c21b44fe3806f99c8607c)
            check_type(argname="argument container_name", value=container_name, expected_type=type_hints["container_name"])
            check_type(argname="argument folder_path", value=folder_path, expected_type=type_hints["folder_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediastore", jsii.invoke(self, "onFolder", [container_name, folder_path, account, region, partition]))

    @jsii.member(jsii_name="onObject")
    def on_object(
        self,
        container_name: builtins.str,
        object_path: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediastore":
        '''(experimental) Adds a resource of type object to the statement.

        https://docs.aws.amazon.com/mediastore/latest/ug/objects.html

        :param container_name: - Identifier for the containerName.
        :param object_path: - Identifier for the objectPath.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6fa3776bc3c16cb1dc465c8979772d15f3e29239ec3bd94e37581c4041c73f2c)
            check_type(argname="argument container_name", value=container_name, expected_type=type_hints["container_name"])
            check_type(argname="argument object_path", value=object_path, expected_type=type_hints["object_path"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediastore", jsii.invoke(self, "onObject", [container_name, object_path, account, region, partition]))

    @jsii.member(jsii_name="toCreateContainer")
    def to_create_container(self) -> "Mediastore":
        '''(experimental) Grants permission to create a container.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_CreateContainer.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toCreateContainer", []))

    @jsii.member(jsii_name="toDeleteContainer")
    def to_delete_container(self) -> "Mediastore":
        '''(experimental) Grants permission to delete a container.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_DeleteContainer.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toDeleteContainer", []))

    @jsii.member(jsii_name="toDeleteContainerPolicy")
    def to_delete_container_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to delete the access policy of a container.

        Access Level: Permissions management

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_DeleteContainerPolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toDeleteContainerPolicy", []))

    @jsii.member(jsii_name="toDeleteCorsPolicy")
    def to_delete_cors_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to delete the CORS policy from a container.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_DeleteCorsPolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toDeleteCorsPolicy", []))

    @jsii.member(jsii_name="toDeleteLifecyclePolicy")
    def to_delete_lifecycle_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to delete the lifecycle policy from a container.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_DeleteLifecyclePolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toDeleteLifecyclePolicy", []))

    @jsii.member(jsii_name="toDeleteMetricPolicy")
    def to_delete_metric_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to delete the metric policy from a container.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_DeleteMetricPolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toDeleteMetricPolicy", []))

    @jsii.member(jsii_name="toDeleteObject")
    def to_delete_object(self) -> "Mediastore":
        '''(experimental) Grants permission to delete an object.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_objstore_DeleteObject.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toDeleteObject", []))

    @jsii.member(jsii_name="toDescribeContainer")
    def to_describe_container(self) -> "Mediastore":
        '''(experimental) Grants permission to retrieve details on a container.

        Access Level: List

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_DescribeContainer.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toDescribeContainer", []))

    @jsii.member(jsii_name="toDescribeObject")
    def to_describe_object(self) -> "Mediastore":
        '''(experimental) Grants permission to retrieve metadata for an object.

        Access Level: List

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_objstore_DescribeObject.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toDescribeObject", []))

    @jsii.member(jsii_name="toGetContainerPolicy")
    def to_get_container_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to retrieve the access policy of a container.

        Access Level: Read

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_GetContainerPolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toGetContainerPolicy", []))

    @jsii.member(jsii_name="toGetCorsPolicy")
    def to_get_cors_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to retrieve the CORS policy of a container.

        Access Level: Read

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_GetCorsPolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toGetCorsPolicy", []))

    @jsii.member(jsii_name="toGetLifecyclePolicy")
    def to_get_lifecycle_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to retrieve the lifecycle policy that is assigned to a container.

        Access Level: Read

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_GetLifecyclePolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toGetLifecyclePolicy", []))

    @jsii.member(jsii_name="toGetMetricPolicy")
    def to_get_metric_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to retrieve the metric policy that is assigned to a container.

        Access Level: Read

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_GetMetricPolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toGetMetricPolicy", []))

    @jsii.member(jsii_name="toGetObject")
    def to_get_object(self) -> "Mediastore":
        '''(experimental) Grants permission to retrieve an object.

        Access Level: Read

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_objstore_GetObject.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toGetObject", []))

    @jsii.member(jsii_name="toListContainers")
    def to_list_containers(self) -> "Mediastore":
        '''(experimental) Grants permission to retrieve a list of containers in the current account.

        Access Level: List

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_ListContainers.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toListContainers", []))

    @jsii.member(jsii_name="toListItems")
    def to_list_items(self) -> "Mediastore":
        '''(experimental) Grants permission to retrieve a list of objects and subfolders that are stored in a folder.

        Access Level: List

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_objstore_ListItems.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toListItems", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Mediastore":
        '''(experimental) Grants permission to list tags on a container.

        Access Level: Read

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutContainerPolicy")
    def to_put_container_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to create or replace the access policy of a container.

        Access Level: Permissions management

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_PutContainerPolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toPutContainerPolicy", []))

    @jsii.member(jsii_name="toPutCorsPolicy")
    def to_put_cors_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to add or modify the CORS policy of a container.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_PutCorsPolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toPutCorsPolicy", []))

    @jsii.member(jsii_name="toPutLifecyclePolicy")
    def to_put_lifecycle_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to add or modify the lifecycle policy that is assigned to a container.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_PutLifecyclePolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toPutLifecyclePolicy", []))

    @jsii.member(jsii_name="toPutMetricPolicy")
    def to_put_metric_policy(self) -> "Mediastore":
        '''(experimental) Grants permission to add or modify the metric policy that is assigned to a container.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_PutMetricPolicy.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toPutMetricPolicy", []))

    @jsii.member(jsii_name="toPutObject")
    def to_put_object(self) -> "Mediastore":
        '''(experimental) Grants permission to upload an object.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_objstore_PutObject.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toPutObject", []))

    @jsii.member(jsii_name="toStartAccessLogging")
    def to_start_access_logging(self) -> "Mediastore":
        '''(experimental) Grants permission to start access logging on a container.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_StartAccessLogging.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toStartAccessLogging", []))

    @jsii.member(jsii_name="toStopAccessLogging")
    def to_stop_access_logging(self) -> "Mediastore":
        '''(experimental) Grants permission to stop access logging on a container.

        Access Level: Write

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_StopAccessLogging.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toStopAccessLogging", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Mediastore":
        '''(experimental) Grants permission to add tags to a container.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Mediastore":
        '''(experimental) Grants permission to remove tags from a container.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/mediastore/latest/apireference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Mediastore", jsii.invoke(self, "toUntagResource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1131746f1246a72d7b623e4b17b74a2f51f717b7d8405f6b17339bcc57da0b75)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__92c0f72f6a3cdec5a72f697ad1dc01660078dd0d4dd3c53c9478109865e451bb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Mediatailor(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Mediatailor",
):
    '''(experimental) Statement provider for service `mediatailor <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediatailor.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mediatailor <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awselementalmediatailor.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__83d11e221cc42400cd8da51aa8e6970c1235976a73e8149480f17cfd0f27fd94)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onChannel")
    def on_channel(
        self,
        channel_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediatailor":
        '''(experimental) Adds a resource of type channel to the statement.

        https://docs.aws.amazon.com/mediatailor/latest/apireference/channel-channelname.html

        :param channel_name: - Identifier for the channelName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3f8558408c367071365304e340e7c7e1a6b1dad96179d02f203a630de7e95b14)
            check_type(argname="argument channel_name", value=channel_name, expected_type=type_hints["channel_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediatailor", jsii.invoke(self, "onChannel", [channel_name, account, region, partition]))

    @jsii.member(jsii_name="onLiveSource")
    def on_live_source(
        self,
        source_location_name: builtins.str,
        live_source_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediatailor":
        '''(experimental) Adds a resource of type liveSource to the statement.

        https://docs.aws.amazon.com/mediatailor/latest/apireference/sourcelocation-sourcelocationname-livesource-livesourcename.html

        :param source_location_name: - Identifier for the sourceLocationName.
        :param live_source_name: - Identifier for the liveSourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e39436e06d324450262a5746038567e1094c1925e504a66cda06ebce97d498c5)
            check_type(argname="argument source_location_name", value=source_location_name, expected_type=type_hints["source_location_name"])
            check_type(argname="argument live_source_name", value=live_source_name, expected_type=type_hints["live_source_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediatailor", jsii.invoke(self, "onLiveSource", [source_location_name, live_source_name, account, region, partition]))

    @jsii.member(jsii_name="onPlaybackConfiguration")
    def on_playback_configuration(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediatailor":
        '''(experimental) Adds a resource of type playbackConfiguration to the statement.

        https://docs.aws.amazon.com/mediatailor/latest/apireference/playbackconfiguration.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9506504cfabc9ef221023aeab16330af8caaad6b3d41349ab76caa9335d68935)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediatailor", jsii.invoke(self, "onPlaybackConfiguration", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onPrefetchSchedule")
    def on_prefetch_schedule(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediatailor":
        '''(experimental) Adds a resource of type prefetchSchedule to the statement.

        https://docs.aws.amazon.com/mediatailor/latest/apireference/prefetchschedule-playbackconfigurationname-name.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__28c45c96003462b1df572fb64afe55ecfb72859f6592af8312dd05e9162e6772)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediatailor", jsii.invoke(self, "onPrefetchSchedule", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onProgram")
    def on_program(
        self,
        channel_name: builtins.str,
        program_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediatailor":
        '''(experimental) Adds a resource of type program to the statement.

        https://docs.aws.amazon.com/mediatailor/latest/apireference/channel-channelname-program-programname.html

        :param channel_name: - Identifier for the channelName.
        :param program_name: - Identifier for the programName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4637b71b2490a26e0a600dca771e263eab1ca014f04380289476161567dc539a)
            check_type(argname="argument channel_name", value=channel_name, expected_type=type_hints["channel_name"])
            check_type(argname="argument program_name", value=program_name, expected_type=type_hints["program_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediatailor", jsii.invoke(self, "onProgram", [channel_name, program_name, account, region, partition]))

    @jsii.member(jsii_name="onSourceLocation")
    def on_source_location(
        self,
        source_location_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediatailor":
        '''(experimental) Adds a resource of type sourceLocation to the statement.

        https://docs.aws.amazon.com/mediatailor/latest/apireference/sourcelocation-sourcelocationname.html

        :param source_location_name: - Identifier for the sourceLocationName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f9cd4923089b8d9b5fc9594ae336eaffb68a9d0b6d23b45957c8f0e7655c713f)
            check_type(argname="argument source_location_name", value=source_location_name, expected_type=type_hints["source_location_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediatailor", jsii.invoke(self, "onSourceLocation", [source_location_name, account, region, partition]))

    @jsii.member(jsii_name="onVodSource")
    def on_vod_source(
        self,
        source_location_name: builtins.str,
        vod_source_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mediatailor":
        '''(experimental) Adds a resource of type vodSource to the statement.

        https://docs.aws.amazon.com/mediatailor/latest/apireference/sourcelocation-sourcelocationname-vodsource-vodsourcename.html

        :param source_location_name: - Identifier for the sourceLocationName.
        :param vod_source_name: - Identifier for the vodSourceName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c72c577209d74642b04c36b701d84216961a2ce6386eef13b752515a29a83230)
            check_type(argname="argument source_location_name", value=source_location_name, expected_type=type_hints["source_location_name"])
            check_type(argname="argument vod_source_name", value=vod_source_name, expected_type=type_hints["vod_source_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mediatailor", jsii.invoke(self, "onVodSource", [source_location_name, vod_source_name, account, region, partition]))

    @jsii.member(jsii_name="toConfigureLogsForChannel")
    def to_configure_logs_for_channel(self) -> "Mediatailor":
        '''(experimental) Grants permission to configure logs on the channel with the specified channel name.

        Access Level: Write

        https://docs.aws.amazon.com/mediatailor/latest/apireference/configurelogs-channel.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toConfigureLogsForChannel", []))

    @jsii.member(jsii_name="toConfigureLogsForPlaybackConfiguration")
    def to_configure_logs_for_playback_configuration(self) -> "Mediatailor":
        '''(experimental) Grants permission to configure logs for a playback configuration.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/mediatailor/latest/apireference/configurelogs-playbackconfiguration.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toConfigureLogsForPlaybackConfiguration", []))

    @jsii.member(jsii_name="toCreateChannel")
    def to_create_channel(self) -> "Mediatailor":
        '''(experimental) Grants permission to create a new channel.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediatailor/latest/apireference/channel-channelname.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toCreateChannel", []))

    @jsii.member(jsii_name="toCreateLiveSource")
    def to_create_live_source(self) -> "Mediatailor":
        '''(experimental) Grants permission to create a new live source on the source location with the specified source location name.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediatailor/latest/apireference/sourcelocation-sourcelocationname-livesource-livesourcename.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toCreateLiveSource", []))

    @jsii.member(jsii_name="toCreatePrefetchSchedule")
    def to_create_prefetch_schedule(self) -> "Mediatailor":
        '''(experimental) Grants permission to create a prefetch schedule for the playback configuration with the specified playback configuration name.

        Access Level: Write

        https://docs.aws.amazon.com/mediatailor/latest/apireference/prefetchschedule-playbackconfigurationname-name.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toCreatePrefetchSchedule", []))

    @jsii.member(jsii_name="toCreateProgram")
    def to_create_program(self) -> "Mediatailor":
        '''(experimental) Grants permission to create a new program on the channel with the specified channel name.

        Access Level: Write

        https://docs.aws.amazon.com/mediatailor/latest/apireference/channel-channelname-program-programname.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toCreateProgram", []))

    @jsii.member(jsii_name="toCreateSourceLocation")
    def to_create_source_location(self) -> "Mediatailor":
        '''(experimental) Grants permission to create a new source location.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediatailor/latest/apireference/sourcelocation-sourcelocationname.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toCreateSourceLocation", []))

    @jsii.member(jsii_name="toCreateVodSource")
    def to_create_vod_source(self) -> "Mediatailor":
        '''(experimental) Grants permission to create a new VOD source on the source location with the specified source location name.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediatailor/latest/apireference/sourcelocation-sourcelocationname-vodsource-vodsourcename.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toCreateVodSource", []))

    @jsii.member(jsii_name="toDeleteChannel")
    def to_delete_channel(self) -> "Mediatailor":
        '''(experimental) Grants permission to delete the channel with the specified channel name.

        Access Level: Write

        https://docs.aws.amazon.com/mediatailor/latest/apireference/channel-channelname.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toDeleteChannel", []))

    @jsii.member(jsii_name="toDeleteChannelPolicy")
    def to_delete_channel_policy(self) -> "Mediatailor":
        '''(experimental) Grants permission to delete the IAM policy on the channel with the specified channel name.

        Access Level: Permissions management

        https://docs.aws.amazon.com/mediatailor/latest/apireference/channel-channelname-policy.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toDeleteChannelPolicy", []))

    @jsii.member(jsii_name="toDeleteLiveSource")
    def to_delete_live_source(self) -> "Mediatailor":
        '''(experimental) Grants permission to delete the live source with the specified live source name on the source location with the specified source location name.

        Access Level: Write

        https://docs.aws.amazon.com/mediatailor/latest/apireference/sourcelocation-sourcelocationname-livesource-livesourcename.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toDeleteLiveSource", []))

    @jsii.member(jsii_name="toDeletePlaybackConfiguration")
    def to_delete_playback_configuration(self) -> "Mediatailor":
        '''(experimental) Grants permission to delete the specified playback configuration.

        Access Level: Write

        https://docs.aws.amazon.com/mediatailor/latest/apireference/playbackconfiguration-name.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toDeletePlaybackConfiguration", []))

    @jsii.member(jsii_name="toDeletePrefetchSchedule")
    def to_delete_prefetch_schedule(self) -> "Mediatailor":
        '''(experimental) Grants permission to delete a prefetch schedule for a playback configuration with the specified prefetch schedule name.

        Access Level: Write

        https://docs.aws.amazon.com/mediatailor/latest/apireference/prefetchschedule-playbackconfigurationname-name.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toDeletePrefetchSchedule", []))

    @jsii.member(jsii_name="toDeleteProgram")
    def to_delete_program(self) -> "Mediatailor":
        '''(experimental) Grants permission to delete the program with the specified program name on the channel with the specified channel name.

        Access Level: Write

        https://docs.aws.amazon.com/mediatailor/latest/apireference/channel-channelname-program-programname.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toDeleteProgram", []))

    @jsii.member(jsii_name="toDeleteSourceLocation")
    def to_delete_source_location(self) -> "Mediatailor":
        '''(experimental) Grants permission to delete the source location with the specified source location name.

        Access Level: Write

        https://docs.aws.amazon.com/mediatailor/latest/apireference/sourcelocation-sourcelocationname.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toDeleteSourceLocation", []))

    @jsii.member(jsii_name="toDeleteVodSource")
    def to_delete_vod_source(self) -> "Mediatailor":
        '''(experimental) Grants permission to delete the VOD source with the specified VOD source name on the source location with the specified source location name.

        Access Level: Write

        https://docs.aws.amazon.com/mediatailor/latest/apireference/sourcelocation-sourcelocationname-vodsource-vodsourcename.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toDeleteVodSource", []))

    @jsii.member(jsii_name="toDescribeChannel")
    def to_describe_channel(self) -> "Mediatailor":
        '''(experimental) Grants permission to retrieve the channel with the specified channel name.

        Access Level: Read

        https://docs.aws.amazon.com/mediatailor/latest/apireference/channel-channelname.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toDescribeChannel", []))

    @jsii.member(jsii_name="toDescribeLiveSource")
    def to_describe_live_source(self) -> "Mediatailor":
        '''(experimental) Grants permission to retrieve the live source with the specified live source name on the source location with the specified source location name.

        Access Level: Read

        https://docs.aws.amazon.com/mediatailor/latest/apireference/sourcelocation-sourcelocationname-livesource-livesourcename.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toDescribeLiveSource", []))

    @jsii.member(jsii_name="toDescribeProgram")
    def to_describe_program(self) -> "Mediatailor":
        '''(experimental) Grants permission to retrieve the program with the specified program name on the channel with the specified channel name.

        Access Level: Read

        https://docs.aws.amazon.com/mediatailor/latest/apireference/channel-channelname-program-programname.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toDescribeProgram", []))

    @jsii.member(jsii_name="toDescribeSourceLocation")
    def to_describe_source_location(self) -> "Mediatailor":
        '''(experimental) Grants permission to retrieve the source location with the specified source location name.

        Access Level: Read

        https://docs.aws.amazon.com/mediatailor/latest/apireference/sourcelocation-sourcelocationname.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toDescribeSourceLocation", []))

    @jsii.member(jsii_name="toDescribeVodSource")
    def to_describe_vod_source(self) -> "Mediatailor":
        '''(experimental) Grants permission to retrieve the VOD source with the specified VOD source name on the source location with the specified source location name.

        Access Level: Read

        https://docs.aws.amazon.com/mediatailor/latest/apireference/sourcelocation-sourcelocationname-vodsource-vodsourcename.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toDescribeVodSource", []))

    @jsii.member(jsii_name="toGetChannelPolicy")
    def to_get_channel_policy(self) -> "Mediatailor":
        '''(experimental) Grants permission to read the IAM policy on the channel with the specified channel name.

        Access Level: Read

        https://docs.aws.amazon.com/mediatailor/latest/apireference/channel-channelname-policy.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toGetChannelPolicy", []))

    @jsii.member(jsii_name="toGetChannelSchedule")
    def to_get_channel_schedule(self) -> "Mediatailor":
        '''(experimental) Grants permission to retrieve the schedule of programs on the channel with the specified channel name.

        Access Level: Read

        https://docs.aws.amazon.com/mediatailor/latest/apireference/channel-channelname-schedule.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toGetChannelSchedule", []))

    @jsii.member(jsii_name="toGetPlaybackConfiguration")
    def to_get_playback_configuration(self) -> "Mediatailor":
        '''(experimental) Grants permission to retrieve the configuration for the specified name.

        Access Level: Read

        https://docs.aws.amazon.com/mediatailor/latest/apireference/playbackconfiguration-name.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toGetPlaybackConfiguration", []))

    @jsii.member(jsii_name="toGetPrefetchSchedule")
    def to_get_prefetch_schedule(self) -> "Mediatailor":
        '''(experimental) Grants permission to retrieve prefetch schedule for a playback configuration with the specified prefetch schedule name.

        Access Level: Read

        https://docs.aws.amazon.com/mediatailor/latest/apireference/prefetchschedule-playbackconfigurationname-name.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toGetPrefetchSchedule", []))

    @jsii.member(jsii_name="toListAlerts")
    def to_list_alerts(self) -> "Mediatailor":
        '''(experimental) Grants permission to retrieve the list of alerts on a resource.

        Access Level: Read

        https://docs.aws.amazon.com/mediatailor/latest/apireference/alerts.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toListAlerts", []))

    @jsii.member(jsii_name="toListChannels")
    def to_list_channels(self) -> "Mediatailor":
        '''(experimental) Grants permission to retrieve the list of existing channels.

        Access Level: Read

        https://docs.aws.amazon.com/mediatailor/latest/apireference/channels.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toListChannels", []))

    @jsii.member(jsii_name="toListLiveSources")
    def to_list_live_sources(self) -> "Mediatailor":
        '''(experimental) Grants permission to retrieve the list of existing live sources on the source location with the specified source location name.

        Access Level: Read

        https://docs.aws.amazon.com/mediatailor/latest/apireference/sourcelocation-sourcelocationname-livesources.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toListLiveSources", []))

    @jsii.member(jsii_name="toListPlaybackConfigurations")
    def to_list_playback_configurations(self) -> "Mediatailor":
        '''(experimental) Grants permission to retrieve the list of available configurations.

        Access Level: List

        https://docs.aws.amazon.com/mediatailor/latest/apireference/playbackconfigurations.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toListPlaybackConfigurations", []))

    @jsii.member(jsii_name="toListPrefetchSchedules")
    def to_list_prefetch_schedules(self) -> "Mediatailor":
        '''(experimental) Grants permission to retrieve the list of prefetch schedules for a playback configuration.

        Access Level: List

        https://docs.aws.amazon.com/mediatailor/latest/apireference/prefetchschedule-playbackconfigurationname.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toListPrefetchSchedules", []))

    @jsii.member(jsii_name="toListSourceLocations")
    def to_list_source_locations(self) -> "Mediatailor":
        '''(experimental) Grants permission to retrieve the list of existing source locations.

        Access Level: Read

        https://docs.aws.amazon.com/mediatailor/latest/apireference/sourcelocations.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toListSourceLocations", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Mediatailor":
        '''(experimental) Grants permission to list the tags assigned to the specified playback configuration resource.

        Access Level: Read

        https://docs.aws.amazon.com/mediatailor/latest/apireference/tags-resourcearn.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListVodSources")
    def to_list_vod_sources(self) -> "Mediatailor":
        '''(experimental) Grants permission to retrieve the list of existing VOD sources on the source location with the specified source location name.

        Access Level: Read

        https://docs.aws.amazon.com/mediatailor/latest/apireference/sourcelocation-sourcelocationname-vodsources.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toListVodSources", []))

    @jsii.member(jsii_name="toPutChannelPolicy")
    def to_put_channel_policy(self) -> "Mediatailor":
        '''(experimental) Grants permission to set the IAM policy on the channel with the specified channel name.

        Access Level: Permissions management

        https://docs.aws.amazon.com/mediatailor/latest/apireference/channel-channelname-policy.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toPutChannelPolicy", []))

    @jsii.member(jsii_name="toPutPlaybackConfiguration")
    def to_put_playback_configuration(self) -> "Mediatailor":
        '''(experimental) Grants permission to add a new configuration.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediatailor/latest/apireference/playbackconfiguration.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toPutPlaybackConfiguration", []))

    @jsii.member(jsii_name="toStartChannel")
    def to_start_channel(self) -> "Mediatailor":
        '''(experimental) Grants permission to start the channel with the specified channel name.

        Access Level: Write

        https://docs.aws.amazon.com/mediatailor/latest/apireference/channel-channelname-start.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toStartChannel", []))

    @jsii.member(jsii_name="toStopChannel")
    def to_stop_channel(self) -> "Mediatailor":
        '''(experimental) Grants permission to stop the channel with the specified channel name.

        Access Level: Write

        https://docs.aws.amazon.com/mediatailor/latest/apireference/channel-channelname-stop.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toStopChannel", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Mediatailor":
        '''(experimental) Grants permission to add tags to the specified playback configuration resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediatailor/latest/apireference/tags-resourcearn.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Mediatailor":
        '''(experimental) Grants permission to remove tags from the specified playback configuration resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mediatailor/latest/apireference/tags-resourcearn.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateChannel")
    def to_update_channel(self) -> "Mediatailor":
        '''(experimental) Grants permission to update the channel with the specified channel name.

        Access Level: Write

        https://docs.aws.amazon.com/mediatailor/latest/apireference/channel-channelname.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toUpdateChannel", []))

    @jsii.member(jsii_name="toUpdateLiveSource")
    def to_update_live_source(self) -> "Mediatailor":
        '''(experimental) Grants permission to update the live source with the specified live source name on the source location with the specified source location name.

        Access Level: Write

        https://docs.aws.amazon.com/mediatailor/latest/apireference/sourcelocation-sourcelocationname-livesource-livesourcename.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toUpdateLiveSource", []))

    @jsii.member(jsii_name="toUpdateProgram")
    def to_update_program(self) -> "Mediatailor":
        '''(experimental) Grants permission to update the program with the specified program name on the channel with the specified channel name.

        Access Level: Write

        https://docs.aws.amazon.com/mediatailor/latest/apireference/channel-channelname-program-programname.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toUpdateProgram", []))

    @jsii.member(jsii_name="toUpdateSourceLocation")
    def to_update_source_location(self) -> "Mediatailor":
        '''(experimental) Grants permission to update the source location with the specified source location name.

        Access Level: Write

        https://docs.aws.amazon.com/mediatailor/latest/apireference/sourcelocation-sourcelocationname.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toUpdateSourceLocation", []))

    @jsii.member(jsii_name="toUpdateVodSource")
    def to_update_vod_source(self) -> "Mediatailor":
        '''(experimental) Grants permission to update the VOD source with the specified VOD source name on the source location with the specified source location name.

        Access Level: Write

        https://docs.aws.amazon.com/mediatailor/latest/apireference/sourcelocation-sourcelocationname-vodsource-vodsourcename.html

        :stability: experimental
        '''
        return typing.cast("Mediatailor", jsii.invoke(self, "toUpdateVodSource", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__34d0f49cf3b2df149d1a5e727e5bb6c9532fbc22007c7e48a366ebf424834fae)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7fce719193eefcf5ed0655fdfaa79331256d739c7fc06e8010fe6d3477558d91)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Memorydb(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Memorydb",
):
    '''(experimental) Statement provider for service `memorydb <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmemorydb.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `memorydb <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmemorydb.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4932c63dd932e5eb09b4a5d94b20bae2e8b77091f3379be33bff8f534a0deba9)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAcl")
    def on_acl(
        self,
        acl_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Memorydb":
        '''(experimental) Adds a resource of type acl to the statement.

        https://docs.aws.amazon.com/memorydb/latest/devguide/WhatIs.Components.html

        :param acl_name: - Identifier for the aclName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b3be9ad532b1718ea0dd60969e4d5477ba82af7d68351082bf5ffc5defe832af)
            check_type(argname="argument acl_name", value=acl_name, expected_type=type_hints["acl_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Memorydb", jsii.invoke(self, "onAcl", [acl_name, account, region, partition]))

    @jsii.member(jsii_name="onCluster")
    def on_cluster(
        self,
        cluster_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Memorydb":
        '''(experimental) Adds a resource of type cluster to the statement.

        https://docs.aws.amazon.com/memorydb/latest/devguide/WhatIs.Components.html

        :param cluster_name: - Identifier for the clusterName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__de259ce5f3afca53a6e4e8448abd75af1b7959d76162ee766c201379989f1f3d)
            check_type(argname="argument cluster_name", value=cluster_name, expected_type=type_hints["cluster_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Memorydb", jsii.invoke(self, "onCluster", [cluster_name, account, region, partition]))

    @jsii.member(jsii_name="onParametergroup")
    def on_parametergroup(
        self,
        parameter_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Memorydb":
        '''(experimental) Adds a resource of type parametergroup to the statement.

        https://docs.aws.amazon.com/memorydb/latest/devguide/WhatIs.Components.html

        :param parameter_group_name: - Identifier for the parameterGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__265b49a7cbba7bb64b8db01d19f93d10673dd8ba1c2f559aed745b61163c81ec)
            check_type(argname="argument parameter_group_name", value=parameter_group_name, expected_type=type_hints["parameter_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Memorydb", jsii.invoke(self, "onParametergroup", [parameter_group_name, account, region, partition]))

    @jsii.member(jsii_name="onReservednode")
    def on_reservednode(
        self,
        reservation_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Memorydb":
        '''(experimental) Adds a resource of type reservednode to the statement.

        https://docs.aws.amazon.com/memorydb/latest/devguide/WhatIs.Components.html

        :param reservation_id: - Identifier for the reservationID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0f5c000ce3b535c1fc5892081eeb17ca96fc79275efdbaf0e4a9e3836d259de7)
            check_type(argname="argument reservation_id", value=reservation_id, expected_type=type_hints["reservation_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Memorydb", jsii.invoke(self, "onReservednode", [reservation_id, account, region, partition]))

    @jsii.member(jsii_name="onSnapshot")
    def on_snapshot(
        self,
        snapshot_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Memorydb":
        '''(experimental) Adds a resource of type snapshot to the statement.

        https://docs.aws.amazon.com/memorydb/latest/devguide/WhatIs.Components.html

        :param snapshot_name: - Identifier for the snapshotName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5dcfbc1ca9d4e2167ecb1a841a4cef2f80d254053132b9d7dec8f2febb0c3da8)
            check_type(argname="argument snapshot_name", value=snapshot_name, expected_type=type_hints["snapshot_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Memorydb", jsii.invoke(self, "onSnapshot", [snapshot_name, account, region, partition]))

    @jsii.member(jsii_name="onSubnetgroup")
    def on_subnetgroup(
        self,
        subnet_group_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Memorydb":
        '''(experimental) Adds a resource of type subnetgroup to the statement.

        https://docs.aws.amazon.com/memorydb/latest/devguide/WhatIs.Components.html

        :param subnet_group_name: - Identifier for the subnetGroupName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__682f32a8ed06b083d623d747cd3510405d491beca5e7ed740693459365734247)
            check_type(argname="argument subnet_group_name", value=subnet_group_name, expected_type=type_hints["subnet_group_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Memorydb", jsii.invoke(self, "onSubnetgroup", [subnet_group_name, account, region, partition]))

    @jsii.member(jsii_name="onUser")
    def on_user(
        self,
        user_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Memorydb":
        '''(experimental) Adds a resource of type user to the statement.

        https://docs.aws.amazon.com/memorydb/latest/devguide/WhatIs.Components.html

        :param user_name: - Identifier for the userName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4604a409f8b4c5213d4025cadf45357407518c8d8fd034e99e4748bbdd98164b)
            check_type(argname="argument user_name", value=user_name, expected_type=type_hints["user_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Memorydb", jsii.invoke(self, "onUser", [user_name, account, region, partition]))

    @jsii.member(jsii_name="toBatchUpdateCluster")
    def to_batch_update_cluster(self) -> "Memorydb":
        '''(experimental) Grants permissions to apply service updates.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs
        - s3:GetObject

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_BatchUpdateCluster.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toBatchUpdateCluster", []))

    @jsii.member(jsii_name="toCopySnapshot")
    def to_copy_snapshot(self) -> "Memorydb":
        '''(experimental) Grants permissions to make a copy of an existing snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - memorydb:TagResource
        - s3:DeleteObject
        - s3:GetBucketAcl
        - s3:PutObject

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_CopySnapshot.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toCopySnapshot", []))

    @jsii.member(jsii_name="toCreateAcl")
    def to_create_acl(self) -> "Memorydb":
        '''(experimental) Grants permissions to create a new access control list.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - memorydb:TagResource

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_CreateAcl.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toCreateAcl", []))

    @jsii.member(jsii_name="toCreateCluster")
    def to_create_cluster(self) -> "Memorydb":
        '''(experimental) Grants permissions to create a cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs
        - memorydb:TagResource
        - s3:GetObject

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_CreateCluster.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toCreateCluster", []))

    @jsii.member(jsii_name="toCreateParameterGroup")
    def to_create_parameter_group(self) -> "Memorydb":
        '''(experimental) Grants permissions to create a new parameter group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - memorydb:TagResource

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_CreateParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toCreateParameterGroup", []))

    @jsii.member(jsii_name="toCreateSnapshot")
    def to_create_snapshot(self) -> "Memorydb":
        '''(experimental) Grants permissions to create a backup of a cluster at the current point in time.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - memorydb:TagResource
        - s3:DeleteObject
        - s3:GetBucketAcl
        - s3:PutObject

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_CreateSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toCreateSnapshot", []))

    @jsii.member(jsii_name="toCreateSubnetGroup")
    def to_create_subnet_group(self) -> "Memorydb":
        '''(experimental) Grants permissions to create a new subnet group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - memorydb:TagResource

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_CreateSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toCreateSubnetGroup", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Memorydb":
        '''(experimental) Grants permissions to create a new user.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - memorydb:TagResource

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_CreateUser.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toDeleteAcl")
    def to_delete_acl(self) -> "Memorydb":
        '''(experimental) Grants permissions to delete an access control list.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_DeleteAcl.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toDeleteAcl", []))

    @jsii.member(jsii_name="toDeleteCluster")
    def to_delete_cluster(self) -> "Memorydb":
        '''(experimental) Grants permissions to delete a previously provisioned cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_DeleteCluster.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toDeleteCluster", []))

    @jsii.member(jsii_name="toDeleteParameterGroup")
    def to_delete_parameter_group(self) -> "Memorydb":
        '''(experimental) Grants permissions to delete a parameter group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_DeleteParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toDeleteParameterGroup", []))

    @jsii.member(jsii_name="toDeleteSnapshot")
    def to_delete_snapshot(self) -> "Memorydb":
        '''(experimental) Grants permissions to delete a snapshot.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_DeleteSnapshot.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toDeleteSnapshot", []))

    @jsii.member(jsii_name="toDeleteSubnetGroup")
    def to_delete_subnet_group(self) -> "Memorydb":
        '''(experimental) Grants permissions to delete a subnet group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_DeleteSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toDeleteSubnetGroup", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "Memorydb":
        '''(experimental) Grants permissions to delete a user.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_DeleteUser.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDescribeAcls")
    def to_describe_acls(self) -> "Memorydb":
        '''(experimental) Grants permissions to retrieve information about access control lists.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_DescribeAcls.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toDescribeAcls", []))

    @jsii.member(jsii_name="toDescribeClusters")
    def to_describe_clusters(self) -> "Memorydb":
        '''(experimental) Grants permissions to retrieve information about all provisioned clusters if no cluster identifier is specified, or about a specific cluster if a cluster identifier is supplied.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_DescribeClusters.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toDescribeClusters", []))

    @jsii.member(jsii_name="toDescribeEngineVersions")
    def to_describe_engine_versions(self) -> "Memorydb":
        '''(experimental) Grants permissions to list of the available engines and their versions.

        Access Level: Read

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_DescribeEngineVersions.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toDescribeEngineVersions", []))

    @jsii.member(jsii_name="toDescribeEvents")
    def to_describe_events(self) -> "Memorydb":
        '''(experimental) Grants permissions to retrieve events related to clusters, subnet groups, and parameter groups.

        Access Level: Read

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_DescribeEvents.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toDescribeEvents", []))

    @jsii.member(jsii_name="toDescribeParameterGroups")
    def to_describe_parameter_groups(self) -> "Memorydb":
        '''(experimental) Grants permissions to retrieve information about parameter groups.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_DescribeParameterGroups.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toDescribeParameterGroups", []))

    @jsii.member(jsii_name="toDescribeParameters")
    def to_describe_parameters(self) -> "Memorydb":
        '''(experimental) Grants permissions to retrieve a detailed parameter list for a particular parameter group.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_DescribeParameters.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toDescribeParameters", []))

    @jsii.member(jsii_name="toDescribeReservedNodes")
    def to_describe_reserved_nodes(self) -> "Memorydb":
        '''(experimental) Grants permissions to retrieve reserved nodes.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_DescribeReservedNodes.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toDescribeReservedNodes", []))

    @jsii.member(jsii_name="toDescribeReservedNodesOfferings")
    def to_describe_reserved_nodes_offerings(self) -> "Memorydb":
        '''(experimental) Grants permissions to retrieve reserved nodes offerings.

        Access Level: Read

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_DescribeReservedNodesOfferings.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toDescribeReservedNodesOfferings", []))

    @jsii.member(jsii_name="toDescribeServiceUpdates")
    def to_describe_service_updates(self) -> "Memorydb":
        '''(experimental) Grants permissions to retrieve details of the service updates.

        Access Level: Read

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_DescribeServiceUpdates.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toDescribeServiceUpdates", []))

    @jsii.member(jsii_name="toDescribeSnapshots")
    def to_describe_snapshots(self) -> "Memorydb":
        '''(experimental) Grants permissions to retrieve information about cluster snapshots.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_DescribeSnapshots.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toDescribeSnapshots", []))

    @jsii.member(jsii_name="toDescribeSubnetGroups")
    def to_describe_subnet_groups(self) -> "Memorydb":
        '''(experimental) Grants permissions to retrieve a list of subnet group.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_DescribeSubnetGroups.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toDescribeSubnetGroups", []))

    @jsii.member(jsii_name="toDescribeUsers")
    def to_describe_users(self) -> "Memorydb":
        '''(experimental) Grants permissions to retrieve information about users.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_DescribeUsers.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toDescribeUsers", []))

    @jsii.member(jsii_name="toFailoverShard")
    def to_failover_shard(self) -> "Memorydb":
        '''(experimental) Grants permissions to test automatic failover on a specified shard in a cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_FailoverShard.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toFailoverShard", []))

    @jsii.member(jsii_name="toListAllowedNodeTypeUpdates")
    def to_list_allowed_node_type_updates(self) -> "Memorydb":
        '''(experimental) Grants permissions to list available node type updates.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_ListAllowedNodeTypeUpdates.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toListAllowedNodeTypeUpdates", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Memorydb":
        '''(experimental) Grants permissions to list cost allocation tags.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_ListTags.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toPurchaseReservedNodesOffering")
    def to_purchase_reserved_nodes_offering(self) -> "Memorydb":
        '''(experimental) Grants permissions to purchase a new reserved node.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - memorydb:TagResource

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_PurchaseReservedNodesOffering.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toPurchaseReservedNodesOffering", []))

    @jsii.member(jsii_name="toResetParameterGroup")
    def to_reset_parameter_group(self) -> "Memorydb":
        '''(experimental) Grants permissions to modify the parameters of a parameter group to the engine or system default value.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_ResetParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toResetParameterGroup", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Memorydb":
        '''(experimental) Grants permissions to add up to 10 cost allocation tags to the named resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Memorydb":
        '''(experimental) Grants permissions to remove the tags identified by the TagKeys list from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAcl")
    def to_update_acl(self) -> "Memorydb":
        '''(experimental) Grants permissions to update an access control list.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_UpdateAcl.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toUpdateAcl", []))

    @jsii.member(jsii_name="toUpdateCluster")
    def to_update_cluster(self) -> "Memorydb":
        '''(experimental) Grants permissions to update the settings for a cluster.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DeleteNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSubnets
        - ec2:DescribeVpcs

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_UpdateCluster.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toUpdateCluster", []))

    @jsii.member(jsii_name="toUpdateParameterGroup")
    def to_update_parameter_group(self) -> "Memorydb":
        '''(experimental) Grants permissions to update parameters in a parameter group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_UpdateParameterGroup.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toUpdateParameterGroup", []))

    @jsii.member(jsii_name="toUpdateSubnetGroup")
    def to_update_subnet_group(self) -> "Memorydb":
        '''(experimental) Grants permissions to update a subnet group.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_UpdateSubnetGroup.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toUpdateSubnetGroup", []))

    @jsii.member(jsii_name="toUpdateUser")
    def to_update_user(self) -> "Memorydb":
        '''(experimental) Grants permissions to update a user.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/memorydb/latest/APIReference/API_UpdateUser.html

        :stability: experimental
        '''
        return typing.cast("Memorydb", jsii.invoke(self, "toUpdateUser", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c6e6292ab87983529c0147e2e800ce874f9606882feb26bfde29dbe77e8bb3fa)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__761dcf473ebdede77e1841d37174582f48e48eed86eaa399b5c0f08bbdd0efe7)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Mgh(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Mgh"):
    '''(experimental) Statement provider for service `mgh <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmigrationhub.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mgh <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmigrationhub.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1342ffdfd9d0dfe7e6157db233e8eaa926efeab808be39e5b6982887fcd965a4)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onMigrationTask")
    def on_migration_task(
        self,
        stream: builtins.str,
        task: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mgh":
        '''(experimental) Adds a resource of type migrationTask to the statement.

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_MigrationTask.html

        :param stream: - Identifier for the stream.
        :param task: - Identifier for the task.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__aa398f057acb0a0c92fd220c507f1ec76e9dbfe35442536fadd85f3d751d6d9e)
            check_type(argname="argument stream", value=stream, expected_type=type_hints["stream"])
            check_type(argname="argument task", value=task, expected_type=type_hints["task"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mgh", jsii.invoke(self, "onMigrationTask", [stream, task, account, region, partition]))

    @jsii.member(jsii_name="onProgressUpdateStream")
    def on_progress_update_stream(
        self,
        stream: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mgh":
        '''(experimental) Adds a resource of type progressUpdateStream to the statement.

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_ProgressUpdateStreamSummary.html

        :param stream: - Identifier for the stream.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ec785b410397ca1114d62dd48c0f2fe7b5bb151882161039a4c71c6eeaca3e88)
            check_type(argname="argument stream", value=stream, expected_type=type_hints["stream"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mgh", jsii.invoke(self, "onProgressUpdateStream", [stream, account, region, partition]))

    @jsii.member(jsii_name="toAssociateCreatedArtifact")
    def to_associate_created_artifact(self) -> "Mgh":
        '''(experimental) Associate a given AWS artifact to a MigrationTask.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_AssociateCreatedArtifact.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toAssociateCreatedArtifact", []))

    @jsii.member(jsii_name="toAssociateDiscoveredResource")
    def to_associate_discovered_resource(self) -> "Mgh":
        '''(experimental) Associate a given ADS resource to a MigrationTask.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_AssociateDiscoveredResource.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toAssociateDiscoveredResource", []))

    @jsii.member(jsii_name="toCreateHomeRegionControl")
    def to_create_home_region_control(self) -> "Mgh":
        '''(experimental) Create a Migration Hub Home Region Control.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_CreateHomeRegionControl.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toCreateHomeRegionControl", []))

    @jsii.member(jsii_name="toCreateProgressUpdateStream")
    def to_create_progress_update_stream(self) -> "Mgh":
        '''(experimental) Create a ProgressUpdateStream.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_CreateProgressUpdateStream.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toCreateProgressUpdateStream", []))

    @jsii.member(jsii_name="toDeleteProgressUpdateStream")
    def to_delete_progress_update_stream(self) -> "Mgh":
        '''(experimental) Delete a ProgressUpdateStream.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_DeleteProgressUpdateStream.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toDeleteProgressUpdateStream", []))

    @jsii.member(jsii_name="toDescribeApplicationState")
    def to_describe_application_state(self) -> "Mgh":
        '''(experimental) Get an Application Discovery Service Application's state.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_DescribeApplicationState.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toDescribeApplicationState", []))

    @jsii.member(jsii_name="toDescribeHomeRegionControls")
    def to_describe_home_region_controls(self) -> "Mgh":
        '''(experimental) List Home Region Controls.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_DescribeHomeRegionControls.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toDescribeHomeRegionControls", []))

    @jsii.member(jsii_name="toDescribeMigrationTask")
    def to_describe_migration_task(self) -> "Mgh":
        '''(experimental) Describe a MigrationTask.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_DescribeMigrationTask.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toDescribeMigrationTask", []))

    @jsii.member(jsii_name="toDisassociateCreatedArtifact")
    def to_disassociate_created_artifact(self) -> "Mgh":
        '''(experimental) Disassociate a given AWS artifact from a MigrationTask.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_DisassociateCreatedArtifact.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toDisassociateCreatedArtifact", []))

    @jsii.member(jsii_name="toDisassociateDiscoveredResource")
    def to_disassociate_discovered_resource(self) -> "Mgh":
        '''(experimental) Disassociate a given ADS resource from a MigrationTask.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_DisassociateDiscoveredResource.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toDisassociateDiscoveredResource", []))

    @jsii.member(jsii_name="toGetHomeRegion")
    def to_get_home_region(self) -> "Mgh":
        '''(experimental) Get the Migration Hub Home Region.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_GetHomeRegion.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toGetHomeRegion", []))

    @jsii.member(jsii_name="toImportMigrationTask")
    def to_import_migration_task(self) -> "Mgh":
        '''(experimental) Import a MigrationTask.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_ImportMigrationTask.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toImportMigrationTask", []))

    @jsii.member(jsii_name="toListApplicationStates")
    def to_list_application_states(self) -> "Mgh":
        '''(experimental) List Application statuses.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_ListApplicationStates.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toListApplicationStates", []))

    @jsii.member(jsii_name="toListCreatedArtifacts")
    def to_list_created_artifacts(self) -> "Mgh":
        '''(experimental) List associated created artifacts for a MigrationTask.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_ListCreatedArtifacts.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toListCreatedArtifacts", []))

    @jsii.member(jsii_name="toListDiscoveredResources")
    def to_list_discovered_resources(self) -> "Mgh":
        '''(experimental) List associated ADS resources from MigrationTask.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_ListDiscoveredResources.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toListDiscoveredResources", []))

    @jsii.member(jsii_name="toListMigrationTasks")
    def to_list_migration_tasks(self) -> "Mgh":
        '''(experimental) List MigrationTasks.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_ListMigrationTasks.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toListMigrationTasks", []))

    @jsii.member(jsii_name="toListProgressUpdateStreams")
    def to_list_progress_update_streams(self) -> "Mgh":
        '''(experimental) List ProgressUpdateStreams.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_ListProgressUpdateStreams.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toListProgressUpdateStreams", []))

    @jsii.member(jsii_name="toNotifyApplicationState")
    def to_notify_application_state(self) -> "Mgh":
        '''(experimental) Update an Application Discovery Service Application's state.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_NotifyApplicationState.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toNotifyApplicationState", []))

    @jsii.member(jsii_name="toNotifyMigrationTaskState")
    def to_notify_migration_task_state(self) -> "Mgh":
        '''(experimental) Notify latest MigrationTask state.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_NotifyMigrationTaskState.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toNotifyMigrationTaskState", []))

    @jsii.member(jsii_name="toPutResourceAttributes")
    def to_put_resource_attributes(self) -> "Mgh":
        '''(experimental) Put ResourceAttributes.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub/latest/ug/API_PutResourceAttributes.html

        :stability: experimental
        '''
        return typing.cast("Mgh", jsii.invoke(self, "toPutResourceAttributes", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__800930f0d1ad4c2481aabb4c662e46cb3c741bbba5671af0a68ba220e210c19a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__528055b983f861edb2275ce8692401741b9fe16dbe422462deecf989d7daef7d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Mgn(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Mgn"):
    '''(experimental) Statement provider for service `mgn <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsapplicationmigrationservice.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mgn <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsapplicationmigrationservice.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4c127079992aaf6b78a12b3a012f25710fd4f274da61362de3d21120795a3f61)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifCreateAction")
    def if_create_action(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Mgn":
        '''(experimental) Filters access by the name of a resource-creating API action.

        https://docs.aws.amazon.com/mgn/latest/ug/supported-iam-actions-tagging.html

        Applies to actions:

        - .toTagResource()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1217d5ba1f0dca80efc8e5cb4c70b61eefd61e5cac9339098086aac2ac74101f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Mgn", jsii.invoke(self, "ifCreateAction", [value, operator]))

    @jsii.member(jsii_name="onApplicationResource")
    def on_application_resource(
        self,
        application_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mgn":
        '''(experimental) Adds a resource of type ApplicationResource to the statement.

        https://docs.aws.amazon.com/mgn/latest/ug/applications.html

        :param application_id: - Identifier for the applicationID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5fa640d7677b81dd80f4ab2b064257d764450864f53d3aeadf9aecccec0281e9)
            check_type(argname="argument application_id", value=application_id, expected_type=type_hints["application_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mgn", jsii.invoke(self, "onApplicationResource", [application_id, account, region, partition]))

    @jsii.member(jsii_name="onExportResource")
    def on_export_resource(
        self,
        export_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mgn":
        '''(experimental) Adds a resource of type ExportResource to the statement.

        https://docs.aws.amazon.com/mgn/latest/ug/exports.html

        :param export_id: - Identifier for the exportID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__607185d1714b4413d94cb198badbedc7b9835321d8db7e5c23a098e8380225d5)
            check_type(argname="argument export_id", value=export_id, expected_type=type_hints["export_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mgn", jsii.invoke(self, "onExportResource", [export_id, account, region, partition]))

    @jsii.member(jsii_name="onImportResource")
    def on_import_resource(
        self,
        import_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mgn":
        '''(experimental) Adds a resource of type ImportResource to the statement.

        https://docs.aws.amazon.com/mgn/latest/ug/imports.html

        :param import_id: - Identifier for the importID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6af1b55538f419cbf215c454c35187ed511c6609818999cd632f4858e8047dcb)
            check_type(argname="argument import_id", value=import_id, expected_type=type_hints["import_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mgn", jsii.invoke(self, "onImportResource", [import_id, account, region, partition]))

    @jsii.member(jsii_name="onJobResource")
    def on_job_resource(
        self,
        job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mgn":
        '''(experimental) Adds a resource of type JobResource to the statement.

        https://docs.aws.amazon.com/mgn/latest/ug/launching-target-servers.html

        :param job_id: - Identifier for the jobID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__39fb1961f1edbe7b0304c3b66b266126850bc176b4f2e3b4c183c3cadbb50281)
            check_type(argname="argument job_id", value=job_id, expected_type=type_hints["job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mgn", jsii.invoke(self, "onJobResource", [job_id, account, region, partition]))

    @jsii.member(jsii_name="onLaunchConfigurationTemplateResource")
    def on_launch_configuration_template_resource(
        self,
        launch_configuration_template_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mgn":
        '''(experimental) Adds a resource of type LaunchConfigurationTemplateResource to the statement.

        https://docs.aws.amazon.com/mgn/latest/ug/post-launch-settings.html

        :param launch_configuration_template_id: - Identifier for the launchConfigurationTemplateID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9a933b82ae220a7e93c968d97ce1cb3e720a8c40d754ad5cadbdda2fb6da90c6)
            check_type(argname="argument launch_configuration_template_id", value=launch_configuration_template_id, expected_type=type_hints["launch_configuration_template_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mgn", jsii.invoke(self, "onLaunchConfigurationTemplateResource", [launch_configuration_template_id, account, region, partition]))

    @jsii.member(jsii_name="onReplicationConfigurationTemplateResource")
    def on_replication_configuration_template_resource(
        self,
        replication_configuration_template_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mgn":
        '''(experimental) Adds a resource of type ReplicationConfigurationTemplateResource to the statement.

        https://docs.aws.amazon.com/mgn/latest/ug/replication-settings-template.html

        :param replication_configuration_template_id: - Identifier for the replicationConfigurationTemplateID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1d18a515256df566854263d20f405668900afdbf6d6019e411ac6eb3f78a85ab)
            check_type(argname="argument replication_configuration_template_id", value=replication_configuration_template_id, expected_type=type_hints["replication_configuration_template_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mgn", jsii.invoke(self, "onReplicationConfigurationTemplateResource", [replication_configuration_template_id, account, region, partition]))

    @jsii.member(jsii_name="onSourceServerResource")
    def on_source_server_resource(
        self,
        source_server_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mgn":
        '''(experimental) Adds a resource of type SourceServerResource to the statement.

        https://docs.aws.amazon.com/mgn/latest/ug/source-servers.html

        :param source_server_id: - Identifier for the sourceServerID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a6ed916ccf0aac149204fc7ceb2e3fca814dd0146011fe478862bac43337af16)
            check_type(argname="argument source_server_id", value=source_server_id, expected_type=type_hints["source_server_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mgn", jsii.invoke(self, "onSourceServerResource", [source_server_id, account, region, partition]))

    @jsii.member(jsii_name="onVcenterClientResource")
    def on_vcenter_client_resource(
        self,
        vcenter_client_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mgn":
        '''(experimental) Adds a resource of type VcenterClientResource to the statement.

        https://docs.aws.amazon.com/mgn/latest/ug/agentless-mgn.html

        :param vcenter_client_id: - Identifier for the vcenterClientID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4591fc4ef576221e1d8e3e5969f165b6c5db5b62fb7c581b4c7dbe17515cfcc8)
            check_type(argname="argument vcenter_client_id", value=vcenter_client_id, expected_type=type_hints["vcenter_client_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mgn", jsii.invoke(self, "onVcenterClientResource", [vcenter_client_id, account, region, partition]))

    @jsii.member(jsii_name="onWaveResource")
    def on_wave_resource(
        self,
        wave_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mgn":
        '''(experimental) Adds a resource of type WaveResource to the statement.

        https://docs.aws.amazon.com/mgn/latest/ug/waves.html

        :param wave_id: - Identifier for the waveID.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8baba7845a30595b61068a500bcca7927142c9543d80f3ba5a04b0766de429fc)
            check_type(argname="argument wave_id", value=wave_id, expected_type=type_hints["wave_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mgn", jsii.invoke(self, "onWaveResource", [wave_id, account, region, partition]))

    @jsii.member(jsii_name="toArchiveApplication")
    def to_archive_application(self) -> "Mgn":
        '''(experimental) Grants permission to archive an application.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_ArchiveApplication.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toArchiveApplication", []))

    @jsii.member(jsii_name="toArchiveWave")
    def to_archive_wave(self) -> "Mgn":
        '''(experimental) Grants permission to archive a wave.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_ArchiveWave.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toArchiveWave", []))

    @jsii.member(jsii_name="toAssociateApplications")
    def to_associate_applications(self) -> "Mgn":
        '''(experimental) Grants permission to associate applications to a wave.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_AssociateApplications.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toAssociateApplications", []))

    @jsii.member(jsii_name="toAssociateSourceServers")
    def to_associate_source_servers(self) -> "Mgn":
        '''(experimental) Grants permission to associate source servers to an application.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_AssociateSourceServers.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toAssociateSourceServers", []))

    @jsii.member(jsii_name="toBatchCreateVolumeSnapshotGroupForMgn")
    def to_batch_create_volume_snapshot_group_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to create volume snapshot group.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toBatchCreateVolumeSnapshotGroupForMgn", []))

    @jsii.member(jsii_name="toBatchDeleteSnapshotRequestForMgn")
    def to_batch_delete_snapshot_request_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to batch delete snapshot request.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toBatchDeleteSnapshotRequestForMgn", []))

    @jsii.member(jsii_name="toChangeServerLifeCycleState")
    def to_change_server_life_cycle_state(self) -> "Mgn":
        '''(experimental) Grants permission to change source server life cycle state.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_ChangeServerLifeCycleState.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toChangeServerLifeCycleState", []))

    @jsii.member(jsii_name="toCreateApplication")
    def to_create_application(self) -> "Mgn":
        '''(experimental) Grants permission to create an application.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_CreateApplication.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toCreateApplication", []))

    @jsii.member(jsii_name="toCreateLaunchConfigurationTemplate")
    def to_create_launch_configuration_template(self) -> "Mgn":
        '''(experimental) Grants permission to create launch configuration template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_CreateLaunchConfigurationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toCreateLaunchConfigurationTemplate", []))

    @jsii.member(jsii_name="toCreateReplicationConfigurationTemplate")
    def to_create_replication_configuration_template(self) -> "Mgn":
        '''(experimental) Grants permission to create replication configuration template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_CreateReplicationConfigurationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toCreateReplicationConfigurationTemplate", []))

    @jsii.member(jsii_name="toCreateVcenterClientForMgn")
    def to_create_vcenter_client_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to create vcenter client.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toCreateVcenterClientForMgn", []))

    @jsii.member(jsii_name="toCreateWave")
    def to_create_wave(self) -> "Mgn":
        '''(experimental) Grants permission to create a wave.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_CreateWave.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toCreateWave", []))

    @jsii.member(jsii_name="toDeleteApplication")
    def to_delete_application(self) -> "Mgn":
        '''(experimental) Grants permission to delete an application.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DeleteApplication.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDeleteApplication", []))

    @jsii.member(jsii_name="toDeleteJob")
    def to_delete_job(self) -> "Mgn":
        '''(experimental) Grants permission to delete job.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DeleteJob.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDeleteJob", []))

    @jsii.member(jsii_name="toDeleteLaunchConfigurationTemplate")
    def to_delete_launch_configuration_template(self) -> "Mgn":
        '''(experimental) Grants permission to delete launch configuration template.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DeleteLaunchConfigurationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDeleteLaunchConfigurationTemplate", []))

    @jsii.member(jsii_name="toDeleteReplicationConfigurationTemplate")
    def to_delete_replication_configuration_template(self) -> "Mgn":
        '''(experimental) Grants permission to delete replication configuration template.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DeleteReplicationConfigurationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDeleteReplicationConfigurationTemplate", []))

    @jsii.member(jsii_name="toDeleteSourceServer")
    def to_delete_source_server(self) -> "Mgn":
        '''(experimental) Grants permission to delete source server.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DeleteSourceServer.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDeleteSourceServer", []))

    @jsii.member(jsii_name="toDeleteVcenterClient")
    def to_delete_vcenter_client(self) -> "Mgn":
        '''(experimental) Grants permission to delete vcenter client.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DeleteVcenterClient.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDeleteVcenterClient", []))

    @jsii.member(jsii_name="toDeleteWave")
    def to_delete_wave(self) -> "Mgn":
        '''(experimental) Grants permission to delete a wave.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DeleteWave.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDeleteWave", []))

    @jsii.member(jsii_name="toDescribeJobLogItems")
    def to_describe_job_log_items(self) -> "Mgn":
        '''(experimental) Grants permission to describe job log items.

        Access Level: Read

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DescribeJobLogItems.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDescribeJobLogItems", []))

    @jsii.member(jsii_name="toDescribeJobs")
    def to_describe_jobs(self) -> "Mgn":
        '''(experimental) Grants permission to describe jobs.

        Access Level: List

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DescribeJobs.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDescribeJobs", []))

    @jsii.member(jsii_name="toDescribeLaunchConfigurationTemplates")
    def to_describe_launch_configuration_templates(self) -> "Mgn":
        '''(experimental) Grants permission to describe launch configuration template.

        Access Level: List

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DescribeLaunchConfigurationTemplates.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDescribeLaunchConfigurationTemplates", []))

    @jsii.member(jsii_name="toDescribeReplicationConfigurationTemplates")
    def to_describe_replication_configuration_templates(self) -> "Mgn":
        '''(experimental) Grants permission to describe replication configuration template.

        Access Level: List

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DescribeReplicationConfigurationTemplates.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDescribeReplicationConfigurationTemplates", []))

    @jsii.member(jsii_name="toDescribeReplicationServerAssociationsForMgn")
    def to_describe_replication_server_associations_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to describe replication server associations.

        Access Level: Read

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDescribeReplicationServerAssociationsForMgn", []))

    @jsii.member(jsii_name="toDescribeSnapshotRequestsForMgn")
    def to_describe_snapshot_requests_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to describe snapshots requests.

        Access Level: Read

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDescribeSnapshotRequestsForMgn", []))

    @jsii.member(jsii_name="toDescribeSourceServers")
    def to_describe_source_servers(self) -> "Mgn":
        '''(experimental) Grants permission to describe source servers.

        Access Level: List

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DescribeSourceServers.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDescribeSourceServers", []))

    @jsii.member(jsii_name="toDescribeVcenterClients")
    def to_describe_vcenter_clients(self) -> "Mgn":
        '''(experimental) Grants permission to describe vcenter clients.

        Access Level: List

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DescribeVcenterClients.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDescribeVcenterClients", []))

    @jsii.member(jsii_name="toDisassociateApplications")
    def to_disassociate_applications(self) -> "Mgn":
        '''(experimental) Grants permission to disassociate applications from a wave.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DisassociateApplications.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDisassociateApplications", []))

    @jsii.member(jsii_name="toDisassociateSourceServers")
    def to_disassociate_source_servers(self) -> "Mgn":
        '''(experimental) Grants permission to disassociate source servers from an application.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DisassociateSourceServers.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDisassociateSourceServers", []))

    @jsii.member(jsii_name="toDisconnectFromService")
    def to_disconnect_from_service(self) -> "Mgn":
        '''(experimental) Grants permission to disconnect source server from service.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_DisconnectFromService.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toDisconnectFromService", []))

    @jsii.member(jsii_name="toFinalizeCutover")
    def to_finalize_cutover(self) -> "Mgn":
        '''(experimental) Grants permission to finalize cutover.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_FinalizeCutover.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toFinalizeCutover", []))

    @jsii.member(jsii_name="toGetAgentCommandForMgn")
    def to_get_agent_command_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to get agent command.

        Access Level: Read

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toGetAgentCommandForMgn", []))

    @jsii.member(jsii_name="toGetAgentConfirmedResumeInfoForMgn")
    def to_get_agent_confirmed_resume_info_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to get agent confirmed resume info.

        Access Level: Read

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toGetAgentConfirmedResumeInfoForMgn", []))

    @jsii.member(jsii_name="toGetAgentInstallationAssetsForMgn")
    def to_get_agent_installation_assets_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to get agent installation assets.

        Access Level: Read

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toGetAgentInstallationAssetsForMgn", []))

    @jsii.member(jsii_name="toGetAgentReplicationInfoForMgn")
    def to_get_agent_replication_info_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to get agent replication info.

        Access Level: Read

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toGetAgentReplicationInfoForMgn", []))

    @jsii.member(jsii_name="toGetAgentRuntimeConfigurationForMgn")
    def to_get_agent_runtime_configuration_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to get agent runtime configuration.

        Access Level: Read

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toGetAgentRuntimeConfigurationForMgn", []))

    @jsii.member(jsii_name="toGetAgentSnapshotCreditsForMgn")
    def to_get_agent_snapshot_credits_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to get agent snapshots credits.

        Access Level: Read

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toGetAgentSnapshotCreditsForMgn", []))

    @jsii.member(jsii_name="toGetChannelCommandsForMgn")
    def to_get_channel_commands_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to get channel commands.

        Access Level: Read

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toGetChannelCommandsForMgn", []))

    @jsii.member(jsii_name="toGetLaunchConfiguration")
    def to_get_launch_configuration(self) -> "Mgn":
        '''(experimental) Grants permission to get launch configuration.

        Access Level: Read

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_GetLaunchConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toGetLaunchConfiguration", []))

    @jsii.member(jsii_name="toGetReplicationConfiguration")
    def to_get_replication_configuration(self) -> "Mgn":
        '''(experimental) Grants permission to get replication configuration.

        Access Level: Read

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_GetReplicationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toGetReplicationConfiguration", []))

    @jsii.member(jsii_name="toGetVcenterClientCommandsForMgn")
    def to_get_vcenter_client_commands_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to get vcenter client commands.

        Access Level: Read

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toGetVcenterClientCommandsForMgn", []))

    @jsii.member(jsii_name="toInitializeService")
    def to_initialize_service(self) -> "Mgn":
        '''(experimental) Grants permission to initialize service.

        Access Level: Write

        Dependent actions:

        - iam:AddRoleToInstanceProfile
        - iam:CreateInstanceProfile
        - iam:CreateServiceLinkedRole
        - iam:GetInstanceProfile

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_InitializeService.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toInitializeService", []))

    @jsii.member(jsii_name="toIssueClientCertificateForMgn")
    def to_issue_client_certificate_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to issue a client certificate.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toIssueClientCertificateForMgn", []))

    @jsii.member(jsii_name="toListApplications")
    def to_list_applications(self) -> "Mgn":
        '''(experimental) Grants permission to list application summaries.

        Access Level: List

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_ListApplications.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toListApplications", []))

    @jsii.member(jsii_name="toListExportErrors")
    def to_list_export_errors(self) -> "Mgn":
        '''(experimental) Grants permission to list the errors of an export task.

        Access Level: List

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_ListExportErrors.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toListExportErrors", []))

    @jsii.member(jsii_name="toListExports")
    def to_list_exports(self) -> "Mgn":
        '''(experimental) Grants permission to list export tasks.

        Access Level: List

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_ListExports.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toListExports", []))

    @jsii.member(jsii_name="toListImportErrors")
    def to_list_import_errors(self) -> "Mgn":
        '''(experimental) Grants permission to list the errors of an import task.

        Access Level: List

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_ListImportErrors.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toListImportErrors", []))

    @jsii.member(jsii_name="toListImports")
    def to_list_imports(self) -> "Mgn":
        '''(experimental) Grants permission to list the import tasks.

        Access Level: List

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_ListImports.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toListImports", []))

    @jsii.member(jsii_name="toListSourceServerActions")
    def to_list_source_server_actions(self) -> "Mgn":
        '''(experimental) Grants permission to list source server action documents.

        Access Level: List

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_ListSourceServerActions.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toListSourceServerActions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Mgn":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTemplateActions")
    def to_list_template_actions(self) -> "Mgn":
        '''(experimental) Grants permission to list launch configuration template action documents.

        Access Level: List

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_ListTemplateActions.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toListTemplateActions", []))

    @jsii.member(jsii_name="toListWaves")
    def to_list_waves(self) -> "Mgn":
        '''(experimental) Grants permission to list wave summaries.

        Access Level: List

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_ListWaves.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toListWaves", []))

    @jsii.member(jsii_name="toMarkAsArchived")
    def to_mark_as_archived(self) -> "Mgn":
        '''(experimental) Grants permission to mark source server as archived.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_MarkAsArchived.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toMarkAsArchived", []))

    @jsii.member(jsii_name="toNotifyAgentAuthenticationForMgn")
    def to_notify_agent_authentication_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to notify agent authentication.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toNotifyAgentAuthenticationForMgn", []))

    @jsii.member(jsii_name="toNotifyAgentConnectedForMgn")
    def to_notify_agent_connected_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to notify agent is connected.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toNotifyAgentConnectedForMgn", []))

    @jsii.member(jsii_name="toNotifyAgentDisconnectedForMgn")
    def to_notify_agent_disconnected_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to notify agent is disconnected.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toNotifyAgentDisconnectedForMgn", []))

    @jsii.member(jsii_name="toNotifyAgentReplicationProgressForMgn")
    def to_notify_agent_replication_progress_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to notify agent replication progress.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toNotifyAgentReplicationProgressForMgn", []))

    @jsii.member(jsii_name="toNotifyVcenterClientStartedForMgn")
    def to_notify_vcenter_client_started_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to notify vcenter client started.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toNotifyVcenterClientStartedForMgn", []))

    @jsii.member(jsii_name="toPutSourceServerAction")
    def to_put_source_server_action(self) -> "Mgn":
        '''(experimental) Grants permission to put source server action document.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_PutSourceServerAction.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toPutSourceServerAction", []))

    @jsii.member(jsii_name="toPutTemplateAction")
    def to_put_template_action(self) -> "Mgn":
        '''(experimental) Grants permission to put launch configuration template action document.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_PutTemplateAction.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toPutTemplateAction", []))

    @jsii.member(jsii_name="toRegisterAgentForMgn")
    def to_register_agent_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to register agent.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toRegisterAgentForMgn", []))

    @jsii.member(jsii_name="toRemoveSourceServerAction")
    def to_remove_source_server_action(self) -> "Mgn":
        '''(experimental) Grants permission to remove source server action document.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_RemoveSourceServerAction.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toRemoveSourceServerAction", []))

    @jsii.member(jsii_name="toRemoveTemplateAction")
    def to_remove_template_action(self) -> "Mgn":
        '''(experimental) Grants permission to remove launch configuration template action document.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_RemoveTemplateAction.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toRemoveTemplateAction", []))

    @jsii.member(jsii_name="toRetryDataReplication")
    def to_retry_data_replication(self) -> "Mgn":
        '''(experimental) Grants permission to retry replication.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_RetryDataReplication.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toRetryDataReplication", []))

    @jsii.member(jsii_name="toSendAgentLogsForMgn")
    def to_send_agent_logs_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to send agent logs.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toSendAgentLogsForMgn", []))

    @jsii.member(jsii_name="toSendAgentMetricsForMgn")
    def to_send_agent_metrics_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to send agent metrics.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toSendAgentMetricsForMgn", []))

    @jsii.member(jsii_name="toSendChannelCommandResultForMgn")
    def to_send_channel_command_result_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to send channel command result.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toSendChannelCommandResultForMgn", []))

    @jsii.member(jsii_name="toSendClientLogsForMgn")
    def to_send_client_logs_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to send client logs.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toSendClientLogsForMgn", []))

    @jsii.member(jsii_name="toSendClientMetricsForMgn")
    def to_send_client_metrics_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to send client metrics.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toSendClientMetricsForMgn", []))

    @jsii.member(jsii_name="toSendVcenterClientCommandResultForMgn")
    def to_send_vcenter_client_command_result_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to send vcenter client command result.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toSendVcenterClientCommandResultForMgn", []))

    @jsii.member(jsii_name="toSendVcenterClientLogsForMgn")
    def to_send_vcenter_client_logs_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to send vcenter client logs.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toSendVcenterClientLogsForMgn", []))

    @jsii.member(jsii_name="toSendVcenterClientMetricsForMgn")
    def to_send_vcenter_client_metrics_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to send vcenter client metrics.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toSendVcenterClientMetricsForMgn", []))

    @jsii.member(jsii_name="toStartCutover")
    def to_start_cutover(self) -> "Mgn":
        '''(experimental) Grants permission to start cutover.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:AttachVolume
        - ec2:AuthorizeSecurityGroupEgress
        - ec2:AuthorizeSecurityGroupIngress
        - ec2:CreateLaunchTemplate
        - ec2:CreateLaunchTemplateVersion
        - ec2:CreateSecurityGroup
        - ec2:CreateSnapshot
        - ec2:CreateTags
        - ec2:CreateVolume
        - ec2:DeleteLaunchTemplateVersions
        - ec2:DeleteSnapshot
        - ec2:DeleteVolume
        - ec2:DescribeAccountAttributes
        - ec2:DescribeAvailabilityZones
        - ec2:DescribeImages
        - ec2:DescribeInstanceAttribute
        - ec2:DescribeInstanceStatus
        - ec2:DescribeInstanceTypes
        - ec2:DescribeInstances
        - ec2:DescribeLaunchTemplateVersions
        - ec2:DescribeLaunchTemplates
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSnapshots
        - ec2:DescribeSubnets
        - ec2:DescribeVolumes
        - ec2:DetachVolume
        - ec2:ModifyInstanceAttribute
        - ec2:ModifyLaunchTemplate
        - ec2:ReportInstanceStatus
        - ec2:RevokeSecurityGroupEgress
        - ec2:RunInstances
        - ec2:StartInstances
        - ec2:StopInstances
        - ec2:TerminateInstances
        - iam:PassRole
        - mgn:ListTagsForResource

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_StartCutover.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toStartCutover", []))

    @jsii.member(jsii_name="toStartExport")
    def to_start_export(self) -> "Mgn":
        '''(experimental) Grants permission to start an export task.

        Access Level: Write

        Dependent actions:

        - ec2:DescribeLaunchTemplateVersions
        - mgn:DescribeSourceServers
        - mgn:GetLaunchConfiguration
        - mgn:ListApplications
        - mgn:ListWaves
        - s3:PutObject

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_StartExport.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toStartExport", []))

    @jsii.member(jsii_name="toStartImport")
    def to_start_import(self) -> "Mgn":
        '''(experimental) Grants permission to create an import task.

        Access Level: Write

        Dependent actions:

        - ec2:CreateLaunchTemplateVersion
        - ec2:DescribeLaunchTemplateVersions
        - ec2:ModifyLaunchTemplate
        - mgn:DescribeSourceServers
        - mgn:GetLaunchConfiguration
        - mgn:ListApplications
        - mgn:ListWaves
        - mgn:TagResource
        - mgn:UpdateLaunchConfiguration
        - s3:PutObject

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_StartImport.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toStartImport", []))

    @jsii.member(jsii_name="toStartReplication")
    def to_start_replication(self) -> "Mgn":
        '''(experimental) Grants permission to start replication.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_StartReplication.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toStartReplication", []))

    @jsii.member(jsii_name="toStartTest")
    def to_start_test(self) -> "Mgn":
        '''(experimental) Grants permission to start test.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:AttachVolume
        - ec2:AuthorizeSecurityGroupEgress
        - ec2:AuthorizeSecurityGroupIngress
        - ec2:CreateLaunchTemplate
        - ec2:CreateLaunchTemplateVersion
        - ec2:CreateSecurityGroup
        - ec2:CreateSnapshot
        - ec2:CreateTags
        - ec2:CreateVolume
        - ec2:DeleteLaunchTemplateVersions
        - ec2:DeleteSnapshot
        - ec2:DeleteVolume
        - ec2:DescribeAccountAttributes
        - ec2:DescribeAvailabilityZones
        - ec2:DescribeImages
        - ec2:DescribeInstanceAttribute
        - ec2:DescribeInstanceStatus
        - ec2:DescribeInstanceTypes
        - ec2:DescribeInstances
        - ec2:DescribeLaunchTemplateVersions
        - ec2:DescribeLaunchTemplates
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSnapshots
        - ec2:DescribeSubnets
        - ec2:DescribeVolumes
        - ec2:DetachVolume
        - ec2:ModifyInstanceAttribute
        - ec2:ModifyLaunchTemplate
        - ec2:ReportInstanceStatus
        - ec2:RevokeSecurityGroupEgress
        - ec2:RunInstances
        - ec2:StartInstances
        - ec2:StopInstances
        - ec2:TerminateInstances
        - iam:PassRole
        - mgn:ListTagsForResource

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_StartTest.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toStartTest", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Mgn":
        '''(experimental) Grants permission to assign a resource tag.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifCreateAction()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toTerminateTargetInstances")
    def to_terminate_target_instances(self) -> "Mgn":
        '''(experimental) Grants permission to terminate target instances.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:DeleteVolume
        - ec2:DescribeInstances
        - ec2:DescribeVolumes
        - ec2:TerminateInstances

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_TerminateTargetInstances.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toTerminateTargetInstances", []))

    @jsii.member(jsii_name="toUnarchiveApplication")
    def to_unarchive_application(self) -> "Mgn":
        '''(experimental) Grants permission to unarchive an application.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_UnarchiveApplication.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUnarchiveApplication", []))

    @jsii.member(jsii_name="toUnarchiveWave")
    def to_unarchive_wave(self) -> "Mgn":
        '''(experimental) Grants permission to unarchive a wave.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_UnarchiveWave.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUnarchiveWave", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Mgn":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAgentBacklogForMgn")
    def to_update_agent_backlog_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to update agent backlog.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUpdateAgentBacklogForMgn", []))

    @jsii.member(jsii_name="toUpdateAgentConversionInfoForMgn")
    def to_update_agent_conversion_info_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to update agent conversion info.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUpdateAgentConversionInfoForMgn", []))

    @jsii.member(jsii_name="toUpdateAgentReplicationInfoForMgn")
    def to_update_agent_replication_info_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to update agent replication info.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUpdateAgentReplicationInfoForMgn", []))

    @jsii.member(jsii_name="toUpdateAgentReplicationProcessStateForMgn")
    def to_update_agent_replication_process_state_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to update agent replication process state.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUpdateAgentReplicationProcessStateForMgn", []))

    @jsii.member(jsii_name="toUpdateAgentSourcePropertiesForMgn")
    def to_update_agent_source_properties_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to update agent source properties.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUpdateAgentSourcePropertiesForMgn", []))

    @jsii.member(jsii_name="toUpdateApplication")
    def to_update_application(self) -> "Mgn":
        '''(experimental) Grants permission to update an application.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_UpdateApplication.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUpdateApplication", []))

    @jsii.member(jsii_name="toUpdateLaunchConfiguration")
    def to_update_launch_configuration(self) -> "Mgn":
        '''(experimental) Grants permission to update launch configuration.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_UpdateLaunchConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUpdateLaunchConfiguration", []))

    @jsii.member(jsii_name="toUpdateLaunchConfigurationTemplate")
    def to_update_launch_configuration_template(self) -> "Mgn":
        '''(experimental) Grants permission to update launch configuration.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_UpdateLaunchConfigurationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUpdateLaunchConfigurationTemplate", []))

    @jsii.member(jsii_name="toUpdateReplicationConfiguration")
    def to_update_replication_configuration(self) -> "Mgn":
        '''(experimental) Grants permission to update replication configuration.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_UpdateReplicationConfiguration.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUpdateReplicationConfiguration", []))

    @jsii.member(jsii_name="toUpdateReplicationConfigurationTemplate")
    def to_update_replication_configuration_template(self) -> "Mgn":
        '''(experimental) Grants permission to update replication configuration template.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_UpdateReplicationConfigurationTemplate.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUpdateReplicationConfigurationTemplate", []))

    @jsii.member(jsii_name="toUpdateSourceServerReplicationType")
    def to_update_source_server_replication_type(self) -> "Mgn":
        '''(experimental) Grants permission to update source server replication type.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_UpdateSourceServerReplicationType.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUpdateSourceServerReplicationType", []))

    @jsii.member(jsii_name="toUpdateWave")
    def to_update_wave(self) -> "Mgn":
        '''(experimental) Grants permission to update a wave.

        Access Level: Write

        https://docs.aws.amazon.com/mgn/latest/APIReference/API_UpdateWave.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toUpdateWave", []))

    @jsii.member(jsii_name="toVerifyClientRoleForMgn")
    def to_verify_client_role_for_mgn(self) -> "Mgn":
        '''(experimental) Grants permission to verify client role.

        Access Level: Read

        https://docs.aws.amazon.com/mgn/latest/ug/mgn-apis.html

        :stability: experimental
        '''
        return typing.cast("Mgn", jsii.invoke(self, "toVerifyClientRoleForMgn", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__edc3e0bab791bd432e207fdd0ccb316ff367fff36041f5aa2db2882884b70e2f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9e730ed98df723da290e51f16dd7e60505c4d38aa90005afda91a71c922e486f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class MigrationhubOrchestrator(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.MigrationhubOrchestrator",
):
    '''(experimental) Statement provider for service `migrationhub-orchestrator <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmigrationhuborchestrator.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `migrationhub-orchestrator <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmigrationhuborchestrator.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bf5524cf24f5ff27e0c967e8b7d078b392f46d5fc2544f357dc9340455442590)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onWorkflow")
    def on_workflow(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "MigrationhubOrchestrator":
        '''(experimental) Adds a resource of type workflow to the statement.

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/userguide/workflow.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cb0cd65b2fb848b31c969484c49f3d05978a01fb9480367d2a377ac65cb5ad1c)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "onWorkflow", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateWorkflow")
    def to_create_workflow(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to create a workflow based on the selected template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_CreateWorkflow.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toCreateWorkflow", []))

    @jsii.member(jsii_name="toCreateWorkflowStep")
    def to_create_workflow_step(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to create a step under a workflow and a specific step group.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_CreateWorkflowStep.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toCreateWorkflowStep", []))

    @jsii.member(jsii_name="toCreateWorkflowStepGroup")
    def to_create_workflow_step_group(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to to create a custom step group for a given workflow.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_CreateWorkflowStepGroup.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toCreateWorkflowStepGroup", []))

    @jsii.member(jsii_name="toDeleteWorkflow")
    def to_delete_workflow(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to a workflow.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_DeleteWorkflow.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toDeleteWorkflow", []))

    @jsii.member(jsii_name="toDeleteWorkflowStep")
    def to_delete_workflow_step(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to delete a step from a specific step group under a workflow.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_DeleteWorkflowStep.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toDeleteWorkflowStep", []))

    @jsii.member(jsii_name="toDeleteWorkflowStepGroup")
    def to_delete_workflow_step_group(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to delete a step group associated with a workflow.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_DeleteWorkflowStepGroup.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toDeleteWorkflowStepGroup", []))

    @jsii.member(jsii_name="toGetMessage")
    def to_get_message(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to the plugin to receive information from the service.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_GetMessage.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toGetMessage", []))

    @jsii.member(jsii_name="toGetTemplate")
    def to_get_template(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to get retrieve metadata for a Template.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_GetTemplate.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toGetTemplate", []))

    @jsii.member(jsii_name="toGetTemplateStep")
    def to_get_template_step(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to retrieve details of a step associated with a template and a step group.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_GetTemplateStep.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toGetTemplateStep", []))

    @jsii.member(jsii_name="toGetTemplateStepGroup")
    def to_get_template_step_group(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to retrieve metadata of a step group under a template.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_GetTemplateStepGroup.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toGetTemplateStepGroup", []))

    @jsii.member(jsii_name="toGetWorkflow")
    def to_get_workflow(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to retrieve metadata asscociated with a workflow.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_GetWorkflow.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toGetWorkflow", []))

    @jsii.member(jsii_name="toGetWorkflowStep")
    def to_get_workflow_step(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to get details of step associated with a workflow and a step group.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_GetWorkflowStep.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toGetWorkflowStep", []))

    @jsii.member(jsii_name="toGetWorkflowStepGroup")
    def to_get_workflow_step_group(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to get details of a step group associated with a workflow.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_GetWorkflowStepGroup.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toGetWorkflowStepGroup", []))

    @jsii.member(jsii_name="toListPlugins")
    def to_list_plugins(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to get a list all registered Plugins.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_ListPlugins.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toListPlugins", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to get a list of all the tags tied to a resource.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTemplates")
    def to_list_templates(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to get a list of all Templates available to customer.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_ListTemplates.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toListTemplates", []))

    @jsii.member(jsii_name="toListTemplateStepGroups")
    def to_list_template_step_groups(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to lists step groups of a template.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_ListTemplateStepGroups.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toListTemplateStepGroups", []))

    @jsii.member(jsii_name="toListTemplateSteps")
    def to_list_template_steps(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to get a list of steps in a step group.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_ListServers.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toListTemplateSteps", []))

    @jsii.member(jsii_name="toListWorkflows")
    def to_list_workflows(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to list all workflows.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_ListWorkflows.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toListWorkflows", []))

    @jsii.member(jsii_name="toListWorkflowStepGroups")
    def to_list_workflow_step_groups(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to get list of step groups associated with a workflow.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_ListWorkflowStepGroups.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toListWorkflowStepGroups", []))

    @jsii.member(jsii_name="toListWorkflowSteps")
    def to_list_workflow_steps(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to get a list of steps within step group associated with a workflow.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_ListAntiPatterns.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toListWorkflowSteps", []))

    @jsii.member(jsii_name="toRegisterPlugin")
    def to_register_plugin(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to register the plugin to receive an ID and to start receiving messages from the service.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_RegisterPlugin.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toRegisterPlugin", []))

    @jsii.member(jsii_name="toRetryWorkflowStep")
    def to_retry_workflow_step(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to retry a failed step within a workflow.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_RetryWorkflowStep.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toRetryWorkflowStep", []))

    @jsii.member(jsii_name="toSendMessage")
    def to_send_message(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to the plugin to send information to the service.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_SendMessage.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toSendMessage", []))

    @jsii.member(jsii_name="toStartWorkflow")
    def to_start_workflow(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to start a workflow or resume a stopped workflow.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_StartWorkflow.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toStartWorkflow", []))

    @jsii.member(jsii_name="toStopWorkflow")
    def to_stop_workflow(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to stop a workflow.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_StopWorkflow.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toStopWorkflow", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to add tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateWorkflow")
    def to_update_workflow(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to update the metadata associated with the workflow.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_UpdateWorkflow.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toUpdateWorkflow", []))

    @jsii.member(jsii_name="toUpdateWorkflowStep")
    def to_update_workflow_step(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to update metadata and status of a custom step within a workflow.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_UpdateWorkflowStep.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toUpdateWorkflowStep", []))

    @jsii.member(jsii_name="toUpdateWorkflowStepGroup")
    def to_update_workflow_step_group(self) -> "MigrationhubOrchestrator":
        '''(experimental) Grants permission to update metadata associated with a step group in a given workflow.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-orchestrator/latest/APIReference/API_UpdateWorkflowStepGroup.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubOrchestrator", jsii.invoke(self, "toUpdateWorkflowStepGroup", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__55070982b7f04c3621a916abb1ae5a013805c7144537d3cb1cf25a01f6e8f3c1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d9b722c7b5caca88c0062ef2e067fc16e4aae91251cb0fcea4b4bfa1650c6811)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class MigrationhubStrategy(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.MigrationhubStrategy",
):
    '''(experimental) Statement provider for service `migrationhub-strategy <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmigrationhubstrategyrecommendations.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `migrationhub-strategy <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmigrationhubstrategyrecommendations.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__581cfd27302fc0ebb0313f922a21d61e5b036c029a77cdc0ab8e4028a441cb7e)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toGetAntiPattern")
    def to_get_anti_pattern(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to get details of each anti pattern that collector should look at in a customer's environment.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_GetAntiPattern.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toGetAntiPattern", []))

    @jsii.member(jsii_name="toGetApplicationComponentDetails")
    def to_get_application_component_details(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to get details of an application.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_GetApplicationComponentDetails.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toGetApplicationComponentDetails", []))

    @jsii.member(jsii_name="toGetApplicationComponentStrategies")
    def to_get_application_component_strategies(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to get a list of all recommended strategies and tools for an application running in a server.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_GetApplicationComponentStrategies.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toGetApplicationComponentStrategies", []))

    @jsii.member(jsii_name="toGetAssessment")
    def to_get_assessment(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to retrieve status of an on-going assessment.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_GetAssessment.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toGetAssessment", []))

    @jsii.member(jsii_name="toGetImportFileTask")
    def to_get_import_file_task(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to get details of a specific import task.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_GetImportFileTask.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toGetImportFileTask", []))

    @jsii.member(jsii_name="toGetLatestAssessmentId")
    def to_get_latest_assessment_id(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to retrieve the latest assessment id.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_GetLatestAssessmentId.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toGetLatestAssessmentId", []))

    @jsii.member(jsii_name="toGetMessage")
    def to_get_message(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to the collector to receive information from the service.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_GetMessage.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toGetMessage", []))

    @jsii.member(jsii_name="toGetPortfolioPreferences")
    def to_get_portfolio_preferences(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to retrieve customer migration/Modernization preferences.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_GetPortfolioPreferences.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toGetPortfolioPreferences", []))

    @jsii.member(jsii_name="toGetPortfolioSummary")
    def to_get_portfolio_summary(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to retrieve overall summary (number-of servers to rehost etc as well as overall number of anti patterns).

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_GetPortfolioSummary.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toGetPortfolioSummary", []))

    @jsii.member(jsii_name="toGetRecommendationReportDetails")
    def to_get_recommendation_report_details(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to retrieve detailed information about a recommendation report.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_GetRecommendationReportDetails.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toGetRecommendationReportDetails", []))

    @jsii.member(jsii_name="toGetServerDetails")
    def to_get_server_details(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to get info about a specific server.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_GetServerDetails.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toGetServerDetails", []))

    @jsii.member(jsii_name="toGetServerStrategies")
    def to_get_server_strategies(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to get recommended strategies and tools for a specific server.

        Access Level: Read

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_GetServerStrategies.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toGetServerStrategies", []))

    @jsii.member(jsii_name="toListAntiPatterns")
    def to_list_anti_patterns(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to get a list of all anti patterns that collector should look for in a customer's environment.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_ListAntiPatterns.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toListAntiPatterns", []))

    @jsii.member(jsii_name="toListApplicationComponents")
    def to_list_application_components(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to get a list of all applications running on servers on customer's servers.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_ListApplicationComponents.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toListApplicationComponents", []))

    @jsii.member(jsii_name="toListCollectors")
    def to_list_collectors(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to get a list of all collectors installed by the customer.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_ListCollectors.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toListCollectors", []))

    @jsii.member(jsii_name="toListImportFileTask")
    def to_list_import_file_task(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to get list of all imports performed by the customer.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_ListImportFileTask.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toListImportFileTask", []))

    @jsii.member(jsii_name="toListJarArtifacts")
    def to_list_jar_artifacts(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to get a list of binaries that collector should assess.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_ListJarArtifacts.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toListJarArtifacts", []))

    @jsii.member(jsii_name="toListServers")
    def to_list_servers(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to get a list of all servers in a customer's environment.

        Access Level: List

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_ListServers.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toListServers", []))

    @jsii.member(jsii_name="toPutPortfolioPreferences")
    def to_put_portfolio_preferences(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to save customer's Migration/Modernization preferences.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_PutPortfolioPreferences.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toPutPortfolioPreferences", []))

    @jsii.member(jsii_name="toRegisterCollector")
    def to_register_collector(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to register the collector to receive an ID and to start receiving messages from the service.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_RegisterCollector.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toRegisterCollector", []))

    @jsii.member(jsii_name="toSendMessage")
    def to_send_message(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to the collector to send information to the service.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_SendMessage.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toSendMessage", []))

    @jsii.member(jsii_name="toStartAssessment")
    def to_start_assessment(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to start assessment in a customer's environment (collect data from all servers and provide recommendations).

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_StartAssessment.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toStartAssessment", []))

    @jsii.member(jsii_name="toStartImportFileTask")
    def to_start_import_file_task(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to start importing data from a file provided by customer.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_StartImportFileTask.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toStartImportFileTask", []))

    @jsii.member(jsii_name="toStartRecommendationReportGeneration")
    def to_start_recommendation_report_generation(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to start generating a recommendation report.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_StartRecommendationReportGeneration.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toStartRecommendationReportGeneration", []))

    @jsii.member(jsii_name="toStopAssessment")
    def to_stop_assessment(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to stop an on-going assessment.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_StopAssessment.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toStopAssessment", []))

    @jsii.member(jsii_name="toUpdateApplicationComponentConfig")
    def to_update_application_component_config(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to update details for an application.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_UpdateApplicationComponentConfig.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toUpdateApplicationComponentConfig", []))

    @jsii.member(jsii_name="toUpdateCollectorConfiguration")
    def to_update_collector_configuration(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to the collector to send configuration information to the service.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_UpdateCollectorConfiguration.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toUpdateCollectorConfiguration", []))

    @jsii.member(jsii_name="toUpdateServerConfig")
    def to_update_server_config(self) -> "MigrationhubStrategy":
        '''(experimental) Grants permission to update info on a server along with the recommended strategy.

        Access Level: Write

        https://docs.aws.amazon.com/migrationhub-strategy/latest/APIReference/API_UpdateServerConfig.html

        :stability: experimental
        '''
        return typing.cast("MigrationhubStrategy", jsii.invoke(self, "toUpdateServerConfig", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__40fb05922b40fa733c276f9eb55de5b837e6636459815aa7c152ac8c2b26df89)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__16c373cad231658f8d8deb91f750adc3320f8aa61474135913b665a67ee350e6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Mobileanalytics(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Mobileanalytics",
):
    '''(experimental) Statement provider for service `mobileanalytics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmobileanalytics.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mobileanalytics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmobileanalytics.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__694a7efb838a692c9ecd36d2c51bc1d0469ce97008a8ec9c153238ab94f0c291)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toGetFinancialReports")
    def to_get_financial_reports(self) -> "Mobileanalytics":
        '''(experimental) Grant access to financial metrics for an app.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Mobileanalytics", jsii.invoke(self, "toGetFinancialReports", []))

    @jsii.member(jsii_name="toGetReports")
    def to_get_reports(self) -> "Mobileanalytics":
        '''(experimental) Grant access to standard metrics for an app.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Mobileanalytics", jsii.invoke(self, "toGetReports", []))

    @jsii.member(jsii_name="toPutEvents")
    def to_put_events(self) -> "Mobileanalytics":
        '''(experimental) The PutEvents operation records one or more events.

        Access Level: Write

        https://docs.aws.amazon.com/mobileanalytics/latest/ug/PutEvents.html

        :stability: experimental
        '''
        return typing.cast("Mobileanalytics", jsii.invoke(self, "toPutEvents", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ca8cad29493b4e66162e478a035b295ae9a74aba4be623afa5c20f8b3a2b401f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2f7abc7855ac457dc50dd72c558da07854aa390048153ff3899c825a89656a4f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Mobilehub(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Mobilehub",
):
    '''(experimental) Statement provider for service `mobilehub <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmobilehub.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mobilehub <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsmobilehub.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__18f71145bda6d02080a248eb7de451b8c93656fb74e847de5c55c4cb8526e249)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        project_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mobilehub":
        '''(experimental) Adds a resource of type project to the statement.

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/reference-mobile-hub-iam-managed-policies.html

        :param project_id: - Identifier for the projectId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__83c3e7c50a83087863287258e1aa656c423626e78832c80bee9d237e90977644)
            check_type(argname="argument project_id", value=project_id, expected_type=type_hints["project_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mobilehub", jsii.invoke(self, "onProject", [project_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Mobilehub":
        '''(experimental) Create a project.

        Access Level: Write

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toCreateServiceRole")
    def to_create_service_role(self) -> "Mobilehub":
        '''(experimental) Enable AWS Mobile Hub in the account by creating the required service role.

        Access Level: Write

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toCreateServiceRole", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Mobilehub":
        '''(experimental) Delete the specified project.

        Access Level: Write

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDeleteProjectSnapshot")
    def to_delete_project_snapshot(self) -> "Mobilehub":
        '''(experimental) Delete a saved snapshot of project configuration.

        Access Level: Write

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toDeleteProjectSnapshot", []))

    @jsii.member(jsii_name="toDeployToStage")
    def to_deploy_to_stage(self) -> "Mobilehub":
        '''(experimental) Deploy changes to the specified stage.

        Access Level: Write

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toDeployToStage", []))

    @jsii.member(jsii_name="toDescribeBundle")
    def to_describe_bundle(self) -> "Mobilehub":
        '''(experimental) Describe the download bundle.

        Access Level: Read

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toDescribeBundle", []))

    @jsii.member(jsii_name="toExportBundle")
    def to_export_bundle(self) -> "Mobilehub":
        '''(experimental) Export the download bundle.

        Access Level: Read

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toExportBundle", []))

    @jsii.member(jsii_name="toExportProject")
    def to_export_project(self) -> "Mobilehub":
        '''(experimental) Export the project configuration.

        Access Level: Read

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toExportProject", []))

    @jsii.member(jsii_name="toGenerateProjectParameters")
    def to_generate_project_parameters(self) -> "Mobilehub":
        '''(experimental) Generate project parameters required for code generation.

        Access Level: Read

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toGenerateProjectParameters", []))

    @jsii.member(jsii_name="toGetProject")
    def to_get_project(self) -> "Mobilehub":
        '''(experimental) Get project configuration and resources.

        Access Level: Read

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toGetProject", []))

    @jsii.member(jsii_name="toGetProjectSnapshot")
    def to_get_project_snapshot(self) -> "Mobilehub":
        '''(experimental) Fetch the previously exported project configuration snapshot.

        Access Level: Read

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toGetProjectSnapshot", []))

    @jsii.member(jsii_name="toImportProject")
    def to_import_project(self) -> "Mobilehub":
        '''(experimental) Create a new project from the previously exported project configuration.

        Access Level: Write

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toImportProject", []))

    @jsii.member(jsii_name="toInstallBundle")
    def to_install_bundle(self) -> "Mobilehub":
        '''(experimental) Install a bundle in the project deployments S3 bucket.

        Access Level: Write

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toInstallBundle", []))

    @jsii.member(jsii_name="toListAvailableConnectors")
    def to_list_available_connectors(self) -> "Mobilehub":
        '''(experimental) List the available SaaS (Software as a Service) connectors.

        Access Level: List

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toListAvailableConnectors", []))

    @jsii.member(jsii_name="toListAvailableFeatures")
    def to_list_available_features(self) -> "Mobilehub":
        '''(experimental) List available features.

        Access Level: List

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toListAvailableFeatures", []))

    @jsii.member(jsii_name="toListAvailableRegions")
    def to_list_available_regions(self) -> "Mobilehub":
        '''(experimental) List available regions for projects.

        Access Level: List

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toListAvailableRegions", []))

    @jsii.member(jsii_name="toListBundles")
    def to_list_bundles(self) -> "Mobilehub":
        '''(experimental) List the available download bundles.

        Access Level: List

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toListBundles", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Mobilehub":
        '''(experimental) List projects.

        Access Level: List

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListProjectSnapshots")
    def to_list_project_snapshots(self) -> "Mobilehub":
        '''(experimental) List saved snapshots of project configuration.

        Access Level: List

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toListProjectSnapshots", []))

    @jsii.member(jsii_name="toSynchronizeProject")
    def to_synchronize_project(self) -> "Mobilehub":
        '''(experimental) Synchronize state of resources into project.

        Access Level: Write

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toSynchronizeProject", []))

    @jsii.member(jsii_name="toUpdateProject")
    def to_update_project(self) -> "Mobilehub":
        '''(experimental) Update project.

        Access Level: Write

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toUpdateProject", []))

    @jsii.member(jsii_name="toValidateProject")
    def to_validate_project(self) -> "Mobilehub":
        '''(experimental) Validate a mobile hub project.

        Access Level: Read

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toValidateProject", []))

    @jsii.member(jsii_name="toVerifyServiceRole")
    def to_verify_service_role(self) -> "Mobilehub":
        '''(experimental) Verify AWS Mobile Hub is enabled in the account.

        Access Level: Read

        https://docs.aws.amazon.com/mobile-hub/latest/developerguide/managed-policies.html

        :stability: experimental
        '''
        return typing.cast("Mobilehub", jsii.invoke(self, "toVerifyServiceRole", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f1f34d94bafbbf38ca65da02136838515f25f937302f777f893763c064ca0518)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ee3eb84de4d4441643bb9c7dc204cd1cff46ef9b33345b397c0ea60efa6b5e6e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Mobiletargeting(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Mobiletargeting",
):
    '''(experimental) Statement provider for service `mobiletargeting <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpinpoint.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mobiletargeting <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpinpoint.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__cf68a0f3389aff8b670b1bfc491fb57c07d682c904c9723e9f9010afe8b4403a)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onApps")
    def on_apps(
        self,
        app_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mobiletargeting":
        '''(experimental) Adds a resource of type apps to the statement.

        https://docs.aws.amazon.com/pinpoint/latest/developerguide/gettingstarted.html#gettingstarted-addapp

        :param app_id: - Identifier for the appId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__212c116fdd33ce3f2920719866ef51aa1fbf9478c84bb8ab3072fdcc45b9712d)
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mobiletargeting", jsii.invoke(self, "onApps", [app_id, account, region, partition]))

    @jsii.member(jsii_name="onCampaigns")
    def on_campaigns(
        self,
        app_id: builtins.str,
        campaign_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mobiletargeting":
        '''(experimental) Adds a resource of type campaigns to the statement.

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-campaigns.html

        :param app_id: - Identifier for the appId.
        :param campaign_id: - Identifier for the campaignId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b6f2e2666ab069dd85d4fd4cc2c8723e9e3fc854125f30d73408f4b55e44a1f0)
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument campaign_id", value=campaign_id, expected_type=type_hints["campaign_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mobiletargeting", jsii.invoke(self, "onCampaigns", [app_id, campaign_id, account, region, partition]))

    @jsii.member(jsii_name="onJourneys")
    def on_journeys(
        self,
        app_id: builtins.str,
        journey_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mobiletargeting":
        '''(experimental) Adds a resource of type journeys to the statement.

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-journeys.html

        :param app_id: - Identifier for the appId.
        :param journey_id: - Identifier for the journeyId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__96ccc2b51efdcecbefd2445494a7c8338069d12952a5a4dd79cb7a953421fb03)
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument journey_id", value=journey_id, expected_type=type_hints["journey_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mobiletargeting", jsii.invoke(self, "onJourneys", [app_id, journey_id, account, region, partition]))

    @jsii.member(jsii_name="onPhoneNumberValidate")
    def on_phone_number_validate(
        self,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mobiletargeting":
        '''(experimental) Adds a resource of type phone-number-validate to the statement.

        https://docs.aws.amazon.com/pinpoint/latest/apireference/phone-number-validate.html

        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__41d8ac4b4b0bd72360fba9abc5095076707b0ee52ffb341628aa72143df249e4)
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mobiletargeting", jsii.invoke(self, "onPhoneNumberValidate", [account, region, partition]))

    @jsii.member(jsii_name="onRecommenders")
    def on_recommenders(
        self,
        recommender_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mobiletargeting":
        '''(experimental) Adds a resource of type recommenders to the statement.

        https://docs.aws.amazon.com/pinpoint/latest/apireference/recommenders.html

        :param recommender_id: - Identifier for the recommenderId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__83bdf14edf668a639676a3ec3ada3cdee69dcfe54386bcc13c19537d95dddddc)
            check_type(argname="argument recommender_id", value=recommender_id, expected_type=type_hints["recommender_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mobiletargeting", jsii.invoke(self, "onRecommenders", [recommender_id, account, region, partition]))

    @jsii.member(jsii_name="onSegments")
    def on_segments(
        self,
        app_id: builtins.str,
        segment_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mobiletargeting":
        '''(experimental) Adds a resource of type segments to the statement.

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-segments.html

        :param app_id: - Identifier for the appId.
        :param segment_id: - Identifier for the segmentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a7f036d06afa431fe977074698290e0340b536f7c8a58f6aac2be1c5c42f3c9a)
            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
            check_type(argname="argument segment_id", value=segment_id, expected_type=type_hints["segment_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mobiletargeting", jsii.invoke(self, "onSegments", [app_id, segment_id, account, region, partition]))

    @jsii.member(jsii_name="onTemplates")
    def on_templates(
        self,
        template_name: builtins.str,
        channel_type: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mobiletargeting":
        '''(experimental) Adds a resource of type templates to the statement.

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates.html

        :param template_name: - Identifier for the templateName.
        :param channel_type: - Identifier for the channelType.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__586cdf71a0ef44d5fe5c742ef7ce908fb643fa95e5019c4d7692ca261be3836e)
            check_type(argname="argument template_name", value=template_name, expected_type=type_hints["template_name"])
            check_type(argname="argument channel_type", value=channel_type, expected_type=type_hints["channel_type"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mobiletargeting", jsii.invoke(self, "onTemplates", [template_name, channel_type, account, region, partition]))

    @jsii.member(jsii_name="toCreateApp")
    def to_create_app(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to create an app.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-app.html#rest-api-app-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateApp", []))

    @jsii.member(jsii_name="toCreateCampaign")
    def to_create_campaign(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to create a campaign for an app.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-campaigns.html#rest-api-campaigns-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateCampaign", []))

    @jsii.member(jsii_name="toCreateEmailTemplate")
    def to_create_email_template(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to create an email template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-email.html#templates-template-name-email-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateEmailTemplate", []))

    @jsii.member(jsii_name="toCreateExportJob")
    def to_create_export_job(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to create an export job that exports endpoint definitions to Amazon S3.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-export-jobs.html#rest-api-export-jobs-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateExportJob", []))

    @jsii.member(jsii_name="toCreateImportJob")
    def to_create_import_job(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to import endpoint definitions from to create a segment.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-import-jobs.html#rest-api-import-jobs-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateImportJob", []))

    @jsii.member(jsii_name="toCreateInAppTemplate")
    def to_create_in_app_template(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to create an in-app message template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-inapp.html#templates-template-name-inapp-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateInAppTemplate", []))

    @jsii.member(jsii_name="toCreateJourney")
    def to_create_journey(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to create a Journey for an app.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-journeys-journey-id.html#apps-application-id-journeys-journey-id-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateJourney", []))

    @jsii.member(jsii_name="toCreatePushTemplate")
    def to_create_push_template(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to create a push notification template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-push.html#templates-template-name-push-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreatePushTemplate", []))

    @jsii.member(jsii_name="toCreateRecommenderConfiguration")
    def to_create_recommender_configuration(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to create an Amazon Pinpoint configuration for a recommender model.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/recommenders.html#CreateRecommenderConfiguration

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateRecommenderConfiguration", []))

    @jsii.member(jsii_name="toCreateSegment")
    def to_create_segment(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to create a segment that is based on endpoint data reported to Pinpoint by your app.

        To allow a user to create a segment by importing endpoint data from outside of Pinpoint, allow the mobiletargeting:CreateImportJob action

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-segments.html#rest-api-segments-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateSegment", []))

    @jsii.member(jsii_name="toCreateSmsTemplate")
    def to_create_sms_template(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to create an sms message template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-sms.html#templates-template-name-sms-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateSmsTemplate", []))

    @jsii.member(jsii_name="toCreateVoiceTemplate")
    def to_create_voice_template(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to create a voice message template.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-voice.html#templates-template-name-voice-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toCreateVoiceTemplate", []))

    @jsii.member(jsii_name="toDeleteAdmChannel")
    def to_delete_adm_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete the ADM channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-adm-channel.html#rest-api-adm-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteAdmChannel", []))

    @jsii.member(jsii_name="toDeleteApnsChannel")
    def to_delete_apns_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete the APNs channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-channel.html#rest-api-apns-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteApnsChannel", []))

    @jsii.member(jsii_name="toDeleteApnsSandboxChannel")
    def to_delete_apns_sandbox_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete the APNs sandbox channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-sandbox-channel.html#rest-api-apns-sandbox-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteApnsSandboxChannel", []))

    @jsii.member(jsii_name="toDeleteApnsVoipChannel")
    def to_delete_apns_voip_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete the APNs VoIP channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-voip-channel.html#rest-api-apns-voip-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteApnsVoipChannel", []))

    @jsii.member(jsii_name="toDeleteApnsVoipSandboxChannel")
    def to_delete_apns_voip_sandbox_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete the APNs VoIP sandbox channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-voip-sandbox-channel.html#rest-api-apns-voip-sandbox-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteApnsVoipSandboxChannel", []))

    @jsii.member(jsii_name="toDeleteApp")
    def to_delete_app(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete a specific campaign.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-app.html#rest-api-app-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteApp", []))

    @jsii.member(jsii_name="toDeleteBaiduChannel")
    def to_delete_baidu_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete the Baidu channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-baidu-channel.html#rest-api-baidu-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteBaiduChannel", []))

    @jsii.member(jsii_name="toDeleteCampaign")
    def to_delete_campaign(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete a specific campaign.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-campaign.html#rest-api-campaign-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteCampaign", []))

    @jsii.member(jsii_name="toDeleteEmailChannel")
    def to_delete_email_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete the email channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-email-channel.html#rest-api-email-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteEmailChannel", []))

    @jsii.member(jsii_name="toDeleteEmailTemplate")
    def to_delete_email_template(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete an email template or an email template version.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-email.html#templates-template-name-email-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteEmailTemplate", []))

    @jsii.member(jsii_name="toDeleteEndpoint")
    def to_delete_endpoint(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete an endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-endpoint.html#rest-api-endpoint-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteEndpoint", []))

    @jsii.member(jsii_name="toDeleteEventStream")
    def to_delete_event_stream(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete the event stream for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-event-stream.html#rest-api-event-stream-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteEventStream", []))

    @jsii.member(jsii_name="toDeleteGcmChannel")
    def to_delete_gcm_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete the GCM channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-gcm-channel.html#rest-api-gcm-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteGcmChannel", []))

    @jsii.member(jsii_name="toDeleteInAppTemplate")
    def to_delete_in_app_template(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete an in-app message template or an in-app message template version.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-inapp.html#templates-template-name-inapp-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteInAppTemplate", []))

    @jsii.member(jsii_name="toDeleteJourney")
    def to_delete_journey(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete a specific journey.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-journeys-journey-id.html#apps-application-id-journeys-journey-id-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteJourney", []))

    @jsii.member(jsii_name="toDeletePushTemplate")
    def to_delete_push_template(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete a push notification template or a push notification template version.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-push.html#templates-template-name-push-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeletePushTemplate", []))

    @jsii.member(jsii_name="toDeleteRecommenderConfiguration")
    def to_delete_recommender_configuration(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete an Amazon Pinpoint configuration for a recommender model.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/recommenders-recommender-id.html#DeleteRecommenderConfiguration

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteRecommenderConfiguration", []))

    @jsii.member(jsii_name="toDeleteSegment")
    def to_delete_segment(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete a specific segment.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-segment.html#rest-api-segment-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteSegment", []))

    @jsii.member(jsii_name="toDeleteSmsChannel")
    def to_delete_sms_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete the SMS channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-sms-channel.html#rest-api-sms-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteSmsChannel", []))

    @jsii.member(jsii_name="toDeleteSmsTemplate")
    def to_delete_sms_template(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete an sms message template or an sms message template version.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-sms.html#templates-template-name-sms-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteSmsTemplate", []))

    @jsii.member(jsii_name="toDeleteUserEndpoints")
    def to_delete_user_endpoints(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete all of the endpoints that are associated with a user ID.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-user.html#rest-api-user-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteUserEndpoints", []))

    @jsii.member(jsii_name="toDeleteVoiceChannel")
    def to_delete_voice_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete the Voice channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-voice-channel.html#rest-api-voice-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteVoiceChannel", []))

    @jsii.member(jsii_name="toDeleteVoiceTemplate")
    def to_delete_voice_template(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to delete a voice message template or a voice message template version.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-voice.html#templates-template-name-voice-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toDeleteVoiceTemplate", []))

    @jsii.member(jsii_name="toGetAdmChannel")
    def to_get_adm_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about the Amazon Device Messaging (ADM) channel for an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-adm-channel.html#rest-api-adm-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetAdmChannel", []))

    @jsii.member(jsii_name="toGetApnsChannel")
    def to_get_apns_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about the APNs channel for an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-channel.html#rest-api-apns-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetApnsChannel", []))

    @jsii.member(jsii_name="toGetApnsSandboxChannel")
    def to_get_apns_sandbox_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about the APNs sandbox channel for an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-sandbox-channel.html#rest-api-apns-sandbox-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetApnsSandboxChannel", []))

    @jsii.member(jsii_name="toGetApnsVoipChannel")
    def to_get_apns_voip_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about the APNs VoIP channel for an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-voip-channel.html#rest-api-apns-voip-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetApnsVoipChannel", []))

    @jsii.member(jsii_name="toGetApnsVoipSandboxChannel")
    def to_get_apns_voip_sandbox_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about the APNs VoIP sandbox channel for an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-voip-sandbox-channel.html#rest-api-apns-voip-sandbox-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetApnsVoipSandboxChannel", []))

    @jsii.member(jsii_name="toGetApp")
    def to_get_app(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about a specific app in your Amazon Pinpoint account.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-app.html#rest-api-app-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetApp", []))

    @jsii.member(jsii_name="toGetApplicationDateRangeKpi")
    def to_get_application_date_range_kpi(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve (queries) pre-aggregated data for a standard metric that applies to an application.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-kpis-daterange-kpi-name.html#GetApplicationDateRangeKpi

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetApplicationDateRangeKpi", []))

    @jsii.member(jsii_name="toGetApplicationSettings")
    def to_get_application_settings(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve the default settings for an app.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-settings.html#rest-api-settings-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetApplicationSettings", []))

    @jsii.member(jsii_name="toGetApps")
    def to_get_apps(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve a list of apps in your Amazon Pinpoint account.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apps.html#rest-api-apps-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetApps", []))

    @jsii.member(jsii_name="toGetBaiduChannel")
    def to_get_baidu_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about the Baidu channel for an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-baidu-channel.html#rest-api-baidu-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetBaiduChannel", []))

    @jsii.member(jsii_name="toGetCampaign")
    def to_get_campaign(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about a specific campaign.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-campaign.html#rest-api-campaign-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetCampaign", []))

    @jsii.member(jsii_name="toGetCampaignActivities")
    def to_get_campaign_activities(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about the activities performed by a campaign.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-campaign-activities.html#rest-api-campaign-activities-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetCampaignActivities", []))

    @jsii.member(jsii_name="toGetCampaignDateRangeKpi")
    def to_get_campaign_date_range_kpi(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve (queries) pre-aggregated data for a standard metric that applies to a campaign.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-campaigns-campaign-id-kpis-daterange-kpi-name.html#GetCampaignDateRangeKpi

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetCampaignDateRangeKpi", []))

    @jsii.member(jsii_name="toGetCampaigns")
    def to_get_campaigns(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about all campaigns for an app.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-campaigns.html#rest-api-campaigns-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetCampaigns", []))

    @jsii.member(jsii_name="toGetCampaignVersion")
    def to_get_campaign_version(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about a specific campaign version.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-campaign-version.html#rest-api-campaign-version-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetCampaignVersion", []))

    @jsii.member(jsii_name="toGetCampaignVersions")
    def to_get_campaign_versions(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about the current and prior versions of a campaign.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-campaign-versions.html#rest-api-campaign-versions-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetCampaignVersions", []))

    @jsii.member(jsii_name="toGetChannels")
    def to_get_channels(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to get all channels information for your app.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-channels.html#rest-api-channels-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetChannels", []))

    @jsii.member(jsii_name="toGetEmailChannel")
    def to_get_email_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to obtain information about the email channel in an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-email-channel.html#rest-api-email-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetEmailChannel", []))

    @jsii.member(jsii_name="toGetEmailTemplate")
    def to_get_email_template(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about a specific or the active version of an email template.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-email.html#templates-template-name-email-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetEmailTemplate", []))

    @jsii.member(jsii_name="toGetEndpoint")
    def to_get_endpoint(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about a specific endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-endpoint.html#rest-api-endpoint-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetEndpoint", []))

    @jsii.member(jsii_name="toGetEventStream")
    def to_get_event_stream(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about the event stream for an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-event-stream.html#rest-api-event-stream-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetEventStream", []))

    @jsii.member(jsii_name="toGetExportJob")
    def to_get_export_job(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to obtain information about a specific export job.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-export-jobs.html#rest-api-export-jobs-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetExportJob", []))

    @jsii.member(jsii_name="toGetExportJobs")
    def to_get_export_jobs(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve a list of all of the export jobs for an app.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-export-jobs.html#rest-api-export-jobs-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetExportJobs", []))

    @jsii.member(jsii_name="toGetGcmChannel")
    def to_get_gcm_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about the GCM channel for an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-gcm-channel.html#rest-api-gcm-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetGcmChannel", []))

    @jsii.member(jsii_name="toGetImportJob")
    def to_get_import_job(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about a specific import job.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-import-job.html#rest-api-import-job-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetImportJob", []))

    @jsii.member(jsii_name="toGetImportJobs")
    def to_get_import_jobs(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about all import jobs for an app.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-import-jobs.html#rest-api-import-jobs-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetImportJobs", []))

    @jsii.member(jsii_name="toGetInAppMessages")
    def to_get_in_app_messages(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrive in-app messages for the given endpoint id.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-endpoints-endpoint-id-inappmessages.html

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetInAppMessages", []))

    @jsii.member(jsii_name="toGetInAppTemplate")
    def to_get_in_app_template(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about a specific or the active version of an in-app message template.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-inapp.html#templates-template-name-inapp-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetInAppTemplate", []))

    @jsii.member(jsii_name="toGetJourney")
    def to_get_journey(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about a specific journey.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-journeys-journey-id.html#apps-application-id-journeys-journey-id-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetJourney", []))

    @jsii.member(jsii_name="toGetJourneyDateRangeKpi")
    def to_get_journey_date_range_kpi(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve (queries) pre-aggregated data for a standard engagement metric that applies to a journey.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-journeys-journey-id-kpis-daterange-kpi-name.html#GetJourneyDateRangeKpi

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetJourneyDateRangeKpi", []))

    @jsii.member(jsii_name="toGetJourneyExecutionActivityMetrics")
    def to_get_journey_execution_activity_metrics(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey activity.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-journeys-journey-id-activities-journey-activity-id-execution-metrics.html#GetJourneyExecutionActivityMetrics

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetJourneyExecutionActivityMetrics", []))

    @jsii.member(jsii_name="toGetJourneyExecutionMetrics")
    def to_get_journey_execution_metrics(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-journeys-journey-id-execution-metrics.html#GetJourneyExecutionMetrics

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetJourneyExecutionMetrics", []))

    @jsii.member(jsii_name="toGetJourneyRunExecutionActivityMetrics")
    def to_get_journey_run_execution_activity_metrics(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey activity for a single journey run.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-journeys-journey-id-runs-run-id-activities-journey-activity-id-execution-metrics.html#GetJourneyRunExecutionActivityMetrics

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetJourneyRunExecutionActivityMetrics", []))

    @jsii.member(jsii_name="toGetJourneyRunExecutionMetrics")
    def to_get_journey_run_execution_metrics(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey for a single journey run.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-journeys-journey-id-runs-run-id-execution-metrics.html#GetJourneyRunExecutionMetrics

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetJourneyRunExecutionMetrics", []))

    @jsii.member(jsii_name="toGetJourneyRuns")
    def to_get_journey_runs(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about all journey runs for a journey.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-journeys-journey-id-runs.html

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetJourneyRuns", []))

    @jsii.member(jsii_name="toGetPushTemplate")
    def to_get_push_template(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about a specific or the active version of an push notification template.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-push.html#templates-template-name-push-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetPushTemplate", []))

    @jsii.member(jsii_name="toGetRecommenderConfiguration")
    def to_get_recommender_configuration(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about an Amazon Pinpoint configuration for a recommender model.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/recommenders-recommender-id.html#GetRecommenderConfiguration

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetRecommenderConfiguration", []))

    @jsii.member(jsii_name="toGetRecommenderConfigurations")
    def to_get_recommender_configurations(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about all the recommender model configurations that are associated with an Amazon Pinpoint account.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/recommenders.html#GetRecommenderConfigurations

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetRecommenderConfigurations", []))

    @jsii.member(jsii_name="toGetReports")
    def to_get_reports(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to mobiletargeting:GetReports.

        Access Level: Read

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetReports", []))

    @jsii.member(jsii_name="toGetSegment")
    def to_get_segment(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about a specific segment.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-segment.html#rest-api-segment-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetSegment", []))

    @jsii.member(jsii_name="toGetSegmentExportJobs")
    def to_get_segment_export_jobs(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about jobs that export endpoint definitions from segments to Amazon S3.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-export-jobs.html#rest-api-export-jobs-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetSegmentExportJobs", []))

    @jsii.member(jsii_name="toGetSegmentImportJobs")
    def to_get_segment_import_jobs(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about jobs that create segments by importing endpoint definitions from.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-import-jobs.html#rest-api-import-jobs-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetSegmentImportJobs", []))

    @jsii.member(jsii_name="toGetSegments")
    def to_get_segments(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about the segments for an app.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-segments.html#rest-api-segments-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetSegments", []))

    @jsii.member(jsii_name="toGetSegmentVersion")
    def to_get_segment_version(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about a specific segment version.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-segment-version.html#rest-api-segment-version-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetSegmentVersion", []))

    @jsii.member(jsii_name="toGetSegmentVersions")
    def to_get_segment_versions(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about the current and prior versions of a segment.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-segment-versions.html#rest-api-segment-versions-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetSegmentVersions", []))

    @jsii.member(jsii_name="toGetSmsChannel")
    def to_get_sms_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to obtain information about the SMS channel in an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-sms-channel.html#rest-api-sms-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetSmsChannel", []))

    @jsii.member(jsii_name="toGetSmsTemplate")
    def to_get_sms_template(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about a specific or the active version of an sms message template.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-sms.html#templates-template-name-sms-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetSmsTemplate", []))

    @jsii.member(jsii_name="toGetUserEndpoints")
    def to_get_user_endpoints(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about the endpoints that are associated with a user ID.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-user.html#rest-api-user-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetUserEndpoints", []))

    @jsii.member(jsii_name="toGetVoiceChannel")
    def to_get_voice_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to obtain information about the Voice channel in an app.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-voice-channel.html#rest-api-voice-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetVoiceChannel", []))

    @jsii.member(jsii_name="toGetVoiceTemplate")
    def to_get_voice_template(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about a specific or the active version of a voice message template.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-voice.html#templates-template-name-voice-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toGetVoiceTemplate", []))

    @jsii.member(jsii_name="toListJourneys")
    def to_list_journeys(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve information about all journeys for an app.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-journeys.html#apps-application-id-journeys-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toListJourneys", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-tags.html#rest-api-tags-methods-get

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTemplates")
    def to_list_templates(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve metadata about the queried templates.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates.html#templates-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toListTemplates", []))

    @jsii.member(jsii_name="toListTemplateVersions")
    def to_list_template_versions(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to retrieve all versions about a specific template.

        Access Level: List

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-template-type-versions.html#templates-template-name-template-type-versions-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toListTemplateVersions", []))

    @jsii.member(jsii_name="toPhoneNumberValidate")
    def to_phone_number_validate(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to obtain metadata for a phone number, such as the number type (mobile, landline, or VoIP), location, and provider.

        Access Level: Read

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-phone-number-validate.html#rest-api-phone-number-validate-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toPhoneNumberValidate", []))

    @jsii.member(jsii_name="toPutEvents")
    def to_put_events(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to create or update events for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-events.html#rest-api-events-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toPutEvents", []))

    @jsii.member(jsii_name="toPutEventStream")
    def to_put_event_stream(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to create or update an event stream for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-event-stream.html#rest-api-event-stream-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toPutEventStream", []))

    @jsii.member(jsii_name="toRemoveAttributes")
    def to_remove_attributes(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to remove the attributes for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-app.html#rest-api-app-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toRemoveAttributes", []))

    @jsii.member(jsii_name="toSendMessages")
    def to_send_messages(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to send an SMS message or push notification to specific endpoints.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-messages.html#rest-api-messages-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toSendMessages", []))

    @jsii.member(jsii_name="toSendOTPMessage")
    def to_send_otp_message(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to send an OTP code to a user of your application.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-otp.html

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toSendOTPMessage", []))

    @jsii.member(jsii_name="toSendUsersMessages")
    def to_send_users_messages(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to send an SMS message or push notification to all endpoints that are associated with a specific user ID.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-users-messages.html#rest-api-users-messages-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toSendUsersMessages", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to add tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-tags.html#rest-api-tags-methods-post

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-tags.html#rest-api-tags-methods-delete

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAdmChannel")
    def to_update_adm_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update the Amazon Device Messaging (ADM) channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-adm-channel.html#rest-api-adm-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateAdmChannel", []))

    @jsii.member(jsii_name="toUpdateApnsChannel")
    def to_update_apns_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update the Apple Push Notification service (APNs) channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-channel.html#rest-api-apns-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateApnsChannel", []))

    @jsii.member(jsii_name="toUpdateApnsSandboxChannel")
    def to_update_apns_sandbox_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update the Apple Push Notification service (APNs) sandbox channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-sandbox-channel.html#rest-api-apns-sandbox-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateApnsSandboxChannel", []))

    @jsii.member(jsii_name="toUpdateApnsVoipChannel")
    def to_update_apns_voip_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update the Apple Push Notification service (APNs) VoIP channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-voip-channel.html#rest-api-apns-voip-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateApnsVoipChannel", []))

    @jsii.member(jsii_name="toUpdateApnsVoipSandboxChannel")
    def to_update_apns_voip_sandbox_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update the Apple Push Notification service (APNs) VoIP sandbox channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-apns-voip-sandbox-channel.html#rest-api-apns-voip-sandbox-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateApnsVoipSandboxChannel", []))

    @jsii.member(jsii_name="toUpdateApplicationSettings")
    def to_update_application_settings(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update the default settings for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-settings.html#rest-api-settings-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateApplicationSettings", []))

    @jsii.member(jsii_name="toUpdateBaiduChannel")
    def to_update_baidu_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update the Baidu channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-baidu-channel.html#rest-api-baidu-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateBaiduChannel", []))

    @jsii.member(jsii_name="toUpdateCampaign")
    def to_update_campaign(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update a specific campaign.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-campaign.html#rest-api-campaign-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateCampaign", []))

    @jsii.member(jsii_name="toUpdateEmailChannel")
    def to_update_email_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update the email channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-email-channel.html#rest-api-email-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateEmailChannel", []))

    @jsii.member(jsii_name="toUpdateEmailTemplate")
    def to_update_email_template(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update a specific email template under the same version or generate a new version.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-email.html#templates-template-name-email-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateEmailTemplate", []))

    @jsii.member(jsii_name="toUpdateEndpoint")
    def to_update_endpoint(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to create an endpoint or update the information for an endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-endpoint.html#rest-api-endpoint-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateEndpoint", []))

    @jsii.member(jsii_name="toUpdateEndpointsBatch")
    def to_update_endpoints_batch(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to create or update endpoints as a batch operation.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-endpoints.html#rest-api-endpoints-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateEndpointsBatch", []))

    @jsii.member(jsii_name="toUpdateGcmChannel")
    def to_update_gcm_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update the Firebase Cloud Messaging (FCM) or Google Cloud Messaging (GCM) API key that allows to send push notifications to your Android app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-gcm-channel.html#rest-api-gcm-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateGcmChannel", []))

    @jsii.member(jsii_name="toUpdateInAppTemplate")
    def to_update_in_app_template(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update a specific in-app message template under the same version or generate a new version.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-inapp.html#templates-template-name-inapp-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateInAppTemplate", []))

    @jsii.member(jsii_name="toUpdateJourney")
    def to_update_journey(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update a specific journey.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-journeys-journey-id.html#apps-application-id-journeys-journey-id-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateJourney", []))

    @jsii.member(jsii_name="toUpdateJourneyState")
    def to_update_journey_state(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update a specific journey state.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-journeys-journey-id-state.html#apps-application-id-journeys-journey-id-state-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateJourneyState", []))

    @jsii.member(jsii_name="toUpdatePushTemplate")
    def to_update_push_template(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update a specific push notification template under the same version or generate a new version.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-push.html#templates-template-name-push-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdatePushTemplate", []))

    @jsii.member(jsii_name="toUpdateRecommenderConfiguration")
    def to_update_recommender_configuration(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update an Amazon Pinpoint configuration for a recommender model.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/recommenders-recommender-id.html#UpdateRecommenderConfiguration

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateRecommenderConfiguration", []))

    @jsii.member(jsii_name="toUpdateSegment")
    def to_update_segment(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update a specific segment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-segment.html#rest-api-segment-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateSegment", []))

    @jsii.member(jsii_name="toUpdateSmsChannel")
    def to_update_sms_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update the SMS channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-sms-channel.html#rest-api-sms-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateSmsChannel", []))

    @jsii.member(jsii_name="toUpdateSmsTemplate")
    def to_update_sms_template(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update a specific sms message template under the same version or generate a new version.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-sms.html#templates-template-name-sms-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateSmsTemplate", []))

    @jsii.member(jsii_name="toUpdateTemplateActiveVersion")
    def to_update_template_active_version(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update the active version parameter of a specific template.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-template-type-versions.html#templates-template-name-template-type-versions-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateTemplateActiveVersion", []))

    @jsii.member(jsii_name="toUpdateVoiceChannel")
    def to_update_voice_channel(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update the Voice channel for an app.

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/rest-api-voice-channel.html#rest-api-voice-channel-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateVoiceChannel", []))

    @jsii.member(jsii_name="toUpdateVoiceTemplate")
    def to_update_voice_template(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to update a specific voice message template under the same version or generate a new version.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/pinpoint/latest/apireference/templates-template-name-voice.html#templates-template-name-voice-http-methods

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toUpdateVoiceTemplate", []))

    @jsii.member(jsii_name="toVerifyOTPMessage")
    def to_verify_otp_message(self) -> "Mobiletargeting":
        '''(experimental) Grants permission to check the validity of One-Time Passwords (OTPs).

        Access Level: Write

        https://docs.aws.amazon.com/pinpoint/latest/apireference/apps-application-id-verify-otp.html

        :stability: experimental
        '''
        return typing.cast("Mobiletargeting", jsii.invoke(self, "toVerifyOTPMessage", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1d0c0c86343c5263f54e8a38b4828d94d037ecb806ec02244ef0ceda3ee0ba0c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__410c563a85feaf2c8a4be3b9edb94cbb02658f0c93550da54a866d9a94661f6d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Monitron(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Monitron",
):
    '''(experimental) Statement provider for service `monitron <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmonitron.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `monitron <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmonitron.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__06fa0670b98952639fe60ee798ca9bda9b3453aee42a406d1fa1684c83998e5f)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onProject")
    def on_project(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Monitron":
        '''(experimental) Adds a resource of type project to the statement.

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/projects-chapter.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ec7bf9c54ca07b45511a2cbf1b6c6fea72f798b5cffe5f85fcf5137df41cda7a)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Monitron", jsii.invoke(self, "onProject", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toAssociateProjectAdminUser")
    def to_associate_project_admin_user(self) -> "Monitron":
        '''(experimental) Grants permission to associate a user with the project as an administrator.

        Access Level: Permissions management

        Dependent actions:

        - sso-directory:DescribeUsers
        - sso:AssociateProfile
        - sso:GetManagedApplicationInstance
        - sso:GetProfile
        - sso:ListDirectoryAssociations
        - sso:ListProfileAssociations
        - sso:ListProfiles

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/user-management-chapter.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toAssociateProjectAdminUser", []))

    @jsii.member(jsii_name="toCreateProject")
    def to_create_project(self) -> "Monitron":
        '''(experimental) Grants permission to create a project.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole
        - kms:CreateGrant
        - sso:CreateManagedApplicationInstance
        - sso:DeleteManagedApplicationInstance

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/mp-creating-project.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toCreateProject", []))

    @jsii.member(jsii_name="toDeleteProject")
    def to_delete_project(self) -> "Monitron":
        '''(experimental) Grants permission to delete a project.

        Access Level: Write

        Dependent actions:

        - sso:DeleteManagedApplicationInstance

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/mp-delete-project.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toDeleteProject", []))

    @jsii.member(jsii_name="toDisassociateProjectAdminUser")
    def to_disassociate_project_admin_user(self) -> "Monitron":
        '''(experimental) Grants permission to disassociate an administrator from the project.

        Access Level: Permissions management

        Dependent actions:

        - sso-directory:DescribeUsers
        - sso:DisassociateProfile
        - sso:GetManagedApplicationInstance
        - sso:GetProfile
        - sso:ListDirectoryAssociations
        - sso:ListProfiles

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/mu-remove-project-admin.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toDisassociateProjectAdminUser", []))

    @jsii.member(jsii_name="toGetProject")
    def to_get_project(self) -> "Monitron":
        '''(experimental) Grants permission to get information about a project.

        Access Level: Read

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/mp-project-tasks.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toGetProject", []))

    @jsii.member(jsii_name="toGetProjectAdminUser")
    def to_get_project_admin_user(self) -> "Monitron":
        '''(experimental) Grants permission to describe an administrator who is associated with the project.

        Access Level: Read

        Dependent actions:

        - sso-directory:DescribeUsers
        - sso:GetManagedApplicationInstance
        - sso:ListProfileAssociations

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/mp-project-tasks.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toGetProjectAdminUser", []))

    @jsii.member(jsii_name="toListProjectAdminUsers")
    def to_list_project_admin_users(self) -> "Monitron":
        '''(experimental) Grants permission to list all administrators associated with the project.

        Access Level: Permissions management

        Dependent actions:

        - sso-directory:DescribeUsers
        - sso:GetManagedApplicationInstance

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/user-management-chapter.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toListProjectAdminUsers", []))

    @jsii.member(jsii_name="toListProjects")
    def to_list_projects(self) -> "Monitron":
        '''(experimental) Grants permission to list all projects.

        Access Level: List

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/mp-project-tasks.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toListProjects", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Monitron":
        '''(experimental) Grants permission to list all tags for a resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/tagging.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Monitron":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/tagging.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Monitron":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/tagging.html#modify-tag-1

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateProject")
    def to_update_project(self) -> "Monitron":
        '''(experimental) Grants permission to update a project.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/Monitron/latest/admin-guide/mp-updating-project.html

        :stability: experimental
        '''
        return typing.cast("Monitron", jsii.invoke(self, "toUpdateProject", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b0b6854f68d2a7eee7bd0b441526dcf12cb5f61b8c0fe81680eaa05225654acc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3c34818fd255d48c8ce0c4dfb5e6f8a9a85c5ee25ccf0ee2b5ce3758fc42c753)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Mq(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Mq"):
    '''(experimental) Statement provider for service `mq <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmq.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `mq <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonmq.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f6d250574885b4b1f414a4adeac62916922dad9d164e73e9b678799d17ef32dc)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onBrokers")
    def on_brokers(
        self,
        broker_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mq":
        '''(experimental) Adds a resource of type brokers to the statement.

        https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/amazon-mq-how-it-works.html

        :param broker_id: - Identifier for the brokerId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__047a5cd36ffa853fab45baadec71cfd3f7d04a009e903f8889ff3fd11cd6aa98)
            check_type(argname="argument broker_id", value=broker_id, expected_type=type_hints["broker_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mq", jsii.invoke(self, "onBrokers", [broker_id, account, region, partition]))

    @jsii.member(jsii_name="onConfigurations")
    def on_configurations(
        self,
        configuration_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Mq":
        '''(experimental) Adds a resource of type configurations to the statement.

        https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/amazon-mq-how-it-works.html

        :param configuration_id: - Identifier for the configurationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3a526cd8a9b2cdaa769bd3bb2cc3a9bbf6ce37a4972e73c2b8fc861a3b5090e0)
            check_type(argname="argument configuration_id", value=configuration_id, expected_type=type_hints["configuration_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Mq", jsii.invoke(self, "onConfigurations", [configuration_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateBroker")
    def to_create_broker(self) -> "Mq":
        '''(experimental) Grants permission to create a broker.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:CreateNetworkInterfacePermission
        - ec2:CreateSecurityGroup
        - ec2:CreateVpcEndpoint
        - ec2:DescribeInternetGateways
        - ec2:DescribeNetworkInterfacePermissions
        - ec2:DescribeNetworkInterfaces
        - ec2:DescribeSecurityGroups
        - ec2:DescribeSubnets
        - ec2:DescribeVpcEndpoints
        - ec2:DescribeVpcs
        - ec2:ModifyNetworkInterfaceAttribute
        - iam:CreateServiceLinkedRole
        - route53:AssociateVPCWithHostedZone

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-brokers.html#rest-api-brokers-methods-post

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toCreateBroker", []))

    @jsii.member(jsii_name="toCreateConfiguration")
    def to_create_configuration(self) -> "Mq":
        '''(experimental) Grants permission to create a new configuration for the specified configuration name.

        Amazon MQ uses the default configuration (the engine type and engine version)

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-configurations.html#rest-api-configurations-methods-post

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toCreateConfiguration", []))

    @jsii.member(jsii_name="toCreateTags")
    def to_create_tags(self) -> "Mq":
        '''(experimental) Grants permission to create tags.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-tags.html#rest-api-tags-methods-post

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toCreateTags", []))

    @jsii.member(jsii_name="toCreateUser")
    def to_create_user(self) -> "Mq":
        '''(experimental) Grants permission to create an ActiveMQ user.

        Access Level: Write

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-username.html#rest-api-username-methods-post

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toCreateUser", []))

    @jsii.member(jsii_name="toDeleteBroker")
    def to_delete_broker(self) -> "Mq":
        '''(experimental) Grants permission to delete a broker.

        Access Level: Write

        Dependent actions:

        - ec2:DeleteNetworkInterface
        - ec2:DeleteNetworkInterfacePermission
        - ec2:DeleteVpcEndpoints
        - ec2:DetachNetworkInterface

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-broker.html#rest-api-broker-methods-delete

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toDeleteBroker", []))

    @jsii.member(jsii_name="toDeleteTags")
    def to_delete_tags(self) -> "Mq":
        '''(experimental) Grants permission to delete tags.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-tags.html#rest-api-tags-methods-delete

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toDeleteTags", []))

    @jsii.member(jsii_name="toDeleteUser")
    def to_delete_user(self) -> "Mq":
        '''(experimental) Grants permission to delete an ActiveMQ user.

        Access Level: Write

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-username.html#rest-api-username-methods-delete

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toDeleteUser", []))

    @jsii.member(jsii_name="toDescribeBroker")
    def to_describe_broker(self) -> "Mq":
        '''(experimental) Grants permission to return information about the specified broker.

        Access Level: Read

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-broker.html#rest-api-broker-methods-get

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toDescribeBroker", []))

    @jsii.member(jsii_name="toDescribeBrokerEngineTypes")
    def to_describe_broker_engine_types(self) -> "Mq":
        '''(experimental) Grants permission to return information about broker engines.

        Access Level: Read

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/broker-engine-types.html#broker-engine-types-http-methods

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toDescribeBrokerEngineTypes", []))

    @jsii.member(jsii_name="toDescribeBrokerInstanceOptions")
    def to_describe_broker_instance_options(self) -> "Mq":
        '''(experimental) Grants permission to return information about the broker instance options.

        Access Level: Read

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/broker-instance-options.html#broker-engine-types-http-methods

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toDescribeBrokerInstanceOptions", []))

    @jsii.member(jsii_name="toDescribeConfiguration")
    def to_describe_configuration(self) -> "Mq":
        '''(experimental) Grants permission to return information about the specified configuration.

        Access Level: Read

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-configuration.html#rest-api-configuration-methods-get

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toDescribeConfiguration", []))

    @jsii.member(jsii_name="toDescribeConfigurationRevision")
    def to_describe_configuration_revision(self) -> "Mq":
        '''(experimental) Grants permission to return the specified configuration revision for the specified configuration.

        Access Level: Read

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-configuration-revision.html#rest-api-configuration-revision-methods-get

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toDescribeConfigurationRevision", []))

    @jsii.member(jsii_name="toDescribeUser")
    def to_describe_user(self) -> "Mq":
        '''(experimental) Grants permission to return information about an ActiveMQ user.

        Access Level: Read

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-username.html#rest-api-username-methods-get

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toDescribeUser", []))

    @jsii.member(jsii_name="toListBrokers")
    def to_list_brokers(self) -> "Mq":
        '''(experimental) Grants permission to return a list of all brokers.

        Access Level: List

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-brokers.html#rest-api-brokers-methods-get

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toListBrokers", []))

    @jsii.member(jsii_name="toListConfigurationRevisions")
    def to_list_configuration_revisions(self) -> "Mq":
        '''(experimental) Grants permission to return a list of all existing revisions for the specified configuration.

        Access Level: List

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-revisions.html#rest-api-revisions-methods-get

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toListConfigurationRevisions", []))

    @jsii.member(jsii_name="toListConfigurations")
    def to_list_configurations(self) -> "Mq":
        '''(experimental) Grants permission to return a list of all configurations.

        Access Level: List

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-configurations.html#rest-api-configurations-methods-get

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toListConfigurations", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Mq":
        '''(experimental) Grants permission to return a list of tags.

        Access Level: List

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-tags.html#rest-api-tags-methods-get

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toListUsers")
    def to_list_users(self) -> "Mq":
        '''(experimental) Grants permission to return a list of all ActiveMQ users.

        Access Level: List

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-users.html#rest-api-users-methods-get

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toListUsers", []))

    @jsii.member(jsii_name="toRebootBroker")
    def to_reboot_broker(self) -> "Mq":
        '''(experimental) Grants permission to reboot a broker.

        Access Level: Write

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-restart.html#rest-api-reboot-methods-post

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toRebootBroker", []))

    @jsii.member(jsii_name="toUpdateBroker")
    def to_update_broker(self) -> "Mq":
        '''(experimental) Grants permission to add a pending configuration change to a broker.

        Access Level: Write

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-broker.html#rest-api-broker-methods-get

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toUpdateBroker", []))

    @jsii.member(jsii_name="toUpdateConfiguration")
    def to_update_configuration(self) -> "Mq":
        '''(experimental) Grants permission to update the specified configuration.

        Access Level: Write

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-configuration.html#rest-api-configuration-methods-put

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toUpdateConfiguration", []))

    @jsii.member(jsii_name="toUpdateUser")
    def to_update_user(self) -> "Mq":
        '''(experimental) Grants permission to update the information for an ActiveMQ user.

        Access Level: Write

        https://docs.aws.amazon.com/amazon-mq/latest/api-reference/rest-api-username.html#rest-api-username-methods-put

        :stability: experimental
        '''
        return typing.cast("Mq", jsii.invoke(self, "toUpdateUser", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d46ecbf5daacd6fcb25247d16a2632db400bbe0b2f2ac0ea86e426dd5edd051a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__515fa36a991a3ea0883b6093603ecc6ad93734a27dd36bd3e72da1a141353ff3)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class NeptuneDb(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.NeptuneDb",
):
    '''(experimental) Statement provider for service `neptune-db <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonneptune.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `neptune-db <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonneptune.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dae208a5cce1e8478f9b260141d28847397cd945b0270092baa64b03a4fa27da)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifQueryLanguage")
    def if_query_language(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "NeptuneDb":
        '''(experimental) Filters access by graph model.

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-context-keys.html#querylanguage

        Applies to actions:

        - .toDeleteDataViaQuery()
        - .toGetQueryStatus()
        - .toGetStreamRecords()
        - .toReadDataViaQuery()
        - .toWriteDataViaQuery()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__49841cc60f60574f9257f6be4c80767b1ecd3fa94d8a9022730c949f12be67bc)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("NeptuneDb", jsii.invoke(self, "ifQueryLanguage", [value, operator]))

    @jsii.member(jsii_name="onDatabase")
    def on_database(
        self,
        cluster: builtins.str,
        database: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "NeptuneDb":
        '''(experimental) Adds a resource of type database to the statement.

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-data-resources.html

        :param cluster: - Identifier for the cluster.
        :param database: - Identifier for the database.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1ea04275a27e7471ceb9371a7ccc39b625f03d5bb84212f1a0dccbda306db2ec)
            check_type(argname="argument cluster", value=cluster, expected_type=type_hints["cluster"])
            check_type(argname="argument database", value=database, expected_type=type_hints["database"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("NeptuneDb", jsii.invoke(self, "onDatabase", [cluster, database, account, region, partition]))

    @jsii.member(jsii_name="toCancelLoaderJob")
    def to_cancel_loader_job(self) -> "NeptuneDb":
        '''(experimental) Grants permission to cancel a loader job.

        Access Level: Write

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#cancelloaderjob

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toCancelLoaderJob", []))

    @jsii.member(jsii_name="toCancelMLDataProcessingJob")
    def to_cancel_ml_data_processing_job(self) -> "NeptuneDb":
        '''(experimental) Grants permission to cancel an ML data processing job.

        Access Level: Write

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#cancelmldataprocessingjob

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toCancelMLDataProcessingJob", []))

    @jsii.member(jsii_name="toCancelMLModelTrainingJob")
    def to_cancel_ml_model_training_job(self) -> "NeptuneDb":
        '''(experimental) Grants permission to cancel an ML model training job.

        Access Level: Write

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#cancelmlmodeltrainingjob

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toCancelMLModelTrainingJob", []))

    @jsii.member(jsii_name="toCancelMLModelTransformJob")
    def to_cancel_ml_model_transform_job(self) -> "NeptuneDb":
        '''(experimental) Grants permission to cancel an ML model transform job.

        Access Level: Write

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#cancelmlmodeltransformjob

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toCancelMLModelTransformJob", []))

    @jsii.member(jsii_name="toCancelQuery")
    def to_cancel_query(self) -> "NeptuneDb":
        '''(experimental) Grants permission to cancel a query.

        Access Level: Write

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#cancelquery

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toCancelQuery", []))

    @jsii.member(jsii_name="toConnect")
    def to_connect(self) -> "NeptuneDb":
        '''(experimental) Grants permission to all data-access actions in engine versions prior to 1.2.0.0.

        Access Level: Write

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toConnect", []))

    @jsii.member(jsii_name="toCreateMLEndpoint")
    def to_create_ml_endpoint(self) -> "NeptuneDb":
        '''(experimental) Grants permission to create an ML endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#createmlendpoint

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toCreateMLEndpoint", []))

    @jsii.member(jsii_name="toDeleteDataViaQuery")
    def to_delete_data_via_query(self) -> "NeptuneDb":
        '''(experimental) Grants permission to run delete data via query APIs on database.

        Access Level: Write

        Possible conditions:

        - .ifQueryLanguage()

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#deletedataviaquery

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toDeleteDataViaQuery", []))

    @jsii.member(jsii_name="toDeleteMLEndpoint")
    def to_delete_ml_endpoint(self) -> "NeptuneDb":
        '''(experimental) Grants permission to delete an ML endpoint.

        Access Level: Write

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#deletemlendpoint

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toDeleteMLEndpoint", []))

    @jsii.member(jsii_name="toDeleteStatistics")
    def to_delete_statistics(self) -> "NeptuneDb":
        '''(experimental) Grants permission to delete all the statistics in the database.

        Access Level: Write

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#deletestatistics

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toDeleteStatistics", []))

    @jsii.member(jsii_name="toGetEngineStatus")
    def to_get_engine_status(self) -> "NeptuneDb":
        '''(experimental) Grants permission to check the status of the Neptune engine.

        Access Level: Read

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#getenginestatus

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toGetEngineStatus", []))

    @jsii.member(jsii_name="toGetGraphSummary")
    def to_get_graph_summary(self) -> "NeptuneDb":
        '''(experimental) Grants permission to get the graph summary from the database.

        Access Level: Read

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#getgraphsummary

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toGetGraphSummary", []))

    @jsii.member(jsii_name="toGetLoaderJobStatus")
    def to_get_loader_job_status(self) -> "NeptuneDb":
        '''(experimental) Grants permission to check the status of a loader job.

        Access Level: Read

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#getloaderjobstatus

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toGetLoaderJobStatus", []))

    @jsii.member(jsii_name="toGetMLDataProcessingJobStatus")
    def to_get_ml_data_processing_job_status(self) -> "NeptuneDb":
        '''(experimental) Grants permission to check the status of an ML data processing job.

        Access Level: Read

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#getmldataprocessingjobstatus

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toGetMLDataProcessingJobStatus", []))

    @jsii.member(jsii_name="toGetMLEndpointStatus")
    def to_get_ml_endpoint_status(self) -> "NeptuneDb":
        '''(experimental) Grants permission to check the status of an ML endpoint.

        Access Level: Read

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#getmlendpointstatus

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toGetMLEndpointStatus", []))

    @jsii.member(jsii_name="toGetMLModelTrainingJobStatus")
    def to_get_ml_model_training_job_status(self) -> "NeptuneDb":
        '''(experimental) Grants permission to check the status of an ML model training job.

        Access Level: Read

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#getmlmodeltrainingjobstatus

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toGetMLModelTrainingJobStatus", []))

    @jsii.member(jsii_name="toGetMLModelTransformJobStatus")
    def to_get_ml_model_transform_job_status(self) -> "NeptuneDb":
        '''(experimental) Grants permission to check the status of an ML model transform job.

        Access Level: Read

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#getmlmodeltransformjobstatus

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toGetMLModelTransformJobStatus", []))

    @jsii.member(jsii_name="toGetQueryStatus")
    def to_get_query_status(self) -> "NeptuneDb":
        '''(experimental) Grants permission to check the status of all active queries.

        Access Level: Read

        Possible conditions:

        - .ifQueryLanguage()

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#getquerystatus

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toGetQueryStatus", []))

    @jsii.member(jsii_name="toGetStatisticsStatus")
    def to_get_statistics_status(self) -> "NeptuneDb":
        '''(experimental) Grants permission to check the status of statistics of the database.

        Access Level: Read

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#getstatisticsstatus

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toGetStatisticsStatus", []))

    @jsii.member(jsii_name="toGetStreamRecords")
    def to_get_stream_records(self) -> "NeptuneDb":
        '''(experimental) Grants permission to fetch stream records from Neptune.

        Access Level: Read

        Possible conditions:

        - .ifQueryLanguage()

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#getstreamrecords

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toGetStreamRecords", []))

    @jsii.member(jsii_name="toListLoaderJobs")
    def to_list_loader_jobs(self) -> "NeptuneDb":
        '''(experimental) Grants permission to list all the loader jobs.

        Access Level: List

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#listloaderjobs

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toListLoaderJobs", []))

    @jsii.member(jsii_name="toListMLDataProcessingJobs")
    def to_list_ml_data_processing_jobs(self) -> "NeptuneDb":
        '''(experimental) Grants permission to list all the ML data processing jobs.

        Access Level: List

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#listmldataprocessingjobs

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toListMLDataProcessingJobs", []))

    @jsii.member(jsii_name="toListMLEndpoints")
    def to_list_ml_endpoints(self) -> "NeptuneDb":
        '''(experimental) Grants permission to list all the ML endpoints.

        Access Level: List

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#listmlendpoints

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toListMLEndpoints", []))

    @jsii.member(jsii_name="toListMLModelTrainingJobs")
    def to_list_ml_model_training_jobs(self) -> "NeptuneDb":
        '''(experimental) Grants permission to list all the ML model training jobs.

        Access Level: List

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#listmlmodeltrainingjobs

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toListMLModelTrainingJobs", []))

    @jsii.member(jsii_name="toListMLModelTransformJobs")
    def to_list_ml_model_transform_jobs(self) -> "NeptuneDb":
        '''(experimental) Grants permission to list all the ML model transform jobs.

        Access Level: List

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#listmlmodeltransformjobs

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toListMLModelTransformJobs", []))

    @jsii.member(jsii_name="toManageStatistics")
    def to_manage_statistics(self) -> "NeptuneDb":
        '''(experimental) Grants permission to manage statistics in the database.

        Access Level: Write

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#managestatistics

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toManageStatistics", []))

    @jsii.member(jsii_name="toReadDataViaQuery")
    def to_read_data_via_query(self) -> "NeptuneDb":
        '''(experimental) Grants permission to run read data via query APIs on database.

        Access Level: Read

        Possible conditions:

        - .ifQueryLanguage()

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#readdataviaquery

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toReadDataViaQuery", []))

    @jsii.member(jsii_name="toResetDatabase")
    def to_reset_database(self) -> "NeptuneDb":
        '''(experimental) Grants permission to get the token needed for reset and resets the Neptune database.

        Access Level: Write

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#resetdatabase

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toResetDatabase", []))

    @jsii.member(jsii_name="toStartLoaderJob")
    def to_start_loader_job(self) -> "NeptuneDb":
        '''(experimental) Grants permission to start a loader job.

        Access Level: Write

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#startloaderjob

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toStartLoaderJob", []))

    @jsii.member(jsii_name="toStartMLDataProcessingJob")
    def to_start_ml_data_processing_job(self) -> "NeptuneDb":
        '''(experimental) Grants permission to start an ML data processing job.

        Access Level: Write

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#startmldataprocessingjob

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toStartMLDataProcessingJob", []))

    @jsii.member(jsii_name="toStartMLModelTrainingJob")
    def to_start_ml_model_training_job(self) -> "NeptuneDb":
        '''(experimental) Grants permission to start an ML model training job.

        Access Level: Write

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#startmlmodeltrainingjob

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toStartMLModelTrainingJob", []))

    @jsii.member(jsii_name="toStartMLModelTransformJob")
    def to_start_ml_model_transform_job(self) -> "NeptuneDb":
        '''(experimental) Grants permission to start an ML model transform job.

        Access Level: Write

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#startmlmodeltransformjob

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toStartMLModelTransformJob", []))

    @jsii.member(jsii_name="toWriteDataViaQuery")
    def to_write_data_via_query(self) -> "NeptuneDb":
        '''(experimental) Grants permission to run write data via query APIs on database.

        Access Level: Write

        Possible conditions:

        - .ifQueryLanguage()

        https://docs.aws.amazon.com/neptune/latest/userguide/iam-dp-actions.html#writedataviaquery

        :stability: experimental
        '''
        return typing.cast("NeptuneDb", jsii.invoke(self, "toWriteDataViaQuery", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f64ebed0a479c4e29185ce94e47b39d6c3995ecda28507797640db121af2c4c5)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1c90ab3a8648d0fae6a34518847ee662a3d575f73dbae4a40dbd195163d11d95)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class NetworkFirewall(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.NetworkFirewall",
):
    '''(experimental) Statement provider for service `network-firewall <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsnetworkfirewall.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `network-firewall <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsnetworkfirewall.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__12f4a3a6331b82acf2363bf30dc65d2a907c7a2a2e13abf91d8607ea21ebe4db)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onFirewall")
    def on_firewall(
        self,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "NetworkFirewall":
        '''(experimental) Adds a resource of type Firewall to the statement.

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_Firewall.html

        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8f31c5027d047acf134f317a22d39907bbf21341c163602a2e46334a8935b6c4)
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("NetworkFirewall", jsii.invoke(self, "onFirewall", [name, account, region, partition]))

    @jsii.member(jsii_name="onFirewallPolicy")
    def on_firewall_policy(
        self,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "NetworkFirewall":
        '''(experimental) Adds a resource of type FirewallPolicy to the statement.

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_FirewallPolicyResponse.html

        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5374d0475dc42033eb47d2fccca54dbfb1a6aa609e91825508a4fb43e3728adb)
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("NetworkFirewall", jsii.invoke(self, "onFirewallPolicy", [name, account, region, partition]))

    @jsii.member(jsii_name="onStatefulRuleGroup")
    def on_stateful_rule_group(
        self,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "NetworkFirewall":
        '''(experimental) Adds a resource of type StatefulRuleGroup to the statement.

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_RuleGroupResponse.html

        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__35e19e8636642875652b5fc7bc6f604259f54a793036eeff281329be5dbae75e)
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("NetworkFirewall", jsii.invoke(self, "onStatefulRuleGroup", [name, account, region, partition]))

    @jsii.member(jsii_name="onStatelessRuleGroup")
    def on_stateless_rule_group(
        self,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "NetworkFirewall":
        '''(experimental) Adds a resource of type StatelessRuleGroup to the statement.

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_RuleGroupResponse.html

        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b8cc276be8cb046cd020514e666c0d7202ad90f1d7931bc91ad93939e386d2df)
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("NetworkFirewall", jsii.invoke(self, "onStatelessRuleGroup", [name, account, region, partition]))

    @jsii.member(jsii_name="toAssociateFirewallPolicy")
    def to_associate_firewall_policy(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to create an association between a firewall policy and a firewall.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_AssociateFirewallPolicy.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toAssociateFirewallPolicy", []))

    @jsii.member(jsii_name="toAssociateSubnets")
    def to_associate_subnets(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to associate VPC subnets to a firewall.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_AssociateSubnets.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toAssociateSubnets", []))

    @jsii.member(jsii_name="toCreateFirewall")
    def to_create_firewall(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to create an AWS Network Firewall firewall.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_CreateFirewall.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toCreateFirewall", []))

    @jsii.member(jsii_name="toCreateFirewallPolicy")
    def to_create_firewall_policy(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to create an AWS Network Firewall firewall policy.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_CreateFirewallPolicy.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toCreateFirewallPolicy", []))

    @jsii.member(jsii_name="toCreateRuleGroup")
    def to_create_rule_group(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to create an AWS Network Firewall rule group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_CreateRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toCreateRuleGroup", []))

    @jsii.member(jsii_name="toDeleteFirewall")
    def to_delete_firewall(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to delete a firewall.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DeleteFirewall.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDeleteFirewall", []))

    @jsii.member(jsii_name="toDeleteFirewallPolicy")
    def to_delete_firewall_policy(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to delete a firewall policy.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DeleteFirewallPolicy.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDeleteFirewallPolicy", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to delete a resource policy for a firewall policy or rule group.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DeleteResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteRuleGroup")
    def to_delete_rule_group(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to delete a rule group.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DeleteRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDeleteRuleGroup", []))

    @jsii.member(jsii_name="toDescribeFirewall")
    def to_describe_firewall(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to retrieve the data objects that define a firewall.

        Access Level: Read

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DescribeFirewall.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDescribeFirewall", []))

    @jsii.member(jsii_name="toDescribeFirewallPolicy")
    def to_describe_firewall_policy(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to retrieve the data objects that define a firewall policy.

        Access Level: Read

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DescribeFirewallPolicy.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDescribeFirewallPolicy", []))

    @jsii.member(jsii_name="toDescribeLoggingConfiguration")
    def to_describe_logging_configuration(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to describe the logging configuration of a firewall.

        Access Level: Read

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DescribeLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDescribeLoggingConfiguration", []))

    @jsii.member(jsii_name="toDescribeResourcePolicy")
    def to_describe_resource_policy(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to describe a resource policy for a firewall policy or rule group.

        Access Level: Read

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DescribeResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDescribeResourcePolicy", []))

    @jsii.member(jsii_name="toDescribeRuleGroup")
    def to_describe_rule_group(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to retrieve the data objects that define a rule group.

        Access Level: Read

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DescribeRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDescribeRuleGroup", []))

    @jsii.member(jsii_name="toDescribeRuleGroupMetadata")
    def to_describe_rule_group_metadata(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to retrieve the high-level information about a rule group.

        Access Level: Read

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DescribeRuleGroupMetadata.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDescribeRuleGroupMetadata", []))

    @jsii.member(jsii_name="toDisassociateSubnets")
    def to_disassociate_subnets(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to disassociate VPC subnets from a firewall.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DisassociateSubnets.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toDisassociateSubnets", []))

    @jsii.member(jsii_name="toListFirewallPolicies")
    def to_list_firewall_policies(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to retrieve the metadata for firewall policies.

        Access Level: List

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_ListFirewallPolicies.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toListFirewallPolicies", []))

    @jsii.member(jsii_name="toListFirewalls")
    def to_list_firewalls(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to retrieve the metadata for firewalls.

        Access Level: List

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_ListFirewalls.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toListFirewalls", []))

    @jsii.member(jsii_name="toListRuleGroups")
    def to_list_rule_groups(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to retrieve the metadata for rule groups.

        Access Level: List

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_ListRuleGroups.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toListRuleGroups", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to retrieve the tags for a resource.

        Access Level: List

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to put a resource policy for a firewall policy or rule group.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_PutResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to attach tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateFirewallDeleteProtection")
    def to_update_firewall_delete_protection(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to add or remove delete protection for a firewall.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_UpdateFirewallDeleteProtection.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toUpdateFirewallDeleteProtection", []))

    @jsii.member(jsii_name="toUpdateFirewallDescription")
    def to_update_firewall_description(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to modify the description for a firewall.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_UpdateFirewallDescription.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toUpdateFirewallDescription", []))

    @jsii.member(jsii_name="toUpdateFirewallEncryptionConfiguration")
    def to_update_firewall_encryption_configuration(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to modify the encryption configuration of a firewall.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_UpdateFirewallEncryptionConfiguration.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toUpdateFirewallEncryptionConfiguration", []))

    @jsii.member(jsii_name="toUpdateFirewallPolicy")
    def to_update_firewall_policy(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to modify a firewall policy.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_UpdateFirewallPolicy.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toUpdateFirewallPolicy", []))

    @jsii.member(jsii_name="toUpdateFirewallPolicyChangeProtection")
    def to_update_firewall_policy_change_protection(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to add or remove firewall policy change protection for a firewall.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_UpdateFirewallPolicyChangeProtection.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toUpdateFirewallPolicyChangeProtection", []))

    @jsii.member(jsii_name="toUpdateLoggingConfiguration")
    def to_update_logging_configuration(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to modify the logging configuration of a firewall.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_UpdateLoggingConfiguration.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toUpdateLoggingConfiguration", []))

    @jsii.member(jsii_name="toUpdateRuleGroup")
    def to_update_rule_group(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to modify a rule group.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_UpdateRuleGroup.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toUpdateRuleGroup", []))

    @jsii.member(jsii_name="toUpdateSubnetChangeProtection")
    def to_update_subnet_change_protection(self) -> "NetworkFirewall":
        '''(experimental) Grants permission to add or remove subnet change protection for a firewall.

        Access Level: Write

        https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_UpdateSubnetChangeProtection.html

        :stability: experimental
        '''
        return typing.cast("NetworkFirewall", jsii.invoke(self, "toUpdateSubnetChangeProtection", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__32969d6534c21b7f2cdf578d4977fc2c3108e304632c6413b49454c096529971)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4df44abe53fdecacc6e8b2d0e457042049dd7aec647008216cf1e7d97d3fa45f)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Networkmanager(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Networkmanager",
):
    '''(experimental) Statement provider for service `networkmanager <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsnetworkmanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `networkmanager <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsnetworkmanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1b3b706c5ca1a12205a899a258e3cff3de5465ea44a6c46209112e19bf236c48)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifCgwArn")
    def if_cgw_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Networkmanager":
        '''(experimental) Filters access by which customer gateways can be associated or disassociated.

        https://docs.aws.amazon.com/vpc/latest/tgw/nm-security-iam.html

        Applies to actions:

        - .toAssociateCustomerGateway()
        - .toDisassociateCustomerGateway()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__233dda88543ac6a3250bf9284266a244744b167c3da8487f20f67f447286dd32)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Networkmanager", jsii.invoke(self, "ifCgwArn", [value, operator]))

    @jsii.member(jsii_name="ifSubnetArns")
    def if_subnet_arns(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Networkmanager":
        '''(experimental) Filters access by which VPC subnets can be added or removed from a VPC attachment.

        https://docs.aws.amazon.com/vpc/latest/tgw/nm-security-iam.html

        Applies to actions:

        - .toCreateVpcAttachment()
        - .toUpdateVpcAttachment()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4ac83c6e67c3b3fe7a844574ab026419e9532fa6817c32a92f9eac7ca60bd2a8)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Networkmanager", jsii.invoke(self, "ifSubnetArns", [value, operator]))

    @jsii.member(jsii_name="ifTgwArn")
    def if_tgw_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Networkmanager":
        '''(experimental) Filters access by which transit gateways can be registered, deregistered, or peered.

        https://docs.aws.amazon.com/vpc/latest/tgw/nm-security-iam.html

        Applies to actions:

        - .toCreateTransitGatewayPeering()
        - .toDeregisterTransitGateway()
        - .toRegisterTransitGateway()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c11c75acb322e29e88673f98823613eea7286b1049bd828446d37eaa60e99c5e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Networkmanager", jsii.invoke(self, "ifTgwArn", [value, operator]))

    @jsii.member(jsii_name="ifTgwConnectPeerArn")
    def if_tgw_connect_peer_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Networkmanager":
        '''(experimental) Filters access by which transit gateway connect peers can be associated or disassociated.

        https://docs.aws.amazon.com/vpc/latest/tgw/nm-security-iam.html

        Applies to actions:

        - .toAssociateTransitGatewayConnectPeer()
        - .toDisassociateTransitGatewayConnectPeer()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7eb95d88ef2c6f9bc308080f52ade1aba2053ff21208bca2ee1c2e1c91cc17ea)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Networkmanager", jsii.invoke(self, "ifTgwConnectPeerArn", [value, operator]))

    @jsii.member(jsii_name="ifTgwRtbArn")
    def if_tgw_rtb_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Networkmanager":
        '''(experimental) Filters access by which Transit Gateway Route Table can be used to create an attachment.

        https://docs.aws.amazon.com/vpc/latest/tgw/nm-security-iam.html

        Applies to actions:

        - .toCreateTransitGatewayRouteTableAttachment()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__6023174c860a60cbfee36b6703be71803a9d32582469ff120b6d8e859a486e58)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Networkmanager", jsii.invoke(self, "ifTgwRtbArn", [value, operator]))

    @jsii.member(jsii_name="ifVpcArn")
    def if_vpc_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Networkmanager":
        '''(experimental) Filters access by which VPC can be used to a create/update attachment.

        https://docs.aws.amazon.com/vpc/latest/tgw/nm-security-iam.html

        Applies to actions:

        - .toCreateVpcAttachment()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__36139926e86cfabd2b5a8b1b1f968ba6d4be80b796f49d4d31524ee406b20990)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Networkmanager", jsii.invoke(self, "ifVpcArn", [value, operator]))

    @jsii.member(jsii_name="ifVpnConnectionArn")
    def if_vpn_connection_arn(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Networkmanager":
        '''(experimental) Filters access by which Site-to-Site VPN can be used to a create/update attachment.

        https://docs.aws.amazon.com/vpc/latest/tgw/nm-security-iam.html

        Applies to actions:

        - .toCreateSiteToSiteVpnAttachment()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fc706aac434aec99659bb41a713590ca673180db56c26eb2200a947364619d07)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Networkmanager", jsii.invoke(self, "ifVpnConnectionArn", [value, operator]))

    @jsii.member(jsii_name="onAttachment")
    def on_attachment(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Networkmanager":
        '''(experimental) Adds a resource of type attachment to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/what-is-network-manager.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4bd60e6598f73a9ce88db6e0e58819d125529e695111107f09991172392bff6e)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Networkmanager", jsii.invoke(self, "onAttachment", [resource_id, account, partition]))

    @jsii.member(jsii_name="onConnection")
    def on_connection(
        self,
        global_network_id: builtins.str,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Networkmanager":
        '''(experimental) Adds a resource of type connection to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/what-is-network-manager.html

        :param global_network_id: - Identifier for the globalNetworkId.
        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__921dcf7253706708fc1ee731a2309909f88223a420b12808630b144e7b4d3682)
            check_type(argname="argument global_network_id", value=global_network_id, expected_type=type_hints["global_network_id"])
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Networkmanager", jsii.invoke(self, "onConnection", [global_network_id, resource_id, account, partition]))

    @jsii.member(jsii_name="onConnectPeer")
    def on_connect_peer(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Networkmanager":
        '''(experimental) Adds a resource of type connect-peer to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/what-is-network-manager.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ecb3be62280f25fcbc1455dd47b1c5b47b40aea564c17887913b6ad83de3d0cf)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Networkmanager", jsii.invoke(self, "onConnectPeer", [resource_id, account, partition]))

    @jsii.member(jsii_name="onCoreNetwork")
    def on_core_network(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Networkmanager":
        '''(experimental) Adds a resource of type core-network to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/what-is-network-manager.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__004dcb2e380765dd2ea0a2b6db05b1ed9d354e24cbadcbaaa803a74e7a22bdc8)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Networkmanager", jsii.invoke(self, "onCoreNetwork", [resource_id, account, partition]))

    @jsii.member(jsii_name="onDevice")
    def on_device(
        self,
        global_network_id: builtins.str,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Networkmanager":
        '''(experimental) Adds a resource of type device to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/what-is-network-manager.html

        :param global_network_id: - Identifier for the globalNetworkId.
        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__50fcd9d04b03d0e94f126d11b0805cda00a80d3ab4c366b30eedcc17109d1e70)
            check_type(argname="argument global_network_id", value=global_network_id, expected_type=type_hints["global_network_id"])
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Networkmanager", jsii.invoke(self, "onDevice", [global_network_id, resource_id, account, partition]))

    @jsii.member(jsii_name="onGlobalNetwork")
    def on_global_network(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Networkmanager":
        '''(experimental) Adds a resource of type global-network to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/what-is-network-manager.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d27d49bd3e19dfd6b58d9c424c497a7847bd8d7a45ec98d4bfc34ea31b798413)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Networkmanager", jsii.invoke(self, "onGlobalNetwork", [resource_id, account, partition]))

    @jsii.member(jsii_name="onLink")
    def on_link(
        self,
        global_network_id: builtins.str,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Networkmanager":
        '''(experimental) Adds a resource of type link to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/what-is-network-manager.html

        :param global_network_id: - Identifier for the globalNetworkId.
        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7d291bd2fbb34e438113c892e2a63ef4bab0e6b7b093b70b118c800f10a2f843)
            check_type(argname="argument global_network_id", value=global_network_id, expected_type=type_hints["global_network_id"])
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Networkmanager", jsii.invoke(self, "onLink", [global_network_id, resource_id, account, partition]))

    @jsii.member(jsii_name="onPeering")
    def on_peering(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Networkmanager":
        '''(experimental) Adds a resource of type peering to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/what-is-network-manager.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e1cdb6f32fb1b3412b0e0c06c9e58febed933688b32e13e18bcb1ed65e8c7212)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Networkmanager", jsii.invoke(self, "onPeering", [resource_id, account, partition]))

    @jsii.member(jsii_name="onSite")
    def on_site(
        self,
        global_network_id: builtins.str,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Networkmanager":
        '''(experimental) Adds a resource of type site to the statement.

        https://docs.aws.amazon.com/vpc/latest/tgw/what-is-network-manager.html

        :param global_network_id: - Identifier for the globalNetworkId.
        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9c9f706706c518dc0edb1237f575ae692e73344374b3df68b63b7ff8122d2a0e)
            check_type(argname="argument global_network_id", value=global_network_id, expected_type=type_hints["global_network_id"])
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Networkmanager", jsii.invoke(self, "onSite", [global_network_id, resource_id, account, partition]))

    @jsii.member(jsii_name="toAcceptAttachment")
    def to_accept_attachment(self) -> "Networkmanager":
        '''(experimental) Grants permission to accept creation of an attachment between a source and destination in a core network.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_AcceptAttachment.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toAcceptAttachment", []))

    @jsii.member(jsii_name="toAssociateConnectPeer")
    def to_associate_connect_peer(self) -> "Networkmanager":
        '''(experimental) Grants permission to associate a Connect Peer.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_AssociateConnectPeer.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toAssociateConnectPeer", []))

    @jsii.member(jsii_name="toAssociateCustomerGateway")
    def to_associate_customer_gateway(self) -> "Networkmanager":
        '''(experimental) Grants permission to associate a customer gateway to a device.

        Access Level: Write

        Possible conditions:

        - .ifCgwArn()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_AssociateCustomerGateway.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toAssociateCustomerGateway", []))

    @jsii.member(jsii_name="toAssociateLink")
    def to_associate_link(self) -> "Networkmanager":
        '''(experimental) Grants permission to associate a link to a device.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_AssociateLink.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toAssociateLink", []))

    @jsii.member(jsii_name="toAssociateTransitGatewayConnectPeer")
    def to_associate_transit_gateway_connect_peer(self) -> "Networkmanager":
        '''(experimental) Grants permission to associate a transit gateway connect peer to a device.

        Access Level: Write

        Possible conditions:

        - .ifTgwConnectPeerArn()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_AssociateTransitGatewayConnectPeer.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toAssociateTransitGatewayConnectPeer", []))

    @jsii.member(jsii_name="toCreateConnectAttachment")
    def to_create_connect_attachment(self) -> "Networkmanager":
        '''(experimental) Grants permission to create a Connect attachment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateConnectAttachment.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toCreateConnectAttachment", []))

    @jsii.member(jsii_name="toCreateConnection")
    def to_create_connection(self) -> "Networkmanager":
        '''(experimental) Grants permission to create a new connection.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateConnection.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toCreateConnection", []))

    @jsii.member(jsii_name="toCreateConnectPeer")
    def to_create_connect_peer(self) -> "Networkmanager":
        '''(experimental) Grants permission to create a Connect Peer connection.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateConnectPeer.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toCreateConnectPeer", []))

    @jsii.member(jsii_name="toCreateCoreNetwork")
    def to_create_core_network(self) -> "Networkmanager":
        '''(experimental) Grants permission to create a new core network.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateCoreNetwork.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toCreateCoreNetwork", []))

    @jsii.member(jsii_name="toCreateDevice")
    def to_create_device(self) -> "Networkmanager":
        '''(experimental) Grants permission to create a new device.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateDevice.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toCreateDevice", []))

    @jsii.member(jsii_name="toCreateGlobalNetwork")
    def to_create_global_network(self) -> "Networkmanager":
        '''(experimental) Grants permission to create a new global network.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateGlobalNetwork.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toCreateGlobalNetwork", []))

    @jsii.member(jsii_name="toCreateLink")
    def to_create_link(self) -> "Networkmanager":
        '''(experimental) Grants permission to create a new link.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateLink.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toCreateLink", []))

    @jsii.member(jsii_name="toCreateSite")
    def to_create_site(self) -> "Networkmanager":
        '''(experimental) Grants permission to create a new site.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateSite.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toCreateSite", []))

    @jsii.member(jsii_name="toCreateSiteToSiteVpnAttachment")
    def to_create_site_to_site_vpn_attachment(self) -> "Networkmanager":
        '''(experimental) Grants permission to create a site-to-site VPN attachment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifVpnConnectionArn()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateSiteToSiteVpnAttachment.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toCreateSiteToSiteVpnAttachment", []))

    @jsii.member(jsii_name="toCreateTransitGatewayPeering")
    def to_create_transit_gateway_peering(self) -> "Networkmanager":
        '''(experimental) Grants permission to create a Transit Gateway peering.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifTgwArn()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateTransitGatewayPeering.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toCreateTransitGatewayPeering", []))

    @jsii.member(jsii_name="toCreateTransitGatewayRouteTableAttachment")
    def to_create_transit_gateway_route_table_attachment(self) -> "Networkmanager":
        '''(experimental) Grants permission to create a TGW RTB attachment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifTgwRtbArn()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateTransitGatewayRouteTableAttachment.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toCreateTransitGatewayRouteTableAttachment", []))

    @jsii.member(jsii_name="toCreateVpcAttachment")
    def to_create_vpc_attachment(self) -> "Networkmanager":
        '''(experimental) Grants permission to create a VPC attachment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifVpcArn()
        - .ifSubnetArns()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_CreateVpcAttachment.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toCreateVpcAttachment", []))

    @jsii.member(jsii_name="toDeleteAttachment")
    def to_delete_attachment(self) -> "Networkmanager":
        '''(experimental) Grants permission to delete an attachment.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DeleteAttachment.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDeleteAttachment", []))

    @jsii.member(jsii_name="toDeleteConnection")
    def to_delete_connection(self) -> "Networkmanager":
        '''(experimental) Grants permission to delete a connection.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DeleteConnection.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDeleteConnection", []))

    @jsii.member(jsii_name="toDeleteConnectPeer")
    def to_delete_connect_peer(self) -> "Networkmanager":
        '''(experimental) Grants permission to delete a Connect Peer.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DeleteConnectPeer.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDeleteConnectPeer", []))

    @jsii.member(jsii_name="toDeleteCoreNetwork")
    def to_delete_core_network(self) -> "Networkmanager":
        '''(experimental) Grants permission to delete a core network.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DeleteCoreNetwork.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDeleteCoreNetwork", []))

    @jsii.member(jsii_name="toDeleteCoreNetworkPolicyVersion")
    def to_delete_core_network_policy_version(self) -> "Networkmanager":
        '''(experimental) Grants permission to delete the core network policy version.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DeleteCoreNetworkPolicyVersion.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDeleteCoreNetworkPolicyVersion", []))

    @jsii.member(jsii_name="toDeleteDevice")
    def to_delete_device(self) -> "Networkmanager":
        '''(experimental) Grants permission to delete a device.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DeleteDevice.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDeleteDevice", []))

    @jsii.member(jsii_name="toDeleteGlobalNetwork")
    def to_delete_global_network(self) -> "Networkmanager":
        '''(experimental) Grants permission to delete a global network.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DeleteGlobalNetwork.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDeleteGlobalNetwork", []))

    @jsii.member(jsii_name="toDeleteLink")
    def to_delete_link(self) -> "Networkmanager":
        '''(experimental) Grants permission to delete a link.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DeleteLink.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDeleteLink", []))

    @jsii.member(jsii_name="toDeletePeering")
    def to_delete_peering(self) -> "Networkmanager":
        '''(experimental) Grants permission to delete a peering.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DeletePeering.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDeletePeering", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "Networkmanager":
        '''(experimental) Grants permission to delete a resource.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DeleteResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeleteSite")
    def to_delete_site(self) -> "Networkmanager":
        '''(experimental) Grants permission to delete a site.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DeleteSite.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDeleteSite", []))

    @jsii.member(jsii_name="toDeregisterTransitGateway")
    def to_deregister_transit_gateway(self) -> "Networkmanager":
        '''(experimental) Grants permission to deregister a transit gateway from a global network.

        Access Level: Write

        Possible conditions:

        - .ifTgwArn()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DeregisterTransitGateway.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDeregisterTransitGateway", []))

    @jsii.member(jsii_name="toDescribeGlobalNetworks")
    def to_describe_global_networks(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe global networks.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DescribeGlobalNetworks.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDescribeGlobalNetworks", []))

    @jsii.member(jsii_name="toDisassociateConnectPeer")
    def to_disassociate_connect_peer(self) -> "Networkmanager":
        '''(experimental) Grants permission to disassociate a Connect Peer.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DisassociateConnectPeer.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDisassociateConnectPeer", []))

    @jsii.member(jsii_name="toDisassociateCustomerGateway")
    def to_disassociate_customer_gateway(self) -> "Networkmanager":
        '''(experimental) Grants permission to disassociate a customer gateway from a device.

        Access Level: Write

        Possible conditions:

        - .ifCgwArn()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DisassociateCustomerGateway.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDisassociateCustomerGateway", []))

    @jsii.member(jsii_name="toDisassociateLink")
    def to_disassociate_link(self) -> "Networkmanager":
        '''(experimental) Grants permission to disassociate a link from a device.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DisassociateLink.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDisassociateLink", []))

    @jsii.member(jsii_name="toDisassociateTransitGatewayConnectPeer")
    def to_disassociate_transit_gateway_connect_peer(self) -> "Networkmanager":
        '''(experimental) Grants permission to disassociate a transit gateway connect peer from a device.

        Access Level: Write

        Possible conditions:

        - .ifTgwConnectPeerArn()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_DisassociateTransitGatewayConnectPeer.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toDisassociateTransitGatewayConnectPeer", []))

    @jsii.member(jsii_name="toExecuteCoreNetworkChangeSet")
    def to_execute_core_network_change_set(self) -> "Networkmanager":
        '''(experimental) Grants permission to apply changes to the core network.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_ExecuteCoreNetworkChangeSet.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toExecuteCoreNetworkChangeSet", []))

    @jsii.member(jsii_name="toGetConnectAttachment")
    def to_get_connect_attachment(self) -> "Networkmanager":
        '''(experimental) Grants permission to retrieve a Connect attachment.

        Access Level: Read

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetConnectAttachment.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetConnectAttachment", []))

    @jsii.member(jsii_name="toGetConnections")
    def to_get_connections(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe connections.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetConnections.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetConnections", []))

    @jsii.member(jsii_name="toGetConnectPeer")
    def to_get_connect_peer(self) -> "Networkmanager":
        '''(experimental) Grants permission to retrieve a Connect Peer.

        Access Level: Read

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetConnectPeer.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetConnectPeer", []))

    @jsii.member(jsii_name="toGetConnectPeerAssociations")
    def to_get_connect_peer_associations(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe Connect Peer associations.

        Access Level: Read

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetConnectPeerAssociations.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetConnectPeerAssociations", []))

    @jsii.member(jsii_name="toGetCoreNetwork")
    def to_get_core_network(self) -> "Networkmanager":
        '''(experimental) Grants permission to retrieve a core network.

        Access Level: Read

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetCoreNetwork.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetCoreNetwork", []))

    @jsii.member(jsii_name="toGetCoreNetworkChangeEvents")
    def to_get_core_network_change_events(self) -> "Networkmanager":
        '''(experimental) Grants permission to retrieve a list of core network change events.

        Access Level: Read

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetCoreNetworkChangeEvents.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetCoreNetworkChangeEvents", []))

    @jsii.member(jsii_name="toGetCoreNetworkChangeSet")
    def to_get_core_network_change_set(self) -> "Networkmanager":
        '''(experimental) Grants permission to retrieve a list of core network change sets.

        Access Level: Read

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetCoreNetworkChangeSet.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetCoreNetworkChangeSet", []))

    @jsii.member(jsii_name="toGetCoreNetworkPolicy")
    def to_get_core_network_policy(self) -> "Networkmanager":
        '''(experimental) Grants permission to retrieve core network policy.

        Access Level: Read

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetCoreNetworkPolicy.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetCoreNetworkPolicy", []))

    @jsii.member(jsii_name="toGetCustomerGatewayAssociations")
    def to_get_customer_gateway_associations(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe customer gateway associations.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetCustomerGatewayAssociations.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetCustomerGatewayAssociations", []))

    @jsii.member(jsii_name="toGetDevices")
    def to_get_devices(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe devices.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetDevices.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetDevices", []))

    @jsii.member(jsii_name="toGetLinkAssociations")
    def to_get_link_associations(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe link associations.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetLinkAssociations.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetLinkAssociations", []))

    @jsii.member(jsii_name="toGetLinks")
    def to_get_links(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe links.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetLinks.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetLinks", []))

    @jsii.member(jsii_name="toGetNetworkResourceCounts")
    def to_get_network_resource_counts(self) -> "Networkmanager":
        '''(experimental) Grants permission to return the number of resources for a global network grouped by type.

        Access Level: Read

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetNetworkResourceCounts.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetNetworkResourceCounts", []))

    @jsii.member(jsii_name="toGetNetworkResourceRelationships")
    def to_get_network_resource_relationships(self) -> "Networkmanager":
        '''(experimental) Grants permission to retrieve related resources for a resource within the global network.

        Access Level: Read

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetNetworkResourceRelationships.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetNetworkResourceRelationships", []))

    @jsii.member(jsii_name="toGetNetworkResources")
    def to_get_network_resources(self) -> "Networkmanager":
        '''(experimental) Grants permission to retrieve a global network resource.

        Access Level: Read

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetNetworkResources.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetNetworkResources", []))

    @jsii.member(jsii_name="toGetNetworkRoutes")
    def to_get_network_routes(self) -> "Networkmanager":
        '''(experimental) Grants permission to retrieve routes for a route table within the global network.

        Access Level: Read

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetNetworkRoutes.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetNetworkRoutes", []))

    @jsii.member(jsii_name="toGetNetworkTelemetry")
    def to_get_network_telemetry(self) -> "Networkmanager":
        '''(experimental) Grants permission to retrieve network telemetry objects for the global network.

        Access Level: Read

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetNetworkTelemetry.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetNetworkTelemetry", []))

    @jsii.member(jsii_name="toGetResourcePolicy")
    def to_get_resource_policy(self) -> "Networkmanager":
        '''(experimental) Grants permission to retrieve a resource policy.

        Access Level: Read

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetResourcePolicy", []))

    @jsii.member(jsii_name="toGetRouteAnalysis")
    def to_get_route_analysis(self) -> "Networkmanager":
        '''(experimental) Grants permission to retrieve a route analysis configuration and result.

        Access Level: Read

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetRouteAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetRouteAnalysis", []))

    @jsii.member(jsii_name="toGetSites")
    def to_get_sites(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe global networks.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetSites.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetSites", []))

    @jsii.member(jsii_name="toGetSiteToSiteVpnAttachment")
    def to_get_site_to_site_vpn_attachment(self) -> "Networkmanager":
        '''(experimental) Grants permission to retrieve a site-to-site VPN attachment.

        Access Level: Read

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetSiteToSiteVpnAttachment.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetSiteToSiteVpnAttachment", []))

    @jsii.member(jsii_name="toGetTransitGatewayConnectPeerAssociations")
    def to_get_transit_gateway_connect_peer_associations(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe transit gateway connect peer associations.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetTransitGatewayConnectPeerAssociations.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetTransitGatewayConnectPeerAssociations", []))

    @jsii.member(jsii_name="toGetTransitGatewayPeering")
    def to_get_transit_gateway_peering(self) -> "Networkmanager":
        '''(experimental) Grants permission to retrieve a Transit Gateway peering.

        Access Level: Read

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetTransitGatewayPeering.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetTransitGatewayPeering", []))

    @jsii.member(jsii_name="toGetTransitGatewayRegistrations")
    def to_get_transit_gateway_registrations(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe transit gateway registrations.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetTransitGatewayRegistrations.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetTransitGatewayRegistrations", []))

    @jsii.member(jsii_name="toGetTransitGatewayRouteTableAttachment")
    def to_get_transit_gateway_route_table_attachment(self) -> "Networkmanager":
        '''(experimental) Grants permission to retrieve a TGW RTB attachment.

        Access Level: Read

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetTransitGatewayRouteTableAttachment.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetTransitGatewayRouteTableAttachment", []))

    @jsii.member(jsii_name="toGetVpcAttachment")
    def to_get_vpc_attachment(self) -> "Networkmanager":
        '''(experimental) Grants permission to retrieve a VPC attachment.

        Access Level: Read

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_GetVpcAttachment.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toGetVpcAttachment", []))

    @jsii.member(jsii_name="toListAttachments")
    def to_list_attachments(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe attachments.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_ListAttachments.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toListAttachments", []))

    @jsii.member(jsii_name="toListConnectPeers")
    def to_list_connect_peers(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe Connect Peers.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_ListConnectPeers.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toListConnectPeers", []))

    @jsii.member(jsii_name="toListCoreNetworkPolicyVersions")
    def to_list_core_network_policy_versions(self) -> "Networkmanager":
        '''(experimental) Grants permission to list core network policy versions.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_ListCoreNetworkPolicyVersions.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toListCoreNetworkPolicyVersions", []))

    @jsii.member(jsii_name="toListCoreNetworks")
    def to_list_core_networks(self) -> "Networkmanager":
        '''(experimental) Grants permission to list core networks.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_ListCoreNetworks.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toListCoreNetworks", []))

    @jsii.member(jsii_name="toListOrganizationServiceAccessStatus")
    def to_list_organization_service_access_status(self) -> "Networkmanager":
        '''(experimental) Grants permission to list organization service access status.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_ListOrganizationServiceAccessStatus.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toListOrganizationServiceAccessStatus", []))

    @jsii.member(jsii_name="toListPeerings")
    def to_list_peerings(self) -> "Networkmanager":
        '''(experimental) Grants permission to describe peerings.

        Access Level: List

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_ListPeerings.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toListPeerings", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Networkmanager":
        '''(experimental) Grants permission to list tags for a Network Manager resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutCoreNetworkPolicy")
    def to_put_core_network_policy(self) -> "Networkmanager":
        '''(experimental) Grants permission to create a core network policy.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_PutCoreNetworkPolicy.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toPutCoreNetworkPolicy", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "Networkmanager":
        '''(experimental) Grants permission to create or update a resource policy.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_PutResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toRegisterTransitGateway")
    def to_register_transit_gateway(self) -> "Networkmanager":
        '''(experimental) Grants permission to register a transit gateway to a global network.

        Access Level: Write

        Possible conditions:

        - .ifTgwArn()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_RegisterTransitGateway.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toRegisterTransitGateway", []))

    @jsii.member(jsii_name="toRejectAttachment")
    def to_reject_attachment(self) -> "Networkmanager":
        '''(experimental) Grants permission to reject attachment request.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_RejectAttachment.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toRejectAttachment", []))

    @jsii.member(jsii_name="toRestoreCoreNetworkPolicyVersion")
    def to_restore_core_network_policy_version(self) -> "Networkmanager":
        '''(experimental) Grants permission to restore the core network policy to a previous version.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_RestoreCoreNetworkPolicyVersion.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toRestoreCoreNetworkPolicyVersion", []))

    @jsii.member(jsii_name="toStartOrganizationServiceAccessUpdate")
    def to_start_organization_service_access_update(self) -> "Networkmanager":
        '''(experimental) Grants permission to start organization service access update.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_StartOrganizationServiceAccessUpdate.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toStartOrganizationServiceAccessUpdate", []))

    @jsii.member(jsii_name="toStartRouteAnalysis")
    def to_start_route_analysis(self) -> "Networkmanager":
        '''(experimental) Grants permission to start a route analysis and stores analysis configuration.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_StartRouteAnalysis.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toStartRouteAnalysis", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Networkmanager":
        '''(experimental) Grants permission to tag a Network Manager resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Networkmanager":
        '''(experimental) Grants permission to untag a Network Manager resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateConnection")
    def to_update_connection(self) -> "Networkmanager":
        '''(experimental) Grants permission to update a connection.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_UpdateConnection.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toUpdateConnection", []))

    @jsii.member(jsii_name="toUpdateCoreNetwork")
    def to_update_core_network(self) -> "Networkmanager":
        '''(experimental) Grants permission to update a core network.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_UpdateCoreNetwork.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toUpdateCoreNetwork", []))

    @jsii.member(jsii_name="toUpdateDevice")
    def to_update_device(self) -> "Networkmanager":
        '''(experimental) Grants permission to update a device.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_UpdateDevice.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toUpdateDevice", []))

    @jsii.member(jsii_name="toUpdateGlobalNetwork")
    def to_update_global_network(self) -> "Networkmanager":
        '''(experimental) Grants permission to update a global network.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_UpdateGlobalNetwork.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toUpdateGlobalNetwork", []))

    @jsii.member(jsii_name="toUpdateLink")
    def to_update_link(self) -> "Networkmanager":
        '''(experimental) Grants permission to update a link.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_UpdateLink.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toUpdateLink", []))

    @jsii.member(jsii_name="toUpdateNetworkResourceMetadata")
    def to_update_network_resource_metadata(self) -> "Networkmanager":
        '''(experimental) Grants permission to add or update metadata key/value pairs on network resource.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_UpdateNetworkResourceMetadata.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toUpdateNetworkResourceMetadata", []))

    @jsii.member(jsii_name="toUpdateSite")
    def to_update_site(self) -> "Networkmanager":
        '''(experimental) Grants permission to update a site.

        Access Level: Write

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_UpdateSite.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toUpdateSite", []))

    @jsii.member(jsii_name="toUpdateVpcAttachment")
    def to_update_vpc_attachment(self) -> "Networkmanager":
        '''(experimental) Grants permission to update a VPC attachment.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifSubnetArns()

        https://docs.aws.amazon.com/networkmanager/latest/APIReference/API_UpdateVpcAttachment.html

        :stability: experimental
        '''
        return typing.cast("Networkmanager", jsii.invoke(self, "toUpdateVpcAttachment", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b632daca5968328f2f1d620e1f816c2f36bdefedf8a0c1a886508529c31a1352)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3275858fd7afc8f2796921a4a2a15dc059c73d011db6a34d931f06a5f76b1a52)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Nimble(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Nimble"):
    '''(experimental) Statement provider for service `nimble <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonnimblestudio.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `nimble <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonnimblestudio.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a4ed636ee25c09eeecd5eafe87ee9a87f4453c543de00329f66773a11d04d3e2)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifCreatedBy")
    def if_created_by(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Nimble":
        '''(experimental) Filters access by the createdBy request parameter or the ID of the creator of the resource.

        https://docs.aws.amazon.com/nimble-studio/latest/userguide/security-iam-service-with-iam.html

        Applies to actions:

        - .toListStreamingSessions()

        Applies to resource types:

        - streaming-session

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d860918c1a7af28ff21b9ea8d763d8dc0a3e286b68ce06d3a679be7bfd644403)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Nimble", jsii.invoke(self, "ifCreatedBy", [value, operator]))

    @jsii.member(jsii_name="ifOwnedBy")
    def if_owned_by(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Nimble":
        '''(experimental) Filters access by the ownedBy request parameter or the ID of the owner of the resource.

        https://docs.aws.amazon.com/nimble-studio/latest/userguide/security-iam-service-with-iam.html

        Applies to actions:

        - .toListStreamingSessions()

        Applies to resource types:

        - streaming-session
        - streaming-session-backup

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c1949b8289287cfdefe0fbaa3453cee2d2ab6b2b2a1cf37b89309ecc601f1206)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Nimble", jsii.invoke(self, "ifOwnedBy", [value, operator]))

    @jsii.member(jsii_name="ifPrincipalId")
    def if_principal_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Nimble":
        '''(experimental) Filters access by the principalId request parameter.

        https://docs.aws.amazon.com/nimble-studio/latest/userguide/security-iam-service-with-iam.html

        Applies to actions:

        - .toListLaunchProfiles()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__020522bdde27b46c02b3ba425b6773be1b13c5a8239ae2c2173bfddd2ab43a7e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Nimble", jsii.invoke(self, "ifPrincipalId", [value, operator]))

    @jsii.member(jsii_name="ifRequesterPrincipalId")
    def if_requester_principal_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Nimble":
        '''(experimental) Filters access by the ID of the logged in user.

        https://docs.aws.amazon.com/nimble-studio/latest/userguide/security-iam-service-with-iam.html

        Applies to actions:

        - .toCreateStreamingSessionStream()
        - .toDeleteStreamingSession()
        - .toGetStreamingSession()
        - .toGetStreamingSessionBackup()
        - .toGetStreamingSessionStream()
        - .toListLaunchProfiles()
        - .toListStreamingSessionBackups()
        - .toListStreamingSessions()
        - .toStartStreamingSession()
        - .toStopStreamingSession()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__180898eeb3070cea2c0aba8c05827510cc55764acac0bc857b9d9d2fb969e110)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Nimble", jsii.invoke(self, "ifRequesterPrincipalId", [value, operator]))

    @jsii.member(jsii_name="ifStudioId")
    def if_studio_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Nimble":
        '''(experimental) Filters access by a specific studio.

        https://docs.aws.amazon.com/nimble-studio/latest/userguide/security-iam-service-with-iam.html

        Applies to resource types:

        - studio
        - streaming-image
        - studio-component
        - launch-profile
        - eula-acceptance

        :param value: The value(s) to check.
        :param operator: Works with `arn operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN>`_. **Default:** ``ArnLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8a1f8c9ee13748bfeb0639c82cb4cfb0c8c909fe644930853b356fcff938df0b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Nimble", jsii.invoke(self, "ifStudioId", [value, operator]))

    @jsii.member(jsii_name="onEula")
    def on_eula(
        self,
        eula_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Nimble":
        '''(experimental) Adds a resource of type eula to the statement.

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_Eula.html

        :param eula_id: - Identifier for the eulaId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0d4c6cc5b3fab000845b790687e3e762b84cf4ad3f55d0b8c21a19279e3be1e0)
            check_type(argname="argument eula_id", value=eula_id, expected_type=type_hints["eula_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Nimble", jsii.invoke(self, "onEula", [eula_id, account, region, partition]))

    @jsii.member(jsii_name="onEulaAcceptance")
    def on_eula_acceptance(
        self,
        eula_acceptance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Nimble":
        '''(experimental) Adds a resource of type eula-acceptance to the statement.

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_EulaAcceptance.html

        :param eula_acceptance_id: - Identifier for the eulaAcceptanceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifStudioId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__299edaafbf61d43a89e23cb8a48476d882c0ff7f37a43e5824ed3da0a801d073)
            check_type(argname="argument eula_acceptance_id", value=eula_acceptance_id, expected_type=type_hints["eula_acceptance_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Nimble", jsii.invoke(self, "onEulaAcceptance", [eula_acceptance_id, account, region, partition]))

    @jsii.member(jsii_name="onLaunchProfile")
    def on_launch_profile(
        self,
        launch_profile_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Nimble":
        '''(experimental) Adds a resource of type launch-profile to the statement.

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_LaunchProfile.html

        :param launch_profile_id: - Identifier for the launchProfileId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifStudioId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f612bfecf76b349b9caf25ca8c0efb71ea8e306abd2a45fea593a04e33fda457)
            check_type(argname="argument launch_profile_id", value=launch_profile_id, expected_type=type_hints["launch_profile_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Nimble", jsii.invoke(self, "onLaunchProfile", [launch_profile_id, account, region, partition]))

    @jsii.member(jsii_name="onStreamingImage")
    def on_streaming_image(
        self,
        streaming_image_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Nimble":
        '''(experimental) Adds a resource of type streaming-image to the statement.

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_StreamingImage.html

        :param streaming_image_id: - Identifier for the streamingImageId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifStudioId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1f9c4845f21f901eacbec3aa7ab9240236539ee4dca61f0ee37d6b9161cfa0da)
            check_type(argname="argument streaming_image_id", value=streaming_image_id, expected_type=type_hints["streaming_image_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Nimble", jsii.invoke(self, "onStreamingImage", [streaming_image_id, account, region, partition]))

    @jsii.member(jsii_name="onStreamingSession")
    def on_streaming_session(
        self,
        streaming_session_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Nimble":
        '''(experimental) Adds a resource of type streaming-session to the statement.

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_StreamingSession.html

        :param streaming_session_id: - Identifier for the streamingSessionId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifCreatedBy() - .ifOwnedBy()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f027f2826af394b91ce30c1d1042a8d20cf95b8b11df370e2dbde3017fbb1033)
            check_type(argname="argument streaming_session_id", value=streaming_session_id, expected_type=type_hints["streaming_session_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Nimble", jsii.invoke(self, "onStreamingSession", [streaming_session_id, account, region, partition]))

    @jsii.member(jsii_name="onStreamingSessionBackup")
    def on_streaming_session_backup(
        self,
        streaming_session_backup_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Nimble":
        '''(experimental) Adds a resource of type streaming-session-backup to the statement.

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_StreamingSessionBackup.html

        :param streaming_session_backup_id: - Identifier for the streamingSessionBackupId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifOwnedBy()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__72dbaae24e8016f448feed8557243b7e2e74d9394e6a33975ed66ef422906956)
            check_type(argname="argument streaming_session_backup_id", value=streaming_session_backup_id, expected_type=type_hints["streaming_session_backup_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Nimble", jsii.invoke(self, "onStreamingSessionBackup", [streaming_session_backup_id, account, region, partition]))

    @jsii.member(jsii_name="onStudio")
    def on_studio(
        self,
        studio_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Nimble":
        '''(experimental) Adds a resource of type studio to the statement.

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_Studio.html

        :param studio_id: - Identifier for the studioId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifStudioId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__37e2c4c7c9a7f77358bcda27d15656e528e703af5db2eedcfd12cd535a90c904)
            check_type(argname="argument studio_id", value=studio_id, expected_type=type_hints["studio_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Nimble", jsii.invoke(self, "onStudio", [studio_id, account, region, partition]))

    @jsii.member(jsii_name="onStudioComponent")
    def on_studio_component(
        self,
        studio_component_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Nimble":
        '''(experimental) Adds a resource of type studio-component to the statement.

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_StudioComponent.html

        :param studio_component_id: - Identifier for the studioComponentId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsRequestTag() - .ifAwsResourceTag() - .ifAwsTagKeys() - .ifStudioId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__532ae028f24a4866cc2ed65db44614cf00048f82de842131848cc4b907ab140d)
            check_type(argname="argument studio_component_id", value=studio_component_id, expected_type=type_hints["studio_component_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Nimble", jsii.invoke(self, "onStudioComponent", [studio_component_id, account, region, partition]))

    @jsii.member(jsii_name="toAcceptEulas")
    def to_accept_eulas(self) -> "Nimble":
        '''(experimental) Grants permission to accept EULAs.

        Access Level: Write

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_AcceptEulas.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toAcceptEulas", []))

    @jsii.member(jsii_name="toCreateLaunchProfile")
    def to_create_launch_profile(self) -> "Nimble":
        '''(experimental) Grants permission to create a launch profile.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:DescribeNatGateways
        - ec2:DescribeNetworkAcls
        - ec2:DescribeRouteTables
        - ec2:DescribeSubnets
        - ec2:DescribeVpcEndpoints
        - ec2:RunInstances

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_CreateLaunchProfile.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toCreateLaunchProfile", []))

    @jsii.member(jsii_name="toCreateStreamingImage")
    def to_create_streaming_image(self) -> "Nimble":
        '''(experimental) Grants permission to create a streaming image.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - ec2:DescribeImages
        - ec2:DescribeSnapshots
        - ec2:ModifyInstanceAttribute
        - ec2:ModifySnapshotAttribute
        - ec2:RegisterImage

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_CreateStreamingImage.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toCreateStreamingImage", []))

    @jsii.member(jsii_name="toCreateStreamingSession")
    def to_create_streaming_session(self) -> "Nimble":
        '''(experimental) Grants permission to create a streaming session.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - ec2:CreateNetworkInterface
        - ec2:CreateNetworkInterfacePermission
        - nimble:GetLaunchProfile
        - nimble:GetLaunchProfileInitialization
        - nimble:ListEulaAcceptances

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_CreateStreamingSession.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toCreateStreamingSession", []))

    @jsii.member(jsii_name="toCreateStreamingSessionStream")
    def to_create_streaming_session_stream(self) -> "Nimble":
        '''(experimental) Grants permission to create a StreamingSessionStream.

        Access Level: Write

        Possible conditions:

        - .ifRequesterPrincipalId()

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_CreateStreamingSessionStream.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toCreateStreamingSessionStream", []))

    @jsii.member(jsii_name="toCreateStudio")
    def to_create_studio(self) -> "Nimble":
        '''(experimental) Grants permission to create a studio.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - iam:PassRole
        - sso:CreateManagedApplicationInstance

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_CreateStudio.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toCreateStudio", []))

    @jsii.member(jsii_name="toCreateStudioComponent")
    def to_create_studio_component(self) -> "Nimble":
        '''(experimental) Grants permission to create a studio component.

        A studio component designates a network resource to which a launch profile will provide access

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        Dependent actions:

        - ds:AuthorizeApplication
        - ds:DescribeDirectories
        - ec2:DescribeSecurityGroups
        - fsx:DescribeFileSystems
        - iam:PassRole

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_CreateStudioComponent.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toCreateStudioComponent", []))

    @jsii.member(jsii_name="toDeleteLaunchProfile")
    def to_delete_launch_profile(self) -> "Nimble":
        '''(experimental) Grants permission to delete a launch profile.

        Access Level: Write

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_DeleteLaunchProfile.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toDeleteLaunchProfile", []))

    @jsii.member(jsii_name="toDeleteLaunchProfileMember")
    def to_delete_launch_profile_member(self) -> "Nimble":
        '''(experimental) Grants permission to delete a launch profile member.

        Access Level: Write

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_DeleteLaunchProfileMember.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toDeleteLaunchProfileMember", []))

    @jsii.member(jsii_name="toDeleteStreamingImage")
    def to_delete_streaming_image(self) -> "Nimble":
        '''(experimental) Grants permission to delete a streaming image.

        Access Level: Write

        Dependent actions:

        - ec2:DeleteSnapshot
        - ec2:DeregisterImage
        - ec2:ModifyInstanceAttribute
        - ec2:ModifySnapshotAttribute

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_DeleteStreamingImage.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toDeleteStreamingImage", []))

    @jsii.member(jsii_name="toDeleteStreamingSession")
    def to_delete_streaming_session(self) -> "Nimble":
        '''(experimental) Grants permission to delete a streaming session.

        Access Level: Write

        Possible conditions:

        - .ifRequesterPrincipalId()

        Dependent actions:

        - ec2:DeleteNetworkInterface

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_DeleteStreamingSession.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toDeleteStreamingSession", []))

    @jsii.member(jsii_name="toDeleteStudio")
    def to_delete_studio(self) -> "Nimble":
        '''(experimental) Grants permission to delete a studio.

        Access Level: Write

        Dependent actions:

        - sso:DeleteManagedApplicationInstance

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_DeleteStudio.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toDeleteStudio", []))

    @jsii.member(jsii_name="toDeleteStudioComponent")
    def to_delete_studio_component(self) -> "Nimble":
        '''(experimental) Grants permission to delete a studio component.

        Access Level: Write

        Dependent actions:

        - ds:UnauthorizeApplication

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_DeleteStudioComponent.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toDeleteStudioComponent", []))

    @jsii.member(jsii_name="toDeleteStudioMember")
    def to_delete_studio_member(self) -> "Nimble":
        '''(experimental) Grants permission to delete a studio member.

        Access Level: Write

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_DeleteStudioMember.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toDeleteStudioMember", []))

    @jsii.member(jsii_name="toGetEula")
    def to_get_eula(self) -> "Nimble":
        '''(experimental) Grants permission to get a EULA.

        Access Level: Read

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_GetEula.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toGetEula", []))

    @jsii.member(jsii_name="toGetFeatureMap")
    def to_get_feature_map(self) -> "Nimble":
        '''(experimental) Grants permission to allow Nimble Studio portal to show the appropriate features for this account.

        Access Level: Read

        https://docs.aws.amazon.com/nimble-studio/latest/userguide/security-iam-service-with-iam.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toGetFeatureMap", []))

    @jsii.member(jsii_name="toGetLaunchProfile")
    def to_get_launch_profile(self) -> "Nimble":
        '''(experimental) Grants permission to get a launch profile.

        Access Level: Read

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_GetLaunchProfile.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toGetLaunchProfile", []))

    @jsii.member(jsii_name="toGetLaunchProfileDetails")
    def to_get_launch_profile_details(self) -> "Nimble":
        '''(experimental) Grants permission to get a launch profile's details, which includes the summary of studio components and streaming images used by the launch profile.

        Access Level: Read

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_GetLaunchProfileDetails.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toGetLaunchProfileDetails", []))

    @jsii.member(jsii_name="toGetLaunchProfileInitialization")
    def to_get_launch_profile_initialization(self) -> "Nimble":
        '''(experimental) Grants permission to get a launch profile initialization.

        A launch profile initialization is a dereferenced version of a launch profile, including attached studio component connection information

        Access Level: Read

        Dependent actions:

        - ds:DescribeDirectories
        - ec2:DescribeSecurityGroups
        - fsx:DescribeFileSystems

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_GetLaunchProfileInitialization.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toGetLaunchProfileInitialization", []))

    @jsii.member(jsii_name="toGetLaunchProfileMember")
    def to_get_launch_profile_member(self) -> "Nimble":
        '''(experimental) Grants permission to get a launch profile member.

        Access Level: Read

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_GetLaunchProfileMember.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toGetLaunchProfileMember", []))

    @jsii.member(jsii_name="toGetStreamingImage")
    def to_get_streaming_image(self) -> "Nimble":
        '''(experimental) Grants permission to get a streaming image.

        Access Level: Read

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_GetStreamingImage.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toGetStreamingImage", []))

    @jsii.member(jsii_name="toGetStreamingSession")
    def to_get_streaming_session(self) -> "Nimble":
        '''(experimental) Grants permission to get a streaming session.

        Access Level: Read

        Possible conditions:

        - .ifRequesterPrincipalId()

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_GetStreamingSession.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toGetStreamingSession", []))

    @jsii.member(jsii_name="toGetStreamingSessionBackup")
    def to_get_streaming_session_backup(self) -> "Nimble":
        '''(experimental) Grants permission to get a streaming session backup.

        Access Level: Read

        Possible conditions:

        - .ifRequesterPrincipalId()

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_GetStreamingSessionBackup.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toGetStreamingSessionBackup", []))

    @jsii.member(jsii_name="toGetStreamingSessionStream")
    def to_get_streaming_session_stream(self) -> "Nimble":
        '''(experimental) Grants permission to get a streaming session stream.

        Access Level: Read

        Possible conditions:

        - .ifRequesterPrincipalId()

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_GetStreamingSessionStream.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toGetStreamingSessionStream", []))

    @jsii.member(jsii_name="toGetStudio")
    def to_get_studio(self) -> "Nimble":
        '''(experimental) Grants permission to get a studio.

        Access Level: Read

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_GetStudio.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toGetStudio", []))

    @jsii.member(jsii_name="toGetStudioComponent")
    def to_get_studio_component(self) -> "Nimble":
        '''(experimental) Grants permission to get a studio component.

        Access Level: Read

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_GetStudioComponent.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toGetStudioComponent", []))

    @jsii.member(jsii_name="toGetStudioMember")
    def to_get_studio_member(self) -> "Nimble":
        '''(experimental) Grants permission to get a studio member.

        Access Level: Read

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_GetStudioMember.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toGetStudioMember", []))

    @jsii.member(jsii_name="toListEulaAcceptances")
    def to_list_eula_acceptances(self) -> "Nimble":
        '''(experimental) Grants permission to list EULA acceptances.

        Access Level: Read

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_ListEulaAcceptances.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toListEulaAcceptances", []))

    @jsii.member(jsii_name="toListEulas")
    def to_list_eulas(self) -> "Nimble":
        '''(experimental) Grants permission to list EULAs.

        Access Level: Read

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_ListEulas.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toListEulas", []))

    @jsii.member(jsii_name="toListLaunchProfileMembers")
    def to_list_launch_profile_members(self) -> "Nimble":
        '''(experimental) Grants permission to list launch profile members.

        Access Level: Read

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_ListLaunchProfileMembers.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toListLaunchProfileMembers", []))

    @jsii.member(jsii_name="toListLaunchProfiles")
    def to_list_launch_profiles(self) -> "Nimble":
        '''(experimental) Grants permission to list launch profiles.

        Access Level: Read

        Possible conditions:

        - .ifPrincipalId()
        - .ifRequesterPrincipalId()

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_ListLaunchProfiles.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toListLaunchProfiles", []))

    @jsii.member(jsii_name="toListStreamingImages")
    def to_list_streaming_images(self) -> "Nimble":
        '''(experimental) Grants permission to list streaming images.

        Access Level: Read

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_ListStreamingImages.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toListStreamingImages", []))

    @jsii.member(jsii_name="toListStreamingSessionBackups")
    def to_list_streaming_session_backups(self) -> "Nimble":
        '''(experimental) Grants permission to list streaming session backups.

        Access Level: Read

        Possible conditions:

        - .ifRequesterPrincipalId()

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_ListStreamingSessionBackups.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toListStreamingSessionBackups", []))

    @jsii.member(jsii_name="toListStreamingSessions")
    def to_list_streaming_sessions(self) -> "Nimble":
        '''(experimental) Grants permission to list streaming sessions.

        Access Level: Read

        Possible conditions:

        - .ifCreatedBy()
        - .ifOwnedBy()
        - .ifRequesterPrincipalId()

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_ListStreamingSessions.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toListStreamingSessions", []))

    @jsii.member(jsii_name="toListStudioComponents")
    def to_list_studio_components(self) -> "Nimble":
        '''(experimental) Grants permission to list studio components.

        Access Level: Read

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_ListStudioComponents.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toListStudioComponents", []))

    @jsii.member(jsii_name="toListStudioMembers")
    def to_list_studio_members(self) -> "Nimble":
        '''(experimental) Grants permission to list studio members.

        Access Level: Read

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_ListStudioMembers.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toListStudioMembers", []))

    @jsii.member(jsii_name="toListStudios")
    def to_list_studios(self) -> "Nimble":
        '''(experimental) Grants permission to list all studios.

        Access Level: Read

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_ListStudios.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toListStudios", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Nimble":
        '''(experimental) Grants permission to list all tags on a Nimble Studio resource.

        Access Level: Read

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutLaunchProfileMembers")
    def to_put_launch_profile_members(self) -> "Nimble":
        '''(experimental) Grants permission to add/update launch profile members.

        Access Level: Write

        Dependent actions:

        - sso-directory:DescribeUsers

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_PutLaunchProfileMembers.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toPutLaunchProfileMembers", []))

    @jsii.member(jsii_name="toPutStudioLogEvents")
    def to_put_studio_log_events(self) -> "Nimble":
        '''(experimental) Grants permission to report metrics and logs for the Nimble Studio portal to monitor application health.

        Access Level: Write

        https://docs.aws.amazon.com/nimble-studio/latest/userguide/security-iam-service-with-iam.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toPutStudioLogEvents", []))

    @jsii.member(jsii_name="toPutStudioMembers")
    def to_put_studio_members(self) -> "Nimble":
        '''(experimental) Grants permission to add/update studio members.

        Access Level: Write

        Dependent actions:

        - sso-directory:DescribeUsers

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_PutStudioMembers.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toPutStudioMembers", []))

    @jsii.member(jsii_name="toStartStreamingSession")
    def to_start_streaming_session(self) -> "Nimble":
        '''(experimental) Grants permission to start a streaming session.

        Access Level: Write

        Possible conditions:

        - .ifRequesterPrincipalId()

        Dependent actions:

        - nimble:GetLaunchProfile
        - nimble:GetLaunchProfileMember

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_StartStreamingSession.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toStartStreamingSession", []))

    @jsii.member(jsii_name="toStartStudioSSOConfigurationRepair")
    def to_start_studio_sso_configuration_repair(self) -> "Nimble":
        '''(experimental) Grants permission to repair the studio's AWS IAM Identity Center configuration.

        Access Level: Write

        Dependent actions:

        - sso:CreateManagedApplicationInstance
        - sso:GetManagedApplicationInstance

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_StartStudioSSOConfigurationRepair.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toStartStudioSSOConfigurationRepair", []))

    @jsii.member(jsii_name="toStopStreamingSession")
    def to_stop_streaming_session(self) -> "Nimble":
        '''(experimental) Grants permission to stop a streaming session.

        Access Level: Write

        Possible conditions:

        - .ifRequesterPrincipalId()

        Dependent actions:

        - nimble:GetLaunchProfile

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_StopStreamingSession.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toStopStreamingSession", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Nimble":
        '''(experimental) Grants permission to add or overwrite one or more tags for the specified Nimble Studio resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Nimble":
        '''(experimental) Grants permission to disassociate one or more tags from the specified Nimble Studio resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateLaunchProfile")
    def to_update_launch_profile(self) -> "Nimble":
        '''(experimental) Grants permission to update a launch profile.

        Access Level: Write

        Dependent actions:

        - ec2:DescribeNatGateways
        - ec2:DescribeNetworkAcls
        - ec2:DescribeRouteTables
        - ec2:DescribeSubnets
        - ec2:DescribeVpcEndpoints

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_UpdateLaunchProfile.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toUpdateLaunchProfile", []))

    @jsii.member(jsii_name="toUpdateLaunchProfileMember")
    def to_update_launch_profile_member(self) -> "Nimble":
        '''(experimental) Grants permission to update a launch profile member.

        Access Level: Write

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_UpdateLaunchProfileMember.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toUpdateLaunchProfileMember", []))

    @jsii.member(jsii_name="toUpdateStreamingImage")
    def to_update_streaming_image(self) -> "Nimble":
        '''(experimental) Grants permission to update a streaming image.

        Access Level: Write

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_UpdateStreamingImage.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toUpdateStreamingImage", []))

    @jsii.member(jsii_name="toUpdateStudio")
    def to_update_studio(self) -> "Nimble":
        '''(experimental) Grants permission to update a studio.

        Access Level: Write

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_UpdateStudio.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toUpdateStudio", []))

    @jsii.member(jsii_name="toUpdateStudioComponent")
    def to_update_studio_component(self) -> "Nimble":
        '''(experimental) Grants permission to update a studio component.

        Access Level: Write

        Dependent actions:

        - ds:AuthorizeApplication
        - ds:DescribeDirectories
        - ec2:DescribeSecurityGroups
        - fsx:DescribeFileSystems
        - iam:PassRole

        https://docs.aws.amazon.com/nimble-studio/latest/APIReference/API_UpdateStudioComponent.html

        :stability: experimental
        '''
        return typing.cast("Nimble", jsii.invoke(self, "toUpdateStudioComponent", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__854b7662731b4b11652120e38a026ab398c51afbf61f64711d6162b1053ba5cf)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__83cb9a03b94596f8dceae5034c4e6d7b25722c4a62cdd698d3a330c1ffa3b242)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Oam(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Oam"):
    '''(experimental) Statement provider for service `oam <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchobservabilityaccessmanager.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `oam <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatchobservabilityaccessmanager.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c729369680ba8c4ad7e0269195be7970574b5fe4a9a0bed8e239eff2973f9300)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifResourceTypes")
    def if_resource_types(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Oam":
        '''(experimental) Filters access by the presence of resource types in the request.

        https://docs.aws.amazon.com/oam/latest/apireference/api_createlink.html#api_createlink_requestsyntax

        Applies to actions:

        - .toCreateLink()
        - .toUpdateLink()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8632c5cf6d5a40519f7dd36551aeea2603fb7939dcbc0dcbf4342d4c9031b457)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Oam", jsii.invoke(self, "ifResourceTypes", [value, operator]))

    @jsii.member(jsii_name="onLink")
    def on_link(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Oam":
        '''(experimental) Adds a resource of type Link to the statement.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Unified-Cross-Account.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ba7c05c99c71b5c2879f046187cb5f83912ef73a884f148ef80db1021953fc6b)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Oam", jsii.invoke(self, "onLink", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onSink")
    def on_sink(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Oam":
        '''(experimental) Adds a resource of type Sink to the statement.

        https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Unified-Cross-Account.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__48a6c49466215f8d21041f7e9aefb6a4dddf499675c5231c75c107df7e73d625)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Oam", jsii.invoke(self, "onSink", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateLink")
    def to_create_link(self) -> "Oam":
        '''(experimental) Grants permission to create a link between a monitoring account and a source account for cross-account monitoring.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()
        - .ifResourceTypes()

        Dependent actions:

        - oam:TagResource

        https://docs.aws.amazon.com/oam/latest/APIReference/API_CreateLink.html

        :stability: experimental
        '''
        return typing.cast("Oam", jsii.invoke(self, "toCreateLink", []))

    @jsii.member(jsii_name="toCreateSink")
    def to_create_sink(self) -> "Oam":
        '''(experimental) Grants permission to create a sink in an account so that it can be used as a monitoring account for cross-account monitoring.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - oam:TagResource

        https://docs.aws.amazon.com/oam/latest/APIReference/API_CreateSink.html

        :stability: experimental
        '''
        return typing.cast("Oam", jsii.invoke(self, "toCreateSink", []))

    @jsii.member(jsii_name="toDeleteLink")
    def to_delete_link(self) -> "Oam":
        '''(experimental) Grants permission to delete a link between a monitoring account and a source account for cross-account monitoring.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/oam/latest/APIReference/API_DeleteLink.html

        :stability: experimental
        '''
        return typing.cast("Oam", jsii.invoke(self, "toDeleteLink", []))

    @jsii.member(jsii_name="toDeleteSink")
    def to_delete_sink(self) -> "Oam":
        '''(experimental) Grants permission to delete a cross-account monitoring sink in a monitoring account.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/oam/latest/APIReference/API_DeleteSink.html

        :stability: experimental
        '''
        return typing.cast("Oam", jsii.invoke(self, "toDeleteSink", []))

    @jsii.member(jsii_name="toGetLink")
    def to_get_link(self) -> "Oam":
        '''(experimental) Grants permission to retrieve complete information about one cross-account monitoring link.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/oam/latest/APIReference/API_GetLink.html

        :stability: experimental
        '''
        return typing.cast("Oam", jsii.invoke(self, "toGetLink", []))

    @jsii.member(jsii_name="toGetSink")
    def to_get_sink(self) -> "Oam":
        '''(experimental) Grants permission to retrieve complete information about one cross-account monitoring sink.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/oam/latest/APIReference/API_GetSink.html

        :stability: experimental
        '''
        return typing.cast("Oam", jsii.invoke(self, "toGetSink", []))

    @jsii.member(jsii_name="toGetSinkPolicy")
    def to_get_sink_policy(self) -> "Oam":
        '''(experimental) Grants permission to retrieve information for the IAM policy for a cross-account monitoring sink.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/oam/latest/APIReference/API_GetSinkPolicy.html

        :stability: experimental
        '''
        return typing.cast("Oam", jsii.invoke(self, "toGetSinkPolicy", []))

    @jsii.member(jsii_name="toListAttachedLinks")
    def to_list_attached_links(self) -> "Oam":
        '''(experimental) Grants permission to retrieve a list of links that are linked for a cross-account monitoring sink.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/oam/latest/APIReference/API_ListAttachedLinks.html

        :stability: experimental
        '''
        return typing.cast("Oam", jsii.invoke(self, "toListAttachedLinks", []))

    @jsii.member(jsii_name="toListLinks")
    def to_list_links(self) -> "Oam":
        '''(experimental) Grants permission to retrieve the ARNs of cross-account monitoring links in this account.

        Access Level: Read

        https://docs.aws.amazon.com/oam/latest/APIReference/API_ListLinks.html

        :stability: experimental
        '''
        return typing.cast("Oam", jsii.invoke(self, "toListLinks", []))

    @jsii.member(jsii_name="toListSinks")
    def to_list_sinks(self) -> "Oam":
        '''(experimental) Grants permission to retrieve the ARNs of cross-account monitoring sinks in this account.

        Access Level: Read

        https://docs.aws.amazon.com/oam/latest/APIReference/API_ListSinks.html

        :stability: experimental
        '''
        return typing.cast("Oam", jsii.invoke(self, "toListSinks", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Oam":
        '''(experimental) Grants permission to list the tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/oam/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Oam", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutSinkPolicy")
    def to_put_sink_policy(self) -> "Oam":
        '''(experimental) Grants permission to create or update the IAM policy for a cross-account monitoring sink.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/oam/latest/APIReference/API_PutSinkPolicy.html

        :stability: experimental
        '''
        return typing.cast("Oam", jsii.invoke(self, "toPutSinkPolicy", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Oam":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/oam/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Oam", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Oam":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/oam/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Oam", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateLink")
    def to_update_link(self) -> "Oam":
        '''(experimental) Grants permission to update an existing link between a monitoring account and a source account.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifResourceTypes()

        https://docs.aws.amazon.com/oam/latest/APIReference/API_UpdateLink.html

        :stability: experimental
        '''
        return typing.cast("Oam", jsii.invoke(self, "toUpdateLink", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__291a11fe41936d8006848d73afcf7265afabf27a7bf4caf3e0534baa94b5e9fd)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f83633424ac9a8674cbcd127c2b8dcc300a6f4923877bce69642698bcf2e3b2b)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Omics(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Omics"):
    '''(experimental) Statement provider for service `omics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonomics.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `omics <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonomics.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1aa526bd2a84d22f4ee7cfcb42f20e744b8260f737097a1b234fb8c49e03f7fa)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifAnnotationImportJobJobId")
    def if_annotation_import_job_job_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Omics":
        '''(experimental) Filters access by a unique resource identifier.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-annotation-import-job-id

        Applies to resource types:

        - AnnotationImportJob

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1634405f92334f00da7e4661b0ea3a73f6b3a443ef606b4132acac8d898448b0)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Omics", jsii.invoke(self, "ifAnnotationImportJobJobId", [value, operator]))

    @jsii.member(jsii_name="ifAnnotationStoreName")
    def if_annotation_store_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Omics":
        '''(experimental) Filters access by the name of the store.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-annotation-store-name

        Applies to resource types:

        - AnnotationStore

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__7cc39b7ca29932c1a11498d6e8bd600ec971193b8aaeeed0258d93770f4e2d26)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Omics", jsii.invoke(self, "ifAnnotationStoreName", [value, operator]))

    @jsii.member(jsii_name="ifVariantImportJobJobId")
    def if_variant_import_job_job_id(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Omics":
        '''(experimental) Filters access by a unique resource identifier.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-variant-import-job-id

        Applies to resource types:

        - VariantImportJob

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bcb86b9470afab2e39ab16c9eaa61d06e93f2f0c7f0d6bf94af6c299ace2213d)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Omics", jsii.invoke(self, "ifVariantImportJobJobId", [value, operator]))

    @jsii.member(jsii_name="ifVariantStoreName")
    def if_variant_store_name(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Omics":
        '''(experimental) Filters access by the name of the store.

        https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-variant-store-name

        Applies to resource types:

        - VariantStore

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__aff0972b2609c6cb90093cf30f755705a868099a6740ef9fb11f84a5aeb3442c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Omics", jsii.invoke(self, "ifVariantStoreName", [value, operator]))

    @jsii.member(jsii_name="onAnnotationImportJob")
    def on_annotation_import_job(
        self,
        annotation_import_job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Omics":
        '''(experimental) Adds a resource of type AnnotationImportJob to the statement.

        https://docs.aws.amazon.com/omics/latest/api/API_AnnotationImportJobItem.html

        :param annotation_import_job_id: - Identifier for the annotationImportJobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAnnotationImportJobJobId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__90236a0704572ac36a23508a0911a0a2de1436b98531c5f9e77b6a04876c29b0)
            check_type(argname="argument annotation_import_job_id", value=annotation_import_job_id, expected_type=type_hints["annotation_import_job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Omics", jsii.invoke(self, "onAnnotationImportJob", [annotation_import_job_id, account, region, partition]))

    @jsii.member(jsii_name="onAnnotationStore")
    def on_annotation_store(
        self,
        annotation_store_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Omics":
        '''(experimental) Adds a resource of type AnnotationStore to the statement.

        https://docs.aws.amazon.com/omics/latest/api/API_AnnotationStoreItem.html

        :param annotation_store_id: - Identifier for the annotationStoreId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAnnotationStoreName()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__82bc152b928f2db973c05f894a9e41533178a7ed837a51d5800576765e4e61bd)
            check_type(argname="argument annotation_store_id", value=annotation_store_id, expected_type=type_hints["annotation_store_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Omics", jsii.invoke(self, "onAnnotationStore", [annotation_store_id, account, region, partition]))

    @jsii.member(jsii_name="onReadSet")
    def on_read_set(
        self,
        sequence_store_id: builtins.str,
        read_set_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Omics":
        '''(experimental) Adds a resource of type readSet to the statement.

        https://docs.aws.amazon.com/omics/latest/api/API_ReadSetFiles.html

        :param sequence_store_id: - Identifier for the sequenceStoreId.
        :param read_set_id: - Identifier for the readSetId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b4cdeba4fd5757c3904407deb7ffeffcddf9760b0c39d7b7121c6d9ba16ace57)
            check_type(argname="argument sequence_store_id", value=sequence_store_id, expected_type=type_hints["sequence_store_id"])
            check_type(argname="argument read_set_id", value=read_set_id, expected_type=type_hints["read_set_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Omics", jsii.invoke(self, "onReadSet", [sequence_store_id, read_set_id, account, region, partition]))

    @jsii.member(jsii_name="onReference")
    def on_reference(
        self,
        reference_store_id: builtins.str,
        reference_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Omics":
        '''(experimental) Adds a resource of type reference to the statement.

        https://docs.aws.amazon.com/omics/latest/api/API_ReferenceFiles.html

        :param reference_store_id: - Identifier for the referenceStoreId.
        :param reference_id: - Identifier for the referenceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5580d0abfab3252f7d3562967f677e2532a5e377da38313958a4134e0953f20d)
            check_type(argname="argument reference_store_id", value=reference_store_id, expected_type=type_hints["reference_store_id"])
            check_type(argname="argument reference_id", value=reference_id, expected_type=type_hints["reference_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Omics", jsii.invoke(self, "onReference", [reference_store_id, reference_id, account, region, partition]))

    @jsii.member(jsii_name="onReferenceStore")
    def on_reference_store(
        self,
        reference_store_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Omics":
        '''(experimental) Adds a resource of type referenceStore to the statement.

        https://docs.aws.amazon.com/omics/latest/api/API_ReferenceStoreDetail.html

        :param reference_store_id: - Identifier for the referenceStoreId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__50c1684b94f904ce347b58d9964b852c122bd65e5d6bfccac93958ad12a7d664)
            check_type(argname="argument reference_store_id", value=reference_store_id, expected_type=type_hints["reference_store_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Omics", jsii.invoke(self, "onReferenceStore", [reference_store_id, account, region, partition]))

    @jsii.member(jsii_name="onRun")
    def on_run(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Omics":
        '''(experimental) Adds a resource of type run to the statement.

        https://docs.aws.amazon.com/omics/latest/api/API_RunListItem.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__37646323cd06599d618211eeda67505d679c690ce1d4900e4880be32c07597a1)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Omics", jsii.invoke(self, "onRun", [id, account, region, partition]))

    @jsii.member(jsii_name="onRunGroup")
    def on_run_group(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Omics":
        '''(experimental) Adds a resource of type runGroup to the statement.

        https://docs.aws.amazon.com/omics/latest/api/API_RunGroupListItem.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e654b13a7200f207ae9a0c0e1e3007055e5b6d07d3c6f12ccdd9ed953afd7fc8)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Omics", jsii.invoke(self, "onRunGroup", [id, account, region, partition]))

    @jsii.member(jsii_name="onSequenceStore")
    def on_sequence_store(
        self,
        sequence_store_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Omics":
        '''(experimental) Adds a resource of type sequenceStore to the statement.

        https://docs.aws.amazon.com/omics/latest/api/API_SequenceStoreDetail.html

        :param sequence_store_id: - Identifier for the sequenceStoreId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__170506f3daf968cce22271f7672c1eab7da93616876d985752842265e7de9941)
            check_type(argname="argument sequence_store_id", value=sequence_store_id, expected_type=type_hints["sequence_store_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Omics", jsii.invoke(self, "onSequenceStore", [sequence_store_id, account, region, partition]))

    @jsii.member(jsii_name="onTaggingResource")
    def on_tagging_resource(
        self,
        tag_key: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Omics":
        '''(experimental) Adds a resource of type TaggingResource to the statement.

        https://docs.aws.amazon.com/omics/latest/api/API_TagResource.html

        :param tag_key: - Identifier for the tagKey.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c00229e98c829415e2d280dee8e4093d39fccf78298c728b0612156d32c63b7f)
            check_type(argname="argument tag_key", value=tag_key, expected_type=type_hints["tag_key"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Omics", jsii.invoke(self, "onTaggingResource", [tag_key, account, region, partition]))

    @jsii.member(jsii_name="onTaskResource")
    def on_task_resource(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Omics":
        '''(experimental) Adds a resource of type TaskResource to the statement.

        https://docs.aws.amazon.com/omics/latest/api/API_TaskListItem.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__8b61688fcc7dbc817d2bd10d20ce38780025389724f4bfdaa385b1e85e1845b2)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Omics", jsii.invoke(self, "onTaskResource", [id, account, region, partition]))

    @jsii.member(jsii_name="onVariantImportJob")
    def on_variant_import_job(
        self,
        variant_import_job_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Omics":
        '''(experimental) Adds a resource of type VariantImportJob to the statement.

        https://docs.aws.amazon.com/omics/latest/api/API_VariantImportJobItem.html

        :param variant_import_job_id: - Identifier for the variantImportJobId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifVariantImportJobJobId()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dec4457d67ad1f6a5b47f02e506b17299d8cef802f7b596d9850c7083d741e39)
            check_type(argname="argument variant_import_job_id", value=variant_import_job_id, expected_type=type_hints["variant_import_job_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Omics", jsii.invoke(self, "onVariantImportJob", [variant_import_job_id, account, region, partition]))

    @jsii.member(jsii_name="onVariantStore")
    def on_variant_store(
        self,
        variant_store_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Omics":
        '''(experimental) Adds a resource of type VariantStore to the statement.

        https://docs.aws.amazon.com/omics/latest/api/API_VariantStoreItem.html

        :param variant_store_id: - Identifier for the variantStoreId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifVariantStoreName()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__bac639fb1c367d2405cff06aef9304f3974dbb5064d0cc8ad97d3ed1f511b385)
            check_type(argname="argument variant_store_id", value=variant_store_id, expected_type=type_hints["variant_store_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Omics", jsii.invoke(self, "onVariantStore", [variant_store_id, account, region, partition]))

    @jsii.member(jsii_name="onWorkflow")
    def on_workflow(
        self,
        id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Omics":
        '''(experimental) Adds a resource of type workflow to the statement.

        https://docs.aws.amazon.com/omics/latest/api/API_WorkflowListItem.html

        :param id: - Identifier for the id.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__907498abd4ba9bcadda952308a00c2dd070413c4d38d333a7489c7573839bb40)
            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Omics", jsii.invoke(self, "onWorkflow", [id, account, region, partition]))

    @jsii.member(jsii_name="toBatchDeleteReadSet")
    def to_batch_delete_read_set(self) -> "Omics":
        '''(experimental) Grants permission to batch delete Read Sets in the given Sequence Store.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_BatchDeleteReadSet.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toBatchDeleteReadSet", []))

    @jsii.member(jsii_name="toCancelAnnotationImportJob")
    def to_cancel_annotation_import_job(self) -> "Omics":
        '''(experimental) Grants permission to cancel an Annotation Import Job.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_CancelAnnotationImportJob.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toCancelAnnotationImportJob", []))

    @jsii.member(jsii_name="toCancelRun")
    def to_cancel_run(self) -> "Omics":
        '''(experimental) Grants permission to cancel a workflow run and stop all workflow tasks.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_CancelRun.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toCancelRun", []))

    @jsii.member(jsii_name="toCancelVariantImportJob")
    def to_cancel_variant_import_job(self) -> "Omics":
        '''(experimental) Grants permission to cancel a Variant Import Job.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_CancelVariantImportJob.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toCancelVariantImportJob", []))

    @jsii.member(jsii_name="toCreateAnnotationStore")
    def to_create_annotation_store(self) -> "Omics":
        '''(experimental) Grants permission to create an Annotation Store.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_CreateAnnotationStore.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toCreateAnnotationStore", []))

    @jsii.member(jsii_name="toCreateReferenceStore")
    def to_create_reference_store(self) -> "Omics":
        '''(experimental) Grants permission to create a Reference Store.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/omics/latest/api/API_CreateReferenceStore.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toCreateReferenceStore", []))

    @jsii.member(jsii_name="toCreateRunGroup")
    def to_create_run_group(self) -> "Omics":
        '''(experimental) Grants permission to create a new workflow run group.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/omics/latest/api/API_CreateRunGroup.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toCreateRunGroup", []))

    @jsii.member(jsii_name="toCreateSequenceStore")
    def to_create_sequence_store(self) -> "Omics":
        '''(experimental) Grants permission to create a Sequence Store.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/omics/latest/api/API_CreateSequenceStore.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toCreateSequenceStore", []))

    @jsii.member(jsii_name="toCreateVariantStore")
    def to_create_variant_store(self) -> "Omics":
        '''(experimental) Grants permission to create a Variant Store.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_CreateVariantStore.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toCreateVariantStore", []))

    @jsii.member(jsii_name="toCreateWorkflow")
    def to_create_workflow(self) -> "Omics":
        '''(experimental) Grants permission to create a new workflow with a workflow definition and template of workflow parameters.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/omics/latest/api/API_CreateWorkflow.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toCreateWorkflow", []))

    @jsii.member(jsii_name="toDeleteAnnotationStore")
    def to_delete_annotation_store(self) -> "Omics":
        '''(experimental) Grants permission to delete an Annotation Store.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_DeleteAnnotationStore.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toDeleteAnnotationStore", []))

    @jsii.member(jsii_name="toDeleteReference")
    def to_delete_reference(self) -> "Omics":
        '''(experimental) Grants permission to delete a Reference in the given Reference Store.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_DeleteReference.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toDeleteReference", []))

    @jsii.member(jsii_name="toDeleteReferenceStore")
    def to_delete_reference_store(self) -> "Omics":
        '''(experimental) Grants permission to delete a Reference Store.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_DeleteReferenceStore.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toDeleteReferenceStore", []))

    @jsii.member(jsii_name="toDeleteRun")
    def to_delete_run(self) -> "Omics":
        '''(experimental) Grants permission to delete a workflow run.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_DeleteRun.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toDeleteRun", []))

    @jsii.member(jsii_name="toDeleteRunGroup")
    def to_delete_run_group(self) -> "Omics":
        '''(experimental) Grants permission to delete a workflow run group.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_DeleteRunGroup.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toDeleteRunGroup", []))

    @jsii.member(jsii_name="toDeleteSequenceStore")
    def to_delete_sequence_store(self) -> "Omics":
        '''(experimental) Grants permission to delete a Sequence Store.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_DeleteSequenceStore.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toDeleteSequenceStore", []))

    @jsii.member(jsii_name="toDeleteVariantStore")
    def to_delete_variant_store(self) -> "Omics":
        '''(experimental) Grants permission to delete a Variant Store.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_DeleteVariantStore.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toDeleteVariantStore", []))

    @jsii.member(jsii_name="toDeleteWorkflow")
    def to_delete_workflow(self) -> "Omics":
        '''(experimental) Grants permission to delete a workflow.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_DeleteWorkflow.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toDeleteWorkflow", []))

    @jsii.member(jsii_name="toGetAnnotationImportJob")
    def to_get_annotation_import_job(self) -> "Omics":
        '''(experimental) Grants permission to get the status of an Annotation Import Job.

        Access Level: Read

        https://docs.aws.amazon.com/omics/latest/api/API_GetAnnotationImportJob.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toGetAnnotationImportJob", []))

    @jsii.member(jsii_name="toGetAnnotationStore")
    def to_get_annotation_store(self) -> "Omics":
        '''(experimental) Grants permission to get detailed information about an Annotation Store.

        Access Level: Read

        https://docs.aws.amazon.com/omics/latest/api/API_GetAnnotationStore.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toGetAnnotationStore", []))

    @jsii.member(jsii_name="toGetReadSet")
    def to_get_read_set(self) -> "Omics":
        '''(experimental) Grants permission to get a Read Set in the given Sequence Store.

        Access Level: Read

        https://docs.aws.amazon.com/omics/latest/api/API_GetReadSet.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toGetReadSet", []))

    @jsii.member(jsii_name="toGetReadSetActivationJob")
    def to_get_read_set_activation_job(self) -> "Omics":
        '''(experimental) Grants permission to get details about a Read Set activation job for the given Sequence Store.

        Access Level: Read

        https://docs.aws.amazon.com/omics/latest/api/API_GetReadSetActivationJob.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toGetReadSetActivationJob", []))

    @jsii.member(jsii_name="toGetReadSetExportJob")
    def to_get_read_set_export_job(self) -> "Omics":
        '''(experimental) Grants permission to get details about a Read Set export job for the given Sequence Store.

        Access Level: Read

        https://docs.aws.amazon.com/omics/latest/api/API_GetReadSetExportJob.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toGetReadSetExportJob", []))

    @jsii.member(jsii_name="toGetReadSetImportJob")
    def to_get_read_set_import_job(self) -> "Omics":
        '''(experimental) Grants permission to get details about a Read Set import job for the given Sequence Store.

        Access Level: Read

        https://docs.aws.amazon.com/omics/latest/api/API_GetReadSetImportJob.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toGetReadSetImportJob", []))

    @jsii.member(jsii_name="toGetReadSetMetadata")
    def to_get_read_set_metadata(self) -> "Omics":
        '''(experimental) Grants permission to get details about a Read Set in the given Sequence Store.

        Access Level: Read

        https://docs.aws.amazon.com/omics/latest/api/API_GetReadSetMetadata.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toGetReadSetMetadata", []))

    @jsii.member(jsii_name="toGetReference")
    def to_get_reference(self) -> "Omics":
        '''(experimental) Grants permission to get a Reference in the given Reference Store.

        Access Level: Read

        https://docs.aws.amazon.com/omics/latest/api/API_GetReference.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toGetReference", []))

    @jsii.member(jsii_name="toGetReferenceImportJob")
    def to_get_reference_import_job(self) -> "Omics":
        '''(experimental) Grants permission to get details about a Reference import job for the given Reference Store.

        Access Level: Read

        https://docs.aws.amazon.com/omics/latest/api/API_GetReferenceImportJob.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toGetReferenceImportJob", []))

    @jsii.member(jsii_name="toGetReferenceMetadata")
    def to_get_reference_metadata(self) -> "Omics":
        '''(experimental) Grants permission to get details about a Reference in the given Reference Store.

        Access Level: Read

        https://docs.aws.amazon.com/omics/latest/api/API_GetReferenceMetadata.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toGetReferenceMetadata", []))

    @jsii.member(jsii_name="toGetReferenceStore")
    def to_get_reference_store(self) -> "Omics":
        '''(experimental) Grants permission to get details about a Reference Store.

        Access Level: Read

        https://docs.aws.amazon.com/omics/latest/api/API_GetReferenceStore.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toGetReferenceStore", []))

    @jsii.member(jsii_name="toGetRun")
    def to_get_run(self) -> "Omics":
        '''(experimental) Grants permission to retrieve workflow run details.

        Access Level: Read

        https://docs.aws.amazon.com/omics/latest/api/API_GetRun.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toGetRun", []))

    @jsii.member(jsii_name="toGetRunGroup")
    def to_get_run_group(self) -> "Omics":
        '''(experimental) Grants permission to retrieve workflow run group details.

        Access Level: Read

        https://docs.aws.amazon.com/omics/latest/api/API_GetRunGroup.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toGetRunGroup", []))

    @jsii.member(jsii_name="toGetRunTask")
    def to_get_run_task(self) -> "Omics":
        '''(experimental) Grants permission to retrieve workflow task details.

        Access Level: Read

        https://docs.aws.amazon.com/omics/latest/api/API_GetRunTask.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toGetRunTask", []))

    @jsii.member(jsii_name="toGetSequenceStore")
    def to_get_sequence_store(self) -> "Omics":
        '''(experimental) Grants permission to get details about a Sequence Store.

        Access Level: Read

        https://docs.aws.amazon.com/omics/latest/api/API_GetSequenceStore.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toGetSequenceStore", []))

    @jsii.member(jsii_name="toGetVariantImportJob")
    def to_get_variant_import_job(self) -> "Omics":
        '''(experimental) Grants permission to get the status of a Variant Import Job.

        Access Level: Read

        https://docs.aws.amazon.com/omics/latest/api/API_GetVariantImportJob.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toGetVariantImportJob", []))

    @jsii.member(jsii_name="toGetVariantStore")
    def to_get_variant_store(self) -> "Omics":
        '''(experimental) Grants permission to get detailed information about a Variant Store.

        Access Level: Read

        https://docs.aws.amazon.com/omics/latest/api/API_GetVariantStore.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toGetVariantStore", []))

    @jsii.member(jsii_name="toGetWorkflow")
    def to_get_workflow(self) -> "Omics":
        '''(experimental) Grants permission to retrieve workflow details.

        Access Level: Read

        https://docs.aws.amazon.com/omics/latest/api/API_GetWorkflow.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toGetWorkflow", []))

    @jsii.member(jsii_name="toListAnnotationImportJobs")
    def to_list_annotation_import_jobs(self) -> "Omics":
        '''(experimental) Grants permission to get a list of Annotation Import Jobs.

        Access Level: List

        https://docs.aws.amazon.com/omics/latest/api/API_ListAnnotationImportJobs.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toListAnnotationImportJobs", []))

    @jsii.member(jsii_name="toListAnnotationStores")
    def to_list_annotation_stores(self) -> "Omics":
        '''(experimental) Grants permission to retrieve a list of information about Annotation Stores.

        Access Level: List

        https://docs.aws.amazon.com/omics/latest/api/API_ListAnnotationStores.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toListAnnotationStores", []))

    @jsii.member(jsii_name="toListReadSetActivationJobs")
    def to_list_read_set_activation_jobs(self) -> "Omics":
        '''(experimental) Grants permission to list Read Set activation jobs for the given Sequence Store.

        Access Level: List

        https://docs.aws.amazon.com/omics/latest/api/API_ListReadSetActivationJobs.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toListReadSetActivationJobs", []))

    @jsii.member(jsii_name="toListReadSetExportJobs")
    def to_list_read_set_export_jobs(self) -> "Omics":
        '''(experimental) Grants permission to list Read Set export jobs for the given Sequence Store.

        Access Level: List

        https://docs.aws.amazon.com/omics/latest/api/API_ListReadSetExportJobs.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toListReadSetExportJobs", []))

    @jsii.member(jsii_name="toListReadSetImportJobs")
    def to_list_read_set_import_jobs(self) -> "Omics":
        '''(experimental) Grants permission to list Read Set import jobs for the given Sequence Store.

        Access Level: List

        https://docs.aws.amazon.com/omics/latest/api/API_ListReadSetImportJobs.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toListReadSetImportJobs", []))

    @jsii.member(jsii_name="toListReadSets")
    def to_list_read_sets(self) -> "Omics":
        '''(experimental) Grants permission to list Read Sets in the given Sequence Store.

        Access Level: List

        https://docs.aws.amazon.com/omics/latest/api/API_ListReadSets.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toListReadSets", []))

    @jsii.member(jsii_name="toListReferenceImportJobs")
    def to_list_reference_import_jobs(self) -> "Omics":
        '''(experimental) Grants permission to list Reference import jobs for the given Reference Store.

        Access Level: List

        https://docs.aws.amazon.com/omics/latest/api/API_ListReferenceImportJobs.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toListReferenceImportJobs", []))

    @jsii.member(jsii_name="toListReferences")
    def to_list_references(self) -> "Omics":
        '''(experimental) Grants permission to list References in the given Reference Store.

        Access Level: List

        https://docs.aws.amazon.com/omics/latest/api/API_ListReferences.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toListReferences", []))

    @jsii.member(jsii_name="toListReferenceStores")
    def to_list_reference_stores(self) -> "Omics":
        '''(experimental) Grants permission to list Reference Stores.

        Access Level: List

        https://docs.aws.amazon.com/omics/latest/api/API_ListReferenceStores.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toListReferenceStores", []))

    @jsii.member(jsii_name="toListRunGroups")
    def to_list_run_groups(self) -> "Omics":
        '''(experimental) Grants permission to retrieve a list of workflow run groups.

        Access Level: List

        https://docs.aws.amazon.com/omics/latest/api/API_ListRunGroups.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toListRunGroups", []))

    @jsii.member(jsii_name="toListRuns")
    def to_list_runs(self) -> "Omics":
        '''(experimental) Grants permission to retrieve a list of workflow runs.

        Access Level: List

        https://docs.aws.amazon.com/omics/latest/api/API_ListRuns.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toListRuns", []))

    @jsii.member(jsii_name="toListRunTasks")
    def to_list_run_tasks(self) -> "Omics":
        '''(experimental) Grants permission to retrieve a list of tasks for a workflow run.

        Access Level: List

        https://docs.aws.amazon.com/omics/latest/api/API_ListRunTasks.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toListRunTasks", []))

    @jsii.member(jsii_name="toListSequenceStores")
    def to_list_sequence_stores(self) -> "Omics":
        '''(experimental) Grants permission to list Sequence Stores.

        Access Level: List

        https://docs.aws.amazon.com/omics/latest/api/API_ListSequenceStores.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toListSequenceStores", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Omics":
        '''(experimental) Grants permission to retrieve a list of resource AWS tags.

        Access Level: List

        https://docs.aws.amazon.com/omics/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListVariantImportJobs")
    def to_list_variant_import_jobs(self) -> "Omics":
        '''(experimental) Grants permission to get a list of Variant Import Jobs.

        Access Level: List

        https://docs.aws.amazon.com/omics/latest/api/API_ListVariantImportJobs.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toListVariantImportJobs", []))

    @jsii.member(jsii_name="toListVariantStores")
    def to_list_variant_stores(self) -> "Omics":
        '''(experimental) Grants permission to retrieve a list of metadata for Variant Stores.

        Access Level: List

        https://docs.aws.amazon.com/omics/latest/api/API_ListVariantStores.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toListVariantStores", []))

    @jsii.member(jsii_name="toListWorkflows")
    def to_list_workflows(self) -> "Omics":
        '''(experimental) Grants permission to retrieve a list of available workflows.

        Access Level: List

        https://docs.aws.amazon.com/omics/latest/api/API_ListWorkflows.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toListWorkflows", []))

    @jsii.member(jsii_name="toStartAnnotationImportJob")
    def to_start_annotation_import_job(self) -> "Omics":
        '''(experimental) Grants permission to import a list of Annotation files to an Annotation Store.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_StartAnnotationImportJob.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toStartAnnotationImportJob", []))

    @jsii.member(jsii_name="toStartReadSetActivationJob")
    def to_start_read_set_activation_job(self) -> "Omics":
        '''(experimental) Grants permission to start a Read Set activation job from the given Sequence Store.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_StartReadSetActivationJob.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toStartReadSetActivationJob", []))

    @jsii.member(jsii_name="toStartReadSetExportJob")
    def to_start_read_set_export_job(self) -> "Omics":
        '''(experimental) Grants permission to start a Read Set export job from the given Sequence Store.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_StartReadSetExportJob.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toStartReadSetExportJob", []))

    @jsii.member(jsii_name="toStartReadSetImportJob")
    def to_start_read_set_import_job(self) -> "Omics":
        '''(experimental) Grants permission to start a Read Set import job into the given Sequence Store.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_StartReadSetImportJob.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toStartReadSetImportJob", []))

    @jsii.member(jsii_name="toStartReferenceImportJob")
    def to_start_reference_import_job(self) -> "Omics":
        '''(experimental) Grants permission to start a Reference import job into the given Reference Store.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_StartReferenceImportJob.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toStartReferenceImportJob", []))

    @jsii.member(jsii_name="toStartRun")
    def to_start_run(self) -> "Omics":
        '''(experimental) Grants permission to start a workflow run.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/omics/latest/api/API_StartRun.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toStartRun", []))

    @jsii.member(jsii_name="toStartVariantImportJob")
    def to_start_variant_import_job(self) -> "Omics":
        '''(experimental) Grants permission to import a list of variant files to an Variant Store.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_StartVariantImportJob.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toStartVariantImportJob", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Omics":
        '''(experimental) Grants permission to add AWS tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/omics/latest/api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Omics":
        '''(experimental) Grants permission to remove resource AWS tags.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/omics/latest/api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateAnnotationStore")
    def to_update_annotation_store(self) -> "Omics":
        '''(experimental) Grants permission to update information about the Annotation Store.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_UpdateAnnotationStore.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toUpdateAnnotationStore", []))

    @jsii.member(jsii_name="toUpdateRunGroup")
    def to_update_run_group(self) -> "Omics":
        '''(experimental) Grants permission to update a workflow run group.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_UpdateRunGroup.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toUpdateRunGroup", []))

    @jsii.member(jsii_name="toUpdateVariantStore")
    def to_update_variant_store(self) -> "Omics":
        '''(experimental) Grants permission to update metadata about the Variant Store.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_UpdateVariantStore.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toUpdateVariantStore", []))

    @jsii.member(jsii_name="toUpdateWorkflow")
    def to_update_workflow(self) -> "Omics":
        '''(experimental) Grants permission to update workflow details.

        Access Level: Write

        https://docs.aws.amazon.com/omics/latest/api/API_UpdateWorkflow.html

        :stability: experimental
        '''
        return typing.cast("Omics", jsii.invoke(self, "toUpdateWorkflow", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d171e84efe01f1f88c2c05169d1fa4c1678b0ba1e6dcd1104cd5a7799c51a82c)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__26a2d0f5ecda053ea0c80e7710ff886e2daac314d71421929e2b6e4256882fd1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Opsworks(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Opsworks",
):
    '''(experimental) Statement provider for service `opsworks <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsopsworks.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `opsworks <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsopsworks.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__81e2bc410befbbdb61fc9205773ce3a84c40e40ce6e4a938b237bffb4c13b2ad)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onStack")
    def on_stack(
        self,
        stack_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Opsworks":
        '''(experimental) Adds a resource of type stack to the statement.

        https://docs.aws.amazon.com/opsworks/latest/userguide/workingstacks.html

        :param stack_id: - Identifier for the stackId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d4897af16076cabfe9021bb5360f88db48c5ded78c450b0bd872bcd224854df0)
            check_type(argname="argument stack_id", value=stack_id, expected_type=type_hints["stack_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Opsworks", jsii.invoke(self, "onStack", [stack_id, account, region, partition]))

    @jsii.member(jsii_name="toAssignInstance")
    def to_assign_instance(self) -> "Opsworks":
        '''(experimental) Grants permission to assign a registered instance to a layer.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_AssignInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toAssignInstance", []))

    @jsii.member(jsii_name="toAssignVolume")
    def to_assign_volume(self) -> "Opsworks":
        '''(experimental) Grants permission to assign one of the stack's registered Amazon EBS volumes to a specified instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_AssignVolume.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toAssignVolume", []))

    @jsii.member(jsii_name="toAssociateElasticIp")
    def to_associate_elastic_ip(self) -> "Opsworks":
        '''(experimental) Grants permission to associate one of the stack's registered Elastic IP addresses with a specified instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_AssociateElasticIp.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toAssociateElasticIp", []))

    @jsii.member(jsii_name="toAttachElasticLoadBalancer")
    def to_attach_elastic_load_balancer(self) -> "Opsworks":
        '''(experimental) Grants permission to attach an Elastic Load Balancing load balancer to a specified layer.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_AttachElasticLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toAttachElasticLoadBalancer", []))

    @jsii.member(jsii_name="toCloneStack")
    def to_clone_stack(self) -> "Opsworks":
        '''(experimental) Grants permission to create a clone of a specified stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_CloneStack.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toCloneStack", []))

    @jsii.member(jsii_name="toCreateApp")
    def to_create_app(self) -> "Opsworks":
        '''(experimental) Grants permission to create an app for a specified stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_CreateApp.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toCreateApp", []))

    @jsii.member(jsii_name="toCreateDeployment")
    def to_create_deployment(self) -> "Opsworks":
        '''(experimental) Grants permission to run deployment or stack commands.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_CreateDeployment.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toCreateDeployment", []))

    @jsii.member(jsii_name="toCreateInstance")
    def to_create_instance(self) -> "Opsworks":
        '''(experimental) Grants permission to create an instance in a specified stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_CreateInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toCreateInstance", []))

    @jsii.member(jsii_name="toCreateLayer")
    def to_create_layer(self) -> "Opsworks":
        '''(experimental) Grants permission to create a layer.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_CreateLayer.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toCreateLayer", []))

    @jsii.member(jsii_name="toCreateStack")
    def to_create_stack(self) -> "Opsworks":
        '''(experimental) Grants permission to create a new stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_CreateStack.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toCreateStack", []))

    @jsii.member(jsii_name="toCreateUserProfile")
    def to_create_user_profile(self) -> "Opsworks":
        '''(experimental) Grants permission to create a new user profile.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_CreateUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toCreateUserProfile", []))

    @jsii.member(jsii_name="toDeleteApp")
    def to_delete_app(self) -> "Opsworks":
        '''(experimental) Grants permission to delete a specified app.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DeleteApp.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDeleteApp", []))

    @jsii.member(jsii_name="toDeleteInstance")
    def to_delete_instance(self) -> "Opsworks":
        '''(experimental) Grants permission to delete a specified instance, which terminates the associated Amazon EC2 instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DeleteInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDeleteInstance", []))

    @jsii.member(jsii_name="toDeleteLayer")
    def to_delete_layer(self) -> "Opsworks":
        '''(experimental) Grants permission to delete a specified layer.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DeleteLayer.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDeleteLayer", []))

    @jsii.member(jsii_name="toDeleteStack")
    def to_delete_stack(self) -> "Opsworks":
        '''(experimental) Grants permission to delete a specified stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DeleteStack.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDeleteStack", []))

    @jsii.member(jsii_name="toDeleteUserProfile")
    def to_delete_user_profile(self) -> "Opsworks":
        '''(experimental) Grants permission to delete a user profile.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DeleteUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDeleteUserProfile", []))

    @jsii.member(jsii_name="toDeregisterEcsCluster")
    def to_deregister_ecs_cluster(self) -> "Opsworks":
        '''(experimental) Grants permission to delete a user profile.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DeregisterEcsCluster.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDeregisterEcsCluster", []))

    @jsii.member(jsii_name="toDeregisterElasticIp")
    def to_deregister_elastic_ip(self) -> "Opsworks":
        '''(experimental) Grants permission to deregister a specified Elastic IP address.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DeregisterElasticIp.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDeregisterElasticIp", []))

    @jsii.member(jsii_name="toDeregisterInstance")
    def to_deregister_instance(self) -> "Opsworks":
        '''(experimental) Grants permission to deregister a registered Amazon EC2 or on-premises instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DeregisterInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDeregisterInstance", []))

    @jsii.member(jsii_name="toDeregisterRdsDbInstance")
    def to_deregister_rds_db_instance(self) -> "Opsworks":
        '''(experimental) Grants permission to deregister an Amazon RDS instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DeregisterRdsDbInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDeregisterRdsDbInstance", []))

    @jsii.member(jsii_name="toDeregisterVolume")
    def to_deregister_volume(self) -> "Opsworks":
        '''(experimental) Grants permission to deregister an Amazon EBS volume.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DeregisterVolume.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDeregisterVolume", []))

    @jsii.member(jsii_name="toDescribeAgentVersions")
    def to_describe_agent_versions(self) -> "Opsworks":
        '''(experimental) Grants permission to describe the available AWS OpsWorks agent versions.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeAgentVersions.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeAgentVersions", []))

    @jsii.member(jsii_name="toDescribeApps")
    def to_describe_apps(self) -> "Opsworks":
        '''(experimental) Grants permission to request a description of a specified set of apps.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeApps.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeApps", []))

    @jsii.member(jsii_name="toDescribeCommands")
    def to_describe_commands(self) -> "Opsworks":
        '''(experimental) Grants permission to describe the results of specified commands.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeCommands.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeCommands", []))

    @jsii.member(jsii_name="toDescribeDeployments")
    def to_describe_deployments(self) -> "Opsworks":
        '''(experimental) Grants permission to request a description of a specified set of deployments.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeDeployments.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeDeployments", []))

    @jsii.member(jsii_name="toDescribeEcsClusters")
    def to_describe_ecs_clusters(self) -> "Opsworks":
        '''(experimental) Grants permission to describe Amazon ECS clusters that are registered with a stack.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeEcsClusters.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeEcsClusters", []))

    @jsii.member(jsii_name="toDescribeElasticIps")
    def to_describe_elastic_ips(self) -> "Opsworks":
        '''(experimental) Grants permission to describe Elastic IP addresses.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeElasticIps.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeElasticIps", []))

    @jsii.member(jsii_name="toDescribeElasticLoadBalancers")
    def to_describe_elastic_load_balancers(self) -> "Opsworks":
        '''(experimental) Grants permission to describe a stack's Elastic Load Balancing instances.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeElasticLoadBalancers.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeElasticLoadBalancers", []))

    @jsii.member(jsii_name="toDescribeInstances")
    def to_describe_instances(self) -> "Opsworks":
        '''(experimental) Grants permission to request a description of a set of instances.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeInstances.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeInstances", []))

    @jsii.member(jsii_name="toDescribeLayers")
    def to_describe_layers(self) -> "Opsworks":
        '''(experimental) Grants permission to request a description of one or more layers in a specified stack.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeLayers.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeLayers", []))

    @jsii.member(jsii_name="toDescribeLoadBasedAutoScaling")
    def to_describe_load_based_auto_scaling(self) -> "Opsworks":
        '''(experimental) Grants permission to describe load-based auto scaling configurations for specified layers.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeLoadBasedAutoScaling.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeLoadBasedAutoScaling", []))

    @jsii.member(jsii_name="toDescribeMyUserProfile")
    def to_describe_my_user_profile(self) -> "Opsworks":
        '''(experimental) Grants permission to describe a user's SSH information.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeMyUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeMyUserProfile", []))

    @jsii.member(jsii_name="toDescribeOperatingSystems")
    def to_describe_operating_systems(self) -> "Opsworks":
        '''(experimental) Grants permission to describe the operating systems that are supported by AWS OpsWorks Stacks.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeOperatingSystems.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeOperatingSystems", []))

    @jsii.member(jsii_name="toDescribePermissions")
    def to_describe_permissions(self) -> "Opsworks":
        '''(experimental) Grants permission to describe the permissions for a specified stack.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribePermissions.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribePermissions", []))

    @jsii.member(jsii_name="toDescribeRaidArrays")
    def to_describe_raid_arrays(self) -> "Opsworks":
        '''(experimental) Grants permission to describe an instance's RAID arrays.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeRaidArrays.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeRaidArrays", []))

    @jsii.member(jsii_name="toDescribeRdsDbInstances")
    def to_describe_rds_db_instances(self) -> "Opsworks":
        '''(experimental) Grants permission to describe Amazon RDS instances.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeRdsDbInstances.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeRdsDbInstances", []))

    @jsii.member(jsii_name="toDescribeServiceErrors")
    def to_describe_service_errors(self) -> "Opsworks":
        '''(experimental) Grants permission to describe AWS OpsWorks service errors.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeServiceErrors.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeServiceErrors", []))

    @jsii.member(jsii_name="toDescribeStackProvisioningParameters")
    def to_describe_stack_provisioning_parameters(self) -> "Opsworks":
        '''(experimental) Grants permission to request a description of a stack's provisioning parameters.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeStackProvisioningParameters.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeStackProvisioningParameters", []))

    @jsii.member(jsii_name="toDescribeStacks")
    def to_describe_stacks(self) -> "Opsworks":
        '''(experimental) Grants permission to request a description of one or more stacks.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeStacks.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeStacks", []))

    @jsii.member(jsii_name="toDescribeStackSummary")
    def to_describe_stack_summary(self) -> "Opsworks":
        '''(experimental) Grants permission to describe the number of layers and apps in a specified stack, and the number of instances in each state, such as running_setup or online.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeStackSummary.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeStackSummary", []))

    @jsii.member(jsii_name="toDescribeTimeBasedAutoScaling")
    def to_describe_time_based_auto_scaling(self) -> "Opsworks":
        '''(experimental) Grants permission to describe time-based auto scaling configurations for specified instances.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeTimeBasedAutoScaling.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeTimeBasedAutoScaling", []))

    @jsii.member(jsii_name="toDescribeUserProfiles")
    def to_describe_user_profiles(self) -> "Opsworks":
        '''(experimental) Grants permission to describe specified users.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeUserProfiles.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeUserProfiles", []))

    @jsii.member(jsii_name="toDescribeVolumes")
    def to_describe_volumes(self) -> "Opsworks":
        '''(experimental) Grants permission to describe an instance's Amazon EBS volumes.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DescribeVolumes.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDescribeVolumes", []))

    @jsii.member(jsii_name="toDetachElasticLoadBalancer")
    def to_detach_elastic_load_balancer(self) -> "Opsworks":
        '''(experimental) Grants permission to detache a specified Elastic Load Balancing instance from its layer.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DetachElasticLoadBalancer.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDetachElasticLoadBalancer", []))

    @jsii.member(jsii_name="toDisassociateElasticIp")
    def to_disassociate_elastic_ip(self) -> "Opsworks":
        '''(experimental) Grants permission to disassociate an Elastic IP address from its instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_DisassociateElasticIp.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toDisassociateElasticIp", []))

    @jsii.member(jsii_name="toGetHostnameSuggestion")
    def to_get_hostname_suggestion(self) -> "Opsworks":
        '''(experimental) Grants permission to get a generated host name for the specified layer, based on the current host name theme.

        Access Level: Read

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_GetHostnameSuggestion.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toGetHostnameSuggestion", []))

    @jsii.member(jsii_name="toGrantAccess")
    def to_grant_access(self) -> "Opsworks":
        '''(experimental) Grants permission to grant RDP access to a Windows instance for a specified time period.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_RebootInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toGrantAccess", []))

    @jsii.member(jsii_name="toListTags")
    def to_list_tags(self) -> "Opsworks":
        '''(experimental) Grants permission to return a list of tags that are applied to the specified stack or layer.

        Access Level: List

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_ListTags.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toListTags", []))

    @jsii.member(jsii_name="toRebootInstance")
    def to_reboot_instance(self) -> "Opsworks":
        '''(experimental) Grants permission to reboot a specified instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_RebootInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toRebootInstance", []))

    @jsii.member(jsii_name="toRegisterEcsCluster")
    def to_register_ecs_cluster(self) -> "Opsworks":
        '''(experimental) Grants permission to register a specified Amazon ECS cluster with a stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_RegisterEcsCluster.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toRegisterEcsCluster", []))

    @jsii.member(jsii_name="toRegisterElasticIp")
    def to_register_elastic_ip(self) -> "Opsworks":
        '''(experimental) Grants permission to register an Elastic IP address with a specified stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_RegisterElasticIp.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toRegisterElasticIp", []))

    @jsii.member(jsii_name="toRegisterInstance")
    def to_register_instance(self) -> "Opsworks":
        '''(experimental) Grants permission to register instances with a specified stack that were created outside of AWS OpsWorks.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_RegisterInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toRegisterInstance", []))

    @jsii.member(jsii_name="toRegisterRdsDbInstance")
    def to_register_rds_db_instance(self) -> "Opsworks":
        '''(experimental) Grants permission to register an Amazon RDS instance with a stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_RegisterRdsDbInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toRegisterRdsDbInstance", []))

    @jsii.member(jsii_name="toRegisterVolume")
    def to_register_volume(self) -> "Opsworks":
        '''(experimental) Grants permission to register an Amazon EBS volume with a specified stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_RegisterVolume.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toRegisterVolume", []))

    @jsii.member(jsii_name="toSetLoadBasedAutoScaling")
    def to_set_load_based_auto_scaling(self) -> "Opsworks":
        '''(experimental) Grants permission to specify the load-based auto scaling configuration for a specified layer.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_SetLoadBasedAutoScaling.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toSetLoadBasedAutoScaling", []))

    @jsii.member(jsii_name="toSetPermission")
    def to_set_permission(self) -> "Opsworks":
        '''(experimental) Grants permission to specify a user's permissions.

        Access Level: Permissions management

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_SetPermission.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toSetPermission", []))

    @jsii.member(jsii_name="toSetTimeBasedAutoScaling")
    def to_set_time_based_auto_scaling(self) -> "Opsworks":
        '''(experimental) Grants permission to specify the time-based auto scaling configuration for a specified instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_SetTimeBasedAutoScaling.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toSetTimeBasedAutoScaling", []))

    @jsii.member(jsii_name="toStartInstance")
    def to_start_instance(self) -> "Opsworks":
        '''(experimental) Grants permission to start a specified instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_StartInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toStartInstance", []))

    @jsii.member(jsii_name="toStartStack")
    def to_start_stack(self) -> "Opsworks":
        '''(experimental) Grants permission to start a stack's instances.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_StartStack.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toStartStack", []))

    @jsii.member(jsii_name="toStopInstance")
    def to_stop_instance(self) -> "Opsworks":
        '''(experimental) Grants permission to stop a specified instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_StopInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toStopInstance", []))

    @jsii.member(jsii_name="toStopStack")
    def to_stop_stack(self) -> "Opsworks":
        '''(experimental) Grants permission to stop a specified stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_StopStack.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toStopStack", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Opsworks":
        '''(experimental) Grants permission to apply tags to a specified stack or layer.

        Access Level: Tagging

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUnassignInstance")
    def to_unassign_instance(self) -> "Opsworks":
        '''(experimental) Grants permission to unassign a registered instance from all of it's layers.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UnassignInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUnassignInstance", []))

    @jsii.member(jsii_name="toUnassignVolume")
    def to_unassign_volume(self) -> "Opsworks":
        '''(experimental) Grants permission to unassign an assigned Amazon EBS volume.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UnassignVolume.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUnassignVolume", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Opsworks":
        '''(experimental) Grants permission to remove tags from a specified stack or layer.

        Access Level: Tagging

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateApp")
    def to_update_app(self) -> "Opsworks":
        '''(experimental) Grants permission to update a specified app.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UpdateApp.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUpdateApp", []))

    @jsii.member(jsii_name="toUpdateElasticIp")
    def to_update_elastic_ip(self) -> "Opsworks":
        '''(experimental) Grants permission to update a registered Elastic IP address's name.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UpdateElasticIp.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUpdateElasticIp", []))

    @jsii.member(jsii_name="toUpdateInstance")
    def to_update_instance(self) -> "Opsworks":
        '''(experimental) Grants permission to update a specified instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UpdateInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUpdateInstance", []))

    @jsii.member(jsii_name="toUpdateLayer")
    def to_update_layer(self) -> "Opsworks":
        '''(experimental) Grants permission to update a specified layer.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UpdateLayer.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUpdateLayer", []))

    @jsii.member(jsii_name="toUpdateMyUserProfile")
    def to_update_my_user_profile(self) -> "Opsworks":
        '''(experimental) Grants permission to update a user's SSH public key.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UpdateMyUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUpdateMyUserProfile", []))

    @jsii.member(jsii_name="toUpdateRdsDbInstance")
    def to_update_rds_db_instance(self) -> "Opsworks":
        '''(experimental) Grants permission to update an Amazon RDS instance.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UpdateRdsDbInstance.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUpdateRdsDbInstance", []))

    @jsii.member(jsii_name="toUpdateStack")
    def to_update_stack(self) -> "Opsworks":
        '''(experimental) Grants permission to update a specified stack.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UpdateStack.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUpdateStack", []))

    @jsii.member(jsii_name="toUpdateUserProfile")
    def to_update_user_profile(self) -> "Opsworks":
        '''(experimental) Grants permission to update a specified user profile.

        Access Level: Permissions management

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UpdateUserProfile.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUpdateUserProfile", []))

    @jsii.member(jsii_name="toUpdateVolume")
    def to_update_volume(self) -> "Opsworks":
        '''(experimental) Grants permission to update an Amazon EBS volume's name or mount point.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks/latest/APIReference/API_UpdateVolume.html

        :stability: experimental
        '''
        return typing.cast("Opsworks", jsii.invoke(self, "toUpdateVolume", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a77b2ceb055e1d1999dac6138b2580accefb4483891ddd5bc2bf334dd4f15ef1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d662d2bfef3024e5f79b7833e977ccd3ae8dc9aaafa8e9edf41e55e681f48e32)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class OpsworksCm(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.OpsworksCm",
):
    '''(experimental) Statement provider for service `opsworks-cm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsopsworksconfigurationmanagement.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `opsworks-cm <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsopsworksconfigurationmanagement.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4e780a6ebbbc92e8bc3c14c8c71372bad4669dfae01d3836ea0fde559d3d7101)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onBackup")
    def on_backup(
        self,
        server_name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "OpsworksCm":
        '''(experimental) Adds a resource of type backup to the statement.

        :param server_name: - Identifier for the serverName.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4e454d66cebe7d068a1d6608ce5ee43fd508e7f0a5e820e34bdf344c10b0c064)
            check_type(argname="argument server_name", value=server_name, expected_type=type_hints["server_name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("OpsworksCm", jsii.invoke(self, "onBackup", [server_name, account, partition]))

    @jsii.member(jsii_name="onServer")
    def on_server(
        self,
        server_name: builtins.str,
        unique_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "OpsworksCm":
        '''(experimental) Adds a resource of type server to the statement.

        :param server_name: - Identifier for the serverName.
        :param unique_id: - Identifier for the uniqueId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d7dc7bb87a87e9d4c4e9bf70f58280263124f6962629d645a2ef26dac1927295)
            check_type(argname="argument server_name", value=server_name, expected_type=type_hints["server_name"])
            check_type(argname="argument unique_id", value=unique_id, expected_type=type_hints["unique_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("OpsworksCm", jsii.invoke(self, "onServer", [server_name, unique_id, account, partition]))

    @jsii.member(jsii_name="toAssociateNode")
    def to_associate_node(self) -> "OpsworksCm":
        '''(experimental) Grants permission to associate a node to a configuration management server.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_AssociateNode.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toAssociateNode", []))

    @jsii.member(jsii_name="toCreateBackup")
    def to_create_backup(self) -> "OpsworksCm":
        '''(experimental) Grants permission to create a backup for the specified server.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_CreateBackup.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toCreateBackup", []))

    @jsii.member(jsii_name="toCreateServer")
    def to_create_server(self) -> "OpsworksCm":
        '''(experimental) Grants permission to create a new server.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_CreateServer.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toCreateServer", []))

    @jsii.member(jsii_name="toDeleteBackup")
    def to_delete_backup(self) -> "OpsworksCm":
        '''(experimental) Grants permission to delete the specified backup and possibly its S3 bucket.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_DeleteBackup.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toDeleteBackup", []))

    @jsii.member(jsii_name="toDeleteServer")
    def to_delete_server(self) -> "OpsworksCm":
        '''(experimental) Grants permission to delete the specified server with its corresponding CloudFormation stack and possibly the S3 bucket.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_DeleteServer.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toDeleteServer", []))

    @jsii.member(jsii_name="toDescribeAccountAttributes")
    def to_describe_account_attributes(self) -> "OpsworksCm":
        '''(experimental) Grants permission to describe the service limits for the user's account.

        Access Level: List

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_DescribeAccountAttributes.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toDescribeAccountAttributes", []))

    @jsii.member(jsii_name="toDescribeBackups")
    def to_describe_backups(self) -> "OpsworksCm":
        '''(experimental) Grants permission to describe a single backup, all backups of a specified server or all backups of the user's account.

        Access Level: List

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_DescribeBackups.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toDescribeBackups", []))

    @jsii.member(jsii_name="toDescribeEvents")
    def to_describe_events(self) -> "OpsworksCm":
        '''(experimental) Grants permission to describe all events of the specified server.

        Access Level: List

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_DescribeEvents.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toDescribeEvents", []))

    @jsii.member(jsii_name="toDescribeNodeAssociationStatus")
    def to_describe_node_association_status(self) -> "OpsworksCm":
        '''(experimental) Grants permission to describe the association status for the specified node token and the specified server.

        Access Level: List

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_DescribeNodeAssociationStatus.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toDescribeNodeAssociationStatus", []))

    @jsii.member(jsii_name="toDescribeServers")
    def to_describe_servers(self) -> "OpsworksCm":
        '''(experimental) Grants permission to describe the specified server or all servers of the user's account.

        Access Level: List

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_DescribeServers.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toDescribeServers", []))

    @jsii.member(jsii_name="toDisassociateNode")
    def to_disassociate_node(self) -> "OpsworksCm":
        '''(experimental) Grants permission to disassociate a specified node from a server.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_DisassociateNode.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toDisassociateNode", []))

    @jsii.member(jsii_name="toExportServerEngineAttribute")
    def to_export_server_engine_attribute(self) -> "OpsworksCm":
        '''(experimental) Grants permission to export an engine attribute from a server.

        Access Level: Read

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_ExportServerEngineAttribute.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toExportServerEngineAttribute", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "OpsworksCm":
        '''(experimental) Grants permission to list the tags that are applied to the specified server or backup.

        Access Level: Read

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toRestoreServer")
    def to_restore_server(self) -> "OpsworksCm":
        '''(experimental) Grants permission to apply a backup to specified server. Possibly swaps out the ec2-instance if specified.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_RestoreServer.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toRestoreServer", []))

    @jsii.member(jsii_name="toStartMaintenance")
    def to_start_maintenance(self) -> "OpsworksCm":
        '''(experimental) Grants permission to start the server maintenance immediately.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_StartMaintenance.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toStartMaintenance", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "OpsworksCm":
        '''(experimental) Grants permission to apply tags to the specified server or backup.

        Access Level: Tagging

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "OpsworksCm":
        '''(experimental) Grants permission to remove tags from the specified server or backup.

        Access Level: Tagging

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateServer")
    def to_update_server(self) -> "OpsworksCm":
        '''(experimental) Grants permission to update general server settings.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_UpdateServer.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toUpdateServer", []))

    @jsii.member(jsii_name="toUpdateServerEngineAttributes")
    def to_update_server_engine_attributes(self) -> "OpsworksCm":
        '''(experimental) Grants permission to update server settings specific to the configuration management type.

        Access Level: Write

        https://docs.aws.amazon.com/opsworks-cm/latest/APIReference/API_UpdateServerEngineAttributes.html

        :stability: experimental
        '''
        return typing.cast("OpsworksCm", jsii.invoke(self, "toUpdateServerEngineAttributes", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__2b9abcf4962be1c0d9c9e95097b494fc953d818ae721f507c54bde21665496de)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__572f6497761497615496e4697a6875772f92b1717e6c4237cab9fb84527aebe6)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Organizations(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Organizations",
):
    '''(experimental) Statement provider for service `organizations <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsorganizations.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `organizations <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsorganizations.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5d8b540d0e9938645197d5cfebf79bc6e623ec1ec26e471053577cc01f8b1c08)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="ifPolicyType")
    def if_policy_type(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Organizations":
        '''(experimental) Filters access by the specified policy type names.

        https://docs.aws.amazon.com/organizations/latest/userguide/orgs_permissions_overview.html#orgs_permissions_conditionkeys

        Applies to actions:

        - .toAttachPolicy()
        - .toCreatePolicy()
        - .toDeletePolicy()
        - .toDescribeEffectivePolicy()
        - .toDescribePolicy()
        - .toDetachPolicy()
        - .toDisablePolicyType()
        - .toEnablePolicyType()
        - .toListPolicies()
        - .toListPoliciesForTarget()
        - .toListTargetsForPolicy()
        - .toUpdatePolicy()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b601c7fcca82be0cfceaa6c634bff7eaf55ccc7ec413afc14670ce95f99f49ee)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Organizations", jsii.invoke(self, "ifPolicyType", [value, operator]))

    @jsii.member(jsii_name="ifServicePrincipal")
    def if_service_principal(
        self,
        value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
        operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
    ) -> "Organizations":
        '''(experimental) Filters access by the specified service principal names.

        https://docs.aws.amazon.com/organizations/latest/userguide/orgs_permissions_overview.html#orgs_permissions_conditionkeys

        Applies to actions:

        - .toDeregisterDelegatedAdministrator()
        - .toDisableAWSServiceAccess()
        - .toEnableAWSServiceAccess()
        - .toListDelegatedAdministrators()
        - .toRegisterDelegatedAdministrator()

        :param value: The value(s) to check.
        :param operator: Works with `string operators <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_String>`_. **Default:** ``StringLike``.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__fd2764f03b21b8b660e0b3f25216aea02595cb0ed4659d2da3f71a282573d40a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
            check_type(argname="argument operator", value=operator, expected_type=type_hints["operator"])
        return typing.cast("Organizations", jsii.invoke(self, "ifServicePrincipal", [value, operator]))

    @jsii.member(jsii_name="onAccount")
    def on_account(
        self,
        organization_id: builtins.str,
        account_id: typing.Optional[builtins.str] = None,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Organizations":
        '''(experimental) Adds a resource of type account to the statement.

        https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_arn-formats.html

        :param organization_id: - Identifier for the organizationId.
        :param account_id: - Account of the resource; defaults to empty string: all accounts.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__52aa62a4781948f7abe635517cc93d3156b458858bb270f4e2988eb9464ba5d0)
            check_type(argname="argument organization_id", value=organization_id, expected_type=type_hints["organization_id"])
            check_type(argname="argument account_id", value=account_id, expected_type=type_hints["account_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Organizations", jsii.invoke(self, "onAccount", [organization_id, account_id, account, partition]))

    @jsii.member(jsii_name="onAwspolicy")
    def on_awspolicy(
        self,
        policy_type: builtins.str,
        policy_id: builtins.str,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Organizations":
        '''(experimental) Adds a resource of type awspolicy to the statement.

        https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_arn-formats.html

        :param policy_type: - Identifier for the policyType.
        :param policy_id: - Identifier for the policyId.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b9d7ac662d20ed2a442b8502fc85bec6a220d5c0d068ccda253d64bb1769e452)
            check_type(argname="argument policy_type", value=policy_type, expected_type=type_hints["policy_type"])
            check_type(argname="argument policy_id", value=policy_id, expected_type=type_hints["policy_id"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Organizations", jsii.invoke(self, "onAwspolicy", [policy_type, policy_id, partition]))

    @jsii.member(jsii_name="onHandshake")
    def on_handshake(
        self,
        organization_id: builtins.str,
        handshake_type: builtins.str,
        handshake_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Organizations":
        '''(experimental) Adds a resource of type handshake to the statement.

        https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_arn-formats.html

        :param organization_id: - Identifier for the organizationId.
        :param handshake_type: - Identifier for the handshakeType.
        :param handshake_id: - Identifier for the handshakeId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d4a63fb0c6a914a98fae572cfc6c7a83e274f4af2c03a299cc9fd21d0f5a9978)
            check_type(argname="argument organization_id", value=organization_id, expected_type=type_hints["organization_id"])
            check_type(argname="argument handshake_type", value=handshake_type, expected_type=type_hints["handshake_type"])
            check_type(argname="argument handshake_id", value=handshake_id, expected_type=type_hints["handshake_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Organizations", jsii.invoke(self, "onHandshake", [organization_id, handshake_type, handshake_id, account, partition]))

    @jsii.member(jsii_name="onOrganization")
    def on_organization(
        self,
        organization_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Organizations":
        '''(experimental) Adds a resource of type organization to the statement.

        https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_arn-formats.html

        :param organization_id: - Identifier for the organizationId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__44f6e81ff18407acd1f39cbc21f8065df78286c84cdf81062b8aafe90ce70182)
            check_type(argname="argument organization_id", value=organization_id, expected_type=type_hints["organization_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Organizations", jsii.invoke(self, "onOrganization", [organization_id, account, partition]))

    @jsii.member(jsii_name="onOrganizationalunit")
    def on_organizationalunit(
        self,
        organization_id: builtins.str,
        organizational_unit_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Organizations":
        '''(experimental) Adds a resource of type organizationalunit to the statement.

        https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_arn-formats.html

        :param organization_id: - Identifier for the organizationId.
        :param organizational_unit_id: - Identifier for the organizationalUnitId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__674e5f370b531a391e04910941577305c901617e06c0a8466039c02c6824e92c)
            check_type(argname="argument organization_id", value=organization_id, expected_type=type_hints["organization_id"])
            check_type(argname="argument organizational_unit_id", value=organizational_unit_id, expected_type=type_hints["organizational_unit_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Organizations", jsii.invoke(self, "onOrganizationalunit", [organization_id, organizational_unit_id, account, partition]))

    @jsii.member(jsii_name="onPolicy")
    def on_policy(
        self,
        organization_id: builtins.str,
        policy_type: builtins.str,
        policy_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Organizations":
        '''(experimental) Adds a resource of type policy to the statement.

        https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_arn-formats.html

        :param organization_id: - Identifier for the organizationId.
        :param policy_type: - Identifier for the policyType.
        :param policy_id: - Identifier for the policyId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__03f8169fc02587a2d0160529a6b5379cd64c590f654ecfe4b0aa155aa7b09654)
            check_type(argname="argument organization_id", value=organization_id, expected_type=type_hints["organization_id"])
            check_type(argname="argument policy_type", value=policy_type, expected_type=type_hints["policy_type"])
            check_type(argname="argument policy_id", value=policy_id, expected_type=type_hints["policy_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Organizations", jsii.invoke(self, "onPolicy", [organization_id, policy_type, policy_id, account, partition]))

    @jsii.member(jsii_name="onResourcepolicy")
    def on_resourcepolicy(
        self,
        organization_id: builtins.str,
        resource_policy_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Organizations":
        '''(experimental) Adds a resource of type resourcepolicy to the statement.

        https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_arn-formats.html

        :param organization_id: - Identifier for the organizationId.
        :param resource_policy_id: - Identifier for the resourcePolicyId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__dcfcf3ccc2bc2b3b7d8e3369427117db44a07ad29adc12386262bc009ab075e8)
            check_type(argname="argument organization_id", value=organization_id, expected_type=type_hints["organization_id"])
            check_type(argname="argument resource_policy_id", value=resource_policy_id, expected_type=type_hints["resource_policy_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Organizations", jsii.invoke(self, "onResourcepolicy", [organization_id, resource_policy_id, account, partition]))

    @jsii.member(jsii_name="onRoot")
    def on_root(
        self,
        organization_id: builtins.str,
        root_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Organizations":
        '''(experimental) Adds a resource of type root to the statement.

        https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_arn-formats.html

        :param organization_id: - Identifier for the organizationId.
        :param root_id: - Identifier for the rootId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__903e75ab3ee880d7e87e80e7be43c529c9d4b538776400b8c5cd2454e5eae46b)
            check_type(argname="argument organization_id", value=organization_id, expected_type=type_hints["organization_id"])
            check_type(argname="argument root_id", value=root_id, expected_type=type_hints["root_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Organizations", jsii.invoke(self, "onRoot", [organization_id, root_id, account, partition]))

    @jsii.member(jsii_name="toAcceptHandshake")
    def to_accept_handshake(self) -> "Organizations":
        '''(experimental) Grants permission to send a response to the originator of a handshake agreeing to the action proposed by the handshake request.

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_AcceptHandshake.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toAcceptHandshake", []))

    @jsii.member(jsii_name="toAttachPolicy")
    def to_attach_policy(self) -> "Organizations":
        '''(experimental) Grants permission to attach a policy to a root, an organizational unit, or an individual account.

        Access Level: Write

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_AttachPolicy.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toAttachPolicy", []))

    @jsii.member(jsii_name="toCancelHandshake")
    def to_cancel_handshake(self) -> "Organizations":
        '''(experimental) Grants permission to cancel a handshake.

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_CancelHandshake.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toCancelHandshake", []))

    @jsii.member(jsii_name="toCloseAccount")
    def to_close_account(self) -> "Organizations":
        '''(experimental) Grants permission to close an AWS account that is now a part of an Organizations, either created within the organization, or invited to join the organization.

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_CloseAccount.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toCloseAccount", []))

    @jsii.member(jsii_name="toCreateAccount")
    def to_create_account(self) -> "Organizations":
        '''(experimental) Grants permission to create an AWS account that is automatically a member of the organization with the credentials that made the request.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_CreateAccount.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toCreateAccount", []))

    @jsii.member(jsii_name="toCreateGovCloudAccount")
    def to_create_gov_cloud_account(self) -> "Organizations":
        '''(experimental) Grants permission to create an AWS GovCloud (US) account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_CreateGovCloudAccount.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toCreateGovCloudAccount", []))

    @jsii.member(jsii_name="toCreateOrganization")
    def to_create_organization(self) -> "Organizations":
        '''(experimental) Grants permission to create an organization.

        The account with the credentials that calls the CreateOrganization operation automatically becomes the management account of the new organization

        Access Level: Write

        Dependent actions:

        - iam:CreateServiceLinkedRole

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_CreateOrganization.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toCreateOrganization", []))

    @jsii.member(jsii_name="toCreateOrganizationalUnit")
    def to_create_organizational_unit(self) -> "Organizations":
        '''(experimental) Grants permission to create an organizational unit (OU) within a root or parent OU.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_CreateOrganizationalUnit.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toCreateOrganizationalUnit", []))

    @jsii.member(jsii_name="toCreatePolicy")
    def to_create_policy(self) -> "Organizations":
        '''(experimental) Grants permission to create a policy that you can attach to a root, an organizational unit (OU), or an individual AWS account.

        Access Level: Write

        Possible conditions:

        - .ifPolicyType()
        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_CreatePolicy.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toCreatePolicy", []))

    @jsii.member(jsii_name="toDeclineHandshake")
    def to_decline_handshake(self) -> "Organizations":
        '''(experimental) Grants permission to decline a handshake request. This sets the handshake state to DECLINED and effectively deactivates the request.

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DeclineHandshake.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDeclineHandshake", []))

    @jsii.member(jsii_name="toDeleteOrganization")
    def to_delete_organization(self) -> "Organizations":
        '''(experimental) Grants permission to delete the organization.

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DeleteOrganization.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDeleteOrganization", []))

    @jsii.member(jsii_name="toDeleteOrganizationalUnit")
    def to_delete_organizational_unit(self) -> "Organizations":
        '''(experimental) Grants permission to delete an organizational unit from a root or another OU.

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DeleteOrganizationalUnit.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDeleteOrganizationalUnit", []))

    @jsii.member(jsii_name="toDeletePolicy")
    def to_delete_policy(self) -> "Organizations":
        '''(experimental) Grants permission to delete a policy from your organization.

        Access Level: Write

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DeletePolicy.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDeletePolicy", []))

    @jsii.member(jsii_name="toDeleteResourcePolicy")
    def to_delete_resource_policy(self) -> "Organizations":
        '''(experimental) Grants permission to delete a resource policy from your organization.

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DeleteResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDeleteResourcePolicy", []))

    @jsii.member(jsii_name="toDeregisterDelegatedAdministrator")
    def to_deregister_delegated_administrator(self) -> "Organizations":
        '''(experimental) Grants permission to deregister the specified member AWS account as a delegated administrator for the AWS service that is specified by ServicePrincipal.

        Access Level: Write

        Possible conditions:

        - .ifServicePrincipal()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DeregisterDelegatedAdministrator.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDeregisterDelegatedAdministrator", []))

    @jsii.member(jsii_name="toDescribeAccount")
    def to_describe_account(self) -> "Organizations":
        '''(experimental) Grants permission to retrieve Organizations-related details about the specified account.

        Access Level: Read

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DescribeAccount.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDescribeAccount", []))

    @jsii.member(jsii_name="toDescribeCreateAccountStatus")
    def to_describe_create_account_status(self) -> "Organizations":
        '''(experimental) Grants permission to retrieve the current status of an asynchronous request to create an account.

        Access Level: Read

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DescribeCreateAccountStatus.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDescribeCreateAccountStatus", []))

    @jsii.member(jsii_name="toDescribeEffectivePolicy")
    def to_describe_effective_policy(self) -> "Organizations":
        '''(experimental) Grants permission to retrieve the effective policy for an account.

        Access Level: Read

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DescribeEffectivePolicy.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDescribeEffectivePolicy", []))

    @jsii.member(jsii_name="toDescribeHandshake")
    def to_describe_handshake(self) -> "Organizations":
        '''(experimental) Grants permission to retrieve details about a previously requested handshake.

        Access Level: Read

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DescribeHandshake.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDescribeHandshake", []))

    @jsii.member(jsii_name="toDescribeOrganization")
    def to_describe_organization(self) -> "Organizations":
        '''(experimental) Grants permission to retrieves details about the organization that the calling credentials belong to.

        Access Level: Read

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DescribeOrganization.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDescribeOrganization", []))

    @jsii.member(jsii_name="toDescribeOrganizationalUnit")
    def to_describe_organizational_unit(self) -> "Organizations":
        '''(experimental) Grants permission to retrieve details about an organizational unit (OU).

        Access Level: Read

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DescribeOrganizationalUnit.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDescribeOrganizationalUnit", []))

    @jsii.member(jsii_name="toDescribePolicy")
    def to_describe_policy(self) -> "Organizations":
        '''(experimental) Grants permission to retrieves details about a policy.

        Access Level: Read

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DescribePolicy.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDescribePolicy", []))

    @jsii.member(jsii_name="toDescribeResourcePolicy")
    def to_describe_resource_policy(self) -> "Organizations":
        '''(experimental) Grants permission to retrieve information about a resource policy.

        Access Level: Read

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DescribeResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDescribeResourcePolicy", []))

    @jsii.member(jsii_name="toDetachPolicy")
    def to_detach_policy(self) -> "Organizations":
        '''(experimental) Grants permission to detach a policy from a target root, organizational unit, or account.

        Access Level: Write

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DetachPolicy.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDetachPolicy", []))

    @jsii.member(jsii_name="toDisableAWSServiceAccess")
    def to_disable_aws_service_access(self) -> "Organizations":
        '''(experimental) Grants permission to disable integration of an AWS service (the service that is specified by ServicePrincipal) with AWS Organizations.

        Access Level: Write

        Possible conditions:

        - .ifServicePrincipal()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DisableAWSServiceAccess.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDisableAWSServiceAccess", []))

    @jsii.member(jsii_name="toDisablePolicyType")
    def to_disable_policy_type(self) -> "Organizations":
        '''(experimental) Grants permission to disable an organization policy type in a root.

        Access Level: Write

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_DisablePolicyType.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toDisablePolicyType", []))

    @jsii.member(jsii_name="toEnableAllFeatures")
    def to_enable_all_features(self) -> "Organizations":
        '''(experimental) Grants permission to start the process to enable all features in an organization, upgrading it from supporting only Consolidated Billing features.

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnableAllFeatures.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toEnableAllFeatures", []))

    @jsii.member(jsii_name="toEnableAWSServiceAccess")
    def to_enable_aws_service_access(self) -> "Organizations":
        '''(experimental) Grants permission to enable integration of an AWS service (the service that is specified by ServicePrincipal) with AWS Organizations.

        Access Level: Write

        Possible conditions:

        - .ifServicePrincipal()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnableAWSServiceAccess.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toEnableAWSServiceAccess", []))

    @jsii.member(jsii_name="toEnablePolicyType")
    def to_enable_policy_type(self) -> "Organizations":
        '''(experimental) Grants permission to enable a policy type in a root.

        Access Level: Write

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnablePolicyType.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toEnablePolicyType", []))

    @jsii.member(jsii_name="toInviteAccountToOrganization")
    def to_invite_account_to_organization(self) -> "Organizations":
        '''(experimental) Grants permission to send an invitation to another AWS account, asking it to join your organization as a member account.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_InviteAccountToOrganization.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toInviteAccountToOrganization", []))

    @jsii.member(jsii_name="toLeaveOrganization")
    def to_leave_organization(self) -> "Organizations":
        '''(experimental) Grants permission to remove a member account from its parent organization.

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_LeaveOrganization.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toLeaveOrganization", []))

    @jsii.member(jsii_name="toListAccounts")
    def to_list_accounts(self) -> "Organizations":
        '''(experimental) Grants permission to list all of the the accounts in the organization.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListAccounts.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListAccounts", []))

    @jsii.member(jsii_name="toListAccountsForParent")
    def to_list_accounts_for_parent(self) -> "Organizations":
        '''(experimental) Grants permission to list the accounts in an organization that are contained by a root or organizational unit (OU).

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListAccountsForParent.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListAccountsForParent", []))

    @jsii.member(jsii_name="toListAWSServiceAccessForOrganization")
    def to_list_aws_service_access_for_organization(self) -> "Organizations":
        '''(experimental) Grants permission to retrieve the list of the AWS services for which you enabled integration with your organization.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListAWSServiceAccessForOrganization.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListAWSServiceAccessForOrganization", []))

    @jsii.member(jsii_name="toListChildren")
    def to_list_children(self) -> "Organizations":
        '''(experimental) Grants permission to list all of the OUs or accounts that are contained in a parent OU or root.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListChildren.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListChildren", []))

    @jsii.member(jsii_name="toListCreateAccountStatus")
    def to_list_create_account_status(self) -> "Organizations":
        '''(experimental) Grants permission to list the asynchronous account creation requests that are currently being tracked for the organization.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListCreateAccountStatus.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListCreateAccountStatus", []))

    @jsii.member(jsii_name="toListDelegatedAdministrators")
    def to_list_delegated_administrators(self) -> "Organizations":
        '''(experimental) Grants permission to list the AWS accounts that are designated as delegated administrators in this organization.

        Access Level: List

        Possible conditions:

        - .ifServicePrincipal()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListDelegatedAdministrators.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListDelegatedAdministrators", []))

    @jsii.member(jsii_name="toListDelegatedServicesForAccount")
    def to_list_delegated_services_for_account(self) -> "Organizations":
        '''(experimental) Grants permission to list the AWS services for which the specified account is a delegated administrator in this organization.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListDelegatedServicesForAccount.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListDelegatedServicesForAccount", []))

    @jsii.member(jsii_name="toListHandshakesForAccount")
    def to_list_handshakes_for_account(self) -> "Organizations":
        '''(experimental) Grants permission to list all of the handshakes that are associated with an account.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListHandshakesForAccount.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListHandshakesForAccount", []))

    @jsii.member(jsii_name="toListHandshakesForOrganization")
    def to_list_handshakes_for_organization(self) -> "Organizations":
        '''(experimental) Grants permission to list the handshakes that are associated with the organization.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListHandshakesForOrganization.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListHandshakesForOrganization", []))

    @jsii.member(jsii_name="toListOrganizationalUnitsForParent")
    def to_list_organizational_units_for_parent(self) -> "Organizations":
        '''(experimental) Grants permission to lists all of the organizational units (OUs) in a parent organizational unit or root.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListOrganizationalUnitsForParent.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListOrganizationalUnitsForParent", []))

    @jsii.member(jsii_name="toListParents")
    def to_list_parents(self) -> "Organizations":
        '''(experimental) Grants permission to list the root or organizational units (OUs) that serve as the immediate parent of a child OU or account.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListParents.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListParents", []))

    @jsii.member(jsii_name="toListPolicies")
    def to_list_policies(self) -> "Organizations":
        '''(experimental) Grants permission to list all of the policies in an organization.

        Access Level: List

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListPolicies.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListPolicies", []))

    @jsii.member(jsii_name="toListPoliciesForTarget")
    def to_list_policies_for_target(self) -> "Organizations":
        '''(experimental) Grants permission to list all of the policies that are directly attached to a root, organizational unit (OU), or account.

        Access Level: List

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListPoliciesForTarget.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListPoliciesForTarget", []))

    @jsii.member(jsii_name="toListRoots")
    def to_list_roots(self) -> "Organizations":
        '''(experimental) Grants permission to list all of the roots that are defined in the organization.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListRoots.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListRoots", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Organizations":
        '''(experimental) Grants permission to list all tags for the specified resource.

        Access Level: List

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toListTargetsForPolicy")
    def to_list_targets_for_policy(self) -> "Organizations":
        '''(experimental) Grants permission to list all the roots, OUs, and accounts to which a policy is attached.

        Access Level: List

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListTargetsForPolicy.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toListTargetsForPolicy", []))

    @jsii.member(jsii_name="toMoveAccount")
    def to_move_account(self) -> "Organizations":
        '''(experimental) Grants permission to move an account from its current root or OU to another parent root or OU.

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_MoveAccount.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toMoveAccount", []))

    @jsii.member(jsii_name="toPutResourcePolicy")
    def to_put_resource_policy(self) -> "Organizations":
        '''(experimental) Grants permission to create or update a resource policy.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_PutResourcePolicy.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toPutResourcePolicy", []))

    @jsii.member(jsii_name="toRegisterDelegatedAdministrator")
    def to_register_delegated_administrator(self) -> "Organizations":
        '''(experimental) Grants permission to register the specified member account to administer the Organizations features of the AWS service that is specified by ServicePrincipal.

        Access Level: Write

        Possible conditions:

        - .ifServicePrincipal()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_RegisterDelegatedAdministrator.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toRegisterDelegatedAdministrator", []))

    @jsii.member(jsii_name="toRemoveAccountFromOrganization")
    def to_remove_account_from_organization(self) -> "Organizations":
        '''(experimental) Grants permission to removes the specified account from the organization.

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_RemoveAccountFromOrganization.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toRemoveAccountFromOrganization", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Organizations":
        '''(experimental) Grants permission to add one or more tags to the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Organizations":
        '''(experimental) Grants permission to remove one or more tags from the specified resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateOrganizationalUnit")
    def to_update_organizational_unit(self) -> "Organizations":
        '''(experimental) Grants permission to rename an organizational unit (OU).

        Access Level: Write

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_UpdateOrganizationalUnit.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toUpdateOrganizationalUnit", []))

    @jsii.member(jsii_name="toUpdatePolicy")
    def to_update_policy(self) -> "Organizations":
        '''(experimental) Grants permission to update an existing policy with a new name, description, or content.

        Access Level: Write

        Possible conditions:

        - .ifPolicyType()

        https://docs.aws.amazon.com/organizations/latest/APIReference/API_UpdatePolicy.html

        :stability: experimental
        '''
        return typing.cast("Organizations", jsii.invoke(self, "toUpdatePolicy", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__331ddcc1b0ebb63aa7436d1c55a9cae7814e160c8ccd1277b7d7fc020e7e3800)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__78aaeb608e441ad2c913192f8ab4f390dc4ab91a17fa6bf052dcce6bfa425530)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Outposts(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Outposts",
):
    '''(experimental) Statement provider for service `outposts <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsoutposts.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `outposts <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsoutposts.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__98c156bcea38a1e0e095cfda15585101028a503f57b543125860b1af4b2da9c2)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onOutpost")
    def on_outpost(
        self,
        outpost_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Outposts":
        '''(experimental) Adds a resource of type outpost to the statement.

        https://docs.aws.amazon.com/outposts/latest/userguide/work-with-outposts.html

        :param outpost_id: - Identifier for the outpostId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__69bddb2d6bed2d611680c5f55b970537c78b7bb9a4fad19e7c5649b4bb1c9b20)
            check_type(argname="argument outpost_id", value=outpost_id, expected_type=type_hints["outpost_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Outposts", jsii.invoke(self, "onOutpost", [outpost_id, account, region, partition]))

    @jsii.member(jsii_name="onSite")
    def on_site(
        self,
        site_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Outposts":
        '''(experimental) Adds a resource of type site to the statement.

        https://docs.aws.amazon.com/outposts/latest/userguide/work-with-outposts.html

        :param site_id: - Identifier for the siteId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__ffe9d8ab5897893f72d061ff1b5f844046c3db036a7fa71422a27af5d4590aa8)
            check_type(argname="argument site_id", value=site_id, expected_type=type_hints["site_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Outposts", jsii.invoke(self, "onSite", [site_id, account, region, partition]))

    @jsii.member(jsii_name="toCancelOrder")
    def to_cancel_order(self) -> "Outposts":
        '''(experimental) Grants permission to cancel an order.

        Access Level: Write

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_CancelOrder.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toCancelOrder", []))

    @jsii.member(jsii_name="toCreateOrder")
    def to_create_order(self) -> "Outposts":
        '''(experimental) Grants permission to create an order.

        Access Level: Write

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_CreateOrder.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toCreateOrder", []))

    @jsii.member(jsii_name="toCreateOutpost")
    def to_create_outpost(self) -> "Outposts":
        '''(experimental) Grants permission to create an Outpost.

        Access Level: Write

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_CreateOutpost.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toCreateOutpost", []))

    @jsii.member(jsii_name="toCreatePrivateConnectivityConfig")
    def to_create_private_connectivity_config(self) -> "Outposts":
        '''(experimental) Grants permission to create a private connectivity configuration.

        Access Level: Write

        https://docs.aws.amazon.com/outposts/latest/userguide/how-outposts-works.html#private-connectivity

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toCreatePrivateConnectivityConfig", []))

    @jsii.member(jsii_name="toCreateSite")
    def to_create_site(self) -> "Outposts":
        '''(experimental) Grants permission to create a site.

        Access Level: Write

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_CreateSite.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toCreateSite", []))

    @jsii.member(jsii_name="toDeleteOutpost")
    def to_delete_outpost(self) -> "Outposts":
        '''(experimental) Grants permission to delete an Outpost.

        Access Level: Write

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_DeleteOutpost.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toDeleteOutpost", []))

    @jsii.member(jsii_name="toDeleteSite")
    def to_delete_site(self) -> "Outposts":
        '''(experimental) Grants permission to delete a site.

        Access Level: Write

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_DeleteSite.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toDeleteSite", []))

    @jsii.member(jsii_name="toGetCatalogItem")
    def to_get_catalog_item(self) -> "Outposts":
        '''(experimental) Grants permission to get a catalog item.

        Access Level: Read

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_GetCatalogItem.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toGetCatalogItem", []))

    @jsii.member(jsii_name="toGetConnection")
    def to_get_connection(self) -> "Outposts":
        '''(experimental) Grants permission to get information about the connection for your Outpost server.

        Access Level: Read

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_GetConnection.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toGetConnection", []))

    @jsii.member(jsii_name="toGetOrder")
    def to_get_order(self) -> "Outposts":
        '''(experimental) Grants permission to get information about an order.

        Access Level: Read

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_GetOrder.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toGetOrder", []))

    @jsii.member(jsii_name="toGetOutpost")
    def to_get_outpost(self) -> "Outposts":
        '''(experimental) Grants permission to get information about the specified Outpost.

        Access Level: Read

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_GetOutpost.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toGetOutpost", []))

    @jsii.member(jsii_name="toGetOutpostInstanceTypes")
    def to_get_outpost_instance_types(self) -> "Outposts":
        '''(experimental) Grants permission to get the instance types for the specified Outpost.

        Access Level: Read

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_GetOutpostInstanceTypes.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toGetOutpostInstanceTypes", []))

    @jsii.member(jsii_name="toGetPrivateConnectivityConfig")
    def to_get_private_connectivity_config(self) -> "Outposts":
        '''(experimental) Grants permission to get a private connectivity configuration.

        Access Level: Read

        https://docs.aws.amazon.com/outposts/latest/userguide/how-outposts-works.html#private-connectivity

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toGetPrivateConnectivityConfig", []))

    @jsii.member(jsii_name="toGetSite")
    def to_get_site(self) -> "Outposts":
        '''(experimental) Grants permission to get a site.

        Access Level: Read

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_GetSite.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toGetSite", []))

    @jsii.member(jsii_name="toGetSiteAddress")
    def to_get_site_address(self) -> "Outposts":
        '''(experimental) Grants permission to get a site address.

        Access Level: Read

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_GetSiteAddress.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toGetSiteAddress", []))

    @jsii.member(jsii_name="toListAssets")
    def to_list_assets(self) -> "Outposts":
        '''(experimental) Grants permission to list the assets for your Outpost.

        Access Level: List

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_ListAssets.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toListAssets", []))

    @jsii.member(jsii_name="toListCatalogItems")
    def to_list_catalog_items(self) -> "Outposts":
        '''(experimental) Grants permission to list all catalog items.

        Access Level: List

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_ListCatalogItems.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toListCatalogItems", []))

    @jsii.member(jsii_name="toListOrders")
    def to_list_orders(self) -> "Outposts":
        '''(experimental) Grants permission to list the orders for your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_ListOrders.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toListOrders", []))

    @jsii.member(jsii_name="toListOutposts")
    def to_list_outposts(self) -> "Outposts":
        '''(experimental) Grants permission to list the Outposts for your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_ListOutposts.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toListOutposts", []))

    @jsii.member(jsii_name="toListSites")
    def to_list_sites(self) -> "Outposts":
        '''(experimental) Grants permission to list the sites for your AWS account.

        Access Level: List

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_ListSites.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toListSites", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Outposts":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: Read

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartConnection")
    def to_start_connection(self) -> "Outposts":
        '''(experimental) Grants permission to start a connection for your Outpost server.

        Access Level: Write

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_StartConnection.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toStartConnection", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Outposts":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Outposts":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateOutpost")
    def to_update_outpost(self) -> "Outposts":
        '''(experimental) Grants permission to update an Outpost.

        Access Level: Write

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_UpdateOutpost.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toUpdateOutpost", []))

    @jsii.member(jsii_name="toUpdateSite")
    def to_update_site(self) -> "Outposts":
        '''(experimental) Grants permission to update a site.

        Access Level: Write

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_UpdateSite.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toUpdateSite", []))

    @jsii.member(jsii_name="toUpdateSiteAddress")
    def to_update_site_address(self) -> "Outposts":
        '''(experimental) Grants permission to update the site address.

        Access Level: Write

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_UpdateSiteAddress.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toUpdateSiteAddress", []))

    @jsii.member(jsii_name="toUpdateSiteRackPhysicalProperties")
    def to_update_site_rack_physical_properties(self) -> "Outposts":
        '''(experimental) Grants permission to update the physical properties of a rack at a site.

        Access Level: Write

        https://docs.aws.amazon.com/outposts/latest/APIReference/API_UpdateSiteRackPhysicalProperties.html

        :stability: experimental
        '''
        return typing.cast("Outposts", jsii.invoke(self, "toUpdateSiteRackPhysicalProperties", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__931882eea6f6ed6f15ca5d1d3c9d058b355eee551b57d1af6b7e692c89204643)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__aa1e90a8366d6d2be4454acaf41db2a369b196fe796a0f5e868a025745c599b9)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Panorama(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Panorama",
):
    '''(experimental) Statement provider for service `panorama <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awspanorama.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `panorama <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awspanorama.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__49510ab62fb408da87b826ed95460d2e16ce90c141f5aee06d72c218019e8124)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onApplicationInstance")
    def on_application_instance(
        self,
        application_instance_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Panorama":
        '''(experimental) Adds a resource of type applicationInstance to the statement.

        https://docs.aws.amazon.com/panorama/latest/dev/gettingstarted-concepts.html#gettingstarted-concepts-application

        :param application_instance_id: - Identifier for the applicationInstanceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5ce41c6607b44cdf394d671fff9addfd70b9c6a5348b20cc1afb15c4a9019d0a)
            check_type(argname="argument application_instance_id", value=application_instance_id, expected_type=type_hints["application_instance_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Panorama", jsii.invoke(self, "onApplicationInstance", [application_instance_id, account, region, partition]))

    @jsii.member(jsii_name="onDevice")
    def on_device(
        self,
        device_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Panorama":
        '''(experimental) Adds a resource of type device to the statement.

        https://docs.aws.amazon.com/panorama/latest/dev/gettingstarted-concepts.html#gettingstarted-concepts-appliance

        :param device_id: - Identifier for the deviceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__93545fefd9beb3593acdc436519f6d49fa837f14d5a661ba3a3428c6e29ef877)
            check_type(argname="argument device_id", value=device_id, expected_type=type_hints["device_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Panorama", jsii.invoke(self, "onDevice", [device_id, account, region, partition]))

    @jsii.member(jsii_name="onPackage")
    def on_package(
        self,
        package_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Panorama":
        '''(experimental) Adds a resource of type package to the statement.

        https://docs.aws.amazon.com/panorama/latest/dev/gettingstarted-concepts.html#gettingstarted-concepts-node

        :param package_id: - Identifier for the packageId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e7a1c8ce0102a894e857e6fe2509cda1b463b8fa60577c2f17a7749dd08b47e5)
            check_type(argname="argument package_id", value=package_id, expected_type=type_hints["package_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Panorama", jsii.invoke(self, "onPackage", [package_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateApplicationInstance")
    def to_create_application_instance(self) -> "Panorama":
        '''(experimental) Grants permission to create an AWS Panorama Application Instance.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/panorama/latest/api/API_CreateApplicationInstance.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toCreateApplicationInstance", []))

    @jsii.member(jsii_name="toCreateJobForDevices")
    def to_create_job_for_devices(self) -> "Panorama":
        '''(experimental) Grants permission to create a job for an AWS Panorama Appliance.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/api/API_CreateJobForDevices.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toCreateJobForDevices", []))

    @jsii.member(jsii_name="toCreateNodeFromTemplateJob")
    def to_create_node_from_template_job(self) -> "Panorama":
        '''(experimental) Grants permission to create an AWS Panorama Node.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/api/API_CreateNodeFromTemplateJob.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toCreateNodeFromTemplateJob", []))

    @jsii.member(jsii_name="toCreatePackage")
    def to_create_package(self) -> "Panorama":
        '''(experimental) Grants permission to create an AWS Panorama Package.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/panorama/latest/api/API_CreatePackage.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toCreatePackage", []))

    @jsii.member(jsii_name="toCreatePackageImportJob")
    def to_create_package_import_job(self) -> "Panorama":
        '''(experimental) Grants permission to create an AWS Panorama Package.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/api/API_CreatePackageImportJob.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toCreatePackageImportJob", []))

    @jsii.member(jsii_name="toDeleteDevice")
    def to_delete_device(self) -> "Panorama":
        '''(experimental) Grants permission to deregister an AWS Panorama Appliance.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/api/API_DeleteDevice.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDeleteDevice", []))

    @jsii.member(jsii_name="toDeletePackage")
    def to_delete_package(self) -> "Panorama":
        '''(experimental) Grants permission to delete an AWS Panorama Package.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/api/API_DeletePackage.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDeletePackage", []))

    @jsii.member(jsii_name="toDeregisterPackageVersion")
    def to_deregister_package_version(self) -> "Panorama":
        '''(experimental) Grants permission to deregister an AWS Panorama package version.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/api/API_DeregisterPackageVersion.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDeregisterPackageVersion", []))

    @jsii.member(jsii_name="toDescribeApplicationInstance")
    def to_describe_application_instance(self) -> "Panorama":
        '''(experimental) Grants permission to view details about an AWS Panorama application instance.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/api/API_DescribeApplicationInstance.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDescribeApplicationInstance", []))

    @jsii.member(jsii_name="toDescribeApplicationInstanceDetails")
    def to_describe_application_instance_details(self) -> "Panorama":
        '''(experimental) Grants permission to view details about an AWS Panorama application instance.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/api/API_DescribeApplicationInstanceDetails.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDescribeApplicationInstanceDetails", []))

    @jsii.member(jsii_name="toDescribeDevice")
    def to_describe_device(self) -> "Panorama":
        '''(experimental) Grants permission to view details about an AWS Panorama Appliance.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/api/API_DescribeDevice.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDescribeDevice", []))

    @jsii.member(jsii_name="toDescribeDeviceJob")
    def to_describe_device_job(self) -> "Panorama":
        '''(experimental) Grants permission to view job details for an AWS Panorama Appliance.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/api/API_DescribeDeviceJob.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDescribeDeviceJob", []))

    @jsii.member(jsii_name="toDescribeNode")
    def to_describe_node(self) -> "Panorama":
        '''(experimental) Grants permission to view details about an AWS Panorama application node.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/api/API_DescribeNode.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDescribeNode", []))

    @jsii.member(jsii_name="toDescribeNodeFromTemplateJob")
    def to_describe_node_from_template_job(self) -> "Panorama":
        '''(experimental) Grants permission to view details about AWS Panorama application node.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/api/API_DescribeNodeFromTemplateJob.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDescribeNodeFromTemplateJob", []))

    @jsii.member(jsii_name="toDescribePackage")
    def to_describe_package(self) -> "Panorama":
        '''(experimental) Grants permission to view details about an AWS Panorama package.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/api/API_DescribePackage.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDescribePackage", []))

    @jsii.member(jsii_name="toDescribePackageImportJob")
    def to_describe_package_import_job(self) -> "Panorama":
        '''(experimental) Grants permission to view details about an AWS Panorama package.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/api/API_DescribePackageImportJob.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDescribePackageImportJob", []))

    @jsii.member(jsii_name="toDescribePackageVersion")
    def to_describe_package_version(self) -> "Panorama":
        '''(experimental) Grants permission to view details about an AWS Panorama package version.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/api/API_DescribePackageVersion.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDescribePackageVersion", []))

    @jsii.member(jsii_name="toDescribeSoftware")
    def to_describe_software(self) -> "Panorama":
        '''(experimental) Grants permission to view details about a software version for the AWS Panorama Appliance.

        Access Level: Read

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awspanorama.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toDescribeSoftware", []))

    @jsii.member(jsii_name="toGetWebSocketURL")
    def to_get_web_socket_url(self) -> "Panorama":
        '''(experimental) Grants permission to generate a WebSocket endpoint for communication with AWS Panorama.

        Access Level: Read

        https://docs.aws.amazon.com/service-authorization/latest/reference/list_awspanorama.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toGetWebSocketURL", []))

    @jsii.member(jsii_name="toListApplicationInstanceDependencies")
    def to_list_application_instance_dependencies(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of application instance dependencies in AWS Panorama.

        Access Level: List

        https://docs.aws.amazon.com/panorama/latest/api/API_ListApplicationInstanceDependencies.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toListApplicationInstanceDependencies", []))

    @jsii.member(jsii_name="toListApplicationInstanceNodeInstances")
    def to_list_application_instance_node_instances(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of node instances of application instances in AWS Panorama.

        Access Level: List

        https://docs.aws.amazon.com/panorama/latest/api/API_ListApplicationInstanceNodeInstances.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toListApplicationInstanceNodeInstances", []))

    @jsii.member(jsii_name="toListApplicationInstances")
    def to_list_application_instances(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of application instances in AWS Panorama.

        Access Level: List

        https://docs.aws.amazon.com/panorama/latest/api/API_ListApplicationInstances.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toListApplicationInstances", []))

    @jsii.member(jsii_name="toListDevices")
    def to_list_devices(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of appliances in AWS Panorama.

        Access Level: List

        https://docs.aws.amazon.com/panorama/latest/api/API_ListDevices.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toListDevices", []))

    @jsii.member(jsii_name="toListDevicesJobs")
    def to_list_devices_jobs(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of jobs for an AWS Panorama Appliance.

        Access Level: List

        https://docs.aws.amazon.com/panorama/latest/api/API_ListDevicesJobs.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toListDevicesJobs", []))

    @jsii.member(jsii_name="toListNodeFromTemplateJobs")
    def to_list_node_from_template_jobs(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of Nodes for an AWS Panorama Appliance.

        Access Level: List

        https://docs.aws.amazon.com/panorama/latest/api/API_ListNodeFromTemplateJobs.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toListNodeFromTemplateJobs", []))

    @jsii.member(jsii_name="toListNodes")
    def to_list_nodes(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of nodes in AWS Panorama.

        Access Level: List

        https://docs.aws.amazon.com/panorama/latest/api/API_ListNodes.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toListNodes", []))

    @jsii.member(jsii_name="toListPackageImportJobs")
    def to_list_package_import_jobs(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of packages in AWS Panorama.

        Access Level: List

        https://docs.aws.amazon.com/panorama/latest/api/API_ListPackageImportJobs.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toListPackageImportJobs", []))

    @jsii.member(jsii_name="toListPackages")
    def to_list_packages(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of packages in AWS Panorama.

        Access Level: List

        https://docs.aws.amazon.com/panorama/latest/api/API_ListPackages.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toListPackages", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Panorama":
        '''(experimental) Grants permission to retrieve a list of tags for a resource in AWS Panorama.

        Access Level: Read

        https://docs.aws.amazon.com/panorama/latest/api/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toProvisionDevice")
    def to_provision_device(self) -> "Panorama":
        '''(experimental) Grants permission to register an AWS Panorama Appliance.

        Access Level: Write

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/panorama/latest/api/API_ProvisionDevice.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toProvisionDevice", []))

    @jsii.member(jsii_name="toRegisterPackageVersion")
    def to_register_package_version(self) -> "Panorama":
        '''(experimental) Grants permission to register an AWS Panorama package version.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/api/API_RegisterPackageVersion.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toRegisterPackageVersion", []))

    @jsii.member(jsii_name="toRemoveApplicationInstance")
    def to_remove_application_instance(self) -> "Panorama":
        '''(experimental) Grants permission to remove an AWS Panorama application instance.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/api/API_RemoveApplicationInstance.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toRemoveApplicationInstance", []))

    @jsii.member(jsii_name="toSignalApplicationInstanceNodeInstances")
    def to_signal_application_instance_node_instances(self) -> "Panorama":
        '''(experimental) Grants permission to signal camera nodes in an application instance to pause or resume.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/api/API_SignalApplicationInstanceNodeInstances.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toSignalApplicationInstanceNodeInstances", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Panorama":
        '''(experimental) Grants permission to add tags to a resource in AWS Panorama.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()
        - .ifAwsRequestTag()

        https://docs.aws.amazon.com/panorama/latest/api/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Panorama":
        '''(experimental) Grants permission to remove tags from a resource in AWS Panorama.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/panorama/latest/api/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateDeviceMetadata")
    def to_update_device_metadata(self) -> "Panorama":
        '''(experimental) Grants permission to modify basic settings for an AWS Panorama Appliance.

        Access Level: Write

        https://docs.aws.amazon.com/panorama/latest/api/API_UpdateDeviceMetadata.html

        :stability: experimental
        '''
        return typing.cast("Panorama", jsii.invoke(self, "toUpdateDeviceMetadata", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__68a8b24cb36835c86be13d799127b4d212dfce2bbd8b4fc15425aee943182c78)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__23e4fb3c5ef395895bc8f2fac0113a6d35d7e4d6e5c2d16b7a8a30e60bde69fb)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Payments(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Payments",
):
    '''(experimental) Statement provider for service `payments <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awspayments.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `payments <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awspayments.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b5fc72a666a32209e82fd6efd6c09e93902f6f37679612cf94729b9e2437eff5)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="toCreatePaymentInstrument")
    def to_create_payment_instrument(self) -> "Payments":
        '''(experimental) Grants permission to create a payment instrument.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Payments", jsii.invoke(self, "toCreatePaymentInstrument", []))

    @jsii.member(jsii_name="toDeletePaymentInstrument")
    def to_delete_payment_instrument(self) -> "Payments":
        '''(experimental) Grants permission to delete a payment instrument.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Payments", jsii.invoke(self, "toDeletePaymentInstrument", []))

    @jsii.member(jsii_name="toGetPaymentInstrument")
    def to_get_payment_instrument(self) -> "Payments":
        '''(experimental) Grants permission to get information about a payment instrument.

        Access Level: List

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Payments", jsii.invoke(self, "toGetPaymentInstrument", []))

    @jsii.member(jsii_name="toGetPaymentStatus")
    def to_get_payment_status(self) -> "Payments":
        '''(experimental) Grants permission to get payment status of invoices.

        Access Level: Read

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Payments", jsii.invoke(self, "toGetPaymentStatus", []))

    @jsii.member(jsii_name="toListPaymentPreferences")
    def to_list_payment_preferences(self) -> "Payments":
        '''(experimental) Grants permission to get payment preferences (preferred payment currency, preferred payment method, etc.).

        Access Level: List

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Payments", jsii.invoke(self, "toListPaymentPreferences", []))

    @jsii.member(jsii_name="toMakePayment")
    def to_make_payment(self) -> "Payments":
        '''(experimental) Grants permission to make a payment, authenticate a payment, verify a payment method, and generate a funding request document for Advance Pay.

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Payments", jsii.invoke(self, "toMakePayment", []))

    @jsii.member(jsii_name="toUpdatePaymentPreferences")
    def to_update_payment_preferences(self) -> "Payments":
        '''(experimental) Grants permission to update payment preferences (preferred payment currency, preferred payment method, etc.).

        Access Level: Write

        https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-permissions-ref.html

        :stability: experimental
        '''
        return typing.cast("Payments", jsii.invoke(self, "toUpdatePaymentPreferences", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__29ae557b1c6bfb5f1185f73019965b621b77a52fd8b6c38668faa4ad91f4591a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9eb02c3877d548f2dda3c59c1a5c85c725dca0a2c90145b951ae32a60a14d34e)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Personalize(
    PolicyStatement,
    metaclass=jsii.JSIIMeta,
    jsii_type="iam-floyd.Personalize",
):
    '''(experimental) Statement provider for service `personalize <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpersonalize.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `personalize <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpersonalize.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__e19dbb5b6540b58430244493b51e1b22be61b42a8a64289070e082290131d0b5)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onAlgorithm")
    def on_algorithm(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type algorithm to the statement.

        https://docs.aws.amazon.com/personalize/latest/dg/API_Algorithm.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0e9ecd9386ce3fd95fdeae36c017526fc9a0dbba16f4471f19c15a4f99680e70)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Personalize", jsii.invoke(self, "onAlgorithm", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onBatchInferenceJob")
    def on_batch_inference_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type batchInferenceJob to the statement.

        https://docs.aws.amazon.com/personalize/latest/dg/API_BatchInferenceJob.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__f77c8051e5f4be1e3cb33a8d577f6f60cc461f9e40cdc0ec38554120f29baab8)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Personalize", jsii.invoke(self, "onBatchInferenceJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onBatchSegmentJob")
    def on_batch_segment_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type batchSegmentJob to the statement.

        https://docs.aws.amazon.com/personalize/latest/dg/API_BatchSegmentJob.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__38df88287f57f24e6415dece7ea6014eaee20462de5f9572b577c1d9b0f1d736)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Personalize", jsii.invoke(self, "onBatchSegmentJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onCampaign")
    def on_campaign(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type campaign to the statement.

        https://docs.aws.amazon.com/personalize/latest/dg/API_Campaign.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__5a318dee946586ee0033752cc4b8e0fc154a945f7bb7259930df782e98db63fa)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Personalize", jsii.invoke(self, "onCampaign", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onDataset")
    def on_dataset(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type dataset to the statement.

        https://docs.aws.amazon.com/personalize/latest/dg/API_Dataset.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__1e7499a492f81b7e1ff37d00205b0b3596ebe65bb957fb239ae994f29d47ede6)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Personalize", jsii.invoke(self, "onDataset", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onDatasetExportJob")
    def on_dataset_export_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type datasetExportJob to the statement.

        https://docs.aws.amazon.com/personalize/latest/dg/API_DatasetExportJob.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__55ab97d93e4c67dc67f2a0db5c51af4dcbb147fb6b25330bc647fa9fc48aede6)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Personalize", jsii.invoke(self, "onDatasetExportJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onDatasetGroup")
    def on_dataset_group(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type datasetGroup to the statement.

        https://docs.aws.amazon.com/personalize/latest/dg/API_DatasetGroup.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b0b617464e9038df1afcaa97089ef86798452c575cafbfbd9e6434a775c983ee)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Personalize", jsii.invoke(self, "onDatasetGroup", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onDatasetImportJob")
    def on_dataset_import_job(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type datasetImportJob to the statement.

        https://docs.aws.amazon.com/personalize/latest/dg/API_DatasetImportJob.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__9fae2e89282de5b240114f4fba03fe27005c1ab07ca504953f8b8d512052dca9)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Personalize", jsii.invoke(self, "onDatasetImportJob", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onEventTracker")
    def on_event_tracker(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type eventTracker to the statement.

        https://docs.aws.amazon.com/personalize/latest/dg/API_EventTracker.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a21c770cea4b4903d1cc157b3ccfa0deb3102bf4bf0ba2e7f38be4f3ef226675)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Personalize", jsii.invoke(self, "onEventTracker", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onFeatureTransformation")
    def on_feature_transformation(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type featureTransformation to the statement.

        https://docs.aws.amazon.com/personalize/latest/dg/API_FeatureTransformation.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c04159bf5531875014bff191d379285680ca9db88867c9dc1f39adfc8c21dd26)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Personalize", jsii.invoke(self, "onFeatureTransformation", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onFilter")
    def on_filter(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type filter to the statement.

        https://docs.aws.amazon.com/personalize/latest/dg/API_Filter.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__a6972aed2b82b28c516a2b6ab8cc40109bbf39de9a07c1e4a66eefa05253328d)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Personalize", jsii.invoke(self, "onFilter", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onMetricAttribution")
    def on_metric_attribution(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type metricAttribution to the statement.

        https://docs.aws.amazon.com/personalize/latest/dg/API_MetricAttribution.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__172661cf7a1a733a0ab1060627f1191827af48ee2e3bd5925a34572a18ca009b)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Personalize", jsii.invoke(self, "onMetricAttribution", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onRecipe")
    def on_recipe(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type recipe to the statement.

        https://docs.aws.amazon.com/personalize/latest/dg/API_Recipe.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d1d066b0bd2a4acd3c81c3097049caa2e0cdc27fad3bab566c598cac40f20e7f)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Personalize", jsii.invoke(self, "onRecipe", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onRecommender")
    def on_recommender(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type recommender to the statement.

        https://docs.aws.amazon.com/personalize/latest/dg/API_Recommender.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b455dd8693b726846333fd050bb5455b06c8f187fe124b59a73a1c9863eee31b)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Personalize", jsii.invoke(self, "onRecommender", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onSchema")
    def on_schema(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type schema to the statement.

        https://docs.aws.amazon.com/personalize/latest/dg/how-it-works-dataset-schema.html#schema-examples

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d65f8e2f99d4d5079d4f62d2b58f7d07993b8fd4089606ce5ef2cf9a9d1c905c)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Personalize", jsii.invoke(self, "onSchema", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="onSolution")
    def on_solution(
        self,
        resource_id: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Personalize":
        '''(experimental) Adds a resource of type solution to the statement.

        https://docs.aws.amazon.com/personalize/latest/dg/API_Solution.html

        :param resource_id: - Identifier for the resourceId.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__4c4f1748612190753757c44a0ce4e39890c1d3ea03cb12947655eaa49b155633)
            check_type(argname="argument resource_id", value=resource_id, expected_type=type_hints["resource_id"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Personalize", jsii.invoke(self, "onSolution", [resource_id, account, region, partition]))

    @jsii.member(jsii_name="toCreateBatchInferenceJob")
    def to_create_batch_inference_job(self) -> "Personalize":
        '''(experimental) Grants permission to create a batch inference job.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateBatchInferenceJob.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateBatchInferenceJob", []))

    @jsii.member(jsii_name="toCreateBatchSegmentJob")
    def to_create_batch_segment_job(self) -> "Personalize":
        '''(experimental) Grants permission to create a batch segment job.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateBatchSegmentJob.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateBatchSegmentJob", []))

    @jsii.member(jsii_name="toCreateCampaign")
    def to_create_campaign(self) -> "Personalize":
        '''(experimental) Grants permission to create a campaign.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateCampaign.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateCampaign", []))

    @jsii.member(jsii_name="toCreateDataset")
    def to_create_dataset(self) -> "Personalize":
        '''(experimental) Grants permission to create a dataset.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateDataset.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateDataset", []))

    @jsii.member(jsii_name="toCreateDatasetExportJob")
    def to_create_dataset_export_job(self) -> "Personalize":
        '''(experimental) Grants permission to create a dataset export job.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateDatasetExportJob.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateDatasetExportJob", []))

    @jsii.member(jsii_name="toCreateDatasetGroup")
    def to_create_dataset_group(self) -> "Personalize":
        '''(experimental) Grants permission to create a dataset group.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateDatasetGroup.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateDatasetGroup", []))

    @jsii.member(jsii_name="toCreateDatasetImportJob")
    def to_create_dataset_import_job(self) -> "Personalize":
        '''(experimental) Grants permission to create a dataset import job.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateDatasetImportJob.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateDatasetImportJob", []))

    @jsii.member(jsii_name="toCreateEventTracker")
    def to_create_event_tracker(self) -> "Personalize":
        '''(experimental) Grants permission to create an event tracker.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateEventTracker.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateEventTracker", []))

    @jsii.member(jsii_name="toCreateFilter")
    def to_create_filter(self) -> "Personalize":
        '''(experimental) Grants permission to create a filter.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateFilter.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateFilter", []))

    @jsii.member(jsii_name="toCreateMetricAttribution")
    def to_create_metric_attribution(self) -> "Personalize":
        '''(experimental) Grants permission to create a metric attribution.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateMetricAttribution.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateMetricAttribution", []))

    @jsii.member(jsii_name="toCreateRecommender")
    def to_create_recommender(self) -> "Personalize":
        '''(experimental) Grants permission to create a recommender.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateRecommender.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateRecommender", []))

    @jsii.member(jsii_name="toCreateSchema")
    def to_create_schema(self) -> "Personalize":
        '''(experimental) Grants permission to create a schema.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateSchema.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateSchema", []))

    @jsii.member(jsii_name="toCreateSolution")
    def to_create_solution(self) -> "Personalize":
        '''(experimental) Grants permission to create a solution.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateSolution.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateSolution", []))

    @jsii.member(jsii_name="toCreateSolutionVersion")
    def to_create_solution_version(self) -> "Personalize":
        '''(experimental) Grants permission to create a solution version.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_CreateSolutionVersion.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toCreateSolutionVersion", []))

    @jsii.member(jsii_name="toDeleteCampaign")
    def to_delete_campaign(self) -> "Personalize":
        '''(experimental) Grants permission to delete a campaign.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_DeleteCampaign.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDeleteCampaign", []))

    @jsii.member(jsii_name="toDeleteDataset")
    def to_delete_dataset(self) -> "Personalize":
        '''(experimental) Grants permission to delete a dataset.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_DeleteDataset.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDeleteDataset", []))

    @jsii.member(jsii_name="toDeleteDatasetGroup")
    def to_delete_dataset_group(self) -> "Personalize":
        '''(experimental) Grants permission to delete a dataset group.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_DeleteDatasetGroup.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDeleteDatasetGroup", []))

    @jsii.member(jsii_name="toDeleteEventTracker")
    def to_delete_event_tracker(self) -> "Personalize":
        '''(experimental) Grants permission to delete an event tracker.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_DeleteEventTracker.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDeleteEventTracker", []))

    @jsii.member(jsii_name="toDeleteFilter")
    def to_delete_filter(self) -> "Personalize":
        '''(experimental) Grants permission to delete a filter.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_DeleteFilter.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDeleteFilter", []))

    @jsii.member(jsii_name="toDeleteMetricAttribution")
    def to_delete_metric_attribution(self) -> "Personalize":
        '''(experimental) Grants permission to delete a metric attribution.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_DeleteMetricAttribution.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDeleteMetricAttribution", []))

    @jsii.member(jsii_name="toDeleteRecommender")
    def to_delete_recommender(self) -> "Personalize":
        '''(experimental) Grants permission to delete a recommender.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_DeleteRecommender.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDeleteRecommender", []))

    @jsii.member(jsii_name="toDeleteSchema")
    def to_delete_schema(self) -> "Personalize":
        '''(experimental) Grants permission to delete a schema.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_DeleteSchema.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDeleteSchema", []))

    @jsii.member(jsii_name="toDeleteSolution")
    def to_delete_solution(self) -> "Personalize":
        '''(experimental) Grants permission to delete a solution including all versions of the solution.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_DeleteSolution.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDeleteSolution", []))

    @jsii.member(jsii_name="toDescribeAlgorithm")
    def to_describe_algorithm(self) -> "Personalize":
        '''(experimental) Grants permission to describe an algorithm.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeAlgorithm.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeAlgorithm", []))

    @jsii.member(jsii_name="toDescribeBatchInferenceJob")
    def to_describe_batch_inference_job(self) -> "Personalize":
        '''(experimental) Grants permission to describe a batch inference job.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeBatchInferenceJob.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeBatchInferenceJob", []))

    @jsii.member(jsii_name="toDescribeBatchSegmentJob")
    def to_describe_batch_segment_job(self) -> "Personalize":
        '''(experimental) Grants permission to describe a batch segment job.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeBatchSegmentJob.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeBatchSegmentJob", []))

    @jsii.member(jsii_name="toDescribeCampaign")
    def to_describe_campaign(self) -> "Personalize":
        '''(experimental) Grants permission to describe a campaign.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeCampaign.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeCampaign", []))

    @jsii.member(jsii_name="toDescribeDataset")
    def to_describe_dataset(self) -> "Personalize":
        '''(experimental) Grants permission to describe a dataset.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeDataset.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeDataset", []))

    @jsii.member(jsii_name="toDescribeDatasetExportJob")
    def to_describe_dataset_export_job(self) -> "Personalize":
        '''(experimental) Grants permission to describe a dataset export job.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeDatasetExportJob.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeDatasetExportJob", []))

    @jsii.member(jsii_name="toDescribeDatasetGroup")
    def to_describe_dataset_group(self) -> "Personalize":
        '''(experimental) Grants permission to describe a dataset group.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeDatasetGroup.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeDatasetGroup", []))

    @jsii.member(jsii_name="toDescribeDatasetImportJob")
    def to_describe_dataset_import_job(self) -> "Personalize":
        '''(experimental) Grants permission to describe a dataset import job.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeDatasetImportJob.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeDatasetImportJob", []))

    @jsii.member(jsii_name="toDescribeEventTracker")
    def to_describe_event_tracker(self) -> "Personalize":
        '''(experimental) Grants permission to describe an event tracker.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeEventTracker.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeEventTracker", []))

    @jsii.member(jsii_name="toDescribeFeatureTransformation")
    def to_describe_feature_transformation(self) -> "Personalize":
        '''(experimental) Grants permission to describe a feature transformation.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeFeatureTransformation.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeFeatureTransformation", []))

    @jsii.member(jsii_name="toDescribeFilter")
    def to_describe_filter(self) -> "Personalize":
        '''(experimental) Grants permission to describe a filter.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeFilter.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeFilter", []))

    @jsii.member(jsii_name="toDescribeMetricAttribution")
    def to_describe_metric_attribution(self) -> "Personalize":
        '''(experimental) Grants permission to describe a metric attribution.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeMetricAttribution.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeMetricAttribution", []))

    @jsii.member(jsii_name="toDescribeRecipe")
    def to_describe_recipe(self) -> "Personalize":
        '''(experimental) Grants permission to describe a recipe.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeRecipe.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeRecipe", []))

    @jsii.member(jsii_name="toDescribeRecommender")
    def to_describe_recommender(self) -> "Personalize":
        '''(experimental) Grants permission to describe a recommender.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeRecommender.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeRecommender", []))

    @jsii.member(jsii_name="toDescribeSchema")
    def to_describe_schema(self) -> "Personalize":
        '''(experimental) Grants permission to describe a schema.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeSchema.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeSchema", []))

    @jsii.member(jsii_name="toDescribeSolution")
    def to_describe_solution(self) -> "Personalize":
        '''(experimental) Grants permission to describe a solution.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeSolution.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeSolution", []))

    @jsii.member(jsii_name="toDescribeSolutionVersion")
    def to_describe_solution_version(self) -> "Personalize":
        '''(experimental) Grants permission to describe a version of a solution.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_DescribeSolutionVersion.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toDescribeSolutionVersion", []))

    @jsii.member(jsii_name="toGetPersonalizedRanking")
    def to_get_personalized_ranking(self) -> "Personalize":
        '''(experimental) Grants permission to get a re-ranked list of recommendations.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_RS_GetPersonalizedRanking.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toGetPersonalizedRanking", []))

    @jsii.member(jsii_name="toGetRecommendations")
    def to_get_recommendations(self) -> "Personalize":
        '''(experimental) Grants permission to get a list of recommendations from a campaign.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_RS_GetRecommendations.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toGetRecommendations", []))

    @jsii.member(jsii_name="toGetSolutionMetrics")
    def to_get_solution_metrics(self) -> "Personalize":
        '''(experimental) Grants permission to get metrics for a solution version.

        Access Level: Read

        https://docs.aws.amazon.com/personalize/latest/dg/API_GetSolutionMetrics.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toGetSolutionMetrics", []))

    @jsii.member(jsii_name="toListBatchInferenceJobs")
    def to_list_batch_inference_jobs(self) -> "Personalize":
        '''(experimental) Grants permission to list batch inference jobs.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListBatchInferenceJobs.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListBatchInferenceJobs", []))

    @jsii.member(jsii_name="toListBatchSegmentJobs")
    def to_list_batch_segment_jobs(self) -> "Personalize":
        '''(experimental) Grants permission to list batch segment jobs.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListBatchSegmentJobs.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListBatchSegmentJobs", []))

    @jsii.member(jsii_name="toListCampaigns")
    def to_list_campaigns(self) -> "Personalize":
        '''(experimental) Grants permission to list campaigns.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListCampaigns.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListCampaigns", []))

    @jsii.member(jsii_name="toListDatasetExportJobs")
    def to_list_dataset_export_jobs(self) -> "Personalize":
        '''(experimental) Grants permission to list dataset export jobs.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListDatasetExportJobs.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListDatasetExportJobs", []))

    @jsii.member(jsii_name="toListDatasetGroups")
    def to_list_dataset_groups(self) -> "Personalize":
        '''(experimental) Grants permission to list dataset groups.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListDatasetGroups.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListDatasetGroups", []))

    @jsii.member(jsii_name="toListDatasetImportJobs")
    def to_list_dataset_import_jobs(self) -> "Personalize":
        '''(experimental) Grants permission to list dataset import jobs.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListDatasetImportJobs.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListDatasetImportJobs", []))

    @jsii.member(jsii_name="toListDatasets")
    def to_list_datasets(self) -> "Personalize":
        '''(experimental) Grants permission to list datasets.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListDatasets.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListDatasets", []))

    @jsii.member(jsii_name="toListEventTrackers")
    def to_list_event_trackers(self) -> "Personalize":
        '''(experimental) Grants permission to list event trackers.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListEventTrackers.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListEventTrackers", []))

    @jsii.member(jsii_name="toListFilters")
    def to_list_filters(self) -> "Personalize":
        '''(experimental) Grants permission to list filters.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListFilters.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListFilters", []))

    @jsii.member(jsii_name="toListMetricAttributionMetrics")
    def to_list_metric_attribution_metrics(self) -> "Personalize":
        '''(experimental) Grants permission to list metric attribution metrics.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListMetricAttributionMetrics.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListMetricAttributionMetrics", []))

    @jsii.member(jsii_name="toListMetricAttributions")
    def to_list_metric_attributions(self) -> "Personalize":
        '''(experimental) Grants permission to list metric attributions.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListMetricAttributions.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListMetricAttributions", []))

    @jsii.member(jsii_name="toListRecipes")
    def to_list_recipes(self) -> "Personalize":
        '''(experimental) Grants permission to list recipes.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListRecipes.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListRecipes", []))

    @jsii.member(jsii_name="toListRecommenders")
    def to_list_recommenders(self) -> "Personalize":
        '''(experimental) Grants permission to list recommenders.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListRecommenders.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListRecommenders", []))

    @jsii.member(jsii_name="toListSchemas")
    def to_list_schemas(self) -> "Personalize":
        '''(experimental) Grants permission to list schemas.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListSchemas.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListSchemas", []))

    @jsii.member(jsii_name="toListSolutions")
    def to_list_solutions(self) -> "Personalize":
        '''(experimental) Grants permission to list solutions.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListSolutions.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListSolutions", []))

    @jsii.member(jsii_name="toListSolutionVersions")
    def to_list_solution_versions(self) -> "Personalize":
        '''(experimental) Grants permission to list versions of a solution.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListSolutionVersions.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListSolutionVersions", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Personalize":
        '''(experimental) Grants permission to list tags for a resource.

        Access Level: List

        https://docs.aws.amazon.com/personalize/latest/dg/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toPutEvents")
    def to_put_events(self) -> "Personalize":
        '''(experimental) Grants permission to put real time event data.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_UBS_PutEvents.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toPutEvents", []))

    @jsii.member(jsii_name="toPutItems")
    def to_put_items(self) -> "Personalize":
        '''(experimental) Grants permission to ingest Items data.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_UBS_PutItems.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toPutItems", []))

    @jsii.member(jsii_name="toPutUsers")
    def to_put_users(self) -> "Personalize":
        '''(experimental) Grants permission to ingest Users data.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_UBS_PutUsers.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toPutUsers", []))

    @jsii.member(jsii_name="toStartRecommender")
    def to_start_recommender(self) -> "Personalize":
        '''(experimental) Grants permission to start a recommender.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_StartRecommender.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toStartRecommender", []))

    @jsii.member(jsii_name="toStopRecommender")
    def to_stop_recommender(self) -> "Personalize":
        '''(experimental) Grants permission to stop a recommender.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_StopRecommender.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toStopRecommender", []))

    @jsii.member(jsii_name="toStopSolutionVersionCreation")
    def to_stop_solution_version_creation(self) -> "Personalize":
        '''(experimental) Grants permission to stop a solution version creation.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_StopSolutionVersionCreation.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toStopSolutionVersionCreation", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Personalize":
        '''(experimental) Grants permission to tag a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/personalize/latest/dg/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Personalize":
        '''(experimental) Grants permission to untag a resource.

        Access Level: Tagging

        https://docs.aws.amazon.com/personalize/latest/dg/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdateCampaign")
    def to_update_campaign(self) -> "Personalize":
        '''(experimental) Grants permission to update a campaign.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_UpdateCampaign.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toUpdateCampaign", []))

    @jsii.member(jsii_name="toUpdateMetricAttribution")
    def to_update_metric_attribution(self) -> "Personalize":
        '''(experimental) Grants permission to update a metric attribution.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_UpdateMetricAttribution.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toUpdateMetricAttribution", []))

    @jsii.member(jsii_name="toUpdateRecommender")
    def to_update_recommender(self) -> "Personalize":
        '''(experimental) Grants permission to update a recommender.

        Access Level: Write

        https://docs.aws.amazon.com/personalize/latest/dg/API_UpdateRecommender.html

        :stability: experimental
        '''
        return typing.cast("Personalize", jsii.invoke(self, "toUpdateRecommender", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__22a510afce28534b1543a0ce0065fc289290f9114941619b0396cf1eddd7beb4)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__c2b1a1727d54dd946e075d7ebf43056433c1e640a0a6b589275f2581710c41ef)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Pi(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Pi"):
    '''(experimental) Statement provider for service `pi <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsperformanceinsights.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `pi <https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsperformanceinsights.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__d6c201b46d93d9118d9e9c9a05d537d794a8ff594f049fa2b297de522627d137)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onMetricResource")
    def on_metric_resource(
        self,
        service_type: builtins.str,
        identifier: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Pi":
        '''(experimental) Adds a resource of type metric-resource to the statement.

        https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PerfInsights.access-control.html

        :param service_type: - Identifier for the serviceType.
        :param identifier: - Identifier for the identifier.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__487cb60752d95cd12d4f1040a41ee4c25034ec997eba38200ee55bfb400ef5ca)
            check_type(argname="argument service_type", value=service_type, expected_type=type_hints["service_type"])
            check_type(argname="argument identifier", value=identifier, expected_type=type_hints["identifier"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Pi", jsii.invoke(self, "onMetricResource", [service_type, identifier, account, region, partition]))

    @jsii.member(jsii_name="toDescribeDimensionKeys")
    def to_describe_dimension_keys(self) -> "Pi":
        '''(experimental) Grants permission to call DescribeDimensionKeys API to retrieve the top N dimension keys for a metric for a specific time period.

        Access Level: Read

        https://docs.aws.amazon.com/performance-insights/latest/APIReference/API_DescribeDimensionKeys.html

        :stability: experimental
        '''
        return typing.cast("Pi", jsii.invoke(self, "toDescribeDimensionKeys", []))

    @jsii.member(jsii_name="toGetDimensionKeyDetails")
    def to_get_dimension_key_details(self) -> "Pi":
        '''(experimental) Grants permission to call GetDimensionKeyDetails API to retrieve the attributes of the specified dimension group.

        Access Level: Read

        https://docs.aws.amazon.com/performance-insights/latest/APIReference/API_GetDimensionKeyDetails.html

        :stability: experimental
        '''
        return typing.cast("Pi", jsii.invoke(self, "toGetDimensionKeyDetails", []))

    @jsii.member(jsii_name="toGetResourceMetadata")
    def to_get_resource_metadata(self) -> "Pi":
        '''(experimental) Grants permission to call GetResourceMetadata API to retrieve the metadata for different features.

        Access Level: Read

        https://docs.aws.amazon.com/performance-insights/latest/APIReference/API_GetResourceMetadata.html

        :stability: experimental
        '''
        return typing.cast("Pi", jsii.invoke(self, "toGetResourceMetadata", []))

    @jsii.member(jsii_name="toGetResourceMetrics")
    def to_get_resource_metrics(self) -> "Pi":
        '''(experimental) Grants permission to call GetResourceMetrics API to retrieve PI metrics for a set of data sources, over a time period.

        Access Level: Read

        https://docs.aws.amazon.com/performance-insights/latest/APIReference/API_GetResourceMetrics.html

        :stability: experimental
        '''
        return typing.cast("Pi", jsii.invoke(self, "toGetResourceMetrics", []))

    @jsii.member(jsii_name="toListAvailableResourceDimensions")
    def to_list_available_resource_dimensions(self) -> "Pi":
        '''(experimental) Grants permission to call ListAvailableResourceDimensions API to retrieve the dimensions that can be queried for each specified metric type on a specified DB instance.

        Access Level: Read

        https://docs.aws.amazon.com/performance-insights/latest/APIReference/API_ListAvailableResourceDimensions.html

        :stability: experimental
        '''
        return typing.cast("Pi", jsii.invoke(self, "toListAvailableResourceDimensions", []))

    @jsii.member(jsii_name="toListAvailableResourceMetrics")
    def to_list_available_resource_metrics(self) -> "Pi":
        '''(experimental) Grants permission to call ListAvailableResourceMetrics API to retrieve metrics of the specified types that can be queried for a specified DB instance.

        Access Level: Read

        https://docs.aws.amazon.com/performance-insights/latest/APIReference/API_ListAvailableResourceMetrics.html

        :stability: experimental
        '''
        return typing.cast("Pi", jsii.invoke(self, "toListAvailableResourceMetrics", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__43f4152509c7c59395f9b157d3f5b24508853f18cb70288c38215c35f3c7be95)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__0ff02e4a28281ca7fd59d357ab3bc056631df0d88c8f81b486ade01e6934fa2a)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


class Pipes(PolicyStatement, metaclass=jsii.JSIIMeta, jsii_type="iam-floyd.Pipes"):
    '''(experimental) Statement provider for service `pipes <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoneventbridgepipes.html>`_.

    :stability: experimental
    '''

    def __init__(self, sid: typing.Optional[builtins.str] = None) -> None:
        '''(experimental) Statement provider for service `pipes <https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoneventbridgepipes.html>`_.

        :param sid: `SID <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_sid.html>`_ of the statement.

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__318c272cbfb540a2397387e424ac55f6f876fe0db94aacd45dec8d84cc189b07)
            check_type(argname="argument sid", value=sid, expected_type=type_hints["sid"])
        jsii.create(self.__class__, self, [sid])

    @jsii.member(jsii_name="onPipe")
    def on_pipe(
        self,
        name: builtins.str,
        account: typing.Optional[builtins.str] = None,
        region: typing.Optional[builtins.str] = None,
        partition: typing.Optional[builtins.str] = None,
    ) -> "Pipes":
        '''(experimental) Adds a resource of type pipe to the statement.

        https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes.html

        :param name: - Identifier for the name.
        :param account: - Account of the resource; defaults to empty string: all accounts.
        :param region: - Region of the resource; defaults to empty string: all regions.
        :param partition: - Partition of the AWS account [aws, aws-cn, aws-us-gov]; defaults to ``aws``, unless using the CDK, where the default is the current Stack's partition. Possible conditions: - .ifAwsResourceTag()

        :stability: experimental
        '''
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__b52079d8ae4c83657b6234fe8af54e7db83a4e6968a15e94e1c820849aee4442)
            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
            check_type(argname="argument account", value=account, expected_type=type_hints["account"])
            check_type(argname="argument region", value=region, expected_type=type_hints["region"])
            check_type(argname="argument partition", value=partition, expected_type=type_hints["partition"])
        return typing.cast("Pipes", jsii.invoke(self, "onPipe", [name, account, region, partition]))

    @jsii.member(jsii_name="toCreatePipe")
    def to_create_pipe(self) -> "Pipes":
        '''(experimental) Grants permission to create a pipe.

        Access Level: Write

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/eventbridge/latest/pipes-reference/API_CreatePipe.html

        :stability: experimental
        '''
        return typing.cast("Pipes", jsii.invoke(self, "toCreatePipe", []))

    @jsii.member(jsii_name="toDeletePipe")
    def to_delete_pipe(self) -> "Pipes":
        '''(experimental) Grants permission to delete a pipe.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/eventbridge/latest/pipes-reference/API_DeletePipe.html

        :stability: experimental
        '''
        return typing.cast("Pipes", jsii.invoke(self, "toDeletePipe", []))

    @jsii.member(jsii_name="toDescribePipe")
    def to_describe_pipe(self) -> "Pipes":
        '''(experimental) Grants permission to describe a pipe.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/eventbridge/latest/pipes-reference/API_DescribePipe.html

        :stability: experimental
        '''
        return typing.cast("Pipes", jsii.invoke(self, "toDescribePipe", []))

    @jsii.member(jsii_name="toListPipes")
    def to_list_pipes(self) -> "Pipes":
        '''(experimental) Grants permission to list all pipes in your account.

        Access Level: List

        https://docs.aws.amazon.com/eventbridge/latest/pipes-reference/API_ListPipes.html

        :stability: experimental
        '''
        return typing.cast("Pipes", jsii.invoke(self, "toListPipes", []))

    @jsii.member(jsii_name="toListTagsForResource")
    def to_list_tags_for_resource(self) -> "Pipes":
        '''(experimental) Grants permission to list the tags for a resource.

        Access Level: Read

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/eventbridge/latest/pipes-reference/API_ListTagsForResource.html

        :stability: experimental
        '''
        return typing.cast("Pipes", jsii.invoke(self, "toListTagsForResource", []))

    @jsii.member(jsii_name="toStartPipe")
    def to_start_pipe(self) -> "Pipes":
        '''(experimental) Grants permission to start a pipe.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/eventbridge/latest/pipes-reference/API_StartPipe.html

        :stability: experimental
        '''
        return typing.cast("Pipes", jsii.invoke(self, "toStartPipe", []))

    @jsii.member(jsii_name="toStopPipe")
    def to_stop_pipe(self) -> "Pipes":
        '''(experimental) Grants permission to stop a pipe.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        https://docs.aws.amazon.com/eventbridge/latest/pipes-reference/API_StopPipe.html

        :stability: experimental
        '''
        return typing.cast("Pipes", jsii.invoke(self, "toStopPipe", []))

    @jsii.member(jsii_name="toTagResource")
    def to_tag_resource(self) -> "Pipes":
        '''(experimental) Grants permission to add tags to a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsRequestTag()
        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eventbridge/latest/pipes-reference/API_TagResource.html

        :stability: experimental
        '''
        return typing.cast("Pipes", jsii.invoke(self, "toTagResource", []))

    @jsii.member(jsii_name="toUntagResource")
    def to_untag_resource(self) -> "Pipes":
        '''(experimental) Grants permission to remove tags from a resource.

        Access Level: Tagging

        Possible conditions:

        - .ifAwsResourceTag()
        - .ifAwsTagKeys()

        https://docs.aws.amazon.com/eventbridge/latest/pipes-reference/API_UntagResource.html

        :stability: experimental
        '''
        return typing.cast("Pipes", jsii.invoke(self, "toUntagResource", []))

    @jsii.member(jsii_name="toUpdatePipe")
    def to_update_pipe(self) -> "Pipes":
        '''(experimental) Grants permission to update a pipe.

        Access Level: Write

        Possible conditions:

        - .ifAwsResourceTag()

        Dependent actions:

        - iam:PassRole

        https://docs.aws.amazon.com/eventbridge/latest/pipes-reference/API_UpdatePipe.html

        :stability: experimental
        '''
        return typing.cast("Pipes", jsii.invoke(self, "toUpdatePipe", []))

    @builtins.property
    @jsii.member(jsii_name="accessLevelList")
    def _access_level_list(self) -> AccessLevelList:
        '''
        :stability: experimental
        '''
        return typing.cast(AccessLevelList, jsii.get(self, "accessLevelList"))

    @_access_level_list.setter
    def _access_level_list(self, value: AccessLevelList) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__3c617047a1bcab9601b03ee0ecc76159a589e7a306041b25148130538ebf9923)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "accessLevelList", value)

    @builtins.property
    @jsii.member(jsii_name="servicePrefix")
    def service_prefix(self) -> builtins.str:
        '''(experimental) Holds the prefix of the service actions, e.g. ``ec2``.

        :stability: experimental
        '''
        return typing.cast(builtins.str, jsii.get(self, "servicePrefix"))

    @service_prefix.setter
    def service_prefix(self, value: builtins.str) -> None:
        if __debug__:
            type_hints = typing.get_type_hints(_typecheckingstub__39589764549d0d14a7feefb567114936a4c6b1d21b4886775e3ef5c6ce0efdc1)
            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
        jsii.set(self, "servicePrefix", value)


__all__ = [
    "A2c",
    "A4b",
    "AccessAnalyzer",
    "AccessLevelList",
    "Account",
    "Acm",
    "AcmPca",
    "Activate",
    "Airflow",
    "All",
    "Amplify",
    "Amplifybackend",
    "Amplifyuibuilder",
    "Aoss",
    "Apigateway",
    "ApigatewayV2",
    "AppIntegrations",
    "Appconfig",
    "Appflow",
    "ApplicationAutoscaling",
    "ApplicationCostProfiler",
    "Applicationinsights",
    "Appmesh",
    "AppmeshPreview",
    "Apprunner",
    "Appstream",
    "Appsync",
    "Aps",
    "ArcZonalShift",
    "Arsenal",
    "Artifact",
    "Athena",
    "Auditmanager",
    "Autoscaling",
    "AutoscalingPlans",
    "AwsCloudControlApi",
    "AwsMarketplace",
    "AwsMarketplaceCatalog",
    "AwsMarketplaceDiscovery",
    "AwsMarketplaceEntitlementService",
    "AwsMarketplaceImageBuildingService",
    "AwsMarketplaceManagement",
    "AwsMarketplaceMeteringService",
    "AwsMarketplacePrivate",
    "AwsMarketplaceProcurementSystemsIntegration",
    "AwsMarketplaceSellerReporting",
    "AwsPortal",
    "Awsconnector",
    "Backup",
    "BackupGateway",
    "BackupStorage",
    "Batch",
    "Billing",
    "Billingconductor",
    "Braket",
    "Budgets",
    "Bugbust",
    "Cases",
    "Cassandra",
    "Ce",
    "Chatbot",
    "Chime",
    "Cleanrooms",
    "Cloud9",
    "Clouddirectory",
    "Cloudformation",
    "Cloudfront",
    "Cloudhsm",
    "Cloudsearch",
    "Cloudshell",
    "Cloudtrail",
    "CloudtrailData",
    "Cloudwatch",
    "Codeartifact",
    "Codebuild",
    "Codecatalyst",
    "Codecommit",
    "Codedeploy",
    "CodedeployCommandsSecure",
    "Codeguru",
    "CodeguruProfiler",
    "CodeguruReviewer",
    "CodeguruSecurity",
    "Codepipeline",
    "Codestar",
    "CodestarConnections",
    "CodestarNotifications",
    "Codewhisperer",
    "CognitoIdentity",
    "CognitoIdp",
    "CognitoSync",
    "Collection",
    "Comprehend",
    "Comprehendmedical",
    "ComputeOptimizer",
    "Conditions",
    "Config",
    "Connect",
    "ConnectCampaigns",
    "Consolidatedbilling",
    "Controltower",
    "Cur",
    "Databrew",
    "Dataexchange",
    "Datapipeline",
    "Datasync",
    "Datazone",
    "Datazonecontrol",
    "Dax",
    "Dbqms",
    "Deepcomposer",
    "Deeplens",
    "Deepracer",
    "Detective",
    "Devicefarm",
    "DevopsGuru",
    "Directconnect",
    "Discovery",
    "Dlm",
    "Dms",
    "DocdbElastic",
    "Drs",
    "Ds",
    "Dynamodb",
    "Ebs",
    "Ec2",
    "Ec2InstanceConnect",
    "Ec2messages",
    "Ecr",
    "EcrPublic",
    "Ecs",
    "Effect",
    "Eks",
    "ElasticInference",
    "Elasticache",
    "Elasticbeanstalk",
    "Elasticfilesystem",
    "Elasticloadbalancing",
    "ElasticloadbalancingV2",
    "Elasticmapreduce",
    "Elastictranscoder",
    "ElementalActivations",
    "ElementalAppliancesSoftware",
    "ElementalSupportCases",
    "ElementalSupportContent",
    "EmrContainers",
    "EmrServerless",
    "Es",
    "Events",
    "Evidently",
    "ExecuteApi",
    "Finspace",
    "FinspaceApi",
    "Firehose",
    "Fis",
    "Fms",
    "Forecast",
    "Frauddetector",
    "Freertos",
    "Freetier",
    "Fsx",
    "Gamelift",
    "Gamesparks",
    "Geo",
    "Glacier",
    "Globalaccelerator",
    "Glue",
    "Grafana",
    "Greengrass",
    "GreengrassV2",
    "Groundstation",
    "Groundtruthlabeling",
    "Guardduty",
    "Health",
    "Healthlake",
    "Honeycode",
    "Iam",
    "IdentitySync",
    "Identitystore",
    "IdentitystoreAuth",
    "Imagebuilder",
    "Importexport",
    "Inspector",
    "Inspector2",
    "Internetmonitor",
    "Invoicing",
    "Iot",
    "Iot1click",
    "IotDeviceTester",
    "Iotanalytics",
    "Iotdeviceadvisor",
    "Iotevents",
    "Iotfleethub",
    "Iotfleetwise",
    "Iotjobsdata",
    "Iotroborunner",
    "Iotsitewise",
    "Iottwinmaker",
    "Iotwireless",
    "Iq",
    "IqPermission",
    "Ivs",
    "Ivschat",
    "Kafka",
    "KafkaCluster",
    "Kafkaconnect",
    "Kendra",
    "KendraRanking",
    "Kinesis",
    "Kinesisanalytics",
    "KinesisanalyticsV2",
    "Kinesisvideo",
    "Kms",
    "Lakeformation",
    "Lambda",
    "Launchwizard",
    "Lex",
    "LexV2",
    "LicenseManager",
    "LicenseManagerLinuxSubscriptions",
    "LicenseManagerUserSubscriptions",
    "Lightsail",
    "Logs",
    "Lookoutequipment",
    "Lookoutmetrics",
    "Lookoutvision",
    "M2",
    "Machinelearning",
    "Macie2",
    "Managedblockchain",
    "Marketplacecommerceanalytics",
    "Mechanicalturk",
    "Mediaconnect",
    "Mediaconvert",
    "Mediaimport",
    "Medialive",
    "Mediapackage",
    "MediapackageVod",
    "Mediastore",
    "Mediatailor",
    "Memorydb",
    "Mgh",
    "Mgn",
    "MigrationhubOrchestrator",
    "MigrationhubStrategy",
    "Mobileanalytics",
    "Mobilehub",
    "Mobiletargeting",
    "Monitron",
    "Mq",
    "NeptuneDb",
    "NetworkFirewall",
    "Networkmanager",
    "Nimble",
    "Oam",
    "Omics",
    "Operator",
    "Opsworks",
    "OpsworksCm",
    "Organizations",
    "Outposts",
    "Panorama",
    "Payments",
    "Personalize",
    "Pi",
    "Pipes",
    "PolicyStatement",
    "PolicyStatementBase",
    "PolicyStatementWithActions",
    "PolicyStatementWithCondition",
    "PolicyStatementWithEffect",
    "PolicyStatementWithPrincipal",
    "PolicyStatementWithResources",
    "Polly",
    "Pricing",
    "Principals",
    "PrivateNetworks",
    "Profile",
    "Proton",
    "PurchaseOrders",
    "Qldb",
    "Quicksight",
    "Ram",
    "Rbin",
    "Rds",
    "RdsData",
    "RdsDb",
    "Redshift",
    "RedshiftData",
    "RedshiftServerless",
    "RefactorSpaces",
    "Rekognition",
    "Resiliencehub",
    "ResourceExplorer",
    "ResourceExplorer2",
    "ResourceGroups",
    "ResourceTypes",
    "Rhelkb",
    "Robomaker",
    "Rolesanywhere",
    "Route53",
    "Route53RecoveryCluster",
    "Route53RecoveryControlConfig",
    "Route53RecoveryReadiness",
    "Route53domains",
    "Route53resolver",
    "Rum",
    "S3",
    "S3ObjectLambda",
    "S3Outposts",
    "Sagemaker",
    "SagemakerGeospatial",
    "SagemakerGroundtruthSynthetic",
    "Savingsplans",
    "Scheduler",
    "Schemas",
    "Scn",
    "Sdb",
    "Secretsmanager",
    "Securityhub",
    "Securitylake",
    "Serverlessrepo",
    "Servicecatalog",
    "Servicediscovery",
    "Serviceextract",
    "Servicequotas",
    "Ses",
    "SesPinpoint",
    "SesV2",
    "Shield",
    "Signer",
    "Simspaceweaver",
    "Sms",
    "SmsVoice",
    "SmsVoiceV2",
    "SnowDeviceManagement",
    "Snowball",
    "Sns",
    "Sqlworkbench",
    "Sqs",
    "Ssm",
    "SsmContacts",
    "SsmGuiconnect",
    "SsmIncidents",
    "SsmSap",
    "Ssmmessages",
    "Sso",
    "SsoDirectory",
    "States",
    "Storagegateway",
    "Sts",
    "Sumerian",
    "Support",
    "Supportapp",
    "Supportplans",
    "Sustainability",
    "Swf",
    "Synthetics",
    "Tag",
    "Tax",
    "Textract",
    "Timestream",
    "Tiros",
    "Tnb",
    "Transcribe",
    "Transfer",
    "Translate",
    "Trustedadvisor",
    "VendorInsights",
    "Voiceid",
    "VpcLattice",
    "VpcLatticeSvcs",
    "Waf",
    "WafRegional",
    "Wafv2",
    "Wam",
    "Wellarchitected",
    "Wickr",
    "Wisdom",
    "Workdocs",
    "Worklink",
    "Workmail",
    "Workmailmessageflow",
    "Workspaces",
    "WorkspacesWeb",
    "Xray",
]

publication.publish()

def _typecheckingstub__72d37775c42581cdbb670fd68b7157d8318000dbfa4394e5d115eb6834d7e5e1(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4142de54e87055936d594b8dbdb0981ee88ec5912bbdb2b62595d24464705d6d(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__182d7f96c5a7e153de558514fc854a34b0fa0ab607426a14d00e60bc309ed64e(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e2b547f6cec706e0492b2d84c3e2a59b5c7e6e266c223abca5022d896b6d45ab(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f869ce9e35996c3eab103799b2e032789f86ae7f0fca53de5044fbbbdc995c36(
    key: builtins.str,
    value: typing.Any,
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__92877fa5ca833dff290c39fc6287324425022283060b299d280fe90639ea08b7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eaf39c85f2af81b764537224bdc27b53b6b7eb05ee0c6a2d7816d86eba47e18c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d7fe33c2e7fb3c3fd22d15722d5ce596f6b2601c1d5e002406a7a6a09c40b6ce(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ad874f1f9d0783c902570b6b453a20a6db9c31a395ef6c6f602e3671ca279fc6(
    value: typing.Union[builtins.str, datetime.datetime, typing.Sequence[typing.Union[builtins.str, datetime.datetime]]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5c1b196a8276597333f3988ce4e427ad5be20653b2baa16471d14e4117d62246(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__955c28b57ca7ce2f0777e4401b0547ec990400a9943ec8e635100f3d95a4762b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6df58998c25fe88b23c9591832eb9bf231dd2e9c2941198bdbc8a1be5d6fb8cd(
    value: typing.Union[builtins.str, jsii.Number, datetime.datetime, typing.Sequence[typing.Union[builtins.str, jsii.Number, datetime.datetime]]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e209c2c156a1a6c358acb461233a213d29e75eb3af157421fb2181b478664075(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__04a0c7ee05c314ea9c0e46853f4c0ff61b41601c4a8ca24f9d6593c4a0625359(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__91973e1fda06329f6c5c65a85fe4fa1c18c2cceef60940a73c75748aa7037e9a(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1cb0683c53cc71b6f4ba8cf3556245efa880c21db413846110499f17878d04a7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1c886ae886d3725fae853f688db984847230ab912e415988123b0afbf06017e7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2e4cb513803791882cb775de121cc7542289b474eaa4b1d45b41e6e85f7046cf(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a14ef324ec25bb000cc61c92f34edff4fa6e68e248fcad3fc600bf916f69ec7c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__951bfd260e8386e5e0f7fc828f074a10c32515575fcaa11ceaedd6b989a9be45(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b6188068715614948a82ee9db6a69e469e37780b6028885ef8302dda0e0d2079(
    value: builtins.str,
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ac8258373923b2923766e5c412c7cf0643549db886d63ef9c4e9ecccf0b31fdb(
    value: typing.Sequence[builtins.str],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__67808cdafa295eb10f078c24f43054eba2f5cabab0a5cd0cd089ce976f16a405(
    key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d2f1f303a488b7caa7d1592314e1b5af8f4ec07ea31fa0ede2bbdd3f079c4309(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5c814044424dc09802ab8a20e1b196186835511c3f7689b71cd873c3a79900b2(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fa825264744a110a82c5dc1c66b258a8e9133ce01b5d7aec53ad0f8ade6d5afc(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d5b81ad2b642de83d2311aca2dc2036d8e29d647786967a04cc3a20217b68e46(
    key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0a84b9e9c46e7a92d6c814fa1b7df61a241c2c7c4f6b7823d1e0dc8727ea6336(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fab7795ff9d0f347f79a69e670065fc55595fad2b3a21f68c357daa237c79a3d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0d2164d86c743d4a898e7b372ce9b0f6627f5d715883f8140947f2740d52975e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__141746fd17b652e11b2c73b6317d24ae7d324a9901b14fce43386d64f7707c54(
    key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f55d5a2e4666b33d273577cd0f5db4493133bf556a3d9ec173cf432b664a5548(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4eaa633410511f81090082df61a822592a05855c120fc21292c8380c73fa7f74(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bacc036d62f9cef7c873de6b00f5215910e3ff72382d19d601eb6f2b5dced128(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d407ee32015418e0e247b4105dd5ace34e3c830908739f643df3ee9b2c195f92(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9584d23ab9608164ec626e741c1effc7ee2eeb752ddba7ce565b34199c49a376(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__26040638818240caee8d929c92f7c94c436e1cfd2db5e6b5b64c61576b83b659(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5ef8327bfdcd66662814c5334ae63d21ea2df82a97692d188933d79f329866dc(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d95392644fec828e1cc941d232f83bca7047bcc3a3e82f3b058a536fa86bea41(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__738df271406b1f2b35a9978194656f9d48da9cfb1b44b4fbac3c7985d68d1ae3(
    value: typing.Union[builtins.str, datetime.datetime],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c548a90e633ac0af4601910e9ce787666ca4c1afdaf5f2e05ea43f9ea29e52ce(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c14032c0deddabeedd95074b4df64be980f756f8704ad5d7a9ef7c5693d63770(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c497c2604db3b035f77d501996f9a0c8fb1fda191d301b88edb120660946a71c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b9fde46ecc3d76d3a2a749d75929e8fbdea476b903151216fbf3266d74965ae4(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a55d20a092f3bb4be0e35fb8b65bdd768ff283f7f34a741a09bd277e1d8bbf83(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__abaef68aa342dc89c1ebbb4ffb5fc88ebbc118aadb78f2db4f0d1b8aa84ec536(
    value: Conditions,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__093d23988cc4ea975381aa62cf894828b269ca1dec2f78c8f11bd47a174fc179(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0e661ada3b2bce9f47803c1fedb5fd7f294305c15395106cc09b9f2879946aa8(
    *expressions: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4bb088cb4d336ef7471f543ab978ff56b4dec26240ac0d6855c79f8304213e6e(
    action: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__70bc750a316df6c18f2ef1b9639d5bee3924253038f53441ec16e0ad872ccb57(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__88771298f7f17a0d0acdf694dbed722afd6140718bc02cc6ef2e154b60feb663(
    value: typing.List[builtins.str],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__71418682b5c967665f77f3b181e1c66f722c341d76aa545c6ce78362360697e7(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__289ffa51b0659b40c0a36d5a3eefc470307d1fe178d5dc6f89cc3e0aa6ff72ae(
    *arns: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4e34071d28c632daa6cd6a4c16a335070f5fc62110d1e3324fe697a18d76aea8(
    value: typing.List[builtins.str],
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__845a5aa0ae395783f65395d684d175028e27e3a75b802ca3d9db219d736109cc(
    value: builtins.bool,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4465fee9053bdfe4b149fdc083264e021432dc42d93a3959546cd8bd1e0aa16b(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__94441803d0dbeb3dfea7eae55172786aa200b4c86b577219f659c77e12785cb1(
    value: Effect,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1a3cff3121729641292e305bd0d07adb5b3b38720476d80db35c4e1fd9b9ff8f(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0f43da71badcc29a12f8a9ee1b7f26b46fbfaf282916e4d10bc0ba7099d9d9f1(
    prefix: builtins.str,
    principal: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c6aa5866d7483abcba1edab3f1753719c023644bddc35894c623579a08b9f6e7(
    arn: builtins.str,
    prefix: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__11f7611db3676293bae1562dfb78f937406ef384ea68773e9070c46deed9cb55(
    *accounts: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5177533b9df3edb2f58583f5b3da6024a5d7ff4e650d527ef4b6e9813bf399bf(
    account: builtins.str,
    role_name: builtins.str,
    *session_names: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__46f209a44ea976f720f05020848956383e7c02a0ee28eaec9e6f0e26a4ef11f9(
    *user_i_ds: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a398adb2e076db82229943e33f593b9571a89fceddadbe48258788e64c88fcd5(
    *providers: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__52b4d0ac664eb61a852b4dcc26d9023f222abe7307e0f1a3983eaf871d2b05b0(
    account: builtins.str,
    *roles: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__98209c9cd4748c3e32123aa1c26a1a628553387024bb9eafd66c7e9be61ab55d(
    account: builtins.str,
    *provider_names: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e17956887090b4bfb55fcf8ddc8caa37832e121a7a2f06ee5d1b50ef2c2727dc(
    *services: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fbbd754f3c05dc4e15cc9c7b3a99afcc314e434bf8c8ac4ea9d016c03509ff4f(
    account: builtins.str,
    *users: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__975d6c3b1ffe9cc28a898caebcec4a48a6e0205dceb7df1b9dbcafaa4caa92cd(
    value: Principals,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0446e0f0791a09b6cb0e75e4afb14085c1f32aeca22b06564a6641a25a8dc48d(
    value: builtins.bool,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__41bafffffee539105d25c03dc13e5d345febb0f4eaf59cb4132893d8763157dd(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d71f9438f8164fef39daa58b6e821bdef745c5794c99f571912c94dc5bcd942c(
    value: builtins.bool,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__20b69a7493c8c6f609b89c4f159face2081504633fc70f61dc30c6914495f2e3(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bb7da2da458aba491da64d937f36a87bc1fb4f6a35eaa814d665a979902753b8(
    lexicon_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__85dbfdae27012d6f5e7725efc8a274ee01ee8d1ddd42dce7175ad9e040c16966(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fffd147f444775c264f07ca6ebb9b8f1b02ce6d6a595c539c3238891ee1331e5(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4b0c9aff2ca48a23be2ef2fd56f4d823682698da291a78d4b6ca70417046ebc7(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0b410851fc6dd6a5be90a3ac3510040d03363efac4412a16e2e752db488cb584(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e8ff737b4ab33bfbf661818c732a7d9cbf2cb904f9847356e442ec135f7d87b3(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__baccef44bf8dc7cfae1350b6d0c0287848d486387725dc69566dec5f0b83f6b4(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8f673f1ba37433ce3f65d2654ff2f7b57c850769ba348dec778eac9ee88186ef(
    network_name: builtins.str,
    device_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__84b89780d71ba72dda333b6deab64b907536a908a1747f1112328e99b0c0bbe6(
    network_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a54334d8aec7668ec473d7c5169485e82ee39df5603b53f1de0d16335f37b564(
    network_name: builtins.str,
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__24ba70bd44af487912a7feff466b6ae9ad6684a8c546affb2fb209624f99fbfe(
    network_name: builtins.str,
    network_site_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6da6913535d67ef2f293d2eaba8b7efd8679f083be4ef8d8032265248ea4cedc(
    network_name: builtins.str,
    order_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__51df11bf202a2eee7fc67df36023d6fec84f878797572f5a3687675805b602ee(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__23b8ddb356e5af6dd5785e81edd3fb367d3d23eef111c041864bc6bff20a2768(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__487679b6cc1ef2e8d7475001dd028d2e87e64dda04781923c0d0594192d77c75(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0f847af9cf62aab87723898d2ae7a030051b64579aa7456e9e0b1ee46a249d74(
    domain_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fe14e7266240222e4a843b36bd6b1d1973b9a57a6c3f2aa6a7f331c146ba78fc(
    domain_name: builtins.str,
    uri: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__410a2d4b5bed7d238a65b0afb4ac2f5dd673a14a55ccd7860caac9876e04686f(
    domain_name: builtins.str,
    object_type_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8de96bf088ad2cdd56f1d21c7157755e743c135fafdecd7aacd5c6c4ab78d343(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dc376c9fb3f9712d79afc10768d730afc00a2a6d3cd6be4bbe6ac08b057cc4ae(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__da733e70a4a0a10536c0f8047bd23dd6ae98ac9a0f27e8feb682fb24558e2a0b(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__be7736f36cca90930baf87c7d52e2937052928cfd1aa3ec51e99441f5b6d7c04(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8eefc3c2db58084a8f6f8f4ee64cba3860fbb63fc0612d037dea70b83946c28e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d3d44f3d30515fe9165f4974d8304863fac8510b653e5d02610f03073a30d7ef(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4aca36f626e2a0310264fb01cd6ecc3758715d2bec0aeaf8362f645b2496ad9c(
    name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e2b54ea363fde1814fd37da12b5325dea3e41c9c9f248f2197d189a80660d0ab(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6e8d551f8b2c9bff21b9d394e36754a6898ed64a862c1bc84da16cd6d9d5f868(
    name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__23fa43f9708b3e612ec1f30219519aebd3ee321715f4631d31b24611266c637c(
    template_name: builtins.str,
    major_version_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__59ed0642dae84025ce09bfab1cf8669defd3fec2740c76f11bd318d51cfe7b1a(
    template_name: builtins.str,
    major_version_id: builtins.str,
    minor_version_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1d15bd90109b94b8ddf415397f12086a685ff4845eea4b7d355128dfa510f5cd(
    template_name: builtins.str,
    major_version: builtins.str,
    minor_version: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6a01052690b69d7777122b583d9650c9eb73318c833608f3f871d769a5183ae4(
    provider: builtins.str,
    name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f540a5856197c1ceb5e96b1b44d34e89510fb2046fe54673f4718d8806af0eff(
    name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__79a3763da14e4bfef0603fd97233cd4cfebc2ef539a026bdf42cb21472605a00(
    service_name: builtins.str,
    name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__622a876e53d64a2a42e103a62ec303c762bd726ed0d2c788e582eb1708e37171(
    name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cff747f8581e3b066f0bd127cdea7af3c22729d5c75422f663a27d6f0ba5d67e(
    template_name: builtins.str,
    major_version_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__681bc8434a298a5aa7662ed6fdcececc138710a293a5b06c0098cf1d93ac2b1a(
    template_name: builtins.str,
    major_version_id: builtins.str,
    minor_version_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e70a3757f3f0596fde80409352bea07e6c40e5499bd4dc96408e1a5a2ffe102f(
    template_name: builtins.str,
    major_version: builtins.str,
    minor_version: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f640ecdb5a51cacdd64ff56687850fc6fb4a2390a917406f55453b87d395d090(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bcd3df32ca3a946e1603394b45c7ad1d717cbf82473fe01a857965284ade29ce(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0be9de5f32d9ffa6b31d1f77ba93ceef5666584191a68a546dc47752ba3fb6c7(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__820ae5d0e7afedf303efefe6fa87fe4ff1578cc365cb567a547b6ecf2e5bce32(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2ef08f6d6514106f1f4df3b52180fb0751d57b3ab5f00ae3c043006ecf963ed8(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__814f945d7e09888078e8031f9d9ec9fdebef7f7cc351eceeca8611a5cd8d6e2d(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e4d6bbc88bcdb9f63fa218d2779e0daae3841f1e693cce053f8c295b00fd0427(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4d8426a9e7421554baff0b52f4ece371e5b61d013593b1993c5f6a88ed62f090(
    ledger_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__33e79725ffe0458181c113282c1c7506a163d022a78447ca77529ca62d8328b8(
    ledger_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__57a800b9336b69e72193b2c799165ace48f65639a98f658c84a7b5246e77c654(
    ledger_name: builtins.str,
    stream_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c0882066580677062a821f19917c77490b17b2470d4e6d6c7e77a838722e68e5(
    ledger_name: builtins.str,
    table_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2542c05856d7cab183f67aaa4cdba31400df231c40113801ff8f1a8c8fa81d61(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1648f958f666f37705c42f7516d337838532216c59187bf22c4f3e65e5d062c0(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f5b650ee63a5a86471675c8c85811a9081ed1f8d431fc90dbb6ea5a37a2ba19d(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e15105889e506399c9bbe41b803f9cbef3a84046090a7feb6250b966c7ea92b3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__df6e6f7e00e6c782d9c80586e2aada3759860d7bd9efd24ec1ff5e0722f71ce3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3d845619e5eda7075dfa0d6180e3d0a262030973594315dbe2d5586bf71a5a09(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bd83b0771cfc687fd08724f78bfc7fce98802655ac3e8366cce9a9bb6dbc2ac3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9b2d28e4b1f23675081bf1c15d8d4dee5f7881a8351525a7e15d7b9632fd9867(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__36fa1b7d2b6d2e4f0eb3c5a3b41032f07e464577e43fd9de36de4782f94cbf7a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2ed20da5bd6f5048349cdeba0ee2a805fe4f0b7b0bae587c99163ece17aec1fd(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__99f18bd5a0a6b5644fc86ff73898cb2e1893f3659b4030f911cdb25c26ab5e64(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__49f52a58b130f567653510c488ecd96a3aa745753ad7dc4bea011ad17277bf5c(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f4cea98dbac9c8bf0ae15b4737838378b4205707b055adc10306a63a784f4a69(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__45a4e615ba763e8a5455f534204870042cbaf63a33d5ea561b41f83bcf4bf55b(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ae931c1971aae55fe2fae041e61e99df03771921e3caab81837bd94ce887b5f6(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d815bffbc64a29c3f2939ef4b083faf8ed3377aad9d1e5e904c4247102f5eead(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__56efff9ad5c3f6968b62b86b6649ae93fe0beae022e0e03c54b08fcb942bb05a(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__21c800e5a0e79a750edc3389e68a2d0eac0161fd6758eb56dba737ac271b06ef(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8c72ea51c73a16409c0d85e2ac2ed686786f6705b78070222d45e87d36188bbf(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__43507e3343149fcf266bd3b3de5ad21d61627af515abc1284352bdfde46c83ad(
    dataset_id: builtins.str,
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c713d95abbd94adafc30660c77bdeaa49cfbb588b9d5d03bcbac0540726d136a(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__422c86e0ed9c63ba4ee8a0dbad096f76d468838e5f3adcc524f9983647cee91f(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d782750e2b0cce99f646a9d623bb35d11a88b7a5826c1fc3e8c5d007626001a8(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eea4b4d48d8d4685deeca3d13ccbf5573b6ff8b6c2ab9f8cf3fa752e1654ea70(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f07f23e73ff9250c5ccc08fbb302b1145d0cfbab439a3f621bbc0c07cdd53db9(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5c9b76a2f9c030a872af251f3975fa13d7a54e3775d1103db2f8fac2dc687f62(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__98cbb69d70a258c1ec4720497c6f44b6b547d0a9611ddd416e8171da124f3633(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3822d1b4cc4a9f83f686273ef60a69c1983dc0422ac7028bb074e4b327ea5f4b(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__edc29dc6472e888320b0f91ea51686478fd8c997393e73e2bc0c0f049bf5f8c2(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d4b5740df16a20cce153a878124a1effc6abfc10ed78b3f9070e3ba63c655aa6(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__08beefe5aeaf1a60b6b87b30aae9fa69bde0e974fa06710ce7afd1376846e5d7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c55db46eb4ef21c0d822f1502de918da1c09d752828c2ac48d53d9b3ebeb44d9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3e1394f3939b98d541ae36ba308ecfbfd65a8c6ef02611f321b89d27b6dfc6bf(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__30a9f30e15645205eb4130141d3304d032a65faa7d2f975853b16a8f67f8f3c4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__19ef0498863dae5ce81fa07a03dc63f4ce88383f2b8477e6b60b2540f899ec08(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__29de824846fd33a5fcbb51fa4fa317df22e60bbd07c8c276e6667b237f708c8b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5e66a5957ef77079a9549af022fa1a1721146af39fbe75fd03da9f252cd8dfe1(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ae8f56f25edb2679a6332dd9d802fb0a889002377848344754308333e80e8f63(
    resource_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eab14802bb8bb4a68566c7a4f08f47e6518e5e3bb4ce0559c9be70a422a45747(
    resource_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ff49915dd987b331ad3209995f07e5fba49eba6e7cc1523a27ef44f2b545799e(
    resource_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b06a45f23f47775400812762f9a90aa7813270ebf83cea2fa4df4448b1919493(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eaf46aa0b566aac65efa2222d41af08a2888aaa9c384ac7f491926180d02314f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1486f9cc41f1f5bff928a4d3df8168339ac3ca60bc62b962d034e27ab9fcbf35(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5d42b9dc9e2b4471c2e3c2f3bbd6aa9d38fbd975bbeae0669800fe7005ddd1ba(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3dc90fde4b73e7da33177c3f72d7ccf8240f226c31750ab626b76607a585dc57(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ee598b2dd198e3f75f23fe52aa36876c48aef8bb26ef018047a30c117ffd1e90(
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8086a2dc6ceb80228d6e78481fa70541388de317a80d3cf8552f0d0f029b8f54(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4b1c354f50488609029035641f684c68550703113af13465c3999d2eb5642fb0(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7636c7610b67a46cc205ee185ac20840292e31ea7e1f6ae1438a1302d18cb8d3(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3ab3000f6eeae99280359a85ca8bd42b1ad99f906b46c6bf65c163fda195b311(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a253608cf4e7826cd7af909fbf9334f347e3bd2a27fba6408e058d46395a7a4a(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__937e42469632c2901d47608bd47a36b34debef19c6936aff4d95b44fc0c6b5da(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__425e6e8696b48a751150a3b1781d9a56909cc9cc11c816c6ff802846b3f6bbb4(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0b41bb04381e5c500622c998047ed3581ed1fbea242f242ed630ae0f47de3e0e(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__904e44a881682bf5233765b57dc3bd91ccc72318dbb3d9899f14abb79da2098d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b37d8177ecc1aee46e9c20a608d7256d803a462d9d7cf48e6fa268438a70acda(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0b5db3d253745c3e30570a1cf00b3aab26c70a7f9cb500ffbb655072c4c00f28(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8a8e31a6f7b197aff8ff896883985b2832087b1fce226fa794e77d3a0fea2d65(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9df5f72cb1251a39e75f0b838a038bd4ef9569c090b5f31612ebc3e20d5f1cd2(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__834b80e9fd553b9c58ea4a872e2bfe4f0736a2af8cdfb672d00c248b13f00700(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cbc12ce971413a37a4d8a3345d7c73181168073c6c86c261b5ce4f508443faf1(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b6cc6588260d4ca9cb732759e1f68c4410431abfa06651c0972ba93ab6a3e7f7(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__57fe25efc8106d3ea75bc7ddb7f9de9c4804a87c3c19ae247bd4f633a327beef(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5986517914b9b386eca46770322bea7d5dc3e42e74a965138d6a43c91be2946a(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e58c252f84180070489f38e64dddb5a20b90dbe392bd768dfeb3a7707e48f4b6(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a2012c53b46afa2e72f7e694b30d7bdece323525e0d3c8b218786c0917954cb2(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__71890cb61a5e334ed6bf74806e7ddcb37e2f5f7e37ad8d08c5747dd4d624c98c(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e17ebdc6f35db16ebfc7eed058d426dbc7de6a8f9d27b9c4bba63c57ce0d8d3e(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e27a364cfd3d6812b5b06b70776d8309c1996eac904fd26f8bf094bbf247094c(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9726eab763c238f6cacc47eb2c4a1a46406e2a14ae3c9368dc62209237996acc(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__63fa097f46dfa3accfdff9650adc3bb2d1b49070682a837a1cb0e12751835db4(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__59401e703abd303033d7148588e2719653eb05d0a46c7afcfc488455ae17e8cb(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__47aaceaf6b257109bb64b9730a4f7f17f898b59ff7509356ee20291725502e31(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b447f32cb32f12a93e6ebde89bb22b0a66aa2c660135d307398b237e38d50f00(
    engine: builtins.str,
    engine_version: builtins.str,
    custom_db_engine_version_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2c753bc15111843fb9b839d1bd2fbf23d7a123dcb3bdca2b6f4e279afa3413bb(
    db_cluster_instance_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c7eb63d7b4f879cce6ccfd80f14c782c5b4e34b6ed6bf1302d0cbc5201c0a576(
    db_cluster_endpoint: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6c490c31dbd2447d92402c8cc914e72d00c424f4dff8901e6deaa949ac8b7619(
    cluster_parameter_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3bdbfdebf219e9af1a9e85e694a0978c89567ec24afe5ef4da8a11204f0cb67b(
    cluster_snapshot_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__213e2c6d9767fc433dc45f567123efa6604cf2d4f3ddf0f68f79ab67c81831ec(
    db_instance_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b4f600006871a45c1710df72018aa2a7ce6de4236038ed5a0aad56dc5dae66d1(
    blue_green_deployment_identifier: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__928e08473a4dfef632b767dba0b0a082d709f04be264ffba9fedbdd8ccf25c6e(
    subscription_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2ec5c5704d4354b0589c96caa43a9d47d06cfccf9f761bca5e020349f566b242(
    global_cluster: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ed21f825311c0a8ce6bf6268b65a9446b2776c0f3fb31b168795a39b84819c2e(
    option_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a66cb7ea4b02f26afedf51b2b874f87124a738f9bb7f37b30a9dc16350dd55a4(
    parameter_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a1850b338bc995d7428d75bb87174606e3c8c21b93a2f9ed44e835d9b052b13d(
    db_proxy_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cbf4dc2b6c68613fbe9ce82be99733ec0f5d942bd17598481feac10a5e381682(
    db_proxy_endpoint_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__83095a235a94abc5648818ab6be50465e4c217ea25341e144abbf3f26c083b24(
    reserved_db_instance_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4028da83b0fdae72dddcefdbfc7359ec51a10ab4acee564644d9bff225f556d1(
    security_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dcd3e75bf0e014b5cc6a5205895bcdac55582d929429f8b124c82c76fa78f1fc(
    snapshot_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__012c3416c0096070e9f64b29a9a8eb3e144ae9ea20ffda6c73de184c603eeab3(
    subnet_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__18861f76cbeaed7bb9265ca79387e115937170477acea58a1d312387ee4c25a2(
    target_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c312ff6b8109c43614d52baeaffa0d7152ddb1fea80a9860a6414d07b2c0791a(
    target_group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__46400253108e0da2702ceb4549475c5e628f0684a21b5e4a1bb321dc064b099f(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__da0da3c0f59be85e2bdbdb75a293978f7792a12a9099e3632c47ec89f3e3d929(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7adc06ab1947d33dc5128d3c0a38b99b455b354afaee4f044205dd8fdb794ef6(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0fc03183d7a01221a12dca10aee0925e8bc5d89f8782608447d74cda602f0473(
    db_cluster_instance_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9661ab517242cb588d73541bf3d54dc9aeeb15df5fb59035ae0d456285c2254a(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bdce333773fc1bbcf36a883a074fd7447dd14c1cea8a595de208ac27278e83bf(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0df314513029c9e2715b49f9200ccdc31543e7a04e6117a1652629eee98f7174(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2bdcd98a53068976e2a153493580bbd366d565d95273bb83207d72491fafab95(
    dbi_resource_id: builtins.str,
    db_user_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5d58a25c6aa1e84f256c8f4898207f5435522fa03337731c7833a7c9d7f9cdc9(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__88f8483a30f023533dd46da4dd7706d7ffdc930aeafd08703739225c5fc3f2ed(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e1cc19c9b003a0b272b79f64842a1f81e627c04b29e6d7a9fc184cfb03b8b10a(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__41c04dbc164f31012c86f4ee582c1b2e590c7c4e18666120276686c616865701(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__476fa7ab9eebe86e6cef1dcbd1461fdfc7b62b28e3ce9352f23d489aaf202848(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__711b45d0742b8200d43850142f31107832286ba400dd833bba2186c8d5288305(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__43403c3b5d60689b406e21a5e8bfff89fc114fec1b57041fc89d1d36963d4253(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__94302136f3d371ba25685d0edda7bf08685210a0476a0b02780a5762394b821a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9ceeaadd289f00bbc22c986c40d4531961652e8d45a44ded453551c5ab20526e(
    cluster_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d790593b5b3023f1f8c3492136fee821a2b1cd656d596d264b34066c93c1befc(
    producer_cluster_namespace: builtins.str,
    data_share_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c370d4e128063c9475605cc3141fe7b11524bd1cf50fd9e7c15371b2cec41615(
    cluster_name: builtins.str,
    db_group: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0b3dbfce38d1e659e6b1cce333d78e105df3c5faf6565daae5cc47a675e4bd2e(
    cluster_name: builtins.str,
    db_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7b0205a0b47edaa3c331c99d54621ff8a52fe906b63dde393e4078864478527c(
    cluster_name: builtins.str,
    db_user: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b81035e540eccfd8aee1f87cab5b3bbc2acb8673007063bc20ec822203b28aca(
    event_subscription_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ee50a592616498a2ae9a6faa57c4d08aa649e4a4d159009fb4c1af9485b90310(
    h_sm_client_certificate_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__78557a6bb0333245df392c4a27b21631f069ab5cfd03e55ad3cd7fe1ac14154e(
    h_sm_configuration_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9d836326f1e8f3665341fcc0ce277e4e0ed5a0b4625cb5f0a0940a74982fd023(
    producer_cluster_namespace: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__101ed9c9e36db19cdb50838d12b97d3563696d31da123d7fb159bf898e05ec02(
    parameter_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8effb3eaa5357dbfe09cd91c30376108ac9b9e4bcfeeee94fc3163ab21db8d27(
    security_group_name: builtins.str,
    owner: builtins.str,
    ec2_security_group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__84c8c7bd11b405684f7ad931ef45129c77d20fbf31b8aa5ce3921c09b9c5286e(
    security_group_name: builtins.str,
    ip_range: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0b618ab42d0d9a88510de49e689b1c202bfdb75db1098c20b2dc789643b8a3d5(
    security_group_name: builtins.str,
    owner: builtins.str,
    ece2_securitygroup_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__414e2e19ccebac929c6aa3a1df94e77ee9d6b063ecdf41641f8bb33db71b70f7(
    cluster_name: builtins.str,
    snapshot_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7a129f339e2b37776d1fda57911e63e9e58c28d0971a0fffa2caf473df3cd664(
    snapshot_copy_grant_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1c119fad2680520883b0f0ac155d029855b57d09a2f081a44a8a53f78943a1ae(
    parameter_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6e3db32d050245bf6b3c90fdd03eb1fba9e10f3d29b6e10146c148eb1007b4e5(
    subnet_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__de105e3fd0a7848a2368922330ac5e9d41bf787fad6a4007a16534a47c23865b(
    usage_limit_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f28f29ae8a037b92bd049cdee3c5cd137092e09fa0230257c152d1dace685ffd(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__14bf5f7ce9fe4589eff2d5505245262db2b74d365314703627e896bf9de9425f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__01b16e1aca1d430dedca398915fdc46c452e5f2df3aee33b8f2a471717e77451(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7d1679a6c1112c48116e86fa276c3a1db260456ce8edc7159102f2afb09c79e7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__be4162736a3b1a9bf2c47ed5dd4368eaa722b36b3db3ea39fb80de60797e73a3(
    cluster_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8f84f4115084e2ae53830236725c2326c31c27cc0974541ed0578e8da318204e(
    workgroup_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f9d15f7aade048017622f7527799fb04a5f54aab6e3b7bd139e6143c48dacc77(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__935dd7c7e3a5e47476c5e77af1619cce090bdb8e986d90407cc0a16422d815a3(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__358d961e21363adae8e7ac62c80a5e5dc217d1cdf5ce6de73c56608f9b29e8d4(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6e249add0d94f77948c435215528bb54484ae9dddb942ad7a7c7fc26b9ef5d70(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c2ecacc5770ad5883f6867cd7b11a0c137ae610ed86cd391bb17cd9140b757a2(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4dc7132ac640f8b7abd41dffc0f8ee008f54e96ad2541dc9935ba9c6d677eca5(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a35910cdccc6cd2505fade1e6ad491cfcc7d93f4c74ae7e83219905356d5ffa3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bef6db18470b302c2135b22fa7cea094358d37abbdc5324f9a8c19804a4c61bb(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__71923bd8aa91daae263c79838ecef22b1748117b16a405ef52d1e98611a535d0(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b6968ae9337e326b390d442d64826cd6730ab56e167f836afd10d1108559e6d1(
    endpoint_access_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7316156c1851a8eef0272cc210af8697e5fafe5d69c24e10c388f2315c9be0c5(
    namespace_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__df8227b107b02b1c522285372025625294fc13f5d95efc8ed75eeaeca115b3ea(
    recovery_point_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__01e05d2a84e7e3ee734299af05dd2cd93c09b99cb76af5fd6b12881d60f876d2(
    snapshot_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c4e5ea105e06d8ac92c73745854dcf1923aafe0381335fcea406493e7fbecdf7(
    workgroup_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1deb17852c187880950221bdbc2ea522bc5bc2072fc42d3c821251d061deb0b9(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__74b8a5e5de499a48ba8d14ac46c69f651cc4dfb17203471407fad252e777c12b(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__854a934cfdb73247f8e90f506eaf5fb5ec41bfe9f253da0fdd941a3255e2ff1a(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b4532fbacba325b4e9dc78e0638f285e4e40ea0221da61b65e239c13053e277f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e03ed697099ac70d72bb4bfd65e17c45f99ae4ad43d1b213d2911a79cc73c3dc(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__69770b64be2ace592c90b62b2d5c541c2981cb6b387ac59963b596f5539500de(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__205a974a40572c29a1133ce70f6e3e4c4fe97d0bdaf9fdc58fd1b43f029ddb46(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8f18a143a2b47c0483c36214e269ddd3687ec8c61cb4a0e21aeb77fa05896369(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__754a7da14fd2f9f19adee64fd048e6d479bb2856da6394ace5200c1e6be98cb4(
    environment_id: builtins.str,
    application_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f84d4717d9c36c5615b4334e6edc50c3172fcec55602449f6091acd5f3ff84f8(
    environment_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__59eaddf66b2beb99457c80e8e438a7e35b27ba269358f23c560a0e55eb555407(
    environment_id: builtins.str,
    application_id: builtins.str,
    route_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7b2b9c11e7b42d64f38a16dbb2213b91744b4ed859bc32759beef94edd215f9c(
    environment_id: builtins.str,
    application_id: builtins.str,
    service_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5cb3c976e58628525dbadc56cbebd62db90603b9d8af00e659e42408c7e2eeea(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__449746669f9fce40e5d293c9262444795d0bc86d05dcf5f41004009a88f7aeea(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1841891799190e920d73bc734030bf5a06299205c248cb3ca6b471c1a00fc54b(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__74432c007be534094ac5e01b546cd6348d1694fcaf76919e87d2b93d80cf3423(
    collection_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c8d5d5b0b99b75f7bc1665613b56ecc8383accbe20585c9a94c8b2b23418b5c3(
    project_name: builtins.str,
    dataset_type: builtins.str,
    creation_timestamp: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e371b3130deb575d899292278fe9d2dd5929fd7b5d279b339bf3b7e78fdf457d(
    project_name: builtins.str,
    creation_timestamp: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1699089d4bd5249a4491fa0eef7fcd437df4db88962642cb330fcb0abff2a634(
    project_name: builtins.str,
    version_name: builtins.str,
    creation_timestamp: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ecffc1329d65e1918fa85a5b6a91cc8bfc5c91e5b369bc0e493eaaa4c816c017(
    streamprocessor_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c9b88152714cf0853b143b864ec1874958a872bb90d95de550cb11614b45d63e(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__137b91340982eba80838094e6d5543f92389d5c1df2936cd7dcbc1ea38fe3442(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4ccc6564bd955878e893e467943a784b479683f56588c6361c1296cecbc1147a(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__84ad352677a2ceaf551975e74e750ee8e5ebfe303c2613dc2325115a6343003a(
    app_assessment_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__12bddb5aaf190bbec30fcdd2b9cc2379a605f48175a5d978be17f0b72ebf88b2(
    app_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7f87d4228c884f3a24dfed7cc0aeb7ebe1f6662256acbba65d824bdf1fd46b35(
    recommendation_template_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8848449db0f4daa8ac39918d199d05d8a5d500ef249db18322b21cd5e29bdd26(
    resiliency_policy_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bb5ac232a61d1b0b1c25ec3d5a05e6d24c0f055020ddade66070b62bf01dba34(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__60ca2c759bb71961c52713a4ac62f1e5ce6454f493276239c1f764861dbd9c29(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f9555de3612f3e7ca2c63c2633bfe0096280d705d78e69807a3d61169c1765a5(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__609c90c8a71ea25fe7e9f0aea1ef43a27edf440eb8847ae1bd94bea457d61505(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e9f63681845c076d3e9c75d3e3062813c02b914d36f6600de34f97466e88950f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__12ba79db4a84211eda9c47c1c159e0bb069d2cbe17426d9864afd1e8299f7877(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__899d978dec65391999f3157cb8be10136fc6616451070a5602c4a98bc045c5ec(
    index_uuid: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6bfc1200edb218e8258a69ae4a1d6a8a895cee091ba00d6fc0856ffc124390e1(
    view_name: builtins.str,
    view_uuid: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__85ec51b149d06bfe41d58beac6a0bec4039d328b6d2d7119cc9a9ae6d2466698(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b8fb1a7656f6cfbc40ed21b11ae2664dea22463ccbf3154add78635778871a49(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eb95bd2bc4554839bd13dc5f8c205957caf135452a06648ad1c37b20ea96d52e(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__143d37c1dcbe5a552a00d407dd532a97845024720015816e443c9f3529e1bb00(
    group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a38521a1796ad59d2e01361aad1c5da5a47f159cb8af3087d0bb1e5ec7c7f6b3(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__af936c72ce1c802281b6483144d22f78336eaf2eef03dd269349aa655a81650b(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d599ed12ef977cba5b19170843b2c0fdba8b93d6c9a5f1e60ac4020947bcbd09(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b9913f702c2864624aa05b1faf1eda08ccd6c3c915ce35f41ca5563f8a30a45b(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6ecdcc4695e39179b9396d9169f67178cbdefc09de4bc90aef77bd33ab0eed3b(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cf1058d56947ac68fc710c2ca40cabff6e03ba8165b9f9c015a863e939dde123(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8481f45070fbdba79c5e44e02381ec5b195e683c6f82b3ee6bbd996c79b58249(
    fleet_name: builtins.str,
    created_on_epoch: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c25ea7be575688f4882a53c7bd1d20f3b9b8cddf834758877ff8de38b11c4613(
    deployment_job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e51238d4fbd0404910189633a75759645337ccb1d3273899203d2b6ce1591678(
    robot_name: builtins.str,
    created_on_epoch: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b7397c9824ba7cc60a78786c6257c020393da26718cb030b68688167b53de284(
    application_name: builtins.str,
    created_on_epoch: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8f944a56aa75867cafcfad9ad1beb4c7c62e0397055cb437ef3dfa513b4e36fb(
    application_name: builtins.str,
    created_on_epoch: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ad1081b9de391d348b5ef7df35936b550d00fb4af35f63c772a778a13541762f(
    simulation_job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bfea4910abd64c9df238843d1d530082dc0a1ee8399aa03de7f43a197ea1866e(
    simulation_job_batch_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f18b9b21d2a2bee4a33e15086beda9357b3d03b8c88f966a4fd36181f804c91f(
    world_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__933769643f38a7925204651030688b44902c0043d40a7ed3e02643bdb4ec6ea0(
    world_export_job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__66a72473fa73ced243aa2aac8512c5301ce7727630314b8a73cda487b75cabb9(
    world_generation_job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f392968549e746a1b2968902af0708f3f6d4114bea510d0b0445ad4a85f86bde(
    world_template_job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0df591d20b902eca9270c35c3e3492cbdcf6cfb886c1afccb7b8bdbf1972c5a4(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2b13eaccbfd240f8766527896d141d580d13c848cb92359015c2ea10a9d45b23(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__228b7755abbe8814f0422fa036b81606c8b737cf27d03dc412a30bad5c70ff1e(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__10004a5c8a47b49bc6896b25e7267860323a07b57b494ccfc559a29d18b037f0(
    crl_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b972d321c1ea6202c4b5b586b49cef339aa26c293f15ac7faca7b99648616e92(
    profile_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f36d64bec08d13a45240e2ff189f374bb021dc4239f0fe4332f2980afda15363(
    subject_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4fb1cc95f0219f5ef09527efca2bfd32eb831b58efece91ef8dc6efd43e72b12(
    trust_anchor_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8b95b1d0c6c28a035b1a422f1f622d836210b1cb7edf4b48a49ae810f9d94076(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__29c31406859440f572680e18a253e54ba8e606204aca8d2f4d554c08e72af32c(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__41e6eaec234868cb978b61090c21226f41d247110ca70bf78370b3e83a141e15(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__27af08ae9e757e86910d56cde383673d9f56a445654bd761f51c0cd49a14c57a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__44d17d965f5ebef61db2b722b17500c785b47ec2030630fe42f85ddf45bfe080(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__193449bd36315bdc5d6c503012ce6cb00eb1f6018e70dadda5d1ec0cf26bc98c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3a8b96336092c5a9b7fc4f0ad98803155227c98ab39bb6e8959078c33f99a3e0(
    id: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__29e3f4306c3f325c0e760cec9e20f551991ec88c0651b4f697321cf89453f27d(
    id: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e3c9ac2753836dd2a4abaa81684b61551b0fbbdbb473e9fe4ad1c4baee100e77(
    id: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__35a1477d7dc71de9514fa82497c4330f54c4a9651000eb491e52189582a7f22f(
    id: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__61e471217a89a6856a85c7dc1be681ac576d7f0192afa9846bb0c62573afaa99(
    id: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__02358f2e315125c3ca0ade5fbeca7d086b288bbe942f776bb4bf30df13028d6c(
    id: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__50f2ea3f59a9ac579795a894a84a4259981a16a01bcbe3d8af7608d857f68b80(
    id: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__67700d2b6aeebf3eb09de4542507bb1e54ae158e7ee76e72c5b120ea73818716(
    id: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__227106973b768b2e8bf62245c092b455ec5c78c131c4c78ac24bf43027432bf3(
    vpc_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__11975624c71cab6b0af1b4acc2b2e448bccb68514316a61b0f3fe7c703928cf6(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3e7d79f2dd050a95a267ef2b5bb67aec53ec58942e61c9468280af94cfa4dd0f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ade085c73bea1a55c14c6793fa1086fbf855a86dbd844dd539ed0c0790db6952(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__aebb2c35a638bdbbfa6a6da856faff7aae4be1375deb66b4c5ea9fae095bf1d6(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a3cc8d7e16dbbf31cb51ad625beea3ee9dc3e13578cddadf4b6e479fcc9cff12(
    control_panel_id: builtins.str,
    routing_control_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4719fa8ea3becd26b35fe8e5598bc373654ea7baaf5d20d3fdc7322936d165f8(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ad3da3b2506b43128dcc5377b68df64f9e02bb658c6ef0d3943b33b0f01171ac(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__31c51af1a6522c5b760c4dca26469ff15e03f99d55f52d7f15e3ab8a2798401e(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0e0c933c6485374ab644c021d9056ec19e9898f43e66e57842517c0bf760a7b5(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__31cc026a3a1c0c0de8e331c9ca37660fd2cd451f41b9985b9b186320835df91c(
    control_panel_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__863a4019fd44e3a387b5116d95a2a264ef50a1774d851eb4d4e416a99774a576(
    control_panel_id: builtins.str,
    routing_control_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cbd670f56ec0cb250ac401f56009bf06c3e9326a374481c6a5e44024fa4d437d(
    control_panel_id: builtins.str,
    safety_rule_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f7595dd039899900ab3356754f599a6d8dd94d7c28b948c0675cd3197d36af23(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ab78dc9f8312f1a0fd9dfaf72c78d15b4d679dba77e1ab85128c96172d0b4eb8(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__71c7088e13648f6927e4f943bff7c727d2a7facae25c6030c8229a081619422c(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__740603af3cef1fd9bcaf8761d53bbc11aa653e15e4d9447c56fce37d6f4a2fa9(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__24e5a73456f4cc6011ac5ec6e89ebf8e1031974da583d61d77ac499da1b9051e(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__56924c51ef7278b8723016e2aa5284941727ac9b399e0bce65064b755ee5cff8(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a26aa844136b5f4a9c9a02228eed3a623d3d4b025d2aa3ef30abb536e99727f9(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__210364fd0a3ebd8664425162c5a82269f1c4c3aa795b8e7765a128133a001fc0(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3558e7176c2bc32d8e9ab5b3584519326f2a2232a126691223217677650e27d9(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9e4dd0b23c7c5fc89bbd8c7388c1ada2e0df6417c196d8fcff9fe1aa75404738(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__862f5bb22a3e0d1072fe42ccb1ae7313f93f93e83ac69ea7a3da619222b88c2b(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__53ace9245e9cc4add7ec6e1979df61134d452f22e27f97c89b542366a9c9a8f6(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__85c35f23ccb5cc0dace8f631b89f96a648ad34f6f134df45e6184565d648d8c0(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ed811994eeb26a74f1c85e52b5654f7af933d904f96cf6c6684ad2e2656de5a3(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__14bcf63b7497aecadb782a2376a201f60b5261ebe3202acde391f561692d5697(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8d286a89cc561d97948b366615bbaacc58a3b332a1e6c7fc00d2e60afa2111b3(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9c07c612f67989901555f40d4506a88a83b9baa48b6c84200979c5eabef96ed0(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c4a1cb46c571680d3ad560c184c905a63ccfefcedeaf1fd3555cc6f15f254029(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8944dc19d25026ebce6e5d94d7328d55bede8c1e11a6b05470f17956db4f3d2d(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6181c53b23f5277fe52ef81d9806cb23e8f16272444a10bcf8a6a0258c20a0c7(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fe651e15a6f7a0517f19478fff426d28b4e19b0984f8e9826cfc69af6e709dcc(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a3a0f3d061d3383dcac03120be65166fab67b32458c50b99bde90032b015b592(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2de17351bd2309d5450b8d5a2e95a156d1f176031780e8f251541a84f4f73385(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9ddb1afd578897b0e26c44cfd3d7c428764e1f16dc8410209377301750345efc(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4b92a30e55311da70673d5356819dbdd338e7cd721b7328c63b06811323aca57(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__afbc5fa3b646aaea98e0f4974c2cb3f420494ac2bb3c2fbcada6ae8563720507(
    name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b9890a755374ba815f876c66939443111871085a4661f87f6e9dedf83646bf0a(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bd0974876fe26151a2b653dafb203eca5384507358a4cf5216101fd17e06490d(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__204d2b648480818b30f1f5d14bb9b04ee4cfe6102941cb8acd2e965c7823ce91(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__751a4a4500eb473a63337cb4d8a7964639f420f39b52e59a634bc519251999f9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a5fdb27729db99652fa737dd302d280d9f2de56dda0f82a162b9c97dbf9348cb(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4820bb345e97433a17027aba00bef67456f3aa5fcfc17f794469baeb92b88aa1(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ed3c5b89355b1245024caf4491f5daff814f9352e9abb261ce10303c3e2081e9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a3775c1c63deaa7b45bca78c78469aefea0e2a076215690446db46a1b9a8d012(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__44548590f6fe8d94a9731f6522e02416c557ada7ccce6f8398b50dfe8c884cde(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d570ff5550d4ae8be49d023ce207287b4c3fe0ada1fe12e3b5a6067f8fffed33(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fddda013f31ec2e8686cfbf92863b50b3923450b0db1e686a8cfe4d00a9b70b3(
    key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c9bbdf01b267d2f6ae1a780785f630013fa307127c47e79c609cd6975f2ddc9c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d779613e564e85b9ad12f4410730466cefa476640c2ac7b4791d4cd71aa58294(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__59ad79ef41b5379b0cb64a3e69abe4545adbab1ddc002f9d17e5a502c6efdc95(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d7b2360228933fb8e4e9d6e77369dda55304f773956461c9a2fc8a99ac4aebc6(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__079f1c2659fe5b41624f2b6cb2c746a8d8a9269d1cc515b97081e88823fd09ac(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1824f0a9d14c17aab153131d76cc7b97162e8f6352bcae7c8596b7ac8f48ea8c(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__71527fd5a0fb298dbb07b8ab8102b7dd4fd7f574f13d1d0a07a61ee5eb191d9b(
    value: typing.Union[builtins.str, datetime.datetime, typing.Sequence[typing.Union[builtins.str, datetime.datetime]]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b375796b49be38bc97653acfa9b6fa1e6caaac426983560f17da532633d29f15(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b24f6e6b7601538e2a30a7d08bc3da201adb7dccc3951287686dd132bb17ed4c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ff4988a2a41e8f07f3d0bf3431b84bed7d703817c30b21b849bafb4a98c506e9(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__02977d77ca9f7f74023ef2e21619c46246b21f21b607d70b28e549e2ec5a92f7(
    key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0d2a81f1543e22dd44e66f0113ff81e94ad22a8b2f20e212a58ab53b83ab33e9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7ced3c080552c34e57b00f0ce20b1969102fb5ed89c5e03d440dad16fa75a033(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ade8f4fe3b1c87dd8d8681c27a87de74bd618454d71d2bde8a2b6db73bf95d1c(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__407eaaef7b1741967da702ab4e2278bfe2ae5a15f7da9cbf4e4eddb4e64b8bf9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b3e2c8bf912b7c825955fa8cfbae470721e5326250b2747c9c52aeea31fd9c1c(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a79b9fefacc8be1ca4652d0d45bbf47872f01fdde45d15a68cc8c6f87c7449e9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__21c78e7d8586f9a9e086abeab6dd1886976c64a1ca222e0a5419c4f6143ce6af(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3711a0135e1d2bb0333cd948629d50ed745b9b871dc022e5242c82264eaacc48(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__578bbad2c16e210d01953835cb5fad5b74cc029dc5083574d0b736569e134c08(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ae655e4c1ce50f163cb4ac5e6e505c0feef0ebc6f7cb70e54c873f6805f93243(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__06862f08fc97147d5d6a9acc680084b779dbc15fca4ecffec3b253d51dab357f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c3213a0470079ac3feca86043de4a489b36c5ffaf6b57a415689c75706b3888e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__db566b4c3ffa52c1a24ce77e438751de9897857f337d7648b746067bfeb79675(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__69e97fe9837b3bc213ac03d35c41ff7699a8615afb7dcb2e3bee2938e6c395c3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fd225052e3c219e6d54b5b5587da59981a355820cf25f3827918f0094456c0a9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1ec9e9d8e7f84a4bc0358e9f3fad331ed1a3637f800c8c08c15b7a9d1fbb39a3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c5fe76678f2020046adc769911c21793bd14010b7f56034dcba3a32072080083(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__06a9727ba3cbaffa8072b4acc84cfd22c52521cc5a03fd1518eb0db6b9613a34(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d1b098c848a3b39ea8c95dda64ea19497dfbf0e6dfde14e237f2d5bcc8891815(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4d70050ada952432da00c73dba4fd3b18d9012922a86cca0d97ab991582150ad(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b13b7f8dd7a529a8534034fcce1401d07e2eb674935f76c6db307c537c4ed0b8(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e4db8e33a6dca0d640ca3b52b1c3abd621f4ca38de40fad8018242c01f9a59b0(
    access_point_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__edf525ceda88fd83a8380afedf1c0e1c7786a4b1556f632bd6410b2c67fdc763(
    bucket_name: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3fbc908ab8b712f776837c39a3fdec170c208cb5d7acc0e8e3c14b75c2856c1d(
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dda250a7c218b58f3d9d076ea9ed339c79c72ef8f41e42a15408570f45292836(
    access_point_alias: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d6b5f3ede3902c93fea7d9671036dfd8472622e8a7c43bb1c93f265ed7e49a5f(
    operation: builtins.str,
    token: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1286302e2fa36c1c44786400c6c676121fcd23c252e646092899e5d2248e1c78(
    bucket_name: builtins.str,
    object_name: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__03610984c767ca572111b297111a86953e1f7d714fd398bb09f7eb1c9bfc87b1(
    access_point_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eb51464842dc4c5e08471bf802776ead766964a0ccf7a3960aab35ed02a2af1a(
    config_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__390d687aefbf8cad0371fc3a5e698a271ed6ff5596da89b5c8291faa41de86ef(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6a8f43ccb94601db1cb36b6bf8ec9898580b2dede5bff80a4c45c011a8f66c21(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__556cc9a9fcb692b4fa1bcee9bbdef538c2ba64c3820d9066fadf4568d2267439(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f955d7713e35121ba74c422f70e8c40243c8b64f76d2739b7d38455806ad1c5b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__48dcd01ab7c8bc2d6379334a44699f55ddb190513300c07e6cbeb328645864ba(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bd988e81c55a0514389365295da9b3c138f8a83a316b2b598862e5bd6c3a78fb(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f6ca424b196a3f70b75984cae5a75d1e460dc2c07453a70c6f4aa9e921c49a69(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__587692bd20bf47cd8cdfe855da68c74fa5f167ebe010f554d1a9d658c5462676(
    access_point_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f55416826d9221848d8b88fc7428e38a5d4ca8c6eff2c66b340a945d1fc6ca22(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6799652f621c97aa700c759ca379d6c41260c411fe6092de05e9b26ea5e32afd(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__20f9c2e24c6f9bb4cd4a7d0127089d57c94accaba02c21974328e91cca369bce(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fdd5356ee590e27e0e7e1b6144a1a4ee7ee50e3175796b408981696ba9a96e04(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f43ca97329eaa701ec31acb7aada4a6175b7d8dc2e72dbae1dd963094bab2985(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1b577f641c0fed274eff8d63d3a6767f9b40083e56065a32de03f318099b5156(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bc4a686a1e1fb68562022b3c1b50e7fce499271414dac55483099d5c40b999e2(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b6a747772dd2d84893bd3fcd6f9e7804f1e745130effd5aca578cd828668f993(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ff041a1e4e9c8c5b7cab57e9ddfe211881c109de7259a6dc2c93fcb9c5d32fd2(
    key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__97167a2366fd4669a1f274b053fbb117d4a87161e851ead70491d64616854515(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e34ebf89834f02c4f50b20de959bf642767dde43a8ec711a9f6cebfc1b3dc874(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d9af2c927d8803e49c15e54e57e9b119f3ce6e600a5dd900300acb2840758b8a(
    key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__72a37a29fffbf1ebb683d7c8555fabefbe9307d4449d2a83717187b5615ab12c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8cac5ae78fd491af49821b5f5c968754307968f55a9159b876a0357f3938f4ae(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__da0b45bf255710f2de5351466165533e0b4b95c24f3b6a20c59e97e366377648(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__07fb03f2066b0bb73256722de4186cbf3aa08577e2bb76183da88e7517a06ca4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__29a131c10f04b2c4c9f9f8a46c8f9ab8479006fcef3dc7ce0ec7b48501ecb96d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c47ac2e0615e6d7e83d4eda69e1d1f0721c8967eeb287640656ba90a943264bd(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5a40f87b2a1233ae20047354f314918d389f3d0b86759f2e1ab1b385b4ae241f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__837e10c397bbc0afdd968647b2358272fca8fd878d1a2d1f73dae9c21660f318(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__83ae660c68cae216859b2f55a4a0124638ded76466c435657762d8d7360fd2d3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cab1e3d37159cc70cc2f523fe33ee48fe1f2a5d161246b1adbca0262c06eaff9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__63c1db2003777a263ce60a24538505dfd3969922633fe134b46018175abc5a76(
    outpost_id: builtins.str,
    access_point_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0fae9ff63e69f4b08c7a652b28912c6a3fff599e7df24f7f8c7dc9bab12513cb(
    outpost_id: builtins.str,
    bucket_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1e61328ea1f721736cd78a0ddc05cf6b1f9c9ac72bc0f23f65c35aa463ea5b82(
    outpost_id: builtins.str,
    endpoint_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7e01404992ddf5f207fcc72cbaafdd14cc474ef2f867b910be2ac8e77c50ecf9(
    outpost_id: builtins.str,
    bucket_name: builtins.str,
    object_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4cac9dc5e5ce8f650a59a18d4c03356ac3b022be44d1ab481aca28cb19bf1ee1(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b6c4cf51ce4f7eab6403410c9a13a2a6ee72e646a42206674d983fbca0cd8ed5(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0055e807508beb4409e6b4b28e3d4638d559fecb5cdad2cf81dcfbe474ae43ea(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8b75e649d689013ac09edbed43983b8af6a061de32cecceb72164edaea18f0e2(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bd7b567d1403112ec2b671f0887198bca94e08a36573513d9ae5b3f77e97f87a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bea808f90d4480d1165ca8a2ff106f09129c37738a4f2804e0f49e4992d14df9(
    metadata_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__579df637fe9099fa99033699d69f12818d0bd271fa49a0badc96747ccda95e0c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7a2902af424e5f9a4bc987b918e0b84ec1da064237a9af9c16af6c0d7bb2f619(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8c96f005592d3abab202aa3471eb94ea18a50f8bac27b21010b5adc4fe5330a0(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d4cb42fe449d8f083c5b0a72f2bff12801d363f93bd2a48c169dfe1b708067b8(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1fb6f2c5209abe87c14d199d5a63a96d7f266fe96c7310dd9fe9d86f9f4e8aa2(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__56dd2bdb6db4c02fb6f98fde35388964dfdaee25be8ee47dddb30d160f6fb7a3(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4994144a1e93bf3bf9dd58475012ffecff1769bbfc5723a8eef39f6e919e4554(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f40184f2257e3b7dde3f8f130f41c1d22ae2aa06b69b08661d2e2ffa74cbe382(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__be6c4523e8626b2ce16e91c2d41ef98bf70119586417b4cbee503e759f0ce88e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__01bf47999420afa84efc82fa3e2cd6894dfbc585d0435f6a4042e83eb4ee84e4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a11aa4225fd3e9cf8e62c5da03afad2ca8da260882ac4db0717615216ff39d8a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__723a876b4812b8090c52f42f0a571f8b0dc67c606a53107fade7d29a45bcdad5(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__93d9a5fe93573ac9236a38cf1e142cdd716024b2462ea5ca8772060d4bb8312a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b2dee821f41cf2ced2df66e4b02f95f27b13898fde31b64fb1a8417ee51bc6f7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__03f2079ebdfc3ebdfe4a6c7747755257159e694d297a73ff901d4da1c05caf67(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__489ca79438af78e1ad7e1bec6bd280322fc889c5dd9bfaaa15474d260e3acd6a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__053a4bdedb133ac1a7742fb7e1f783677acafec5c3ea00ed1d1880897eac59fe(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eb3fd666fc868c0418af611f7481e08bec2feda884a81b245883215e5095198f(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9cbba4d3ce9fae6e47181d0b491f1d97ae1200da2fce2d92fc630aedf4dcdc24(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__14b03243663c31a56705cfc9e2a642ebd6076678d510bb67655abf8cca7be95f(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__11bd224fa445d1495b9758924fedd9efe3940068cb20311f91fe40282978fc1c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3cfdfb87c0b8b641ff938da1bdd634434af2b556eb117ff9af28f8095a951093(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__793dc4b82967dd8ce70ceb32db0a584a03a4561dd64a387b231db12068d58025(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__df23f51f619b278cc0c6724bb77e1ff1292c169f916c2570905907bb14a2c371(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cf541c6a98855568607a6887277126095e6daae1cfcf67cae47ac22292d81a7e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__404bd6abf3382e2e2ab0fb6b7425865af19bdff8c9d7cdc8d5c08dd0dc7b28c8(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9a97dc0bedb25ddfa1f276db7645e07e7021b7041236bfb4dd5ecc6bdb8724e7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6d84cb41b41ad05914e995b64d96b56f6e7bc73048031e9f73abc2acad2f3398(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9a56494c453682d3960504b6662fdd5908cf0d76704a170b8ff1bc54f35a5e0c(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b14758d6261962fc38420d4169b89a8837f24cacecae40483616a37edbabcc00(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__83a1f281f80dc72072a3e2cbaae8204b581f21af3a669deef8c348ccb62c98f1(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5f7f81027bda93f155ad29fbb13a0c57a512cfdd9fcb53cfd6b11df8ee2fe2f1(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dc5285641c598ac848c8f96ac7d4f187d599123090452c6f6bea6719e80acef3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__650a9ea5d2ca7d4247a4da6b27fbbf7115104db82941af82bc5eb77743f03859(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7a9cdef098e6ee19e45bc212da2ae631eeb1407301c979321ce11d1a2e355ddc(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6ea77127a1e28fd01e13831d5e69c4a64c82ba66c437904e0cb58f5fa2ef2182(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7863676364db59b8d3219a3d4740b00160b1a28e1022efed0ccbd28f8ca4a0c0(
    action_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__796e81830b1eaacf7b9c2dd58e1e29a2829bc10fc4c9535a2521d9019cd7629d(
    algorithm_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8b26604fe5c6673ced72519c4395d67d1c223236910e6fff9b848e05fb240a23(
    domain_id: builtins.str,
    user_profile_name: builtins.str,
    app_type: builtins.str,
    app_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8b42aa6af10417e2f703fbaefa19c4fe2961e4b28718ee72a1d26738a187d847(
    app_image_config_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9e898da66b886a3715e8d188d4e84c04942175348cf46b64341cf94cc4981582(
    hash_of_artifact_source: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4d232b13481f75812dc9bb5674aa90a214318e4bfc24c1ab50e6a44f6fc0b0c6(
    auto_ml_job_job_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__20c9eba04963e54b880c766f84763778836627411b992174eb8aaf139376d237(
    code_repository_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__540860134303763fae931c9b635a57e51a5e545b92d507d6fb29b286be3c1c88(
    compilation_job_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__17825cb8f22b7e7e18daf9e35ac01a54c235ca41a7be1a47ef173399c1e5cc5f(
    context_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__be1e2c46845f61ab844791887bc943a97155d44d3f558c5670dd76df1fc7fa53(
    data_quality_job_definition_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6935be1530a251f69c0e8bf465c0ce2c495ae6357de4e8fa460b1ce132eee710(
    device_fleet_name: builtins.str,
    device_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ab02cc8abf076599810efb9572af72aff900e01586a441808c6145256703c9b3(
    device_fleet_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3a533bd466d24ad07ded287744ef6bf964eeaeb3700e705ddf51f844f94e15d3(
    domain_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cf4cbdb468737e083f9ec26f8c7e079aa1a0e340076075a7ac6bc5a60a2e7f94(
    edge_deployment_plan_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__478e9b855121c62a04b8ad67f8b3e99578ff45562bbfed8d724e13c8ef92d279(
    edge_packaging_job_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f8a8f4439bd1cc2f18a1a883ad496ec681114164eb49473112d58053f64415f1(
    endpoint_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ac4f2afa5bf6b00fbb136c79e9f026bc3f1f5d29e5c10ded95a17b0a25cd9443(
    endpoint_config_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5b11b9c286e941dd22e209bfc6f6acaaea361d2d4c8a0ef240f58793feed71b3(
    experiment_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__816238b87cfa136779250b3abd25e31be58ac4e97e073dadb87e8d0a1a084039(
    trial_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__765679dca7cc45ce640b88247eb7237c8b2e193eeccc1efefca69e1c04c32bd2(
    trial_component_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5912bc0ca12b6889eab535bea747936aa271803655077b91972a6faa1917df8e(
    feature_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__159c8968c1c06dd2b9ded2423da177a3d2de576ddfbc61c5251a0ba65eb9550c(
    flow_definition_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__682eecdb6402faa677bb7b94725bffaa828ad06b1967434c5377cef5be7c1398(
    hub_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9a1c127bafd1752ec7ddc338f45000056f156f8cd98065ac90105ff364f72567(
    hub_name: builtins.str,
    hub_content_type: builtins.str,
    hub_content_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__300eb028ffecc8c818e582f3154083ebc599947b3d56d39b4528b0346661a24b(
    human_loop_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__00ffa16a4c46e1c15d3b157f723db16c26941a57909b16bf823ed431535b04e3(
    human_task_ui_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__99e58ae553c70ce888ac5905074ff968d05770bf4d913667a3fbf9c8bfca31f7(
    hyper_parameter_tuning_job_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__98c63974480cedc4877aa7ebd1768301b5e74d63a65ddaf2f5e31c9309539c95(
    image_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ebb217492b666a905088056314a1390d6f75113cc9333d057ed703e39b28db39(
    image_name: builtins.str,
    version: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e0a2bdac1abafb84c9d80f4c24f6446f8fba7dd9ac59b19e8335f271471d3f88(
    inference_experiment_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c75ad3b13bad4306cc3de0270d422d7924f6c8a60481ead63aa4419c9b807293(
    inference_recommendations_job_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__40feca216d525bdb958d495a575f1d82336eca7be9ad98a64951abcd0db793f9(
    labeling_job_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d0e98aae84721bf08eb7f0da67d3c2105e764ac54985dee4ee902d057b2e9ff9(
    lineage_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7e4a79c642c7042f12a5f0d896add1b2c0d71bb48627d00b7e619dc5e139d154(
    model_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__27ee2f17c7f072db3db08385b802dbbe5695cf970003124add8aa22496404231(
    model_bias_job_definition_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e6964b63280577dd56ebd9426115ff58e9322954faa6974f8a3124a1cd40b5ca(
    model_card_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7bbf9ee248c97de86fe031f75c934ae9b9b082d90679060014187036446fefad(
    model_card_name: builtins.str,
    export_job_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__aa5a83ea034d7f244198ff41c70140f6e5a85abd1d8306f359228e42dd4fdf9b(
    model_explainability_job_definition_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cc89dc57eeac927db3fffd51f78981bb19435907cee528b9762cccf6161aa5cc(
    model_package_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6110e80ff6fce02bce0eff6d6fdd338a65a3ffd476620d640af8ea734bf3bcb2(
    model_package_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__11af252dfccbd6b02f76c3a3ad9f1d3bdd5ec282cecc1686899f9789919e719d(
    model_quality_job_definition_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c76f311a2cb276f0e81076245cbf02bf633afbe364d33a48ba40006d0f129b81(
    monitoring_schedule_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fcd862db13619eb528fe1c91c7d2ee13bf312ee3c7287467d617fa19c2266631(
    monitoring_schedule_name: builtins.str,
    monitoring_schedule_alert_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4986cb9ca9b55048cfb744701360cabceed033f68303193697aa7413d2e645ea(
    notebook_instance_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fbf71bbc77be6298b931df7f75a5b90b058d5b45ad6cb30b629f1248aba006b3(
    notebook_instance_lifecycle_config_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c26c116684aea5f0becd9447cf320222efc77fe4db849c583938c7b77aa843fc(
    pipeline_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cc1b461516b3ca48fc9a5abdf0234faa49ebe10575f48aee754e29dd8fd01cee(
    pipeline_name: builtins.str,
    random_string: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b1f400f3cb274254c36806db76d79a3f9e2f1457623bcbce735b8beca46d12cb(
    processing_job_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__da3de3213eed4ee45e513e0d0374c1eb1dd5150eabc0ca95d7ae5de82644023e(
    project_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b38e7744ea55406529b6fcd7ab31f5ce285d9dcac7a1c56d3016395a773ee379(
    shared_model_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b2e0866dae97ed5e16e0baf811ccfa11c8ab0d7c563caf7d3f114bfffd1ee1e7(
    event_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__44c6a82fcc7526d434ffff3e1e8d47c1684cfc3ef72215fe0637756adf6f7cc8(
    domain_id: builtins.str,
    space_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d1d3beef3b095b21e8713c958ce623d7c718ed14c0b6990e3d83f8beb2acf68d(
    studio_lifecycle_config_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9e7bf52e3b195642f933a3d01fb1797fde061c39725304a411b1a950795f3647(
    training_job_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__acf964369d11a91e43b4bc9d2eab1ec61cf498f6696174657394bf24a79dc084(
    transform_job_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__112038a0c0f21714a3e75ec931ed39e1af380668c86294421daddc32160804ab(
    domain_id: builtins.str,
    user_profile_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__aeea7282546dbcea8ae5e74b74768001c3944c6dafe47297c255025527f20e97(
    workforce_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__467160d2ff33f276998b2700930e9965d18b70dfcc8ead8d2bf914cd9cc70e10(
    workteam_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__21fabe9fa35db96efd4fc41546e87b74541ec510a8cd1c012531f0943a93ca23(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__85fe82884422cb8e242d71ba21fe14f0f5b53e56d05491d52ca7ab6fbc983c6a(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9f025d179e4168e5730ecd3a8961e9302fb7dc6698f1822054f250fd719dbdc3(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8fe8637a3c8d47ee93e3621d947ae2efdb25fc7828bd42b0c1bc57f927d30045(
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__919ac3adda749c9faf85f09ec284663d0bb7692d65a007b7d314516439d6c8ae(
    collection_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7d18716091460fb28815de64868ab4f676e7ef41eb928943265e14ad04619ee2(
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__528f9e89ffb2fe77e536e022b00a0807730d4a44b7f764ea8304a34105e7ea54(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8a6e8d7afff6b99dc9796be0d92921e2195cc68ee7e568a8fc81b38551a535d0(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__11d8a2a5586fbfcd5411050f23d43fdb5476695228ee26f1e69a25480aefef24(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__45dbcf1a28a99da5abaef61a99e512eeb1534165fc153219a4bd4b81181d1d63(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6535a5d5b6bd97a77bdec7d2621c9e1fac770501de51287e77bde3b28c0d56dd(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2e051a89bfef609922681f2bfc704c0e2b4e61a241f04a4146db8d384f2467e0(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__189a5972dbf2620252fa0364830674113e42bb9dbe8c0323d9fb0f4bdc7c3fc0(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__72536760ada142415d995a43d4fc03a489fd6e5b6efe678411af47a46293e129(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4d2c0fb849232a2194327b0f463852641642259d0637a58a913760a0fdf822e0(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cc132cc4f1027b0af3d0fb279b72619b76691d942c25b6f6983b57d69fdfffdd(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1287e9f9062dfc34d8eddf85a8c1219a0dbd02a4c3ba6d3559f0e52425fe0d53(
    group_name: builtins.str,
    schedule_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__05ea99d9a2af1a5c3da661ff332b852973a83f97aaead057a1b0268a47844c2d(
    group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__985b20f741f91e93a7bf04dd0d199cd0ad40f34539c6cec4ce488cd4a6d88f0a(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fe787b4a2e5b5d07e459ca737f8d45513d373a373a952e900071e0a6f23edfae(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e12400e27b63c38f82d1c83218b47c27a2ac124932c45ecb53d575225ef20f3e(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6f452d41835600865d404defed4a8b010b202d112d4a57214f852f661716f721(
    discoverer_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__866b3364177032b55de7c8bc704b9d5b37344d1a4ec41bd94794f93f1bd88d2d(
    registry_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__51a9cfc7b457bcbd2c7e22a0b4fa37723e13cbf27c92ec34a560f817d90c7275(
    registry_name: builtins.str,
    schema_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__66b4ccfa6708d5322fa6effb804e614ba88953f0e8353052c835672e5e156ddd(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__942c0b33b76a030dbb4446158295b9f5a0bf7b17caaf85bbcad71084dc772324(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__04821c10c101abebf062fd39f5af049b7c0f658d3d8bc737d0c7a557658ac786(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9264aa8fb78ec71792f3d5c37137131461014d5d41aed566c5fb6b9f2ba71dea(
    instance_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8ab554b01092d6c78ad6ac11f86657a32287841ec7f62260245755ce9ff6abdb(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0f5158a57dd9898a98c3d66ecd49850516435f035bb3b44a42c362dfface42c6(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__62ae9074a9ea9615e3b93c198fd1f7623321b7f8c1057d5484912389ae03aaff(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7a2e5fa4900bd17442e87b5ffa3f75440504644dfa80515dce96b6b9bd4176cd(
    domain_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2b9b4f1bd95a982ca84eeb440c37f352f42476948e858a4f4583a54977e2df29(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ee620ef099565a31ddd1aed87c21ad85908020d20d66500c6961091b19d45003(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__63c2210c9c1f23cf1409ca6e48d6aebb0063fc0a72e1861fea23e29094a6d699(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__346c3e74abb8b696cbb4254341d905e09133286c29ec9b22f3fe78487aae22f0(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1c3b06f1245b75f9a9f8123f869855bd6b26c8410b1c5464ae7f8868e69bf053(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7b1fa93528d106f17aa67f7979d2a130b5f50647f7e84acd889fd65c9be4334e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__903d98438388df7460dba1861bc0d02bf9e298c7ef8f25a9beb71369c3015d24(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f357db7bc2007a8c39db59377a4009ba84439420e4abfbb7df1df962765c6d41(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2c3aeed3de11f1d5d374584883605a7f8d1634c40f195aa20d6397096a2043c7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__57aa5290dadaa3e597c113897e82bed43b5fed4cb9cc7e99cf76c56b64572187(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cf4161ffc70e5c63997a21b8e78ed18d3d6931d0afd738bcf6be7bd08ec7fd02(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e1942306124dcd44c2cb2f60323c3ed95c9ac4ee2a4aff1dc829bde75d5c1f48(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__45b5b5bb58dcd9ac75a694c2dfcab7960e41865785038191b69e434c6fd4273f(
    allow_rotation_lambda_arn: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a640854a0ec658c056cc2e5744c633fcdcfdb30ac9c560a316910b6f8ebfee6a(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__45a1740bd806ac144bc8331c38af97cc95cfdcff6f598d1635059f98f192f9b3(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f302f23cac9a5b1a193a526e398206adb09a880b7099bfc0dee864c7ee29e0c3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__79b31cd04209550d05450b2ea1734fdec59bd2b0b76c4c90aaa271c9c3f111a9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7a064fe8b96f0ae05cd7e2152ea9f2464015c1ce4c6ddabfdcbda4c92521cb9a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__22cbd397d618a495591361efae0f81f7395e8520342c025caedccf02d7667ef7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b5e644c821cade590cacf332f352efa88c5f0d00857e2b6ac19e3e394668e44f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__66dcb05eda6852751969cb2d14703f9f24c684492fad4203f21342ffb75bcad0(
    secret_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__561f5567c9fc35993dae2a4b841dab0f378d15d4683cf4038bdd6f9569104ac1(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__24ed7db0edfca67b0bfd96fc518f69355c5c66e6ef563262db65d62559f0c292(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d282eb7d5d5f833a3c847832520f471cf7950bbe01363eeba50eff9005b942d4(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f601b80df00d6ff10ad2192531e64c58e778a4b4ce7f63c8d33edd17bbdfbedf(
    a_sff_syntax_path: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d8c19d9740bc6046812aa3af15837c56e864a66b0d782e7cc20423b3ae25b935(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__59561e857ee43db03cc3ddc3c12b96fadf2e5ea71f817ea411bc8ce2965340d5(
    finding_aggregator_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0097544895391113be59f1ab22393350dfede16a5d5100fea77e3b61dcbc80be(
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__219ff1e692b48fae32eda615147e24ec9eba22038a28cab8df696245d0d3ea17(
    company: builtins.str,
    product_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__065c6fde105a5cc26656d516fefeafdb50611d79dab03f9ccb669efc3ec7d1e8(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__78805481c0fc1807a6f54b8d433cba5942c70895e7bd03e4cb2c1f3adb649024(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2765ee2a63346742e067ce4f042051473dd135523be5c62247a9c530face779f(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c6382b21583add71c9f12c48f81666da10825f0315812fd8d803044fa0624162(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__24b4ff0200a7d39918983dd565edd022eb872fbe1777bfb8dd95d955e067bfda(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1d1da0eb9512ba7950976de8b2661f12f08ee885b41f1c30edd7134420aa552a(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d88dc0962ec9b8bc8e720fc9582d392022e5e96820beb986e7bbb65dd9caf0e6(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__98aee4a12946db0cc506479815d250aec935e13e3154b1e6e2d24f3e7bde5f62(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__214346c3466f8b883d9d87a248a49a7463ace1a5982ef5b3986430a524578916(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__83d3407d51b29a7a1543bf6d0c6bc9dd8f2ae038602289ebc3143fcc758cecd7(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7a5e96a94c6a32b7b0c39b7e3ebe740bbbbd68252bb6719190f25539a1570fc3(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dba344aee5408f59fafb3905d774c3f02bc6d747e4d4d0aa4e32cab428d01b77(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__56bc8246d4d66c4a0a738222a6a09222090fa6f1542637c6956a66d2d763110f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__86744fc574cb8902d17c35efe7dd7ef3f53099df1412c884dbf33cd6ea9960f0(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5d889a778659fe4df315b48c96a4c54f58219ac77628aba7dad0a1618ba4cfe5(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2688565885b095e90903e8023bf1b8f161bf6fca2530f18c53d3e51b37c8bb0f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1cb3282a1afaa9055e0e4c949bbe9fa9bb23e97db6ce48bf3e1820612699b018(
    application_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cf1a8939f88adbbe6d9ee42884f77f8f82cc6a01219d2561937e24e60aac4b7e(
    attribute_group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1ef43de883bfc1c1925a33523f80805ccbd08675311652004e1dca371a84dc24(
    portfolio_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bb569c8d418d95489d24e6c0d4f6b852c895f115a9cfd0e3cb9c6d77679d9c4b(
    product_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__76793c047df69b845ba625d61ab284f4050037279da49b10889e333bd20ba069(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__94b3817a35535d5911e0468ee94fc38d4b925eb5f31a131d4b3479a07a09e7e4(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__166ea47261e77afa84d5f8d15522762d2e83e67e0b117add923234dd9ee3a107(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9f9926fe0d419c4a9cecd73d14d98dedd71c01cbfcb354db2bef1e255542f2f0(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7d56e1a6aa2c4cd4f386ffcb730c1180c03b2b2da854e7c35cf7f92d8f6bc41a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__30ff5b200e689437b8ad5a3c1433fb419139251ddf6f85ffff1bf4d457640c3c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f5ed3ca966534014f7e065297f5dc4f4ef81ae21dfbe79df651c5ae55b8b93a1(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__13b3ade9ac9e0dabe4e74805db6dc9a59aa60596d9010c2573e14f5a414111a6(
    namespace_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f9e840f2bfc641b49daa51da4d07d84cbfa9550a127d9151dbb1073249f18dd2(
    service_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__00836319ac4c750d7251bce510777d284e2215cb997cfc2bfb25c89ac0dd4666(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ecaf5d197d18a9692dbc2e2f54085404a64b5c4974758b838b78840eff3c78b2(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ff698471aa7b0376982f8175033e69c6cc232794994792a000af70a1715d2c19(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fd3c383d3ed1cce76472de045e92a6ab3b9b3d2ddfb00f251c031e48d8ebcb0c(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c61598712824cea10232405eec7a81589dbac6305889d86067f0d0e9dafacf82(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__586f09737757a3e9c53cae39a42eb69af52bec990e1b12efbcaeb37b1100a021(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3807e4ae7adddac04a7cf30edb08c28ffd4c3aca24d323a6bad00ee5eda630ae(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__24175140b43ee1244e94b72a3c153e89c7e24ba37dca605cc3c15a9940ef1b84(
    service_code: builtins.str,
    quota_code: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5417bc76d8960997df5965f7a7d26e133fa0c55fd6113bc53e64ac32aff76de3(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bc06f97eb0228245cafe9e469c15b7af500f45ee80eb5a6fa6e24066f6a2f272(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5b0611a71f985969a0147417e9b8e38b511cc72bdb06526ea42db2ca1ed452f0(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5a144f1c39f4441a1335ec83eb31648b863010f936e390121f49e1bf37de2a26(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2d61c7a0c046b1fcb1ae9210dc3c2c1d0ed4329816a8d96934fc240ba84aab0b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7f05f0c612489fbc449a65141e5368321b6c3a3422ba1a4552d7e72ce175e66b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__74e4d70ba2ffc2b77fc295091ec8243da09af403833dcf3e494f0892ddf6e1f3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5f5b32a557ee89d998ce82dab58a978899ca982878e02f9f402d145645eab92a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__40efa58fcb305428fe4bb6557b45d1a1288121d2cc1b7295d17ef08a2892e11c(
    configuration_set_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0d09c11ee0d98d8ab9b4d755621a0cee1f96dc4e156bc5d7bd0ac7eea7b40dff(
    template_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f7e690f7c1a682e1c822912ebb381f08a7e009f22a2883e5fadd5c3860c386f5(
    identity_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8516eeb0ee2bee19ca1f0f288f4c5b54288d2e7a627fcd9385daf179c9a72bde(
    template_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b3efa9734e4a54847296acd6e77b84562d14c895b83f5432f2bb1de3d8ff42cc(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__192f1e6bbc1f67730875d1bb6061f75d327960b096c30c4df123f37568bd6eff(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__34ca7ea8adcdbf366d86ea2fd1b5525d4e73a74d99fb0e4f4708f5358f855600(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5b6cc86ded288bb8fef8521a582c6c26d82e6c861296de716aef0533e70679e6(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__367e8a29c6f15b28f934bd47d32b3d667c01c273f4df98345ee8a73f59c8b0e3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a87f61cfea30cea3f57671597179400cf9edbdf7be59ba51f0ba06fddae5bd38(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ee37059d2f950354d1e371d52a2df67feb9183c36b31c3baf64f0e6f7cb60a7b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7761fe07d1b24a44dba875ac883be9976008c517a586e349be0fde4274db8a6d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d18f4659705187489addbb6e6dcccae8691f79c0f381181cbaf35c8b32e39f23(
    configuration_set_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1455153690bed9033480c259a4f9d7674bf20e9b2398cfe3967ef2bdaf08071a(
    dedicated_ip_pool: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__01c34ab46bf7d272b95170a1fd6c1d082431345cf97c0abb61e473538dda3768(
    report_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ea7bbe50aad0d5cdac55a3d8670bbd304e00bdf356951f9902cf3ee6f31f01c3(
    identity_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0edff633f91f072458d04e80b93f3affa8dd4ae7c4ef8a0c9669bfab10c97f96(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__aad92e8685b9852b6e1a9a57daf8ec28908bdd99910de40a6fc46e0f054eb266(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__aebc1bf352e14a6a45590dac33fb4f7b4c2158aa3d25f1cb14e4bc4502453296(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__939b4c47d72d1d86d986f4d6b130dcc157396b9356de260530716a26a3a68ea1(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b037c9e033d5f5a573cb3677058ad0109af3e23ed5732c7cd75ee4e583417c27(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__92d0659dc748d7997ac19f3319c27b59d6c599475325dc2fca922946ba53787e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5877ced29aa8058dabdfccc2d8a8e0eb076153110a65e865884ef3f13a48024d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1e319a4d1bc0661c173b10e56bf1a1ed531c236311379cb35c5cd65e053aa2f0(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__75deed51736a745188e5abde2c7e44508772b495fc27d98568012f8dc0403848(
    configuration_set_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b4f0496a0413816e2008d92ef22742a61f4c5e3cedbdbf374afdd1e4ad8babb2(
    contact_list_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4a7b03c8b6368809daa7eaec12e66e109a64d0d4ef86c8b9b4448c46d6f1454f(
    template_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3a45bcdf45ecceecc0b1dc8f14b60c0524f4e3f2025e87dac7961e5035cb7f8f(
    dedicated_ip_pool: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8a0b1ba541d8c5ff25538dcb9d4cb9a0774cc38997239aa92c22aad393aec427(
    report_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__12a16f666a99e8de55b24fd39aef36d1f8c311bf5aba32cc949b61ea9b831b2b(
    identity_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2bf136e0afdf29a3eef64d4e0b6383f81b04c0e7e6b3d907dae454663a6df7be(
    import_job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7c628c4243c208a6be09c8175a97e2b318991072889f93bbf7d7616925aba3af(
    template_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__672d896d229630d5445a80343a0e1527cd296ed2219135e78154417168190b83(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ebeee6f37ae5b8253b97bf49de897cf9b4afd3d52cd3e4f068f2d1d19b8883bb(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7b4feae8832287c5ea0116aa537a50d03f466e019802ac0f48ab8f3698cc390c(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c7110de9eeaada351e5bdd1762070d0241fc3413c9c4b59c3c8c2f6c76c45018(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f6dcca718b7a58e2b1c04174ea401da2965718cb8b36a2121ab80c434a1d9692(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bffbd26642a3c2c730ffcf9bf45caa2adf08982eb7fcaaa1897b18cab285b4ba(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__86c6790a89658ec0c74b1d5ef784c8b3a0d6777f0b1d8b0012adaaa1f5037a3d(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9ee13293f6ec62f60e28528ea1d3c57cde3a5d09c3d3f26d4e071a2709313a2d(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2319dbe72568d9252172ebd922a5ddb9727c54f57b7b3c9a522f838f0d28e6f7(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b7ef7ebc5e0aeaaffe8370c2576f3e24b55d2fd98b13c5c0e2af373f32ab3cab(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__167d9464c65a4ade9d01dbc7998c5252526a399dea326a0b95bc5f5c824653d4(
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fb603d50503b24e030a2f8ca638694d11d50fe4b649c7ada5f085674a2d614e7(
    profile_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cff38f64cb76e3f9599cc3d01ddd8523ff0cb673050eed13406c48dd07e6a97f(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__15fbd5d238ce6bc3eb73d9f9de67e6c6d47dcc10e50251a46f498bc3ceace2c4(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c8d1f3adcd66b64402df8829a108a004d6b57be0466940b633aaa9ba26856ff9(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__013cab7ab4b7cfa94f2b18e769a0af8c110fe4aa8634159807a9ffdfa27e3cbe(
    simulation_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__981ea21ed8a0fee712143fbdc94206fdd27575851b6f52a7c2d6db7275fc201f(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__10b6ee64e96dc867880e2702619545c39b09b919a0f41a5e433a1fe32b934eb7(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4638f1d357bdcaeb2d149b26eb0014e5e0e2d677ab9eab03b66503bf0c3e67fb(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ed4c15494244e09b22241aa1df6cff7d10e7f725ca0307a797deceb9d869332e(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2924c37dde393ff3567947435013caa81d0426679bb59c389cfd180b004df2b2(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__906735803afb3ebccfd860f24580649e4aa945350620e13da4a7b7a89d8170ab(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0a8572826a01039491aaea677ccb01c822878dd99b0f4f50adcf3d51742bb1d1(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9ca86626df5945ff63e17c8a4b36d9b5d8f9d7722347b1a126e6483686a51102(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e09917c5358a03f13df7c760a0e400f8408bf2bdcb2ddd7c562ecf7d6dbb62dd(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7d3238f8e5eaa87f8f858c51b5bfed45252482637aecd1a0abf16bce3eee6b14(
    configuration_set_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1d763ffea5165d438e9bb1881cd6a0e582e167f214080de4174b98b336db0634(
    opt_out_list_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__77bec5694223178ca7b8629286b5c37b86e3d32cc2f8468b25bc4cc1d0a22c6e(
    phone_number_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8fce59308e8114486b81cd95d1264188e218443a318ea941662983bbef15c01f(
    pool_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__27ef0c2458938e0c91b016f929bf03b029676da95f6670b49b2ccc3752f447d9(
    sender_id: builtins.str,
    iso_country_code: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c9b10b150085c0184b0f0ad1cd0df5dd6deec75985ec5550bbdef4680b031fc8(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__504dc41a13c5db43524d41fadfdcad33ab037ae1cde01ced8d8786fdebd4413d(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3c9c893433e56788b954446939d04f0c2e6062b00cfbdd45ec4fc38f7bd37738(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1bc7df8adec6f6bc0db69afa2e85c82203fa5542c91c79eee3ce5a97006ccf8c(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e0fefe778747a8ae54bf92028d9cc8949dccea8293ad0c1535b334a3249bf8fe(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__654e3e880ec3edcd0d3a7fa04d7c33033ea18372c43a37ea861138ba6b3bc717(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__51fb6010c9656901e011f0880972afbd15c7e05bb20fb741d9bcda0c50519faa(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1917470060469422d915d151b1e71453304f40bc3230ff54508b3b44ceac7d5a(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e4efaaba4a23d245cd7bd848de6bc9c9cc9836d65574f3ab63d93b9a2cca2e5e(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ca34d63acb82872a5178f6e1fce0b5325acbd97f14e590979163dabae9eeaa9b(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1a0911fbb141bdf8997a04c87bb4a2faee0ab48f67b652ca0e9678b8bf734716(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f40efdc1c39aad1295daa4c28d0986e9f68bc2268e1d8eb6cbb605803b54349d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6d0f09ce247bb145bb0ddd167165dfa18d4b14666357772999dd99107c296c1f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a9de08845c19af73e116617284a2ea7f864166f700984f9746396ff5eb211a6a(
    topic_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e122912a6ba4b5a92d9723934aaf83598892a66b104db1b372e4c9f7ba99a4bf(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__70937720a021a3a9b519c417a1c98f34dd488d7e3674d2aa35e32a67efb8c459(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8de3055aa368b7f7649396294aaab8f9a8b6a3ac9e51366c322b159b5f3068dd(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8961e70f71fbdb23521b0d32af61687775d762332ee7020fb6814735e9057866(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f1e72e9c3a6f36fa0f76efd7ec1d89343c27644c56b5ab4130cb63a666da01f0(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__773d8e365ae1799f54d8bb5aba23b7c227bd4b973859e25b3ecaf810117a592d(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__490fb1e78924745c47469014ebec6c4561b5ceb019b00633f98b4324662ab086(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__23b846b087ab5348468a8f1438409aa110c059a72f56583064c74de62b134062(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9ea22e497308ff3f8e9445b0c4b6ce88a0e1a63d8edc1d366adbf5776c041ed9(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fccd9fc39e93f80f77296767e0d60aa02992ca1bed806a4d3eabb8d90ab921ee(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__51e1daeda696c8932ee675101e23a053ead15338af6140ef7d5e2f94e8ef2cd2(
    queue_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e272461768414eb0ec3967df4dba3057b72c8c54f036f51d22e65c9ec243c41e(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__db192eae69bfbf21c201d69f35158fe23a69da9681df05af1c48156b1eff2491(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0ad998b19f58b64e9262fe0a0b6fa1c923f9e53915da72f6af4f46f207e0cefd(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d21d4780faecef7937f8b13481b61ce9ff1d9e874f25d9f4bfa0822119433144(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6368fc3f0f6e02902d81e09304b263b2b6a17373ac3c68ad62fd425253acb88b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a5d344accd91c4bc0d9fb62199901673bca733e7737156d6fc55ff634d5fba71(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fdeba58250f33179a26d13118f45e6845eca131494ddaa82e59cf4867f767031(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__47e56a396519fa21988aeadc34f3e2ee48928ab667a3d78a375b49d8554b9ae5(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b731304a3f289d36bcf30999f1a54b7c0e03ab148ce050f5750b69dc7ff54042(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__73995f777b648b0d5520ae18d48d2db71cc906fd4d2c851c8fa4527a0b12708a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__723e9848902d7aa95d07abe1ce1946fac3d6be7d9b22071fb017f01c93c4148f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3a690b2e7212dffe57321e819b0cc554abff0949b8a337133dd5faf5331ce306(
    association_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0b7c87b26fe3a829e99a8fde3f9a342e89666955068f9ee3666f8d48df7f63f4(
    automation_definition_name: builtins.str,
    version_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ce9c6b9e0e7c6c0db227b0c4449f71fdff22c7bdf14bfb3603782bcb1cd87df4(
    automation_execution_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__93bdc703883db78fd3066ce97e86a791e3161cfd15134686c66792af3d2c8538(
    bucket_name: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8831332cc87dc66f659de4d73ef21ad89457ded5ad9513aa5e545940a7b1986b(
    document_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__60f7f3607269202710f649a183cba792709972775e32dc65fb2ca2dd52c586c9(
    instance_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2dae4ed88e159631d79293a79cec2ecea7dc40f51321224d4a5e4e56815d1428(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7b5d8647d7a2f1c5c3d0bb6885d642d439d647d5f66f7453fe4345bab2de1818(
    instance_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ceaafbd0ad6b1bb40725ab4fe8941dbb37516cff23c325e67311ff64b28bc2fc(
    instance_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__40d0e87526570dfb7d5517b587dc3535379f754ca0d32f5d68703ae712b446ee(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__01902bc286564c45dc9cd7d427d29ad5ae3e5d06bb74beae2766ad0005a29e2d(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__744056e81ef89f4d59306e8a9ea9bf6d7da09d3f68fe51d95e888e1cd46aaaee(
    parameter_name_without_leading_slash: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0034e20d5babf1c3e8cbb2ef63d5d68affe53e5803c8a972ce4080a2998ec672(
    patch_baseline_id_resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__376c05b04d5b57766995569b6dfc6fb1fc6e4b960c48e2e49202b15cadf09dcf(
    sync_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e28c5e04fd85884e07b599bb134ca39ab8bd18d44b7d7a55fd5bef0688074fdd(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__67233b376bd08a19fa97a0d65a3c875c96d5af84d9eda51b8626962d4addedd4(
    session_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__00fa255a9579b572a472d43df2f78b789d2325f94e12a28b74f1b61e3c1d9ec0(
    task_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__97d5a3ab36abacbe640fb1f617a1ce5bc625fbcebe3662afae7cc0c8deac2781(
    window_target_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f4506cae2860b90df0d35e04d061047be854ef7f8cb3bf7607eb4a9e0304a51f(
    window_task_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6ce1d5b64b818d34eb9fa5a9cef692922506a7cde7dbecccaff02508d92557e5(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__34d20de9249ac4fe9453fc8d0c34075c2f0f60f9bac0a768feb56c6aab2fa700(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b97a269b85fb988a2ce94394ec2fbcb1e0249487b8d9118a2642929022cd1457(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e07296ecf68d77ad0520f7c8a42711492e67e7decfe7955ac4356b8953a7d722(
    contact_alias: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ac36c6957ce6f6d5fdbd11be227074c2039919277373651eb22cd1628fe97b32(
    contact_alias: builtins.str,
    contact_channel_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d005bb4fbf936d5c009e068331f304f1cd95fbf2b033d7aa3f5096c42299bdf6(
    contact_alias: builtins.str,
    engagement_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4dbd26ae66aec629596db0825730025631a434a4577144de6da6c3517cf6b630(
    contact_alias: builtins.str,
    page_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2290442744ee4a6c7b21f3a73365f280a540c7cef8b9e3da9bbd248be27403b6(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3871e3e1558ba0436a8022415cf9e7843c90893522ef77c2089d3cdc19528843(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__62f60a6407d30858fcc35b15ffb0ebecacee19839b130dd757d3be587e955f6d(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d21621d14d1dacd99903eb5025c11e18b9240fccf2cfb4d66629ef2e470f41f0(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d64ff359575fc154f9664b6630223476b64ea9b439b6b43da0a4f01062cea74a(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__34af6c06c3863e3d9f37aeb060ccb85b1d1c654143d874b2878968bd55a22ca8(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__26cd2c5f407d7b40a87482dfc83811cd15a9c06cc21f367870519197dac276ce(
    response_plan: builtins.str,
    incident_record: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__75fe15c4788f7999fe2a1bb3a75e97e42fb3aa7897c39442f0ebedaa48731098(
    replication_set: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0c5626431eb7a73aa9d7cbc925ed3a3aad14b3a6a64d99bc2c74d883c4570b9a(
    response_plan: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e82f33ca7ddabbab3e011de103bd0fc268b12c2a7e77a76e5376f59859a350dc(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9a3015fb513bb07a72bee00f6cd06fbfd33184bd3d49eca61e60f3f200f4711e(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8e1f3c37c8d8f52f2f9fd199e1cd6d6bd3fff929890029b3d7ffb48cdfa1f801(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cbb4850102aacdfd95276abeacf8fddc6f79e2147dc3b48b41be078932b55983(
    application_type: builtins.str,
    application_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a9cb9d67a9bea3626033eb6d8fd231be02240f647e602b9ae266cafefbf3f5a3(
    application_type: builtins.str,
    application_id: builtins.str,
    database_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__71068862c1238d56139f055258b2bc9b507fe2cd665845a2baa72793829763fb(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__77842f52ae99b69674c800be95d62b47c7b8a6284c1d6df618df60331527bb93(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7c47be7bfa792b19301b4cbc9e823dee415a54d1aa7c44817bb059b2f55ca5f1(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__177593f239ff7cd7664dd659c9177f9fded3acb9eda1d3a1b6af4a4370ba0816(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__46ae1a7e0027cf8835661744952d68d02d68d4d25396305479472938231c14e3(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__69895cc4a897e97b8d0712803ab2fd2c95b1fcd55c21e96b8cdfe8c68c22a97a(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5f878961c46a0839dbcdf6b301b2c32f0cde1c3e515acf5f22aa53ecee02c938(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b6f5b6e3cf68d1cb0f4e7c35a8ad3ae7b2128dccac84cc208bc7a17c8bb9f47b(
    account_id: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a1787d6c191a21966c5b0010f00f83a0b0a9f380c3a14cc9eb033ade897fea03(
    instance_id: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__63ade45b9bb87fef9cbb6f484172b4b507c024bb4d4db369dd7e4df78ad7105e(
    instance_id: builtins.str,
    permission_set_id: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c216bafa9a5b8047acb9936f27492a5f91b4392541ab5bf1ee47acf7c18f4085(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__537abb243bc9d940cf81d1fc94e8eba3e3b3edad6c88e6ab7813017ff3c66cc9(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f024cc4b61981becd4f619604c9bdb338f2222157d5b405c64246d1fd54828fb(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ed2eb7056d5245b4e2a809546003657b2e0385664c0ebf8434a8dfce7d95d759(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5eeca7f190ce58c4b30b106d7ea49a7ab1f5c90c06c3e713e151fd881b49f207(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ed0955020bbb0da6925ada301a6d65f2ad958b99dfcdfc3133dc1dd8306008a1(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4e291cd11ec002cab3033624d9a3a12849e557550358a05191438b1ee1dae21a(
    activity_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0191754f5a5c160fdcf9734a0daf21bd185f8f9080fcc2150ca8c921293870e7(
    state_machine_name: builtins.str,
    execution_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3a68d68c4888bd83a5602086eed88979b6b4d549998a3cb27ada82114af38f80(
    state_machine_name: builtins.str,
    execution_id: builtins.str,
    express_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5df039604cc31381ad4caa6a7a15e7e1bf2343eedda532363cb6ed6c1ae48ed7(
    state_machine_name: builtins.str,
    map_run_label: builtins.str,
    map_run_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ac41413fab9e2754ed12469f07af6b7945655f4eb8b18ca2e1c6a2cf4dd1e7fb(
    state_machine_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__87d9873cfbdf85187facec46fa491a94618e5df6219afd37667a4da44bf4d449(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dfa48111a0b3465c2cec6f128e505ea5ac5d780b174020b528d42c745f86481c(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9c3aeca01d88b90536839a962bc6d4044b9ec9887b7133a9b13398339a6bca1c(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f3705bec0b19a0cc8c873674f2c77166f84cc0f2fc0d7e632a1d004ef9801082(
    gateway_id: builtins.str,
    vtldevice: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4dd0165acad7fd54985f5dbfc80632719f692f6ce1acd4c4a8ff76800d4aae06(
    fsa_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__754d09fd07f00c25ba0ca22a1cee1715244821de0986e91c2a33a49a5a1630cf(
    gateway_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f6b4138bc0d492321ca31c010823d6ca2b72d2a39f919ed5db2c84840903f30c(
    share_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__290e6527445ba4129d396990bd1334b7c5a4657cfbffe347fcc7bd9f947eb4cf(
    tape_barcode: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4f2ba424417053514176bd3e3b91bfa433331fb6f6da4105fc3b6625d83fe6ed(
    pool_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eed06797c7a772a537bacc5b19c09c1b312df7e8e411a9521abf0189c5f15b22(
    gateway_id: builtins.str,
    iscsi_target: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b939d883ada70bc93a034725420fc31325fc51d4bd9fdf4794bfcf6a385984d4(
    gateway_id: builtins.str,
    volume_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__624ac004b79de488a735dc28b99c40109dae9abadde957c06a478a6cde0ee75e(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6bdad3bd6ed61feb8e92d788c9dfca5cdbed68ac2821485015452809f74134e0(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__86e170b56bd3a15c7143c1e29f676d302d10480b8c95be9866db5a5e9d47e758(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d4dea5fb5f8cd93353f5ccf2006653ef2d8fc926a945e4bc5d16474bd9043c52(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8e6725f230c6c875e30b5562b4774ff1a66746857730bb4c3396078f00acf952(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__80fc49431fb3c404f8c2dc22277c0cee68e4a616cd02b4a7fb5c13a278fe45e6(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d41dab24468618589a7a45f9d2fe0fa567e02e703c8f4c935a67de4cbd197d75(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9613326b8506bb94417ca35ecc47e23c583842939f8eee1a3ff84cd4da2e9f61(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d26ac9a1d2229cf5de57c1dee38992fcbee5ecd4c10665875da2885630ab2e0f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__58033881b816cf03cd91fe2d4377ffc19c642e3f8747fc47a90301eca9ac7be2(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9ddbdf61f3b746862785cb87f5a34889697fd1543d74221c5a33355a4598f3ce(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ed77f7dd92e58c7e561e2b08384e270f8d317b25764c55ae350b84decf89c7cf(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1a39288a20bd0992caf1e14ee9a4dc1417fbb45b706cf187be9081f0436df352(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ef185aa1c2330a9cdebed47e2dc2f25f6eeb749684c0a09abcf744d5934dd785(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7c5024da0f6a7450c4110cde370ca0e7a028e151ad5b68b7cac2fb243e1e562c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4751655c11baeee8911ec1dba9af835a411a98069116e6de3a803d241f894c49(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fd2897ec1e6ede668d3db6593bc41b4c76efdcff066b36ef6c159e129bead359(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7e6cc41b9ae285697ba05f96b9f2c45f278c23eaf6990a4f89ebb57914eee537(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5a246586d4a47e7c8c472ea8fbe7f298308e4eae0bed4f08735dcfbcd6d36103(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f73de92cbc62d86829fdf56f54beb68287fd51146d8491ccf2654e2f0259b6bc(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__119f4ef398ada60b80718a14f0ff8f7ff6d605055ae3037fd3d9f1056f48a8dc(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c18ff4e47b571b9b521ee344ccf390062475dacaf971a6a27729423d1e317935(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0e5c2c792cb26c5833dfebbdb60a3662beb1abfae5415c34a2d82df5399d7ae9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__097107d31340096dee938186a1394aa944cef8e425f4b3101ed6f6f00bc850f8(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__28fe106fa961c346331008e48c8648cc036e739f9ebc459cf6a5977039fc17cf(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e00d8fa17cf7675f5a2aab7603d1e68d20cacb4c9f80187579838be8234d295b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4b56c9d23932256637837ba0e00e3c217642fbefdfacbfa85d694242089163ea(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8fd070e199c8d4d948a364af1585418ed8216267987cb3f2320eaf7cd3f0e96d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cf0c6ddda289a88b108d90713a468ad7ff905587f4d32fb8539a4541735576a7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3be76b5a622b89d650aee6ad081bc2f72100eafb6d78fdb54bd98e95071b27a2(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e2def24883e16b11b1c7f4e1b6aeafa31bb701bbb792f28b33833ceaaa6b6e14(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0a4b9c8ef93daf99263415b1787025c7939133c6aed81a65f4071fe599dc3761(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__40927177ed01317019d4346c0f3a59e4ce83c2e5c6b563d83efdac8465f111e2(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__aeb67f5368baf9421cb4234c2c42937f7139b84fb2a09e1756e0a95942b78858(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ce9474e89919cd0c15f3b7c7128e1d7a94d57922b51ea4076547a679dbfda28b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7bb522bcfa7ce1ef9eff5880794b44ab61392fc968f3ca987b4683cca3b5d02f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9cc9cef74dbd4eaa87838f37d9ea514f1daefd3d66287b13976343041bb541ad(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fc3582cf863121fef55d0e223fb7708753fb6392a9dcb1340678eed309104dab(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9676d5ef1d2d61698b96b5f2a827a843cc1211587c9c67723660bf4334e644d2(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dc4620aaf2e705eef7492643d1e3be1d1c0888246740771fc8b71999ff5cdb24(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__90bd70bd821af043c7fe793294cafca4af1f1850ace81cc763b14f4ffbc2594f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2fa6ff17f83e90c9034d6779b19e37a54d2deeb0e6c1798dae7c97e5fb6de71a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dbeb608be78161f55c7dd2bb6f4dffe1fa3ef69a02d66df7abcfcd6c280eef07(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__01f13036fd39efefad3d0e0b1868c764473ba8f41c050bfb2d904e4968caa5b4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5725398960785bb97bd65260f913cf39c476eb7564678edcc32f0618a69c5f30(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__40adba0ddeb6e4210248574a1347c35b57f08a87fbd87c6693b0a1d2362c7cd4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__905761b6982a83a87ada445a61d2fbcb4859b18f72a4439c61cc6c3c9f447e72(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2b113d389bd6b42a0cd95224efa65ad56d4adefbc807187259aeb312442b7c99(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__497da8efeb48a097a4171b058d5e7b4749e3868fe18ab12704f1672efdba3910(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__101f270d955990943edb3d54190d63435f2cc26d28be1eb793c481e3cd8eb7d5(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__800339932e78f3fd812c48d204510ab3fef77c221f0fa84752391ecef66931ac(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__10e9461fb8138723b4aae739414da04da16bbb70a553f555d73a01fdb41f41a0(
    role_name_with_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a1f9095d2b2e63ef1801b7290b6594aaf2e2e707e291bc0b2d7906cf4f496cbb(
    user_name_with_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5c389ee1ca374f6e575b6f61ce8ae74569e28ea4a131139cb5213d9b828fb1fa(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f9dc5225c527b4109a7a8f2e0be8d261ed0f5149821e2645cbf7633941fbddc4(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2710d56d7481cb2137a67683680a49ef0ca63eee56abb66a0638dd24d3038d53(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c2c787ff866306980d383230807ec7cf190f1d3704145a00cf06f01a3eea7334(
    project_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__20d1f1c66dfe136039bb797d75f4cc0e20b2f58faac8351c8de8414b2c53df26(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a3d0ddb65847027cf1a4d109b4e5c0b9f1ede3bb8639560b61baed62d3ee5cdd(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d9cf79fd3d670e6fed5baa91453f7d2d241b6445e1f3535d8d71c090e90d506e(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5e9f9672f2e4d93df4a37cbd07d16014e208cd750c38b27a6bf19b60230a445d(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8aba9e97a71679f0c06c93273ae543ffcd64744f79f243aa89d60baf689242c8(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__880d648c725d62e41c16e576729a2a0800f28e6c1d4c4af096ceff529700be0c(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__39aa9f762a42beebbc40899a7838347d25b92ff92e62d24842328e0d939420be(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c606e7cc7ef1a932ad96527f6119385bfbe9fe6e33a195402cbb0e076433c0bc(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f7118001cbe60d38ec66523ca6a6b1280e40ef727fd7654484593cf521d6eca2(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f7eb470d0fedadad25bcf462354641906fb70020a819f1c033895bf4775afef4(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__663cbfcc2cfcbf5ed11f789bce19f76ba688244c0189506d72e3e4e0f94a8168(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f3a2d1de5e087e267ac010fd913702d408585ea13a5cb4b0b7c727d37d8786b5(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__85d3722f0c6a35f4974c570596c493df12d3bea4a45f6aa9c036261e7a6f6016(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__92717c3b3e1958ba21275c5cf277c4bfc9b4cfb0f838fa5b362a71d59bd7f11f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__401005076d8d2ef514993ed0d56b7e0d3fd47f3cbbb277a1a36370133acc0c2a(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9f98bd1b99d83c024228cf2f41ee3e186dbee2b13f17c1a8cd611a3c6c5f5000(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ab2940dccaadef726b66e3d000815f5e71a781aded7385299b23f26dcbf0dabc(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ab8b097c6f56ec476347e8f7e64f632ddf5ab70de1c05dfea9c479ba5c2a0391(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__546fdb198014edd7d9e7598cae50e7c495cf4d78b58276f5fc4161d28d8fe8e5(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1da560b7a0b6df9245e3a63ce433b4fac6af3f3150e93b9ccf934151ef8edee1(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cf067ab42a1590e2947268626f21d4650207bf17fef2ee41f1f6a001d6406ad6(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__081ca266b067a927bf42506e3e02b1a5ac5684fe78da5aed049a35e19a1e7650(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9dd5654595f04a41c77b6b28d80025ced96f956ac9e5665f363f7f1ca8c1f1d3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fbd2445b760cd02155a46ffdb2334b89cab3e4209c17380c124f21b056e9eae0(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1e6e40d34be7990b9ab90c1d9552001f13a6cef48bc1deef5a3f068b139805e5(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cc742c8a8b3d1e16b5bf5c727f0d1ab7d31d9d35616a118e7961f66605112824(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d5f2a620f5ec538cca1695d4fc05ea5e7dee2a96af40b939228eabc69422bbf6(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ab706faaab2a04b42d721d376e089783cc7e42ca78b8ebad193ef079b2af66a4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__73843ec09987a1b3413aec002d4b18cb3ab587aa083d202745b7079fd2d2acab(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__89f08a0aba629adec94302d327b8ec07ddc4f5e2f942c3316c743444af7cfbcb(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__84172be50fbaa397baf1d7f83b76ae68f10193c7e748f0accbcb873d1b870c00(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2a3d9c3088480cebe2589e1cd841df224ab0b29b935755f529dae072216a409a(
    domain_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bbd8a1618acf55cedf4988ce47735c675ad40fce308dd1fd89b5e132740aa37f(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__729dc5ea8c1aea81b5eacc910a37804635e8dcacc1da1dc7677c0a38f65799ca(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f41f0ea26593ead621dd90c949d7bb3a809aac3110ab3a1e4159aef02ab4033b(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__79db552aad46ba626a797c24f6894397fe326ceafb3f2719fcbc605d30e14e0b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__31e9b4b3753b07d12de9b34cdb8e83885aebcfc1d6d51b21b0ea574fcee818e9(
    canary_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4d3d9f9fd8682951232d1ab254ebd7940b33b544a5dedc84a1c699c41c9ff8a0(
    group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d6c71e74bf6da61bd48a10f2b9e989cfecd358777ea64135eaec08e30190d6f9(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__228a815b6e912cf29c33be27353eb4fabb696070fac0d6469fcb33efb6b83ae5(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__95a714f3bf823af6dc4f9ce45c95903e192ec56b42e0ec5098ff9500ffc2ad28(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1d4ae76c379cc588fc843f99fbc8b810b2c61963ae29dbf121cab91595cc161d(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__224dc8b2d664c93d8122348a9421478b4e5710789c0411462ae3391607768d14(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d8128e8848d9e1a176bee2c0f654b0581b5b3817d8939785cb378fc68f5f122b(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fa8c212cece8aa01566cfeb6723b9be64a2ed0ed34cf32d9aa3b707bb7f591f3(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1719ad04cb3fad19fe645a6a79b118d106a66b625e2c3341b8b12f35438d6bfb(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__de24a031499f3d290e14f3a644e23ff5c989c20963f4c8be26d59837b6bb6d7b(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__48b47a21c3b86e66a9299a6cb18d33a99147d5bb399455915f73d2182b242a40(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ee483bda936ec13f0f62d200494cf4aef6c632961fa6554826a283eaa024e9dc(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d22c607ca6010838de47efe07c056fde26cde6fb02fca8cacc5ea8f9d73f7511(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ec70fc662bf2e01e7afc89c49998eee675a84dd05102e577b840c94408d91aa8(
    database_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2f1bb7f0bfe8635d3c001ce5e21e9a9e0109cdadef77f57ade3dc033e5807d3d(
    scheduled_query_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cfc4cc2ec883b8f2354d272a0976e7207b21055ebb7f8de5de41a932b814dcee(
    database_name: builtins.str,
    table_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5b24675b710539b8947b64871894e4d3621614bc30f6fd6f7986305186a26839(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1815e746353d2c032737c60eccd675e1d2dc9661055528ab81eb4829cbdfdc87(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__da72cfafc3a77f77e384569ba362c315660f7e44829adfea275cd3f2c787dda5(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bc6d8bca1745d4c25b6b37fe67ef7cf9ae0e1ca75fc4861f2758fd49a33fdc36(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__34af5f1ad639e27f581e68a8d5146b9fa768e2d115b6afdd3dd972676de91258(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__94745ec3295d458cc0fdd3abfb4bf925955eebc8b62306f6d5acc9fb806696d3(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9125165f1c7e2676fb6c8ced601153f4ad0013f021e1d01784f944fbcaef60fa(
    function_instance_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4af165ab86e053df8df675925f1632131a6cfc87f148c69b3975591e15a5cd0b(
    function_package_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2417c6ee036e1e7b7139b71523506c92fa7e42ce0d13280b4d796d0b809fa507(
    network_instance_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__910361a523340d3ec21662d1139acb43c279a4226d15bdb3e715241ec8dcd180(
    network_operation_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e34c79e9d9232cce4bcddcccf1b541d952438eaba3a28ff3bd344c33048007ee(
    network_package_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a1d172520938b2ef7ef3168c4a2d5938d261a2483f49063dc0d2b067fa4222fa(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d4dbe9a1c7c65978f2b13564faf2cfdeef0bc3cfb5bab92845179acd644cb77b(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5240abf1b7e52717682400c05c8437b1468e8ac7d4ac1d2d5d539a4b51654e57(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ee4022d350c718f8c830b2d4c9c06b1197b866025d7b933d0d1a4c8447d61e22(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3b160391d20bb786d185bf14331a1cbcb14c73e9bc8bc94db69a03c6d59ce507(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cf92ca4f951110771ea4a5922a131081870458345095f285ba32a8109dd27440(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dda65eb06857ba8b510afeff64300b238057f3390c63080c9735da027371f0db(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__58b2f48793dc1f004a7e05b726003a1f95cbd6e9e3cd19b79ba500cae210f2e7(
    category_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f6056a54bc5acbfc56fc175e9d8f08ae3e8f4b503c032fbd97b3d00571c0eee9(
    job_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__894a96f27215e4eb9f586f8db36eef8bbe92b01f85473e051610127b5573625e(
    model_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2914d583e3ffce5dc6a9224a0afb431fa41bfe3ed78b05b641abf2dc82476b82(
    job_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dd11428f223cf45d3e9d13766cc19d19e3fc255507d60491bee6b64a754217c0(
    vocabulary_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d1cc5fcea587f0dd81ba30c68b13493830415ac411cd5d24f33ec8474199feed(
    job_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2c7e9b0a14032534c593b9a0de35b7886a2e12098116a67cd5273a891702622f(
    vocabulary_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__68be0fc75254e58a1c0ff6d22635f76e37e8524b0c92432efd3366bdb438167b(
    vocabulary_filter_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2fb9e4e30259cde4213b501402bdc8a53264216191ffce66eef7648e4fc7d648(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5a14473164302e1ed8c1319d09e750fcbf6ad095b6857f28cf10b54e89ded17c(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__63b9f22b8cf9806947fc6410cb8c2fd74fffda7969b1953575d4248125f435b4(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e5287b1d3c771413c286a5c9592ac1ac0212bea69ae07628cb635d822a8c9f6c(
    agreement_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0750c1caa2dea27b2fce681238b105f1e4c48b1c079bd259873cac449f1ee736(
    certificate_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0f9cba706901a6d118adbd5f5e24deb3470063da1f65187b091540730b986540(
    connector_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3e3b6e5d1b47679d1593a7ba675cbe4ffb693be9d61360820ea365b12ed1d90d(
    server_id: builtins.str,
    host_key_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c5a85ca9f4292acfb24a318bc530500ab8a1e7fa4347e84382ddc9013bb24d48(
    profile_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4d0141f74c4d81f4771424ef73f0e9a62a429f02ab4d2d36363181f67e624487(
    server_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dee9d058c76c3478cff9bdf2f5e1b9bee7d1ada30a57f2440e6a05a0c5a14fc6(
    server_id: builtins.str,
    user_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__13dec3df02b9eabd2871a514e4e4115a6a5327efcced82bf2f29ee75f97631b4(
    workflow_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__726e466d63afaba0c4c860c214eedbaa63f57a9ea828f8fa13daddbf693ea283(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__76fde3cc12ba747dc8826adeed16df8a898cab1bbd60f40112e3376afa417f7e(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__576460c0eb2ed326e5ff565e62262b7df3825892d3d899463573360b47a1a171(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6352ca38c76e4ab07ae86904adbe3dd56ba64021960ff42439662839bd37b06d(
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8192602327a443c39da8311ad6fe802dbb7151d65b114c34a7c0ff4a297d608e(
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ae8b38e7e9759a3c41489b788ccd843b99bc6310c0b066e5a6646a7a1426ad6b(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2be198120610f90bbdf7df7c478141d424d7c5a096feed64cd119a9f0344879f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__43444a5d8678154f5e5aaf4a0fdc618b727452f3725d75347e30282cec97bb95(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1fb83e395cf3c99d9bfd4825ff29375f23d5c3cf53e8310bee528f863421591e(
    category_code: builtins.str,
    check_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f405f62c342c4bd37d784f4aa40861e19f52346f09af6280e0e2c219eaae27eb(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__272fe5e0190e057edf02a745db15f1df81396e8d9fa8f0e20ee6e3d634f07626(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9593447a04d774bc87a3cdc642ccd9c7f5727e04f557d840e6febe1524e47985(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f13a4fbf1efe19ee7435ed6bb1f97cb61e21b93187570eb1e79768e147c29deb(
    resource_id: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__873c3d7fda770ffbf18f274b85b69785dc6f9ca5bd1717d0377aca0afb8d9a57(
    resource_id: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c00e49488d435a86243ff99f52da64f8995f0fdbe6cc0cbba4c932920d71e84d(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2b0de9f2c082eb465ce66656b25026c6166a16f5745dcbcc5dfe9d33721f02c8(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2e7a0f581a6afbad03ab167c2841c0489f6f38f5d55240743435ea2a9167bac4(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__09b7139463151ebef24e6e6889ee936fbc167fdcbbadd69420237d3443ea2326(
    domain_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c9c9c6986ef1c0cfabdcc3bde64476c9331a58401adc275ed19e13f92db7f25d(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__42d308245a17e33df44d6c12be17fedf783af7167609ef5629fbc79867635dc1(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6b145f8b254834cfdee8fe9a8f1d34dbec995e2107b83bc0ce26d94fd648eb70(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2e17c8d391c2eb5335ef273753c826b40b22f9a55a4e1cdd14569d623a87270a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c8ebf003c42352209f555b1e4106a42a714b02b835b08c5e0ee41de97421e588(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__78cc658b293ed08bad100724d9abe01426354d6ad961bb6988a0466b5a159256(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3d3785840fc1c498dc02c99058237b24f0b965fcf7c65e83f0f5a50849fce6e3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dabb495b3ede5ff6309375f9556d22e44174004e6660f475197e9b1400561e40(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ef9d0ab6e91db608f64da2e162940c514eff6c9286cac276af4ac048f102268c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f8c26dff454d7e40b1b73aea8acc534deaa2f929843f1aed91deabd6d5849393(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1e5dd5c1d6114a88640462d5fc2d312189c75c52926cbce38578aa4d67307203(
    access_log_subscription_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__63ef2d6533edf6220457aea405a7efab37b29d19fe8bf5728f807b6855fab9f1(
    service_id: builtins.str,
    listener_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__34a33e99c3761bb826c680e1a45a02b160423342f311a095fceed67ea4ba1e37(
    service_id: builtins.str,
    listener_id: builtins.str,
    rule_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8add5ec497a6b0305efed45bb3c41316b2282e1c39f02927d04ea8cb4c46a6b5(
    service_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cd37aa53463cfa9f6252c08263fbe746dfa46ae4c278af8e0e121644f8223969(
    service_network_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__19aae0712db45d8efb1b31b0649f75e3c594d3282fa1fd4ef16e7ba15bf0a25f(
    service_network_service_association_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__686e4ddba7b08974e00a7032284b1fc0569cbb4576818e5c1e5b2208b564b6ec(
    service_network_vpc_association_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2c885de69dd5492dc63dedf1201bdcb8ed83c516a48729466595d414fe0cd6a3(
    target_group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9ecafe5751623fc79b59cc0312d49dd0e061269bb6a09dcf95b23701bcd30058(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7a9f0d3583e6ea80d2ff4a46ac5225fd15bcc1dc3b4ac038ea40955d72f130bf(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__21fd17d8bf348e0de13f57c5a36a5871783e07eb4bb04869386dc8ec78f8f44a(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cb261d588a95d09b2376b6db795db1d5d102f086a1462bd50b85598b8a501f9a(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__07987bc737c37191cd05fb028257a93f91378b95de9d5e1727fecffab860fb8b(
    header_name: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f9242a839edd50560a4e8165b51a3d0057b01354ec3b4d31ba2736c5ec0c0246(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e109807f9f71cc58676d6e69b92befa0bcc2c3caf8d785d4bced3eb5e0cc09f0(
    query_string_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f24b0b34978fea8301a3f3edf1912e53743dd6b947eb0b209e3cfeb3f96d079a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__97521041b694c093e07bcc809ca8d67af2846ab3d626ff66613b65e01c3f7a8e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3c20a6f76e6fb9e18838a1c020b7cd6a3860e4cd77579d56c058477ebaa97dd0(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f4494e7c2c11addbfef0616fa94e781dd6a20a076b76c0bf0d85ffae09707c86(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2b6aa799a7f4f728fcea20d780a9f9915ce9eb4b201bcfb38242388af71f2de8(
    service_id: builtins.str,
    request_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b2cc5bf015252401dda404b06fde5c2e95b9a418e1da95aa361fe57d489e2c14(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c5003a0afe40e1e3525452f90b7beb31af7f35cebe6346eae3fe3a2a472c33d9(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3bc13df1895b0cfd5a765bbeec3fc77caae030e5c57bdb3d50839ddcd3f6b82c(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c692b6b58c96d4645697f9174ed7f2f632315c04eecdfa1154b4c98eb8706827(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__818f146e02f74a396ff42c7900e8d92ed3cfca16a339fa8e3a5bcb2e90227d16(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c6beb09e881dc212819a0d780e9946c774abb1add3a42e8e14ee459eca692434(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__96bb1fe18c57614b0bc7d23fd452d3e0cb3db573ed1cce2bfc79a7c29530c9cc(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2645070c6205dc0bbc961aaecf9bb6ac394f52116fe10c42a3d9ff9f8cf30c67(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c34c35151a8cee1b7fbfa72dc4569a23bcaa1968e80a5e059af9e477a4b02905(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f94f619ee20145f614f863016bda748b1f8c6c4521906b71dc80aa9d6b03fcbd(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cca752a58267c43c70ef6ffafb76bd5ace0a8f282003022ae6d3d9189a80de28(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0eecffe102a95073d3243834ae4e243fdc05d69704abf0291ba8dcf7f8024dd6(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__20615ddce06b6856de117ff9ecce0a7f2456138b81ffa356ccd04e8f82445d1d(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1c8aa9f60359359391795c3f2acef57a6c982a507a9057ac939b9c0ad4851641(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__28a8b895f9d775ba465b7c50f720b92c7babce89464da6ceb517d375687030e9(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__20ad43cabba8f0c1be2eb448f03640aaf78095de38e4cc27870c3594174af771(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a29ceca0eeed58b6a9352a581c8cf369c91086f7aaea8dca24693465699040b9(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d574bd245cbe6dde573b73d771c892f07c9ba50f333341b86a22bbb527fc6461(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__94d8284d30fbf83f5481e30bf816486fc095885057ddc12c87e0facdfa1fd303(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c99d780fbc63c7ed1aa3422bf41e0bc85c3a1c619d425a4f1e3c351b7add396e(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bd0b25f1f4e31cdde14e1bbccaaf348f50b7b3e1a097b8bebbeca51f62a2fa25(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__401f97f7245f32609b37d08a4c5c04e64475ff806f1e063f67e4b8567e386434(
    load_balancer_name: builtins.str,
    load_balancer_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__11aa1cc37fc1041577d27f9e9e6bf099295794106f781dc025f34a21effde631(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__620bad07cb7eee52a967a497dab207a30ba9e828883b2f217ff5b78a388bd6ed(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f0feb395ebee2ada7fe779086c263ca1ee647e26069af2415f4315502f4b12b5(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__22c3889231e446fd7925006fbb9629510b0753418ab4216adaab585146dd671f(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__47ff2eb76197bbb6b4d970431bd2b6946a521bfca4e94c9ed511f57c99175295(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2d5cfc72dffc594ddd66eaa43783e867977b15c315b093ba789cc85dcd66a3af(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1c2e2b569bd1539d314ac1f2d14563aecddb641107c6893bfd1caf677c05c902(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__470469c6f19e413ca9d904490937f95c398bf0c698c7bc1fccf1eabc208b554b(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__230db673ac1664025a1b78b70996f9ae753801a52baeaf5b4bc141dffccc15e8(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__557336f89a5153158f41d1c1e9e1897b8b246303394b343ba4cc3c574d2fa350(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__455bb298b135b115f8da13a918bf4a3fc0c408ffc19ae664020fe00290396765(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a48a992334a6f2dc0631958e729b9081620e778548435bac3fd641d1673ea664(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ade2809a597527fff600188676aad69f2e336cfbad22f16374cd4a7307ef19ad(
    api_id: builtins.str,
    stage_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__536dadfab5117cf6529d6258430d4a1bc6dae21ebdbabcc819869677e7c85494(
    graph_qlapi_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__534184cc4cdd1b7d0deb7f74a8b1a6d7e2588eeeb0b5710fdb606966ce5a4d18(
    scope: builtins.str,
    name: builtins.str,
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__902fe171a2f44f862878a54c489268eae9eb962e7d5058930e25d61013161fc8(
    load_balancer_name: builtins.str,
    load_balancer_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c7250e95d21ba834aa9a27a2d1481c53b0a8e6d6fb461b8b77f7b664987d78e9(
    scope: builtins.str,
    name: builtins.str,
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a8090d788946545a9608b8edcc4c4488c5fd4c70e50bf6914ed4639f21ae1a53(
    scope: builtins.str,
    name: builtins.str,
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__778b4e5066ef26178cff9789ce121ef103670b551f8ccc213bf3b25413ed68f5(
    scope: builtins.str,
    name: builtins.str,
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__60bd028351ab91356da9cbba4e431fb2153b0cb190c930117f30cae354aaa045(
    user_pool_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0645c5ee1547c5d0f9138d4056af1c6bced2edf738ec41fdbce9f9dfb8f5f668(
    scope: builtins.str,
    name: builtins.str,
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e6b35d1f0f552822286259b90ced6e618fa5086e26826c17717fb375f423071c(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5127268e62fdbf1de5d5ea9a0549a4af69513e6efdeb8e96b8df34db2a3a48b6(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f33b07b992c08d2b12e8991929922b3936016db905588d6df8641b58370b49f1(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9c7e4f0a087c0dbdb79cee9c7235b92d19c610d44dcd46533fb3c3c959026bc5(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7ccbe05a775d0ad42744e765af6f01b2f2e57a63f14f981016e198f20ecf4a87(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__44edddf868534d6afffcc35c7f65203a5be0054511a82160e59104de7cdd55f8(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__54b64cf2d8416e0ce74c5dbe7caa457b16cb4a5689b7df0aefb6dd0f303dbbc9(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8c163ac88fcdf471ff6a0e79f2cff729b9643d76ab5d98b000719cf4e2d2c5bf(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ac478942613a3a1c0f5efad39d3bc197b0abc3ea9ed5c7e1e0d8a8de548a8848(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bcc9addc08dbc1ce288346a132885e9412a43e7653fe3e8922c01383b482e62a(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__29f48c371042037dc0369a50c48445ac686f25f39e4c5ebac87708e653fc4e3d(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__79a1b63282d4ed3d7caa2d9047a101dcdc5e8e6538fb94ddb6b050ea10002586(
    network_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6fc18e96263e03f8dae42c7c3a556466687d0fc8c84c147fb5a03dbbb7763b34(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__633b66838e207be051d6981e3f54f92f9cb268bdc98a7c5d38826ec78112fa8b(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__348ca49635bfe6a12b97203a79e3b81805c988400b7424d45b5d7a0432675e1b(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e6041c13bd857b0e76431eba36c75203834085da57bebdcbea7784c3da6b2d59(
    assistant_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6607552f3a967264ee9cf477a1f648ac8b2ffd409944b0dbae8efb5be3ff4e79(
    assistant_id: builtins.str,
    assistant_association_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fc6d5b36ce8fec1fb24ce6e7cfdcc2095623181f7f7d7a63846fe905a1860301(
    knowledge_base_id: builtins.str,
    content_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__294a0f24f77096fee8f806c05067bfc7cc162e7f723ae44ce0035cb35375ffc1(
    knowledge_base_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5a9fca40b8ecae515fb46856d2005988dbc476e88f548c927082c566ad300393(
    assistant_id: builtins.str,
    session_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__676d194e909053a3703c2f0b6c6b58742bb3ba3cbd459cf3bc73974a8bdee78d(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__05f8179e59c1e462940be949e3c4bc4fb74810889911452b3f25cc76b485bdab(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a78829170a6d1c01c2c74d544b4af5928d82951a7c6156bc79df8fef02e3630c(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8c071342b9add8072ba98959a364ca1764d2feaff8fa23c244e2c7df676a4382(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__47cb0fbb2cd6276dba53a7e761cc6dcfbac3b45755fe6b47d30a92b67ac9a164(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ccc400871d4b6c37807dfa2ad89b7eaa261e735565290db7254128749769c9d9(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1931973335f7e20699052944fbd759189229d623bc4ddf2fdfbff7a0f4d82fbb(
    fleet_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a6c01c0c3f9ee4b7e6aa112c6cace9558eff2d910cf7927a64b26377071bf3b3(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__75ab9691d78a366a5238e5faf735d8bd45021577c1576ba97150caea474b835a(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0c568b6caa447269b891b728952efe8171314704d4d1b19b1ddf86a015715550(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8f3b2b435c16465d51d9170e257c53c7346cab0edc419020e1ba920f4eaf716a(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fed7fbbfe829918736b7fd9413b5779162aae8c1b9ac35c5ca81a759fb1c1123(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1d42c4c0f91c02d417a641aa7b585bbcbd243688d4ace5164ddcac183cb0e2a7(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5f419e5570579f2336a43aff56617ce1c67d1387208e22c66c3f91710bf66922(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a5377ac5004a0ec1928dda5895b493a87d3981a4615661fd6e43ac07c4503332(
    organization_id: builtins.str,
    context: builtins.str,
    message_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__600553d9f2d1bc06ca5a2bfda3feb16f6c28ed128b995a27e6f6b63a0ee7b326(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e653f65927e798df47dbda6edbcc000edf48f0e9247d45254fa41c512683cdd9(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d3092bddf277c4ce1e5019210245efe86f7f671b0081180431a5c5eb8d9520c6(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0a1cb19cb5982fb7ba873423644cfd189bfb46a922fcf81455b2cd202fd9f864(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8c239b8b66ce23532b77380172127b049311fd7e91746950e13a128e5e556343(
    connection_alias_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eeacec8522feb087ee5ce0a81c07bd985465f2d9440f168f5afb4375d437c70a(
    directory_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__001ecb4097f183b0da634b4bb2791beabb2b3316babeced6c92546e667fa7875(
    bundle_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__490219130220c8f40a43a3a965b89430aadbf6bb254e36d7668e51d92c8f7b26(
    workspace_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__faaca0941e0bab4aabb95742e3dda54ca4f0a373e0ec0d1a4e0484c573517930(
    image_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ab78926810be37a4513457d1efdebc0138017dc95924a6d000a0286ff38aaf87(
    group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__76d4929de6e689ae653bea2ded8a4ead4dbb6aca114c501f7eb1ba74af670f2b(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__99e44628ae06653b277050ecb65f2c8f914e88e60b1afb08fa91276019f58aba(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__efc186d55691f743ef561bf1fe3bca6cfe40b9755bfa98a33b09ef656307d020(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__59e5b31136ff23090fb8c3fec04e4ef6b455e1e771e99995e32330357cd76eb4(
    browser_settings_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7f2c39661f2548646dbfccf634d235b3bebbcc2710e3ad347848656caa83ff56(
    network_settings_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__503d724463b57ab890d71ce0795fe24d600c28ca00124c1a6485a13767fb5caa(
    portal_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__48e7f7a4dc6b183222f9be13688fb8ea3b6236c3521f7beed977b27e3d82ba88(
    trust_store_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6de53e259cfc1abae9f35abf83edaa467436ce5a6565037cf1d5af3583c50d36(
    user_access_logging_settings_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9fe894044ad917a7abba8a7cb50a08931e32b520918c968814c8f4789e3f912e(
    user_settings_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__001770afb7e25007c66ecac23721c3dfcbc912e5c249e48fc5bf8fb605c1a5d1(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__08fd0892d016f715141ce6fca0c1af7d5ba458df7f498db9bd2335e9855f5f0f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e35d4a170f92992b1c7debc55baface5da8b4f4f1dc78d80f0691effaea13243(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f23330e5ad1dcaed183f36f6dd17cabdfcaa1309014a30aa2b6f49839eb9f2b1(
    group_name: builtins.str,
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4cf9f9da6ad703803a1bac604c6a365ac35c4da7c48082682348d5d2ad4399b5(
    sampling_rule_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2cabe5be09d9d1d4cb8ddd9f39751fea9789568e1a6c12e9f927168a58463168(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__414d1444afc4a7024552a1c70acf331917c22519e62d0ebd9e24957169a2ee19(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b6f56bd993a37ef8a332edc70fef8910cce29c2aafee4792ffed36990ea3b337(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__293e807f8ed7a3e0515719807411c6d56659d24cb7a66992b3fb04ea6609dce5(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2f7d84967a9a626e41a42eeb67c998db62d9f5c08fafb3b3db6b313e609ec253(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__13441344ae15feb2b31bac0511b29587c2fe26c76ed11d74bb54154aa3f36976(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ee9413d08182379ed24854780242a621dc969ab0f106e5e7ae06a7519012f742(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__59f623d7397d5022baa9afa7e321d34ce63153fa58d2873faac275fbe881e501(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0d9b016537980c7ae9a01012484cc2816dd298d0c41173956018af10e10a8f5a(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9b1184a4215ebe98e4b3e39267bf6d5cc81bdc47b5b7e9cd0157b23ed3691328(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2c8bbc06d12a79834222c8bbff0239417eee19285e025f488acd8e7c30ee44da(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__87e6369fa0e8b711d92d5f4c324bb8d020d382302ac9a136358bbcfa118b0fca(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5f61423be7e3b6bba3af206086d1c5f36e5b48af90fae061154c79133b631e77(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e7cc684688893a8cf5110fab6d6398f78a62f162449a3bc1e820aac70c613cf4(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c8e2933437c495dfc30e6de6cff15b62e7bcb75259099b539aa01ba106a27fe2(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__27d5defd9872a3b27b4313368e24f83c0bb94c1e6bd621c0daf4e10bbd8b9cfd(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__14862e1d4258a8e636002691d669835da7525a332c1e200824d65432ddab41c0(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__31ca654324d0a38193a808f2b7cfefb561c692d8a63cef9209d1fe8bd61a85e6(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f9938fd853430716733f4ffc645c596f12df264e7e724daf783352c7cc913ef9(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__02ebdf3f69b1ff6568b791f239d9bcd2dc9342c27300d10cd1af61125e3655b0(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d0931889f1df5a0e2f008f347d4b46026ffd713e22d8c01f2efa1d77916260d6(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cc434cee142c2b37245693edb584daf54c9b2d778031dff7a33b6f5c0d99f44c(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c508442e952f83e11b33b577e1c9089bde7d92c78c5ec344c22d373bc6d88826(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__def17afa84dc76e42c2c29831d8054c997819f995dce8de81ed08c6b158d128d(
    analyzer_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3966325b7bb408ef98191c31e6571d53c6e74e96e5fc12350d18eb3fa3ea6f83(
    analyzer_name: builtins.str,
    rule_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__80cfcc5aa8ad2a51cc8955c6fc363e722fa4e5783893e61bd723f05c6e61224d(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__55fb80f32418a6c1bfdcc9b5a4fd8551f45f11e2b3aa383ad2768e1cf31bcc92(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5c17c311301760e2c2d1c0d2523eeeea9845dd7b4d3c4b60b204456862d6d5a9(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2d4113bf6c22350636daf09d52135023cc940c2b229d32b6586f50696b150ca7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6a80fa11b48527459e81d37c0b277dfa8b5ca4f5a8eb8846fd51e782e1ce866d(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1b4db971664df27eb5d4d9217029889218946cf47b0e3e7d848ddbc484ac1d00(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a0430d0dcc2d5802a136678457a3eb67bf38f3a643d9b689a0e195264c34ab7f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__20ecce0753eab78037ab489c52a2d213b797ece5b12eda5b140fe6050b2ade9b(
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__658fa090ce69908fd4b1087226e592b8cf51d3b73f4824589fd6cfa711ff3a26(
    management_account_id: builtins.str,
    organization_id: builtins.str,
    member_account_id: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9623425cbb41370beae4f12e3300a7ca782eb88499c155da867371af571ccb95(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e7b68bdf0aa66a4bf71942c3bfb67d7ee26e2c41a319793e2b15828542f7d5e1(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__24ba6dd8c4754efb8c5e417bc16cfdc8ba1a11bd477d3fe7e36b5f7146b57aed(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a87bc246c32da7ea0b8d07ba116340aaea81ed8f9225dca5dd1cb8d1f1519993(
    certificate_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7e47f6c3ab031539023288f643b7ca08f09c68689c1946e714ca47d721b06526(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__414e46502a3a2121a1332a5d50c165c0abeddc1bf0066f3024771c803011bfeb(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__65bac14af6fc83741fda78224f9620dd16080ad902da1bcf88b4500795b60c3d(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__78f4f95ccf07790708dd646b715161c300718dda4d3d92864dde43c7279935f6(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b0f029d43bed757a552ea15c38680f12de54e507eb01a088458df433f37814cb(
    certificate_authority_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c0c199ede9d18871cdc3d542e69070c632f300b730810b75ca551eebb30da3ff(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a83cb111bf9c2b727aeb13aa3c2d850cccbf644868d1d0cf59ae59653d398e29(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a4f5e3d2a87deed86d34c97b5834f1ca07472a67cdb17858162e6e7d7d6f0fa4(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f9b2b96a9f7b62c6843df00a8c03b5bfdef2ad154568579dedef4eb33d8eecc6(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__929f9b83d5aeee90536f2a626fa09c282c24118a5192ac158197fc60b0f0cba4(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bcec2e8f6965b483a4513523e089897405efc93c6c553d4b58bf018728c88264(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1bea05b15e3866937bdbc3a2ade2661b642009333c5a2e551931b6e476a2a7c7(
    environment_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__78e800396afc9c4999729b3fa2c61e214886af8f01453ef9f33a02d5ca14de79(
    environment_name: builtins.str,
    role_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9933dd0ee11b91147ba7d39246fe175a102bae7e5438e1013344d486ca0c6167(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a921e0ff9493702085299da9ae1f65a92bd15811a3fa5be2cfa5762f8a8c8c7f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ff99b89bab8987008ce3c867eab18192d615ea08d588bfe5134b45c114b21027(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ea911c20f41d8e05bcade090f28b9caeeabeaac6b198a1e6b9410999335d7e4b(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__63954fa7ebcaef07492f470ccd2d7773b2a9c09361d15004167dcc00c6a1f0be(
    app_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3a03edd896ef5a245307ee843a4d20ebce2ade99f9f1442292c732057659bf3a(
    app_id: builtins.str,
    branch_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8b7aace0e71bff1b3bb2d8015c652dde8589a8f07a2c7ab6a368ee37bdd285a8(
    app_id: builtins.str,
    domain_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6b5f0ba2996067cd005925fb71f8ceaa815e9d9628f3a4779ed6a75c1e3dc86b(
    app_id: builtins.str,
    branch_name: builtins.str,
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__058bcefea185bc195a9a76e0042a0c138ef0dd802368fd6e4491dbf2506c2705(
    webhook_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f278b570e92bc5658e303aa7216ef9b0027e41c728e0c2801ca0ed97bf4297cf(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4118b7dc616fce0eec06dc9075f4d60dbf7492bff6b048f3463ad447a202afd4(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f08bdba844c5347c58776c27f374869f36f41de21f84e06f7e944b1d5ec62d32(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7b167fcbd32fb7ae90dc86f822083f646163da366e5d92d82a6aed69c91b435c(
    app_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ef71bbeb950dd2b439644bc6a47a91132ef4fe54e697400114b3549c02c0001e(
    app_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__97a02b6a80d94f75533f05a18a0c3d7b05a7a22bce24e787b6d2388b26bd46f0(
    app_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9819306678061ff5b7feda95bc3681c29039c76b754463723779239203241c4f(
    app_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d465a8a8cd292c8abe4798fc170da54a9d96c2d70c61b3cd77a4e60d17c11f24(
    app_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a03b21dc1d3ca77be81a5e590493a69cff129947ab9e44dde37c7e4afe9cda7e(
    app_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1baaa8002577f07c76371697803ac01138ef4b8a7e4a72602b43fea25e05daf8(
    app_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4f7d8c7078b2f48005e7b04042af64ab60e0cace254ba41cf40e0820045a4a7f(
    app_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6d7064e8715fb3679274c4761247fa156a2c8a9e899afcd4bdf1ef809f5d9ac0(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__38e5a4b0fc1105d8aa1690179e11d4819495690b9f0bd1b0ee43bf542ec1c78e(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ccd6c1bce3be16f11b06a3f2eebcc19f78343eaf1c6a9061daa0ceb644eef6b4(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__75b1bbbe185b01fc8b2da32c829089823788a29ef88de1a4769fb66f63a404e1(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2198835387421d36ad5189f330e78f199f129991f0823d142db3d36cd679003a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b41d95d3b89bdbef78f460f50a8f681efcffebd867ae6aca4631c078dc0e29dd(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__44d26b1f9e981f3204c28d4f6ee7f29d3e3892de7f446df513137286c3a1ecd3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6cd0d8930d54d69df3069863a6109b8d8adc6010608a4903649a6e3251afa635(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7b14bf711ff738f63cc162fb8a66767620c6977871188b83b889ee71983eae80(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9b25ba382215dfb4a49c6cc4c906e44428157f90d03b9bd056859767ac718018(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__78a059d51b059ac1febfe11340bf0cac46a841733f0875e2391e44392dbbb88d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__baf6a88fd699183966ca738d1f713e6bc5edabc1afe4888055ac47fe77189fc2(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__46da67faec1c019e51464034f0393f055a492f983b39689247b3016b28b5e674(
    app_id: builtins.str,
    environment_name: builtins.str,
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__233e0437fa0b92045799a763fe4b72e753472c5d477068afd238f88dc935c71c(
    app_id: builtins.str,
    environment_name: builtins.str,
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e0b25023fef03215d25dd149562b176f4a663c3941fa56851c4f0da860b8dd8b(
    app_id: builtins.str,
    environment_name: builtins.str,
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e4f81a4f95ccfcadbad31b84f45ef0f2aeed78e6b12ed2b78c480f786fb02c91(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6abedb2f0c63cdaa54b2fb3d151c30c39a1e792896808e5c517e363db03bd5c9(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e00bbc1f2534c43ad853bbf54a3ec0fdfd1e37e9dce348b9b52bfa94bba8c2bc(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2b82826c3b3d995a66dea55869d8b989e2364e488861756129bf14143c481364(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a7416c4da0c335e30c5ec7d31adfa82b586c326a80e81d4899bc052473d41932(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ec91b36437a242d4e9726530cc0096509ff6f73ba4a34c4dcac802939877fbd1(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0d6c43d0f943af100cee5781309a8d6c74089281588956b35271e05298392e64(
    collection_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c511dc3e544f9ea8bb929b3c4261e2b3f040d6fcd2634ed9410d9b21384ff3a9(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0fb2afde9403f2cbee55b5eebfde57abb62c0eb5ab0e9e1c43be07706c63cd67(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8ebbbeafc4e0b59d69d5d6bc74726b58fbf5bbc76e11257e15e59b89d4c238b0(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e1abd6bdf144f9d1e386c5542d1f01eaa63ccdb91de3fb3b1ce79457202c9992(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8e154f64e3e6ee3374004a8538c12e2807e02ae5a8c15845e24d295e6a0e5bc7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__496f4f522ccdd53e12bdd53f3625f8dd7019f6a720a7e1318fd13f6f5bd7fdff(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eff2e8fb19f11ce316ef048ef143a1e891cdbe8af0c19d44025f37f2c838760e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__243cdf3a76be7d207e2b2f576e5a487517af95871d4400023661f4acb26641c2(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f423256c906304daef0e5d3966a80e2d6b0331ce48ea15afd9b949f0d1cb31a0(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__170bbb198958bee1bb14dc8b23e75da0a813ac18f6bf8e338ec3ce4e6244cc9d(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a34335d6386d953d99b8e2c07de54da96d947d379110c9b8f248da711675c7c7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6ee15b3ab8d867498b529f8de44ce103351bbbd91a9e0b97485fe7b34e72340d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c698928ec9fcffc162ef5bd0bf8d20fc6eb3e568ab01425f7eeac66fc30a82ba(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__13f3958b3d8eea9ae1f88839546a48017d768e78a2123a128dd996f3cee18bea(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1c591120bad2c46dd59cf23ab5bf7824064f8c228a9f3c5d7f41d577497d12a2(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__426aa4eb0900307633a93da2029b317a0fd019388f30a033bb6bbfa3166573a7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3ff309c8203f19bde0991da5d6ba4141622622dce5592fef546f22d99cf3fdfd(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e48d9ae040177c94ee2efad9f3a53fb9aaff2df04fe74e46e8dc8f8be9f005fc(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__131270a9e3a301d1ed34e0dfad9ddcfc378afde5792c23bcfb06892d37d44ee5(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5e1cdfaef855d55a8b4eb3db2ac7baf50a8f02fe53b14d7961b2fde5e108acaa(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__72bd78ff8d90809a0cb927da227ecb4b06163207fd640eca3fcf2c700906f1d8(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cf97ace412d97b5c8275e0bb990274ca4797c9ea5cdd65197888c53a354c032b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7b33b74fec50cb751ec71f836fb82039a2437cf5b747cb00fe18dbb90f43a0d5(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fd26974e035e10143c8b7bdb0a18179993ce90b9b3eaf652c5ec09278792463c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fe7ec74e6cdaad428532c6984969f13ea819eaf5ec9ea18ecbe9c9398d230f7e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a961e33d9aa0aa90400f4f6eebc81d1c4692071817a71e2332f88a958eebd5d2(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__965bd539fdaf142fb7cade59e478c6e0a33114da88174bca3081194fc03f50b3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ac62bc7e4a781b7750b43458ab5bf6d3ce436b71e2aa09243de1f766be6966c9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__19101b0d132688fad53f64c99e7c3ce894d30b202c573b291200bdb33f27bd55(
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4a60808c06cc58cd35d249dec5df61ef9622b785d155fa50dce56dc3ab11291a(
    api_key_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1b34879670acbbc2dd01982378911022df5fa42aaad32ba447eb62913e9c13c3(
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4a89925e20065052691a4a071153fcae59c27b57e269a301accdceddd3e81ada(
    rest_api_id: builtins.str,
    authorizer_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0c4280c75822abe88c3d3f9e2ff636f3510f2e8297496399d93021b1ec4df1e5(
    rest_api_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1fb08c5d1017d45449bcfab4ff8764fdb1baaab1c5a130da80634656bcde34e1(
    domain_name: builtins.str,
    base_path: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bd9f866af965eb22f171a864411a45ff914b9d5175683825b05df0ae1c73e4a9(
    domain_name: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e01897062f32bc3ffeb9e26ee5d23565fc33aad36aad51170cdab6515e7eec39(
    client_certificate_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__332d3ca346efb56c83fd6de312671b62f06430cc44f0c1f7f3460e2eb0ff0f75(
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__91ad117a35a650dc2d239b47730bef05ef717e050d29445cb7161aa241b13d41(
    rest_api_id: builtins.str,
    deployment_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__426151a92b6b24f9f04c768e2acd0c744b1295d592977dc9a0d4dd2d9eaea2f1(
    rest_api_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__046d526adcd9a128cb902eafc98dfdf58974923d834330bcf6249460e8173ddd(
    rest_api_id: builtins.str,
    documentation_part_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b3dcb623af80cd6e2be10337e4f28e5cd4574cb39a1594be3e28f5735a0a50c4(
    rest_api_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__05a8e2fbda2a61689f1cbfa31dac31b71dfedf74173c6d1ba0749bd49fbf5c48(
    rest_api_id: builtins.str,
    documentation_version_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d4b5eb49540cab82a6f8f4b29e81f7941942bfa0f62df97affcd6f2963f4a8b2(
    rest_api_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__363941a8371385d6cf0218e42f35b74bb54997670af5c05ff01917d4757cee54(
    domain_name: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__de3227d8970f49c36bea478dc5575ab2bcb190752e93c2c3349985e02705a516(
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b8908750e691a6423591a735cd8648aa8324fd1454f0f3a01c7ba09fd61bba40(
    rest_api_id: builtins.str,
    response_type: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5cb75f467caa9c2302e4e84adb7b10f6fcc6f62f281bca9616a069772dd08f46(
    rest_api_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ca558505beac0e46bacc98f4a0b7ec78996f3b832964d1ec735b25a5ec784afa(
    rest_api_id: builtins.str,
    resource_id: builtins.str,
    http_method_type: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fa2ce910848f7d7ecb091055337989b0b0bf0ecbbc68b8cd48bd682c7121f52b(
    rest_api_id: builtins.str,
    resource_id: builtins.str,
    http_method_type: builtins.str,
    status_code: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e17a4b45dd20045a8b784da4ee0826643aada43ffbbf6f8eec557ab46018d65a(
    rest_api_id: builtins.str,
    resource_id: builtins.str,
    http_method_type: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__87f6dda7540c41fb1bc1f2d5d284900998d1d233ff2072cb31f7d37cdf3f9bb0(
    rest_api_id: builtins.str,
    resource_id: builtins.str,
    http_method_type: builtins.str,
    status_code: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6f36110849cc875e77edab4eddb8d3dc5861a342f12861c2b2ced251f57a5928(
    rest_api_id: builtins.str,
    model_name: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8f9377317cac7f1b297a96f3c183d6049e4013a319525fb0668c711502ab3eb4(
    rest_api_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__72b4964af9e0cc2b1448848ef28f632500504d27042d9835112b0fd7c991cd32(
    rest_api_id: builtins.str,
    request_validator_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fb4af8fb0ac17c7b735da95080cbd3607d4698e70d28de46ec347c8d340c9552(
    rest_api_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__68aa0726c0b1f95c0628a37994b4b469bc42140f23cfd02cedb33152bbb191e2(
    rest_api_id: builtins.str,
    resource_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4543f8591ba6f60053f5e3fac414e676dec0bb545a0f364a3dc21e005ee2d70c(
    rest_api_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5ae016bc619fecec63a6425a7b31fbede844702e9e49e4c72e7f32658bb7f9a8(
    rest_api_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__20b32a794ac168cf103bf3b0f608ce309e722d923a7bc2e1990debd951c5588b(
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b3f93ca368a95020db42711aaea8ccf28036c9a4421553db8b5e6aa8d8f50fd5(
    rest_api_id: builtins.str,
    stage_name: builtins.str,
    sdk_type: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__87f38f114d98f71a821d80e92b64a5e3002d22a15b54a5447b83b93de2dff370(
    rest_api_id: builtins.str,
    stage_name: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c47398a9ff89394cdee149ec68802776a562af4269b65f433fe7c4c965f351cd(
    rest_api_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9d11934907c3c1205bdde6a86960066b933776bb5c295beb3c6cc5a8d6f5b239(
    model_name: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e6163f45342e821d12ac9e27a75631f0db6227afe22e28771df3501035c565a0(
    usage_plan_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a9620df8c6d34387b8ed19ddd32865ad639e7108c23a729a0f4194b825ed1115(
    usage_plan_id: builtins.str,
    id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__402058ce44f53239fcbe13dd55a20dda6d418be7e9ce99d191c2e4ff02fbe017(
    usage_plan_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dffc7647793ba2357394cff346e22e201d2ee23e148525f8fd0531d248bc7568(
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a32822ff512477a8338629c450a902baee81c4c17e1fc80208d6ae86e92d0f8d(
    vpc_link_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f45b900336719d34007c783e8f3a3fe68cfc0059b8900b3f9b52f075a2b053b4(
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__217d20332550f6b3d147479d8ceb14839d4b9e03abb059e913ef60e48cf1130e(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__15d8cbbcf6660ea7c06d96ed7eb4195af76f654759e866e161cfe4834ff9a9e4(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__162bac3663ea7b76c0f3f71fe148679fb838cd66b09f051186faf9258accc946(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cd3febcc9a528e4f08a42bb93fb717b69cc47fabe4d283028d661a9c32e2a154(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6ad67a2cf47719cdd821e2e2e8911b3bfc2f8fd2da98560911d615603ce79dd0(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f2c8e883a80faaa62e174d3d397271baf7dafa9cedf863772f1aa394f73fd103(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__38df69008f65888580d7d0c8496f5df03929602baf291af9d0459994959ea599(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9f2cf3a87804670d9c0e9833fd3c943cee758634a607dd8ea3a223e2ecc1def7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__58b717e4b90eb962265d173a7e6385424f85804033adb4da7b1c3e5f6c1904b9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__71c9c5d13cf415a09c8cfe9d7a752e324a8bff8ad24a81dbc9a9255b473f1f1f(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1dcb245da60ae1c7a3aa0b6cae032f38a6e38a20cb6b0497abf2695610311396(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3e333e1282cc63816442cdf0c062a2b53571c3396839146d7742642bdad2b5ce(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d60bf840d85a95072aeb12350186ae28d6d286726dcb260a0bc5c5cebe9a1400(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6f16bf3120afb0c6261bf1a056e84080881ebac692631dadc50a21aa71b7487f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__db7da52bb7aa34f4193848f7c22fbd1a894da606a93b1ac39dce447d9c8d7117(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__475bd1a97286269bc82fa76e8475bf5882af612ef55b1f34aa6f02ffa5d77328(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__07c3eecd3648cff58000bb2ac0506bcdd6d6bc69a84cd7dbc1da792b706754fd(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__10542611edf0fbcb31db6b15037f0cad80448e6dc071cf34f45ba8fdce199d79(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cffb7534a8d71c56802f44770be782ebfc87090be16bebffe86b65d2fae92fe3(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__48fa34e53797932d0f64e2a6f0d33e504872fe6791a1d5369c068d7aa65ed856(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fe8ae24c9a4aac8917f1c4715d593665f2fffade87105699b771edb529dae18e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9c6cec87b5f535c9a5ddd6d3058d248ddfc7b82e7725854396514c2309a98a08(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3c11148b2575111e6c50c6aaeaed60a386e6a1d56c808b889948a4904447c74e(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cf2a2e4fef82f996b5e70661b49ec446f0e10b66b57ebd44a11a8db3e554ec99(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5f01aa1a862742121111dd0f20d87574024d0afeb7b1370359b579c2a9769b18(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__94a8c3fa1357bde9a18a101a13ef03015b4cf4153a36a9e73b00dfa26c5ed395(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fd0eec195f2bcf575f511c56f4405f01dc76335ea286610717885e1f1bbec181(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7c940aa4bb08b9dde520d33362d3e4462db7df6bd0d10283c198435a3e0aab76(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9dd6c989d2b2d9a61040fdfdadf8f6710bc65e71b01a039253b55975c807f7e7(
    api_id: builtins.str,
    stage_name: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c7fb108ed5d19ad41fd059a3f934759a8fa65bec9839ad2fa061b0f59b37009f(
    api_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dcd3b84690412d4b5c877b6ac71323bc68a04568bee0738d610bda830ecf4314(
    domain_name: builtins.str,
    api_mapping_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__54419893159495b115616bb7478c3196c652c943d01dc1b272b0d23a6faf85ac(
    domain_name: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__059a7c810618804b2e7723d9a473d6ec4ecc67e6ef55067798dfbaf67a817aa3(
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__10c72e7e45626a6802c8e6ae7f167f630ad169b0ceddb44f217963f84d5f0239(
    api_id: builtins.str,
    authorizer_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__98df183e076ca640cd855de2be0335ebc974a4c6a06bc21e936e0f2a4885bfe9(
    api_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c03d207407dcbeed81c56cb08fdfedd77d4a44ec182269035b9c50bdf012585a(
    api_id: builtins.str,
    stage_name: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ae2639bcf4aeace347f6ac8711f29b0265f3634ae1cd96eec5ef4abd0731201f(
    api_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3f933b3ad9f66e250b8ab8af6b2aa60a6eb2209dc2d4d2bf2c3aa7db404fe71e(
    api_id: builtins.str,
    deployment_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e96f1056477858682e6a0ea0538d5d7a78906a264ecaaf7d7e7143686e7e3779(
    api_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a4bc210600213b4877e16d6a1711b1143e83dfdd0a07e4d825af3d10998ac0c5(
    api_id: builtins.str,
    specification: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__110bab2befe477badd8332fda042663aa66eb33f930ba190ea47b9a1f9b353a1(
    api_id: builtins.str,
    integration_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d42f66f1dca015bdefbf07ac889a5832cb87ead9894c32760ea536f891921028(
    api_id: builtins.str,
    integration_id: builtins.str,
    integration_response_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6a4e27128f4f4c919da57777195aae1b31f40623632f48545ac1c33803d46608(
    api_id: builtins.str,
    integration_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__476204a91c84492d5e0049b92851ab20b5f9652ab8a7048da023030aa0803f9a(
    api_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__47b208ebef6d6aedaf37ba93c189a521494fbce7c62c33ad65a8245e8f136dbd(
    api_id: builtins.str,
    model_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9e136e453e3b2e8facb6dba7b9c410116dab94c9a97038359db0e00fbcb0b5c9(
    api_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__34f13e2f32e452dad13ac5707b4a034f83bbb8ddbccbd263acb3b073c5c62599(
    api_id: builtins.str,
    model_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__30665e138686e37e2d6b3d3776eb2adc4a445a60dd85de95da0fc5936ce15ee0(
    api_id: builtins.str,
    route_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b29bd368726b0003306e61167f021c83a67dd284d97d71ecd582c8f3654f34da(
    api_id: builtins.str,
    route_id: builtins.str,
    request_parameter_key: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ed5a71c4cd972a20f11385d382fecd7e69276ed8cfeea6c423284b25cb9678e5(
    api_id: builtins.str,
    route_id: builtins.str,
    route_response_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d0372da6265413676bff0118aab197024f196ad5f2e52d3d25457155d6d75593(
    api_id: builtins.str,
    route_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c5c9925bb3185d1da88ccd42d5e784d7c3e15fc4503c5bc76b60e05891d004cf(
    api_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1dcd8f0efa602fcb0bc4af80af97342d0e4a778be0674e04b37693627ef43be3(
    api_id: builtins.str,
    stage_name: builtins.str,
    route_key: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b6ba0d5f2d0bcc3b2545446f156cd5951a68804eff8aff8692b8e91055c2bd3e(
    api_id: builtins.str,
    stage_name: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0f84c06459f93734b0a7fbc3f4d9984fbce7e5896522c47d162f780734531e6a(
    api_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d006759582fbdc7548cdc784626d126146bdd00dd153754a58cd8c4d6859ed28(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3809f971b7d9af7ed5b0e7b9daf5409aa5206be44ca8395060cfd99903092857(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c9926cf5f981207ebee79296cc2bd3103df3f2061b909e2290b5c4a8944320b3(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7aa8bb8c326cd7fd88aaa6e6d1f4b3ee63cf29bfeca59325fdeb8465bf9bbd70(
    data_integration_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9595fc5853dbec715becc14317a9dcdaaee95e994176ebfe0917635d3503abe8(
    data_integration_id: builtins.str,
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dd4b72e727905d7a0ef3ed3238ddd9211c1da15cde744e964219609b3a790f98(
    event_integration_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1ae0177bf6fc8f5dbdebb2853255877d8de5dc8362c1934f2b925d4feb852e60(
    event_integration_name: builtins.str,
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__68b2f2ca86f92a8a5cab573f39a814a7de96fdddb6f5e1efb18f2ff09c6aac6c(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__142c403fb9b552c3516dbcb6aa615cfa6897757c8ade1381db40f2a118ec7b63(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1b0fc92e0a00e566b5db144719ee19770931bc488bc4e90e26b0038e4b98a0d3(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__01204a7bdc16481b05ffe497673d0522288d7d33866bf7e7dd091cde339f03d3(
    application_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6bf0ca4e2b4d2022fa8d68af69ab1fb5e99416936d8ab94627fe3ba7a24c2e38(
    application_id: builtins.str,
    environment_id: builtins.str,
    configuration_profile_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d701e53ac3c5997e321f39e49859eedea8b723316cd14adc7bde8f61bf710b5c(
    application_id: builtins.str,
    configuration_profile_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4c7604a94e5400ab73e8b7b9bcf003925b42dd7289015543f5c2a53e93bf3c96(
    application_id: builtins.str,
    environment_id: builtins.str,
    deployment_number: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3ad5d87825ca6835ace538493e6e2cfbd9272fa9b7a3eae925bd0776bcad0379(
    deployment_strategy_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__af30dc999d3ecfa5d6322c5e6c4b5b3f487194fae7cb976635fe28616988e461(
    application_id: builtins.str,
    environment_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1d7380a7c1532cf848799aa7d0061063c5f03d691c7c61ba4eba5627291a3bd9(
    extension_id: builtins.str,
    extension_version_number: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f802ee9b053464c7d720c181642ae93831bb204602117cbb80f8c385a97b804b(
    extension_association_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1a1dc7eea77d9a85cd4a3ba8bb66595b0e85419d017b8a424c7f4089fa61ac05(
    application_id: builtins.str,
    configuration_profile_id: builtins.str,
    version_number: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6887af4652baa4390f010798103d67ffe035184f2b61507a9fba632a5d71c06e(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__df9124c221f4f06dcb3a49f2529daabbe7261a13994ef4e1766cfbf6df725a93(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b3305388be7b1e308485da23992f4035b9c88e79d465695e9889cf9c0a153f62(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__332581ec4b84f4cb7aa150ddb8b64b961a14aa07b39dbc4afaaf726da9012705(
    connector_label: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9e9e2ee3ef82186f440555af5c3120b69f2a258271a00cd7f84ab1374ed21d31(
    profile_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8c7f60e20cd4e471b5d253bdb0388fb8da15af5f26026b70a3886706b6e20edb(
    flow_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__10c24b2a44823c48dd0c34799649e0e53a5965636c0bb8c83a873da276ef3a3d(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a1427c2ea350922058118251549824e2feb14cfde303de57e521c0c45584a7c7(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6ecd8537bd40fbffeeb2ef302df60889ef0c77e6fe156c792d3ec289ef2f2adb(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__04ff9a10af37e74df7970e714b5f5c2cc26efc0c2f71935330fec0307d0b3b31(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6a1a75b19c81684a999bb17b7347b58df68105355b0bbbe8f8100c0831c70ebd(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__43954ab7c2752f34413a65b938f09aee94924a616ca3f6fb4776099bbe80c1d6(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7d8787fcc02a2ac02610bf3f04c6133d6eecfcc14bb4d42ef0f710e59ab4f7f3(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__28a4131aeaeb874a8294b62abffeba2bd9e73a195d3e61a026395c13e496489f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5dedd149e25fa4944d1a65d54c7db0afe4b57542f33e7462fab5ab28a93829af(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c1bc7d64e2a867a010736a8bc937fb9db4b74019ad2b953b9919ac1d994154b3(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__433cbaca2e2f965257b8983be3dd0eef4d6106134e2aaf8c8156e163abf1a6cb(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ed51515cbddff5435fc829fb556f3a505ab996984a7bc9999ac9c97b9ab0572f(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8ab3267f15e22799e09f78750eb53d17fcc6f1bfc328712e884702e00e8aa568(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f10f7de83b233d176bc29386c449ca1c896376a24d7ccd3be2a2b6115174242f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3f3896667f675b74ec7dc3169055afbbf76f7424102b707f0049b19e711f06cf(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ee8275e553b46d33cc318aeddb03b11925c0c7d8bf475b7422e22534ec1d9044(
    mesh_name: builtins.str,
    virtual_gateway_name: builtins.str,
    gateway_route_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__76eb5f0336ddb6e28fc01334c4ddc937e4d3166dac5f1e5702bdc525dc0fc8cb(
    mesh_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__50c7f80412376467c8cd5c87107bfea747d733a2c967d8184c265286a55c06e2(
    mesh_name: builtins.str,
    virtual_router_name: builtins.str,
    route_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e935895973dac7a90eb45a095806590ffe6299629fe7eb836401463e49322ec7(
    mesh_name: builtins.str,
    virtual_gateway_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__94734bf404122eda2b8ba34a44f59b95dad66809861c6682a2939e6e372e9a8f(
    mesh_name: builtins.str,
    virtual_node_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9820fef83c88f5c16a278004b8c04c8dcf496bc7626334a09b621ae70d40867b(
    mesh_name: builtins.str,
    virtual_router_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__faafceefcad372cc857bae82a10e6a7324734d81502b4670804e3c44f68f7a5d(
    mesh_name: builtins.str,
    virtual_service_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__46162400107251a17c23d80401f45537247a0f9f6c5ab8c50f7226578790ed87(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d198eea514e71884f8bf92d2c80a4f39efd31053e16d6a91b6e8471b7b2feb48(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__54e65157c5e57312ba86ed1f7abd3646dc401e14fc703bfc49b8a45525e6462d(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__85f668a69191ecd617b7231f9dec8f7dcfed76b5e2f26114d95d5556e1860cf4(
    mesh_name: builtins.str,
    virtual_gateway_name: builtins.str,
    gateway_route_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d8d2a6bd5f8feefb2493a58daa3c00724864378ba150a5dc76612b912acaac0b(
    mesh_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__577e836a38cfb38796a80fc6a5658d6827bc75cf00924c6d3fd2688cb5da95f4(
    mesh_name: builtins.str,
    virtual_router_name: builtins.str,
    route_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e95013551bf58e5db471d5dc349869146d9ea74ddcc4c2029aed56ef4cbfb319(
    mesh_name: builtins.str,
    virtual_gateway_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__812dd472cf52dbf4becd7685b57bd295b67b4409c5d91bb7e15938a10e54d9c5(
    mesh_name: builtins.str,
    virtual_node_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d02485ff73b35b64ad763b2a7a98d8365a71120213d34bf7c372df4df0cca74b(
    mesh_name: builtins.str,
    virtual_router_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__00eadc8e9a52e0b148f00966ae485eb3b41b7b1e634a5be22eccbd87a76aba08(
    mesh_name: builtins.str,
    virtual_service_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a1581764176cb0097162139ad9e4cdbd27ec61a1f583a958713b4c1a0083e21a(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c0ccaab39fcf3257c5f270e69dee28317260a150394a9497dc7acf327c749e4e(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e9595ff4dffb0ecdea0dfcfc06c96c49a298c61b892a3146786d4ee1e3ffe352(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dd31126a9212663e996a5458750e69e83b47475f540da4560884a9818f86f465(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5ed6b97af5b532cd1678f1d55049d00438afdfb1dd1bf0118541c52a5353544f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f385994ab993b9ed9a5dfbfe4a8d846a6e66a055e54d2782fd001f1e2a5049ef(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8f5c44c85f7913f68a49d76a664e841db237e8d7dcea5b46fde8a8d0794f0d35(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__388d497328b3dc4d7dfb230113ae27fc428829885f684cd165eede48e98b4b7c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__faf2c04fc4f53be0753f795e89645ff331d9bffed9191d1c37db431e11dbb04f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c39ef32a072d833a835a7ac305ffa65742d6f5162f56bf55d9561d72ff3c8522(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__16b0c7f9d973d55831d7e89c6ac299827d8518c07ac0c284bfd7cd876ea15dc7(
    autoscaling_configuration_name: builtins.str,
    autoscaling_configuration_version: builtins.str,
    autoscaling_configuration_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__84cda51accb2bd933993ce154d6b053c1acd344751e98dd8d5267b4a93b1cf79(
    connection_name: builtins.str,
    connection_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5ecee0997521bcd1d8afe3c99bc2a2ee2e30c5ff56587015cddd5a9d202679bf(
    observability_configuration_name: builtins.str,
    observability_configuration_version: builtins.str,
    observability_configuration_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e9054fb4a954d46b87371df7193f4b813690cfc29874c4c74d1aeb8e39afb681(
    service_name: builtins.str,
    service_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2ac3123ec7debf49055e8bf0b8b96ea665bfbe5dc4f3ba2d2b3768f67c053f3e(
    vpc_connector_name: builtins.str,
    vpc_connector_version: builtins.str,
    vpc_connector_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c9d598b2d0f8cc49214d7e245416b2b0020f23a75cb77905d1ceb5d91de31065(
    vpc_ingress_connection_name: builtins.str,
    vpc_ingress_connection_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1fdc41673edac5293ee8f8d68068e91fe8bfcd730f02f35e7b1575827beabff5(
    scope: builtins.str,
    name: builtins.str,
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__aa7fb12d43ea38700ce1b8b06e544edc07b88404c85eded8044df2ab6a645eb4(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f90d42871fbbd85b35972f156c1b02e6893d354bc15beea8001be6b5ebd9f366(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__749e0202b8407078ee17407a347aef00f0b92c0a321d458d6edd2c33bf18b12a(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__da1d5d9832a671010a714855b6e8db84d657052adc486f23ed34f89fb3d8f045(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3a0d4c92a435bea06e78cf2ecfb08787945e138904839ba43cb17394e84ee8aa(
    app_block_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__62958b129705fb34011bdad6827fb09957c4fe9a8a8e779054d55b4687005cf0(
    application_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__af996f80f7c4eb95ea0e21b6715935a5a014d3e162844432dda0b5fc458a6a8d(
    fleet_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6159b1f40c366aeb13ba9b8c3ece3d8bc84c0d0afb7639147f034df4155fd641(
    image_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__54f378f2a66875933411438130bb355dcdc555dde6f6bddad99906c7d8955e91(
    image_builder_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ea1ccf82fe1b8c26e24328fc06928f9410e3b773fb79d3e46fc90efb21e6e1e7(
    stack_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__85318f579ad1dacf7682f7c5896e16724a4c475ac19cd53d6388a847faaa5bcd(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6ee8fbf51caf0bd163834debe4a7b1138953cff0415b340e0d6b52121b6cce35(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__05e8edb3ab0c2823541fae7532d344af567a63b3becd72f111c7e60e73a8b55c(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__54e93badf3829e4f8db8844f89afc64c077f79e44a89a501aee4d511ee61eb59(
    graph_qlapi_id: builtins.str,
    datasource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__84840affdce4947261ab847bf8ae12e6f24de0fc3c7a495a20d4366cfa44076c(
    domain_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f90a6978b1f150b7e74c581a0df10f6f43cd46b0c150f5162dcc9232262285b7(
    graph_qlapi_id: builtins.str,
    type_name: builtins.str,
    field_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__98a638809341cd41cfc318bd981b71ae6b5588b44c3e3f656833387be1e97f85(
    graph_qlapi_id: builtins.str,
    function_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d814e29815fdbd16ce197c190fad643ce77a1d485981fa7ff592e0d5222a81db(
    graph_qlapi_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__808ace7caf386f1233845c8d50988aaaa45b0cad1efe4793ffe64fd753bfeae3(
    graph_qlapi_id: builtins.str,
    type_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__37d4b4b21f78cd20dd2cde1e2214f984f66721f64e909bef52c573e24223aee4(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f383a2e1c5cfc40d97046c8c82f4c06c054cb9384b05924d0a80db963be86c80(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__362247d0c8a74ddc335e115a6abebd8b20f8199f97220deab96c95a5794c90d5(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__86619506e245456ca45aa088c5404744faf1e58bd77cc9647042d5e7255294f3(
    workspace_id: builtins.str,
    namespace: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e06bcbbad0bc9f17f3d2ed0719a1fb75143628bbf1981959149d0f6481e75d37(
    workspace_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0570745ec844545a58382bd5b4289951d851d9a7adf5f89b06813df18516b4ff(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__554b6f1b4b621ac06e7f2485852ba315bc3537b4bb5df66605c75dc246b4602b(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d1d606cb53403633aca4b41b606e1ff2c81dc2f9b9382efb5beed57e00269b31(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c460714b8283435f93847336eed02d3a2a6b4c81f0e95ad128a0a90ee056b590(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8a853ce4b0d960cfbea94256ba18d22c89753cb8a309f540689a0b3800894f40(
    load_balancer_name: builtins.str,
    load_balancer_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__774009c0d8e97117e62c2e98bd307d91202a8f8e1d7ee17f12cebf5129a3e676(
    load_balancer_name: builtins.str,
    load_balancer_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__476a177721635eebe476780e074b8c37261cedfcdad746583e4f8dd5cabf8095(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__882236aa42000dbe3cd463fb4943d6df6e0ca27be8e1086f85e64671e21dbecd(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1948b5b186d263a12a3da163c22d25b36bee8acaba4f41086a25478efad8fc89(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__806547cef3b3d00ce57dff57e65c98e7a8c3ed6a37e3d916f64168a2760822a6(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f0f16fe3ece206ff0707072e98204cd67056e49bfca575f1832887c00997e71f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cb0b1fb32634a090fd1f58c8eec5ac9932f4d827e1739df9219fe634daa22426(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d303204878d1a778df94b4b1a52cae8676876268580defbeeb062beb8f79680b(
    resource_name: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b575816bf0c7d22fa82a5c9df70d20bd675eb3d1a313d1d281b3d2dbcd12654e(
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c6f4477cbfe291790ffd04a8dfbf0d585fd86ef6cf469e7339963940ea896103(
    resource_name: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6ef2d03b7f872ec7a6909ba9aa2364031a1fa1a3d9b81c7ca064cd72cfdb0581(
    resource_name: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__096226c075785a76a9d46d8d1a579d54032c19aca28078d599a23a4c66f5d314(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__87d09455e8891ea771de5006659548d93476a4003ae02000d21eef979b2a07e1(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f518ca5228e37f93c03a0b7e4f4dc8925fa2af269b227f20e46d6877519948ec(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a1b80850c6723a4b917b1678fd37f3c7b890f7c6f4f102d15d8c23e808e5720e(
    data_catalog_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5e1d1cdd90471f662ed01482d252b16eb445bcf5cc146bd05c2bacd4e66a6fe0(
    work_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5f214c324ad7e33b477c006f5bbed334ad582d11486c57f0ba5b7edc9e7143fd(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8604b861112646539e15078c214413d5b1e040cde5107442d9efe6f958600ac7(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5cef04f403e3f94aef8a1e7b1d8ff52a2dee8ea48389f31759979e617184d428(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5ad7b0ead2d7c41b7e4dafe55050e7cbe8368a0632ae1718b81062d619ced52d(
    assessment_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__68a6c131a91c4a5ca4872411c02136ab7346c500f970fff0f837153f4b431873(
    assessment_id: builtins.str,
    control_set_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3b93ce0c35a4b7d849ded80fba37bceb8d1a24e03080a1daae47e84bbe4e0f4f(
    assessment_framework_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__55ddae23e382dffb72b7fc298dcec1e87ceb0e1b66f8017e441846e658a730e6(
    control_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__97617f251a3edc56414c776426ea69d196cfd8e3e0f5201e371ac4869d96ad32(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c9cbb5829409d2ffc9141160d2a461e83b7bc43226ed548e90b81b1feeafee57(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__58b5cca4c83ffc80b86d397b6dd576e1d4726837c02aa894c505b0bb86f77bff(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c7c26d8cadf257c43c38c2d436422f4d199044377c4262b02fd12f128bf3539d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__57ae7c28319fc9cbb27ef04259a321ab9e263d2eaba2f68e2e24dbef86ffcf1b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cb23f6926842b11dd49a4ebf9a24616e08adf76cf68be33e81582c35c609817f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e7d2e68f765b33413671fa4683322bad2e2892f03cd29f8c8cff5a83ea7efb41(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f72d700757d8550f3722ddae604248f197c06c158ac1ced61f63dcc5ad32f98c(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b0d5a7fbd117b68dd7b3a6ba8fb12597fb95b962d385a597826f03179fa15765(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1cd3623c5544f05330fafaaa1457fc976172d239eed29a11298e71b3ecb42c54(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__458d5d7a45c9a321ca8945e4e498ac3417cf893cc4e9ec95b821658256e22ccb(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4abd3af99bd2196f02d0df71ccc665076758975680ec480f8039c64092fa06db(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5028f940de5966da584a9756f42f0a94aba2d22828e34bfc444d14a0b2a1db1b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__356f9f5e76928ff5b070d6ddc8b9257ed57ad55f88a6ecd809a406d0f8ab2c06(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e8ccf74d4b465a1cda2abf804ab8a4dddc7d7900e12f1c2cfda068e4099bb681(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__181fe1dec77e87606f53d99152315e28597ea993f5684d8eca19500d0444e0bd(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d59244e138babe9ff1e0662c23aaf5d8925acf240246649428ca74b8235400a4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b5be7d341f11150dfaf9f3f6e381022f47a1a1474c124f50bae8387a38f5e172(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f3cb966818eeb22f5391fbfa2e497465cc7129fc65afcee358bdfd743742e39e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ba6e3c4631a6a51b49ef434e232aba65c9e587f4601c462a1c599904222a3f21(
    group_id: builtins.str,
    group_friendly_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b647a3c5a897f0aab8ac63fee08cff082b962ceb52e765e226292b91c150f7a7(
    id: builtins.str,
    launch_configuration_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cb2a69f50c115881b2767868c2d77e13acd67bb496645da0f6a5f4a5847bbcab(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4c9a5969626df89a5fee4191d07bc1e953ed632905bd1c5fb9da1b494c9a0bd3(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9f20dbc820c26515998e7f65ca5d61e54c6818029084784210ebe83882e24d61(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d803c2da8d7509d6d23586def676c829253c13902dc49dc10148bb631f36495d(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__49482f55fa21c7d7a1cd901d2f7cd25ef4e35450d0ae60a8d91bbe32190e9752(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fe4c5a709680a74af58a71089b86f3a170a2b85444ca80b0caab74f4a8802fa8(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ab0ec6ec99b6056ad819946130576ed34abfc6c528b8a3054e643b0518e39738(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ea4f9068f962d98cb94fce3af384714cfd6b7b1112f07a10235b47b65d0aedb1(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1f4ea36c84a244954705defad03479adf0ec5bc8699bfa43e92010d6e345a2a5(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e4c2c7be32731606bc53b6a8a51581ec3377aec6d60dddecc9b666a29d23adac(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d3c6e6c0f584c319c793c9093668f9bf34a0fbe7488d5f544fa9f8ba2efb0aed(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3324f6bcb8361073336d171502931ea06e9bc52f148384d78badea6cf031a41a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f6905198e094bf8dab2dad592a12c9fb134a4229936dbac6ea2fe85a4c16cb7f(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__53149af53bac9559e6f529f3c2b273557f81913a4dc92f3399e9d0a3943d8fda(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9326c1a2ff02fcaa83caf7ec9250e1f0d6a859bd8c9bdb886497388c8ef7b847(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cdbeb31ff1c56a3985dc024c7eb5bb3c2485497f3c683d16c468ec539f5f7a2d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f8f0deae60a88146c64e9fff5d4e6ff8eeb48d4dbf3c59764db4b28339f3c535(
    catalog: builtins.str,
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__024b37a5337d574aac3101e43d1afce052c7933501e379d67b366621309d3b6f(
    catalog: builtins.str,
    entity_type: builtins.str,
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0ee588f305b960d80011b32e1f0877dbd15972ed69e1567a3d3b31f025798c1d(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8f44eabd0f2ca9af66d874ae289e82c250487539d601ce726b888981b6263188(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__05ad8064444b40c5b1c46af55d8d04a84147064b24a65bc3c4f42635f92979ba(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__376ae21ba351117ecfdb5a25d3649b8e2e267b3e9c778812d8856cfd083062ae(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d072e9f5274e47cbe761f93542e761d113cfcc1fcb0424b62fbdff7769b7b9be(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__936b0f04f737979f2a68abd68ac1b63ed538a417b369f29b42841234eadb517c(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f9e3514cfec7701d6bf0e08d3e81fbf0487212610fece2cd83ee8ecc0a4a76ae(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2ca4794235c7370f3bba8cea341c74ad1de145b7e272c96bc96f9662fd228497(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__02ff78958fd35a0639b876a7f30b90c2e8337ab494238f19d9230657be24dd60(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3481799d1c139c8f16b11f354e5b6ee8cebbdede6dac1e7290b7a1a2aa2491dc(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__db27e288ad62b636a8bba2345091ca83ccc9f812519f762b7ea9aa2f1b6eabd9(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__376aa37ec0f1f8c331b9cadf6a2d2c866fdacb05fb3f8c97fbc4d9e11830bcf2(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5b188a925912977fc8ce094690155c747616169b7c357e1a90b572a025a816ed(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bb675b4a95a4a3e7a4b4008f739913b3a3d660381778c73c126c3989b0c360e8(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__507b459bea7a0cfcaad2fe5621fd6d9810d1c4125be32337b48d16690fee23c3(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f2c6b3866aff09e5628037c83eab6abee1bf01ae94e9518f9231280946ee0b54(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5f61b5eb604b5aad832a8e8ce8686a8244192d415174a1e7aaff93cc65b7ea6c(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ec6cf607765950e3153a59a3e8775b6fbea0bf66dfb3beb25fbc30000a8c9382(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__97adf50a25cb90af32667067c6eacb2aa751071c2707954ac135640a2b284300(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ed4cd7b6ae4a810da063221797e707f24b0d61fc5e12ce5d20f4d3626693cb7f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c8e1f38fc5d720fae3c79171a06a70fea95e585890ea8958726f2f08c91e78dd(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__46ce284aca191bc85f19887eece8610e8e71c16a876f6fe202ae91c7b5c24a63(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b444bb165e4715613c82fa8e21845dd4114f2561c5744fc7cfe04610fee6636c(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__db732f1d051f21db2f656101f0dd09b808200e60feecb9b9cde6b78bf18b5373(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__62ae6954438803791ebb6b493f06e61272d7d24c2a64a58d41ba0660d92d32bc(
    catalog: builtins.str,
    dashboard_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__626690b1fee217feab20e9b11ce18369175b72996be327f3169542d05d5299ef(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ca643dce8f888623d82ca1e61cbd6ecee57854139679554f57545c89452bc30d(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c7eb3f45d9c562c52033924391e15c9971ad6f6fb6018bdb81aef9673fc3aae7(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dab7b0ebd2e20dde2271b4d6725c566b8f221ba3b5a5a5563c90eede15962881(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1e9384a5ad431f37d127a1f924dd0a1c268f298e5dca98eac3f0e9686f008f28(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f58c827c837708b4800174487e9accfedf848020b20e781e6d00af8594567a05(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6452b27af18b4b9b48e880e739019574f59b714f77a7b26aaef364257f443fef(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8a75c6c0a64f4a105a0a0236ed4c0a6be47cce40db83e66638f3e764dfe568d0(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8d1f20a13861954bf53e986153a255cf27eeb85f11fc5636366536b2f77bbb72(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a1833328f065d12df98b5ba4283951b56ef6c6a7ba0d8ce8f163bdaf4e54ee5d(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__94e863f59f3e011d5257915391f2b8bab99c47e642796f0e176e25ad45089404(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__caaea0f35c479c53cbe89506f5d91af458656f0577841ef4e2b3dd32dab5c438(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__46a6c772b4317f8aab45931f649212284ae13a0ad2b19deaac2d26f1cf3df4b7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4bba7fe1700c041d4d02be9b02c55a7da51e34b1b367850038f8d60968aa23bc(
    backup_plan_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3a728744324e221189053f52db13d621ad865d7c2a2dcde20f939759f8ef098f(
    backup_vault_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__242cef4f455dfaf795694c213ef571ab4dc0a7e037b470d51c3c81acb5274f53(
    framework_name: builtins.str,
    framework_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__606013e035ffc533ac6f7256665c7719a1219fc1e7f33905bf87d27abf4a6eaa(
    legal_hold_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b6f6e54dc769893feea207b29b35509b8167a3308d279f1403366f797c6cca97(
    recovery_point_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ecf03e605c94dfc98d695a7c631f7b3665edb743b6e89ea01f94aa82d8f3bca5(
    report_plan_name: builtins.str,
    report_plan_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d124452734450e9f4cc1971dd9ad6792603b7cc0b55c390e20a09b91d686ad1e(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__87d0670eabe1e87448387ee10e4248e8e385caec303410f24d37aa1cd6e95ed4(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__44ccd6ee47869e62636a81830ce86552370b10af2bfee0c2167823b9e571505f(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6950ee71a4f5c32212625cc5fc399885cf03402a98634a04491bcfac2161848f(
    gateway_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c925077c41dbcc1b5789553dd92ced31d764c3aca54c8c28e442d49cc7e6f832(
    hypervisor_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9b83f29bd420b71eb19ecb6fddd83e2b69826d744c74eb6e5af3d00016c4fd88(
    virtualmachine_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__04b48a8c2c44a68899bf91452ca616a45c6692bcd5eab72efc2f26a6436f3755(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__37bbf79aecec4119d28ee501057817facc88ad16a0bdc4635957ae9960ee28c4(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fe09a130f65ea3a7c1921034d3049e7a6a0df3f719b6f28d823cb952fd81a051(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5ea131868eda6bd1e10b5c34a10254ea5a7c73c5572e704c31d5b6c6bd0fa8a9(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c14cfc92503d02f081e19aac071f3ffe0626931f6a0c0325b457443bd5b9c3af(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__729ebeace8c71482c60d51d582c66609e34aac4b48af87312b1506f81e733781(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6e775683859f316f87d2102d1bffe56a7f3e4635770078c0a2176d0bb49a421a(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c7b5e9719bd8bc150f504d38073ecb07f5dcfb1d22c610452e92436918175c4c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5c5fc492427fb6a8ef0d402ebd910874abc5a1c8199c529d0a800792062179de(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3d5c9caeef5afd80227a031b29529adba9910f54566cbfcd6c71366f8766c4f2(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a95387d28b30830433d145b1f749aa4d97a348ca79e5384632c43e47c15f1a54(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__310a56081149883a5b9b74dbd16622a4c464f7cee3b6251414859c6e3e435356(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b4d0208d9084d7cf658bb01c7afe46e7d6ae1265d6f8bb08dd4d5d41e1cc490a(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6821ffcbe22f58eb4440a8d9bf76fd931dbf226aff004c795016a2305a1a348e(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__422517ce44b51e351ac50489b50ee2c2a74fdb10c68667522054ec49186ead49(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6ae3ea96ddd7f8991512960f1aaf89707058952d8fdb660fd4297e5865189b2d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8f29324403c0dda932375e7febc07bb88c33fa6e42ee57cc92f07d52bf9f5c3d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eaadac3d4a38b0a7071c14c5c19921a8ab7ceaec828fe5ef63560a9ff431cb89(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__93c24adb0925e5266eaa810f45eb98a8f995d74636c7c30bd58efbc0577b52a3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__63a42f74e8d4ea8c3c6c805b978f10a19594080263ec3c5574c4f75d5a577004(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__276681df06807e87e204492dae639ff24dc3b813d0150ac540797a88e568d92f(
    compute_environment_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c7b8712fed4156c7f2f204b81d7c22ccf09cd41fcff81a1ae312ea9be5ff2316(
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6d66b6c43e3e65ee46dc5b9450d56cfa5806cebd94067d04d173681bcfdaf9a5(
    job_definition_name: builtins.str,
    revision: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c8e4899cb043e1e623aaf5b6372a3ca9473d85e98dfd5a7d597bcb8164497826(
    job_queue_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5f900e41c76c4ba1bcebeba9beb4a123e5d8d6dbdf402e54b7f4c2ef932ba880(
    scheduling_policy_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e3c80868df4f2abb50fe3e825697fbb936ab49d02d2a1e4077825e3bb63a458b(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__415a4fa0103919a766a5a9d5a5f218630e1159ee716a8a14cc2a29a306385508(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bf1f2860c3021cfbee23baeeccd868aefa58e97b43d08038d4b45cca0736eedb(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3968e3405ed250c3a3dd40eb2bd47f53c14666a65368768cd7389a1e8154984d(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e55cb3d2736d3c92c224c2e44981e3a74f927037ac6f141e1461184191c80489(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bcc803ea171a9c92287ea94e5d096fa6dafe4f267462f5e7a8903e1fdcb6f148(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f6a0dd171308d968ca95d07b99a4a3e145a703eeac922ddd9cef5f7f3ccedaee(
    billing_group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7d02cf443ac429d6c286e43db4518e3e85aac055803d71404abe160e5eeffd8b(
    custom_line_item_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6634f08c1371fb86eb59114566140a9bf945d65f8d9c661066a00905213aec3d(
    pricing_plan_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__253802e1fbbb5f48493a1fa751c556aa4dcf3eeb0839c28599a2911fe9538e58(
    pricing_rule_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b9f1890080f3384631ff0e42252dd76998ff7f128ff5f00d8bacdd80a2b8fabb(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3e9bd030bf4442ec56cb51f92d2bf23c8ade3a62cb20d6c830e78794e6d44f66(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d5eb712bac5abbaf9ed2ad9e0a3864bb46b6d97d0e1dd3656ecd7fc05a54d75b(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4e229b5c29d02648d9cc29e99d709bb4c9a6581354e965dd61ea24bf739299ea(
    job_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d685654c2596dfea885623c7e868e429558b224e80dbe4d02c8e195a7eb84e7b(
    random_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e132c814b4c4ec3ed4253e0df0ef04c12b612b96dd413cc2d1b3fb3d1180fc13(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__848c06e5178bc83b2f5fdf5c6c970223c557149189f32f91e3ae3beb7a99607f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cd54aa98789322c960512dd3a0ad9d5b1659b27a0e50e139603bab53bc17a593(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ce629a22c30d17b6f90b4ce4cabdab9dea22b36a2f68e5e934a4a13e3c47503a(
    budget_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__338a69663ae6166b439973d206e7fd08d95711d0d4969baef48ab99d202a92b5(
    budget_name: builtins.str,
    action_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d810814bc7799ee1250d056924b19481567ac8f8b6b606e2b808a0c97a6d9549(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5b4624ebf188484f0f337d0353bd1dbbd66fafb10354ed992df2b9c0d213c4d9(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d1fea4d3511d7d6e2f8664f5700c0cd4c3cd96445713aa82d401cd0678c0d6c9(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__94aa0a57ebeea02911925f901881267a1410a050c94496fbfbb433c6b951135b(
    event_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4c5df6f4162d14757d52ddcca8641d1616d659a2ba678f860da6be576f4efa6f(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__38bd2a7c80d99f87fa724bdd162d943eb079ff71e330a82eff6fc316fd104cd3(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1dec88351c6f39e7d75edb15cf8ea8585b856b86b58e591a84e20ca9323c84e0(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6ca0e92273f6096cc8a46ecd636daca1add04c2f690fefa898b8860743181aa6(
    domain_id: builtins.str,
    case_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dbb8b77c7105a38bd8751501f9482224e3cbff02864199e73d86d66eac9b448d(
    domain_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a1c07b384e0af6e1e87284b250621393fad30540dd086d327139e0d8420d830b(
    domain_id: builtins.str,
    field_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cfd6b787e63aa5af9dcf403cb81bf6ce1d98c4cf4380e0d742ce8963ca436356(
    domain_id: builtins.str,
    layout_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6f15ac642a23dda316adc2206523caee5fb600204a77f309dab44eb9941fb953(
    domain_id: builtins.str,
    case_id: builtins.str,
    related_item_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f7c2532d61ea713614033c71bcba3327af51f41eb2f44a28e5ec7d90a68ae7eb(
    domain_id: builtins.str,
    template_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__951561acd0e1526b6e1b82f418ef8eaefae6f04b8d3a36e684659954dd5e0ef0(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e82d91701c2065887e65d1d0924fee90cb786f29d6ed950523a3a510fcc5f34e(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b2a1e393d34ec13f42797f9f047b937150e275a325ebaef2c25f0e720ed9f8b1(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ff3ada33465244ea7e74cd8f263ede277b14db0f9d8d4c161de59c3e66ee8801(
    keyspace_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__43d00bb8299a917ee5b580decb488c75a3cdfd3e8d356cba048296a785fdc16d(
    keyspace_name: builtins.str,
    table_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bd1d256ae5d407c53be4efe480af78bb80ae8ad28ed3d80e3538763d32f4c6ff(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__890246c174b009420e2a4774a99b7424411bfee7f1397b6ebc1dad2c83364355(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__70fac6d9ddf176b163c6f9ef26aab520ae9beb4494c7f3475ef104f59c40843e(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3be9c25066d96659971bd2ada25fbfc16c8debda536c1aa46d427fb272f73742(
    identifier: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bda03acf12b9dedd0daa30b7f88cfdcdd47445047bfae12bcf2a06034e9f3c3e(
    identifier: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d519d425b9054f3e1fe85859fff48b3136d6e92ac9e5cc5732e96dbd4a11091c(
    identifier: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__befdb89f1b706253f56d0a0899e54afc108a8fa31796f3a3fe855ed4341cae67(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__298b00de780fbb4fafd010b8e75cb0ece12b6b719ef1be102fe2e269d9a1ed11(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2d1d474c6dfd57227c082d9b39aeec26ca4972568a7a14470e36608479724600(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__54b60e31fa91167b8294ea4ce72f708c53dc053f5da5a17ad77c874f3f3e78b5(
    configuration_type: builtins.str,
    chatbot_configuration_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__920bbb1ac122b275c34237b7dabe1ec24e945fe4faa9b390b9b93962bab53532(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3db1ecef7ca8741cf49bb24027a9db3b701dda862677bd897f9b03d368c5ac0e(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4f8bd3f1e78faf7e018224590708a6fe60bfc9b055f3903465d3f3a0f3403bc4(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d9e9c251da376dc99e13b8d21da71b14086dacc7da687324557c02fe0cf18e88(
    app_instance_id: builtins.str,
    account_id: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dc16f904b4818019d052a0b4a765448b3c48e804d997b7cdd83c1633ba202f64(
    app_instance_id: builtins.str,
    app_instance_bot_id: builtins.str,
    account_id: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8d411e4394ba43e2a1b4f295a4aecc11d2326feeca4baa7ba76876e6a58a97a0(
    app_instance_id: builtins.str,
    app_instance_user_id: builtins.str,
    account_id: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b6cf6a51d8e2a2c69d901c01e50d85f944092633a647241236e0215cc8267005(
    app_instance_id: builtins.str,
    channel_id: builtins.str,
    account_id: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__647594b6501520ba2f88addeee34765e95774e50a9d8fff1a74aaede68bbda39(
    app_instance_id: builtins.str,
    channel_flow_id: builtins.str,
    account_id: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fd37b708e7cec369fc7605b079726f4ae65c844da9acb3ca069391f688b50114(
    configuration_name: builtins.str,
    account_id: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9cac840270fc19e7d8fd62bd20c7b7f36d0d665feb222898c0e92546cf2e857c(
    media_pipeline_id: builtins.str,
    account_id: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__407cea03ec7371b2a3aec3aa45518afabccd6959ab22fd085013b51635af62c0(
    meeting_id: builtins.str,
    account_id: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d775ea9e66e542293393e1f9f087899e3ebb22156091a5cc745325bf1d6ec036(
    voice_profile_id: builtins.str,
    account_id: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a9a25a23735e612378ef0117ce5a8fe41d7055d5b5accde2d6a01cfe6ad92f90(
    voice_profile_domain_id: builtins.str,
    account_id: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4b4c3392bb4b58e19c30dcb31b952b8c2817871dbfaa8e9c1da8cebe87d28388(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2002394112378a611877a5edf31bad30463f5b16f69c2388b1ce5b592de409b4(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a3f50c07bca9ae9a764bde58a930620fb12d7084f49dd629653433f1027ce0ef(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bc40cad9432e509aabbc219c94c9c598a9b89a460dea32d6d6ee07f621ef4dad(
    collaboration_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0a04065e76e705af5936a1bd32cc49e8c4121503514003e041c871a07d511f38(
    configured_table_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__01e555af0e1980d1e38fd3c9b82b206d6a39fad829a96f3a29819b561817f95e(
    membership_id: builtins.str,
    configured_table_association_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8629a5454e6b9e7fb81abc3c602b985abb505c9fa65b85f43e430178d3d6ef8b(
    membership_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dbdcd4914dc48f244c92c709db889fa32a07838a5304e60d932dc034046b3b2e(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6a8d1259a28bff11e4e85d1cd1df897db799a69835d8a1d50501cbae104f58e6(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__339744f47c675293e0c17266ae5392bba4d44700878a1d505b1575c5e9192280(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__05fb138899d207c63afed40fecc9203afecae9da4ccd802805f1a8d1335f94ec(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bc8ab2d6240167ae0937c87efd297583d4245f35829095d1bcdbd3d7e9e5ad27(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6e62c3ed460edf02944bec057e523f525d81a789159030a13f3d38c75ed815af(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8ff07b4013b1bcda516d669eec5c65f46a57720b3d78cb1aa431aadc64cb2a1b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__61189a43fa5c2a9d60f3f94df129b0d2977651c435485ea3f38a52aeed966451(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0b821643eff4500a26d2640670dd058e6a2c6b9b7f0b9e7ab18f2236570049b2(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d8aac11d9c34245f2d12173e7e906bab70b36d51e2434253c290c5b94ddbe3de(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5eb71ace7f84bfca8fbc39d943daa510a54b1e24f717ab695791fbb81ec3c03b(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__15edc460d78d0b11a94fa211b2f44275583884a0342c58728cf0e942b61e1b3b(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__294bc921bb77482ac3526d3cff74adf7b09f57afa8e1a097aa822504bf251627(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bbe5c34de249aa71ea745fa7fc61c4ad997a074d7c34f2b243b9db29e9c08b74(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__902b92e402d96b75eb9e697feee51c0f5399ee99457fde19062c69fa7d22af8c(
    directory_id: builtins.str,
    schema_name: builtins.str,
    version: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8415f0ebe00ea65806c9e087fc6aff5248867b14992b711f176042ee6676c547(
    schema_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a0cdcd85f79a20b790a9af2f471ec4dcd453c3b70702ff074b417089d416d012(
    directory_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7b048125e8e1e81f55cb4a063468630c6fe9757b8fc5783fe5e33362e22777a5(
    schema_name: builtins.str,
    version: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__91e53331d5a8607dce71e26a16e42f662de19fe99fd39e3ee8ff831bbbb12e21(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__307cabc78418ae987bd6ebdc4ccc5a254fe2f9a10421d2b6696c1ced7e8a4f45(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__921f6454e598e7e2eae142afe80f1dbef15f5719f66655bfdf27f24a0864f6ae(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__55a3345d40efd2382583c102e2b75c1834daa3a297d48e2cb4262a2e1009a677(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bcb12380db3ea952ca3f44f97688e1cdf4eabe03928e03879980d631d048d50a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d0db01570e18ae854adb80ee9fb6b4929679df7f1798b7071abd6a11f63be2a9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dfce19158769c20d0ae878c5295efe014769864f928bea8b25aa4952d0036ffc(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5650670ea6d8052d4e8a79c0a2e5c5dff2ab2d8843c172b5e34c46761a8f00da(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__aa280d9ccc463d292ca06d2053a341bced9f1c37dfe7f91702cdc1909e245178(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__27404c94178949e8f100f72d300e434b024abad9a8b0de2cac5290da77c9d080(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a4ff710b2676fd87f6d10fb128a8a8067909eb7b9d92742afc9f66020fba9adb(
    change_set_name: builtins.str,
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__85a94d20fc811390841192341621046a3655d8ff8f0c11624d33fb491b9d612f(
    stack_name: builtins.str,
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ad4f6658ccc02558502eacd749e4b007e357677b87ab0ac2d4d2cdea1919e94c(
    stack_set_name: builtins.str,
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4063d250212439bbb150e7d6833bc4c9d4c17089b940bfbc490f0678cc5ea717(
    stack_set_target: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a62d71a7ed7e71b1b27de542176da9b3a72064a53a22cf1659ab3f26b4f9ab99(
    type: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2bfc4e539cdb89284b732b548fdcc40510997e1ad433cd2809fe67e296369cbb(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7a6eac315f9fd895fe73b4b5bad99453f686877c831719c4afd90783a424c8a5(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__284c20a3ff5b8c63e99af030c65f7af19486bd32c4e2036e4f2cda837d7b427a(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9db6d4cc792ddb7adce535bebe82bae67b62f64d1790b40879a8a34007c0a680(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8cc07955dc8c66e5d42e37e70c0c7eeccd9e9fba2f141b7aac32bc9664fe48e2(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__032baf43dd267b86d9f9d0df81a9ac2d60e29bbe72821fd880ebcd6c8e4c5912(
    distribution_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fe695ad991af0cc392869d518c18074d8561181a2d86e231005b6010102441e3(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__882c48b1de790e253c0751fb332b18aabdf7c36a2e7d3a36a024accc4ad0bbc0(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b58bc8f890347bdd151d02ffd9cc03d3c0c1273b03f97b48c9d9bf4e38237f34(
    name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__10da0d616757e8c67387bb73ab04a0d909c553eb16372633e23bc48bd9513b4f(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cc58ee31d8c91527ea7c0564c0f83e24c1338ad3aff452e06563f18cb746c72a(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__04a34233d9b80d3f8395ce325c9140dfccbd6c109ee248e9cd3ec10dae059379(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5a09f38031a6e31db6004f63641e36c119cbacda04feecadcd81473ac0a12e66(
    name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__42c392ab2e5d1740fc3544f272afdc1e169f915bd9dae8dee27d0cb2fdafd631(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9ee1ffc63f929156764ef520269d50280ec8509b3f5e6a4ce5690ec8b944f14a(
    distribution_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1549bcb70304660e4423237b06ae74e1b1bb9a4505b9accf1d0a4e33442be9be(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__819d06565119d1eef50329d633e8b52adc698e975d92e620e5343e523dda7f20(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c618325844edfcfca00d3df06d89ead301aa030fcdcc282e8183635a41874670(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cb9dbb292421b1ede29ea434b63c699233cf201f006985106a76edbdd10bd0b0(
    cloud_hsm_backup_instance_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7d005b7c766ec74132ba9ebfa655765282b6ab3f7bca5b14da360b3351ce75b9(
    cloud_hsm_cluster_instance_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1510cc6f96fc5f6d838591c94168c91f0b3ec239710b3afb69b8224977bb4124(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b708bd8aab1c0f79e6f82351fe6361ae73cb14111f459fa3a9d9a3eeb503c283(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3aaf97bb8837069758e8d5c58f625d2cfb8e46a6bda834ccd920d1f97a893ca2(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6db74c930bc263498a0df36bfc36c3d8a374c37afc0d98facf05d37115fc128a(
    domain_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1be4cd245bd9ef109b08d4b483edc93ea2fc5317c14e098905e4cab714229425(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0a9aff3eca1fda0d4b8acd5440e118f45c36cdaed84111ce7fc809eee945a8c8(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1a401be43645b82aa761c27ee65cad379ea2fe36915635579c5f3dd5e5bac63c(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__06e61fe1b7997b20bc7b20966f69b79aa36238a730df00ec0e3ed39621826927(
    environment_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__60e12a77bc5ae7d92f37b0092ec678197f89d616e1fe4517ea08f3af75952629(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9b1229bcf480fbfd238363d0c34e5ad683da2693577c7675c39655280f4f5da0(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6adc3fe3fe96ef1de4fb7d10f08b66ae31a3682b01de28940dff7add48da10f7(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d0f9d85097790bc043e691665bd6460ea0e9581ecd684c1388b671270f661e0a(
    channel_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7378630105bbaf29bf0ae4d2fe8993da469acd339fd00f172e8336a146fa5bfe(
    event_data_store_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e1bd325c0918b17901837459530824758daf15e218a92f5340e065de3bc8eaf7(
    trail_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__aef4bb71b32ffb7d8e8bb177054308e078fd8492cd6483ea24c827e334fcf24b(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__81e7aafd003377751fa0889b1f07680bb05aa7b7113332a9b1aa4498d316b058(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6d6e4f460e1a398f66a24bd5575959ed8ef3554704a24dc8af37c2b88db4aca3(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c1549d0732fda68480145bc72d0b4d96cd5c675e554304cb4f1ebfcabc3aa9e9(
    channel_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3185e90b098458d6536ec132c7c9e3a907458953b1ce2bd37c2dafe15b2cee97(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b75789dc662ab4e04dfb3e26ae28a10cc5c5f84760c514782fac51d63e60a1d4(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__97c569f863eab5ff16c9e03cd232cad939f6831a528d0377d549965df7cbb798(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3011eeb43915553a74d2e3117128425ceb108af80c68646019d7822c541b1dd3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d493837bed52dcfe28f1559b68b09ee0122b33c684409450c9acf73ab940d105(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8c52ffbb10a7670442bd00b801cfb9a3208207a1de1db870f2ba47417c4461eb(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__986aded21503c397ec5d736cfcacf8a23b7d29ce6905f27e70dafb2b9091f30c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a49a0ed65920d0d1fd569cf28183674a01f64ce83aff2ef965b7244ff60fd3cb(
    alarm_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__72c9f11b0904d9c65a50854ca3af7c070b2cb7c68ec120031ada2af77ec2aa70(
    dashboard_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f41f613203e3a9d43a14c1dd898689f35bbb223511067b4c1b1cd3c811f07f28(
    insight_rule_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__244c6e840994d6073b8333bb116306a5394365e3d66bd8824b249fd2c6dff89f(
    metric_stream_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__269d8cb01e6b695e8be38796fa8177d6bc6fa549a33ac727d1fb9cebfaac6294(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ef656465221d2369d3138e4575175349ad7ad1e4245673d6c6ffc17561bd6574(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9fbad76ad5dec94e2fca5aee9bfc09f1a83652b3ab4a4edf1fa492e43797473a(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__25e5d56049c1a9cd60a9d21f7f91a0816d77715065d272abfe8f6fecd66b26c0(
    domain_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a3e7e01ae6a55f8968f266e37425208e49044858a063ec85e34cf5f0dccfba4e(
    domain_name: builtins.str,
    repository_name: builtins.str,
    package_format: builtins.str,
    package_namespace: builtins.str,
    package_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__459698c83b2adf482adb0db4d9e66bba2ffb76ee6240e7c52d16cacb6c432114(
    domain_name: builtins.str,
    repository_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ec28460b547d985a6d184a4e756369ff2fd8c6709b1c07a0bc7f69a02638be75(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__76d71c75f5019fc07080e272253894d2765a52c85c5e17ed68d6faf86968347d(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5912f31dec319cf74757168123e8d8a452b4bb8ae4f8647196e65bb4ddcee72e(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0f29ece8a0e97a93833122f747a52d83c9c086a5d1ceec092afca57ee8a56f9b(
    build_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__42a54e4cb9091420f2cc6c01634f223eb91518d1cadcee03ecc926500d6a2248(
    build_batch_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bda5052a4e2f6e548b1e22237be00c24e5e13f4b2ec874ea2871f1512f34ba1a(
    project_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__96406c70f67432ab11aa00a7fba15affb22c30d15b2efaef9a4e305df1bfac74(
    report_group_name: builtins.str,
    report_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4c6041f5e8b990ba82ce1a78073f0948d99cedfa69973cb7fd7f8ab9aac49c89(
    report_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dc29a06bbdfc5d4dc9253622dbdc006e8344dfb1dc7fa9b722badb508346a8ec(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f9cdfe2512accf0792c91693a9899ab9aaa4525912079a9ea39e117961afac66(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1e528452326f6c7feda17df61ebe76c4bde30c6e36ad8a52d99f8f8b2d25c1f1(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6fa91574ddaf9ab69399cf21e0cb92c7571062320921ec9dbfc3e5a7ed753dfb(
    connection_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0bfdf85ee9929d543a111bcd4fcc91dae5e50eaa5959372f2c883675d7798a37(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dac1bf23ac373ce07e5241edeaaeea5bad51e670484810d6ad8a1d1c33e337f8(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5c957abae8d161c35263140b141d60ee8dbd67071526f12a16ea1b3b3832f5c8(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b860a9613c60f5c7bcdff908af2fd9998c0eaf290087e9ebf9a9fbb2f885d9d0(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__94a31e727bd0cbd1ff9a5ba13cd000aa33785237713b835993ac3ed113575186(
    repository_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0258a325b9cb19a77c0840d2520572c02cf29c36bfc744d352cab329dea3ad5f(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b3997ff6f894540d9f2cf3697594a5d661289a7703c1c8a31ee462ddcc204180(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__06aa6dedf802387a6e4e2c6e4b0c4d7212369014f481d0edb9aec7ae660956ef(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9acced9ba0046a9212949b2bbf3e947b8ebe5e16de2297c40ed98eed12be8420(
    application_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__82501286b2848dfc296c40d559fa8ef59e5f5c6a11e50a76520817a58355d90f(
    deployment_configuration_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6744ec9e2fe9ec62450c735cc51f3125348cfb6395fc74a1d139f57476996549(
    application_name: builtins.str,
    deployment_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__010f2df40b04b7326c88dd6225a8af6d1fac9bbd14b1d39719bc780e18baa65a(
    instance_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a882e75e584d87eecadce14c68b27fd374820e1d4289d4e2147fdacbfae3f8b3(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b82da6474c11bf7c2d6db975db4ac0aa644c4fd0d6f305dc87540ce4da534d66(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6b11d62533a9c864894b187283e92365414c117e28a9fe13084cb3f852bbd322(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2203b21641bf6c0e780c69096daf94510330159c94231456780ade602f326da9(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__893b2624813d11a65b509ba905699c80c5e4ab49244e7c68e1ad0d7e803b6cef(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__50261d62adc64dd381673a1cf7d0fb7ceeacbe6cb390a621e6b90f7d32c0803a(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6b609efbf0a575a41636822a7301cf807d2573095e89f61b51edbba1ca7638f1(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d2024c04b20c0a5cf68d80b40d7a6a198b8737b9ea56309c3d1659371aaf6974(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fa9956816b9d7e2fe23d8a462c910386fad3b746600822390fda293830bd3582(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__46ac148611e7ba807077e6b90279183e6dae31a8bb73be8dfb3d425528524319(
    profiling_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c7343b479c5bb7ccb48a7f5feba4a4a412daa1f2106c60c7f3640cfe49d2b32b(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4cf69bce53160c45c75c879790713beaa16f74084fb32ae04f593e1b3a714ecc(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b90e71675cd3736d230ab5f52703f25bb20a96783226b08310aff906298b245a(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__709703b08fb862474b31e76b4bdbc973876cffe49e7d250f4b8d0b285d380f0e(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8ef25f1527fd4124143ae35ddacd94fc2aeeb51196cae2e439c32773b2d5b921(
    code_review_uuid: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f63268c46e506235a60c43a252b0b55e5357d2cabc1674d195b1fb9d3bdf10ab(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f614f1b6e33ff523b994444ad0406b00b75bbb28ad9d4c97a08948cfcf1509d6(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9073eb1536dc71c56c9bfd03a8ce16f0fd91d74f67fe2548256338d745cd5dc2(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f24efb0a76216f2a0d5d97f70dc3148b09606f073ab4d6457331155383ea9b36(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d22a6a75ac5df3e266b69cb5a4419e6d2079675606188b74f398a54943e595aa(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__961ed013a26167fcd77e0421cf67c5224baab87219b470857bce11c20aacbd82(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bca61aedbf11fc6194b86f49f22ba22a35223508d64008f43e3f89cadb3eeda5(
    pipeline_name: builtins.str,
    stage_name: builtins.str,
    action_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__282ca84ca16aad9f97bfccb9bd13de49ff30e60e98bb27fd01c8115a8970fa1b(
    owner: builtins.str,
    category: builtins.str,
    provider: builtins.str,
    version: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bf0751660e6d5e8a58c06bc0c901e96140b8360d879b0eaa88c0f4817d120482(
    pipeline_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8250ad5686eb7c92af73b6ecc995d91bb97f1709fc65019040e633c1370c8708(
    pipeline_name: builtins.str,
    stage_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9ab6d70a130118bc8cb55969bccafd1f480121f6f169f41a8e5d7ca5e52e7700(
    webhook_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c3440d4b3893f363d1bd26d195ad16e13e8bd5ca269be99c9a2226647cd6ea2d(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4198741edafb3689f46ee951242bda5dce4581e556903d9b9f0f1b5e93c1362f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d225b031d2f7c9cd0c1ab3b872ca91874222f19668f43143a2332141732c5782(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bec2741790cc29810b8f8bd6478162651fd2569f5a6b2150d556e8382421e656(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5dce08edf9cd751f65a30dda41e638ea100815ac08cf3a5d0bf8abc9750b56e2(
    project_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__55b1daf24942cd1ecc773235dab458f0a730c081bbca43efc6c356eb2c65dc05(
    user_name_with_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c1e36811f4c1ce6e5d6406a68f763226e27ceff0b6eb9433ac724a7505a6c85e(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a6edd243b1c5143a5b535ebdbe2dc64faadaffb7aceda1d9b5719c74ea2e39d4(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7135e87b2ce48b556ddb418f096de9c252f56ea4c3a7cf94844f8ba4975379e3(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8b29f35309612c0c584a103e35972462a79b9c29f212dc991f049423242c0a45(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0b51d68408883bfa90d1ca3f36ca565cba894caf18bc5904ab32eedc3774965f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3accca27f1f7c511942488d1f8771e439ca5bec0267a0ee9e363051089bdb025(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9050fd0c96966c21c3795f249521c8e1d19f73539a6f17842b29b81375ab8076(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c05e086157c823822ed2490557b863120671d87c7de98f9dd0be7bc7893e5f4f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__27fe27c260d9ca82a7b1984be4ef0791fef12ee32dccc7df7dbc09468936884e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4c7f038fdfc7b4a180dc6f046b512400034ab697c2b33fa5fcd3ebe2722887aa(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__492c219bb059f3848481b3c3c50813e6db6a3849d8a349b542f87737cad53ff6(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4ed4d8859bdd7ee18c9f90ec901801630cd3f7f535ce0843e25fe7cb4aebd2c5(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e2d6f912b3958fbadc6e41bd767aa5d5933c1cae678f39ee614a46e001e14bee(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5c433b34b7ad3fed78409f039de278a55820d49ddaf9300a0e5612ee5533b98b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__32d989810e90dfbf9bf4d8f873f69930811b1781d7e7ae9d7cba99d085e6cbef(
    connection_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5e8fe310cbc32236dc992d37407610730b26a8aa3c1b66dcb06dfcf67f38235c(
    host_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fa07f1186b7d9b9fbf363d6a5b683d0d50965920c8a63d32e4faac8a7b3c27ee(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9240e9637b79fce9449a928d6d4932d5f2ef21c3438529d37da05e49195dc0b4(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0ba12f594eaed71bd624782a765c1110c23fb79c86b973fd74299121156152a2(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0daefac47925bb0312dff751ea1c5bcbf78df4e7f5a59f87f1d19f5df28ecbd9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__42cc194ebc87f1a66a5abd15124b64c62416b81a3a91e37784c03c9e9ed3911b(
    notification_rule_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__407cd49d23a2c5e9d8d28e72817e04da2724784366c289c643c789a9adbcc5e1(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__76c753ef462ba4fdea4cd8bbe3aca8fdc4df71fc14686bb81f020b07b7d95930(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__13a6869838895aefdb07d45a1e3ec269421fd24694387e26cb61b49f97dc655f(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e150183a95c54a1df64eb98b7fd1ad3dd76e2f5603feab416470f3822cc21773(
    identifier: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e4aba20f1e2d4834a59dfdb7430ebdab2df66154ad04526acd4f3cdc943afd3e(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1abb797db9d10abb0995e23fc4329997d562e182191ee370f3ee8961519f3f0d(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__af0416c9d600c5960e68094a5fee9a46e2c5eca92e64ecad7bd4e357a3853c51(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__60f69bf526a3fdef13798ca4efac7f665544c90fb8adeb1b6d7fad449fa1e975(
    identity_pool_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2e7366885a602fd6fd0f6eb8997d1885db1631b9de273da234a633eeeba5a6e0(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e9b694e41dbadb273d231301c95c4af0c84b40831594bf4cd80dc6c256ce8df0(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cbc276c1386ec26e00e6d9a8830300f36ea3094ac763e2b3caea293bc98ae5ec(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f1c1b737e6991114f3508eb75ecfb9b538af87138f6257875354de8224418a0b(
    user_pool_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__20b149cc1e7214fac9177621450779fae33bed6006c72e1d0ef18f2d79d72022(
    scope: builtins.str,
    name: builtins.str,
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__594cee336dac514aecd1eb0b78a2d22dce2cf3bf51a4cfb180b4fec11171192c(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__76d7f25e0091ce81b21cf65fddd4b54f79e028130919268bafae6694c360cbc1(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2a26780bb898528affa80fc0603a1242d45f5a69fdcfb6483059f1e0f66a3cde(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__121062d5d4be719395bdb4df636ac5eda902bebc86f649826bbcb5a42dc0751c(
    identity_pool_id: builtins.str,
    identity_id: builtins.str,
    dataset_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__704369765323fd7eb22cf70bb87a08eea8be0b550d37c6d6d1453b64874387af(
    identity_pool_id: builtins.str,
    identity_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__61970d1d124d0ec0cb38323ca2bd118bceb1835f8d777b7193b5330dd51884a0(
    identity_pool_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6ed11f708d557036c551cbd6c72ff3ea3d4ee7192378c8bbee042cfdb75caa11(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__88ac78adf44cb408b3b110c91740ed5214ea08a62a0332b73c52eb6b327a0ecf(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c130948d975e9afaa1e4a528bf32b9be5a02fb7c7b73f1f08327487a59168183(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1fabc923583fe768ea68bc398aecae36b4a2aa87eea593b5cf896916f1e74891(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b164a26a21b2eed0fe85ab55c7bed0ad0d0259c58fb016df998a9e572a7c79f9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7815e1d8335fcf6700cbeeb7943066038893ad24b08429f8fa4e2ab6d1d222c4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__98e4e66f112bcaf47ad372b5402e049b5c97525029b8971e6279ad7ec2ae5f56(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e061f5526e9bd9e1524330d7b4906efe0f1bb5221e4573c90154a4503ecbaa3f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__65a7452392153398ead0722974c12b8ec7162684a9c2107b8b867ad13510141a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__03f58f279b03c5c21612d61fe97c462919f2893d5e9a7459c0499e4096d5f3c7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a6c3236fe022f22cd17ae7e6ab0ef4deb0a12e759aee5c69f55e6815964734e7(
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__27f06fde4bd289bde36117c3a779c9ff404bd925c24a99e79a16ebfc88f86482(
    document_classifier_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5208915eb453451c12bb859759f0e38997d7d17d1ea51c412b0ef7af547faf83(
    document_classifier_endpoint_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__04886549e1201603c1137ee495a1e91bd1cb0b8e81d8db697c6522a09f2ed8c3(
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c27e136665688165e70a7a9b251f4df3b76483106e90b4be7012f103f116a16c(
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4db18c5e59efc0a3bfd63fa8207a8ac539dfa925cafe6eacfd5b7a6e8eb5ad54(
    entity_recognizer_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f3350ae06773fc7dc2ce501187e04b3024f8fae45059e05c70b85fa588a38cbf(
    entity_recognizer_endpoint_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__59394272f23a8bdbe337b3e70db63755fa3eb5a08cf7fe7cd9ad09b90f1e5c15(
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1a5cdc0788476cc38ee70b029a9498c1355331b905c6d5a418df6c13a3481a18(
    flywheel_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ad2fe0606086f6e1cedac906cbf3be8cb6d393ac36c47a62c8a16b8f4026725c(
    flywheel_name: builtins.str,
    dataset_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__229bb39361db522de69ee50b7595d375d4fc88eb594ebba8bc166dfe130094f3(
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b83c1db9c893a515ab32fb0166a613893f1f94a7853c2f0e8a45362c12f3e38b(
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c2f6e64c1d8dacd1158e3e8a3ce787046b1949792ed6f0a8f27da85b1d402904(
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d21494cb080bc6cd87ca444ca7be3eb399e9762112d33db25ff006adb9037ae5(
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d00545b1934e6f4038b55189fe7fb382ba7b95e477c5cb1aac05f09b42436c1c(
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f4affec4ec5dfd6285ea1a1501f5e1f01fbe89987a480c694f065223f92630af(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__61488b8469c41d52821db25e6b70212dce3b84331e73b69929fdfc8e59ef1f42(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__013716d4ece2226345b5679e473ed9a92cc881fe5c6b129d9f4b6d87b09c693f(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6425e418c01aca557544771dd1ef06bdef2ba8e899948c55d987cb8a2863d413(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__23498e5732b821c470ad23e57266ced6598ed65b21a5a31e99d32aa21bebfabd(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a7d3dee663229d49604e9ead97c6ae353404d2ea752bf7a7cd695c686333957c(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__633ba91d59b1180568d27e5f4bcdcb46b9130873e78917f7d4a6fe5f3b46a1fa(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e7554b4f2e6a6a403d2828dd5fe53d6c886ecceed67e7be0cfb5f8fcae4028dd(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7ccff432ce13596e0cf8907bde628c359763685e31eee26cac3f61850b262ac4(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8ab359b30cfe48dfba1a8814c5d3f19f7d37172f70800f27f8daaadb5ccf5a60(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4400a19ef1d3d835148c0b52a88da1b8f99db73caafb202754f6b6a0cdf4aaf7(
    aggregator_account: builtins.str,
    aggregator_region: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8df99ec1f48a3bc5cae813ab84191d9b3d28b90e93f003d16db552c96f5603c1(
    config_rule_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f03d1e7ecea2057f97062bb52c3829d06d37110ae59ca319f07f04b08b33b12a(
    aggregator_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__101397e27c5dae8c935deab5f7302b3c021f44ee2b6d944d09c6bb997faed43f(
    conformance_pack_name: builtins.str,
    conformance_pack_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ce4946478ee1bcb7b74391ffd5e5cd4d12c9251ae89925a52d036274890ba8cd(
    organization_config_rule_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d9b51c297de38b16ebf5d61ccae2a545d99461e29b9510911635553bb5da1bbb(
    organization_conformance_pack_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__deba6f49f7eb1aa4544a55d3d074f9ac69789ecda1506b58b58e1a4626fcf1f7(
    remediation_configuration_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1879b2a9f052574dd43f163cc3129c25d9683d3d39cd558b41116d7cbe6242f2(
    stored_query_name: builtins.str,
    stored_query_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e78d8061b8ed152138f7cac4ff3e7071a4d87d5b436f074067b03a0ca6dd22af(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b487fb0eeca04e758da8195d9278fccf6f58eda190b0677d76062c11000d1185(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2f76cbf77b6d70680934c8c5f184b1bce7d68d80a96da467de875c112d6f8631(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c43c5d2c5bdd08ef921a96007f9bfbfcac14164011216b3207ffa133b28206f6(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__23a23f0cea9725e45396744178c8db1e879000add90a239d480c6b363db918fa(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__75757a49c2f856cb24915dfc6472d0875d8cf7285497e8f19172b9bd341c80e3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7874d06e497f1a2c94b975b2acbf9d3d62cede1f1e758735027f806db7f6d83b(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__80ac32b63796e215c83ebb4bfa6c65039a4b7c0b1c676298b36c0dde5e99415f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fddec106ee169d8eb52784d92e727f9b597a2a08af8883d287a069439f1f479b(
    instance_id: builtins.str,
    agent_status_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__37eddfeab8e28a6a706b0991f2532eb82f2883999b7e353b66e0c1b7e67fb3c2(
    instance_id: builtins.str,
    contact_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__64530d828a719cc6b367cb9258bb0f10b81e56e927800fc8401a219ec10d98f5(
    instance_id: builtins.str,
    contact_flow_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8d746c75ca07fb24f24beb4c729a021dc5dcb3c5fd1ab776c4d1702940de9412(
    instance_id: builtins.str,
    contact_flow_module_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__31558c404504e6b551d880c0384710d336a8639a59766e42a6accee87413724e(
    instance_id: builtins.str,
    hierarchy_group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c77fc77b09578f01951ef778a4060cf16e57db0d80f52d30691a07dfc9d888ca(
    instance_id: builtins.str,
    hours_of_operation_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b6b2fcde0b37adab9a1f221d4ed7603efe961a9d2b2caafd738a8f58911d3c84(
    instance_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b60b75c77fb2c4f40375c43100361188d96b4174d9b12e4bdddfdcedb93efcf4(
    instance_id: builtins.str,
    integration_association_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__72d7809ebab9b633bcf4e119f168932e6af082c922e2c01ba86aacb4e78540f1(
    instance_id: builtins.str,
    phone_number_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ccf49ba4080d2d1f975a38a7bb7ca0b2a7be8bd4346d40ba27ea6aca04ed0d84(
    phone_number_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__21d09fab16ec15379eae4aee2d8d776ffb339b7096caf31c904c4016d4f43a8d(
    instance_id: builtins.str,
    queue_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__453c2a347f787c0918ce24440c4be72774229057869934969424b0e503902ccc(
    instance_id: builtins.str,
    quick_connect_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b8124620022667da018d99af85226c9b53de5f19dee1d02bd14e783a3cc21fc0(
    instance_id: builtins.str,
    routing_profile_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e2bf873b62ed83c92d81ad6f2ee6edb300faac548418b9bb559d9d8f22792b64(
    instance_id: builtins.str,
    rule_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d72c07a62ba17b5b4c28d57a0b6259f8c93a5c74c5c988e6f3d14e5b0614dba9(
    instance_id: builtins.str,
    security_profile_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__522794ce543d573f242c1d7c0134cb7c030634df78b5cd957892cc6349186693(
    instance_id: builtins.str,
    task_template_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9ca3e4ddae4d5d509196e5cbea50373f758938610ffa87c80256c6fbcba87853(
    traffic_distribution_group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__79f9940b4c9ce873ab69c295c481e8296ffab57872d4a4f8a350250aff271e8d(
    instance_id: builtins.str,
    use_case_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a4dd5abdf59dfa4fad02b588c0e6b63494da063b812996724689ca2202f97898(
    instance_id: builtins.str,
    user_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9f6236a84b4a789e76466dd6e16bb1b31e9a2871f576cfc5aa8e8623e6b22e57(
    instance_id: builtins.str,
    vocabulary_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1e38f57fdd0d411134cc6d92585c957cf2e7dc6707993f9a3fd0e6eddb78d68a(
    instance_id: builtins.str,
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7dc23399c3ce26f2ad120c9e635e25e2211d60854916c6b05c647686fd62ea1f(
    instance_id: builtins.str,
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__497b05b75657aa7230afe0d3ded01b1ea5e05eea89bf330be8ee6a052df74bb7(
    instance_id: builtins.str,
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__96d0efe78b4287c270702960ae9f132a05497b3337798955a893683d53ca710f(
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7618e27e18b62cc1747c871f3d602152e3b3a17b3f791f27b357845dedb66a2c(
    instance_id: builtins.str,
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ef53334681556515aad6c88d03841dd16c579c96b3aa1e3156bd060ecece0cdc(
    instance_id: builtins.str,
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3445cc4fb699c1e3539b308e835415346c6d57c084e3332f9c6527c42dbef12e(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__666d787f8fa6253ab14ab26bafb0d2fc35cf8f6bc7e8ec6cc57e59a147e5d5db(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8c33a88bc358ce713b33862e55e242767f49a80d862e336432184aef7788ea0b(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d35c60891ecfd77852d3fd1b1d6e462d10b77c004ac7149efd7c3de1bb69dedb(
    campaign_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c901b0cfd48aece2ad44a7951edf7178501342babf1250ed1901040c5eee829f(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6a6436c6b5c334ce456217d09b03eeb5aa11982850062ff55a67c55cd9527a69(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0505ed0882f1579f90118afc6d5aead6f1d520261c2f1368a7cce06bb8c66efe(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__233d68beb78f583705028963e883f32a4d7b0e53cd3b094abef624cb4b48039b(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ec04a48b2831562dc23fc2af867fdf04718ffdbefec25dcda963c7a78b9bd841(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8a328e51cd1a34c58b00bc13a2cfdfb6923ad5e47b92d68d70679be60d8cae5d(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__66d5f19961d7c2b8c5ec516c776945825c5f5c350dba6e1eb7b46e0c491b7356(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ca7df8e8197c7efed46804d02bf1c8a02de6b65f8c4b2dc685b1f23ff32c763c(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__677ee5149a535c4d19d4f7e1a79756f39ba75429c6d6cc4d4222fee4850fd970(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a5a17c18ccfc67481c158d76b19d9dda8dc3ad109dea573e129b68774bc468aa(
    report_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__08dbe5c6af6162e95481276be632ca74081af0b18ee46c183b5e45d14aafb69e(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b5f939e39951e2869ffc581af0e84c32d50057d16d433b414d8e2c2d9f5844db(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6fac55e1e18eb27b75439c444f00cda7483ebbad7a5007e30ca14b61a5470576(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__69971928680e711cd83b629cb9129467ab6937368f9bbb82d3df015c685b9570(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0c2f366da2850739e6a2cb9c8a275d37a0ee9991bda815d281a9890de1f0dab4(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__787ca2dea43044517a4844f01b3d85a3d1b18df20623df7d407fc40476058491(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fe9c38a5671beba49f4a87e78fd3757e9b2360d0441eb02f872043bb0c916beb(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__36b0f9592cd9124449b28545b8e5119be0ab4adddd952c90282e9309238adb9b(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2e6c1dc5739d603182c874cf141ca0a431e60a0a4338efc972b38bc2e9b82e60(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1f32f38ca82d229d2b5cb6e21bd51162a79af40a1fe436ae38cca4b42a91d2fd(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__285176a60cb7790a4ceb4bd80a4e7797f863dea6fd304d4ba4f02c3f3eabb8f1(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f3dbb035c383b90353d420322f15607c9bf3d723f2650bdc530f7bdcadf17fa8(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2ed0505fed9353413379e98f429beb73bb9c2e3eacff074e5300a193c387d91c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__93052e44fa7209f4bca33fcd5b4d2258a4ac5ce6082f89be727dbf433659fd74(
    data_set_id: builtins.str,
    revision_id: builtins.str,
    asset_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b0e7bfb54a596527f0c410eecf47654c2130b6dd8ae453873ca24d0815e3cd0a(
    data_set_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ce784b2abc1e93e553e3badb3c0b2c56ff2199b428b2479b6c406821944b097c(
    data_set_id: builtins.str,
    revision_id: builtins.str,
    asset_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__930594eed8c9f121a64343f66e50712adf4575a05b247aebd30f1463bc08a5c8(
    data_set_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a8f5d712a5c7463da23f820e424942b734e63dd6dad7674fd21a318fbe88fb8f(
    data_set_id: builtins.str,
    revision_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7db7837611561b7b3c58357714bb5c88b33a3fe0583e39b49817c6d50a83346d(
    event_action_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b8b47f8d5ca72699597b8618c317c67f9c2e73a5e4654234ddf66711ca281608(
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e9e139d7e18d1b18a2f6a8c7093caea9532d3f4e2f9e6b4c5370d980fd3351a5(
    data_set_id: builtins.str,
    revision_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1558697df2314e3e71e3e9baa978a9a5825e421b559796e372d45de33699aadf(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__877e693b37dbfe277276ce5c5d478854cba0b35214da86c35456e1dd711ee1fb(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a6f14d67ed555c7291b87eddf22846e5ff2282d0cdff77aba66e59820336449f(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c4a154e7d9ffa00a383a2ced9530e6a6d34217317e1472268d4e31b2d59c7a7a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__de9a1b07071c2a499e0835703f1dc782d61a7093efe60dd2ab3ebea69a557ef1(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0fda3a54c21dfee75888316dcebbfc770745aee35635694bbec9e030d05b6073(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c8ae3e70760e051e30476a0955b4489199590d53efa45fe606aa868637f8718b(
    pipeline_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__34fcbb242fcad5bbd4b10429e009e2b8278ecb61e314b6cbd1e82261598452ca(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2d927939287d017a6464122aaeaabfd124ca3192e9eeedde1f3a8da479a9e43e(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__885c2d0919ed5e318b4bd42fadc4317848e682a19f44e15b1b8bd2408325fa99(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1ddfd026200073ccd341a2ca241f9ec81930919d3bbde11ecfcbcb4f6b2b8934(
    agent_id: builtins.str,
    account_id: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2d611a097443ac811627829246ce57b0b8d7094b76d9974d93d2fdddf1bd14e4(
    location_id: builtins.str,
    account_id: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5351ff918899ef2497a3d3792b662e162a925d336d8a0d48b85aeec741f28687(
    task_id: builtins.str,
    account_id: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c92fa68d55599b7a397b98e3a097740050376c1750e98af375e93292f4409377(
    task_id: builtins.str,
    execution_id: builtins.str,
    account_id: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__11edf18e5f39ff8f4f5d713ac1457c9beb476d6ca4838c1e79970ac44aa95286(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6095368760c817dd1fb8a1696e25b3c88a453cb26bbd30efe7fb99c8bdb649d8(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1ff9f1e271de364f9cc31edf856bc744bb7b95d7a87d0f73eff40d9ae0a128d0(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3130623d19faee1911ba3a032f90124f21c761c385e54846f51b70a887d11b4a(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4b62276c8dbd5e60bb56c707a755eb9cdf5e6dab75e7255522dbe9e4fa39723e(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__386ea3bb66ccfd18e82c0204a0827c06ba8231dd0b9309ed8c22e9911d2eb31a(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0fcb68009639dca99313bdab6ab7c567832eab6401e253dd1d3933eda446be39(
    domain_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ee3b1b0b357f10241ddd45db7e1993354180d217eefd661c21453576b9a5df54(
    domain_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2a16ebde54b006e52c0ce437384845876d7ef0f63bf0dd45f3df1dad8667101a(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__824e5039c20738e1670352e91459c4c7123f47198c2477a2f07d65d4f42d3065(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__88517821d994e32780c13762480fedfd4c681e8ae642b90a349a4b15295a37d1(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d657d055da3fe3f17dd678215fd9810a7b1f7ed6c15ef4d3287870e7a269b47f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2b6062ba873ea2e26bf62f27baf494f2375e690fcc5a9fc7ac82e05b4380e8be(
    cluster_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__82a4aa6e9d67642fa731f8a8dd072f9d45c40afa8ecaeeac1ae1aa67f0a6f6b9(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__85767ab6614a3397f6914b064796e1e2faec57a01cfcd27bc652239a4e9fdcc0(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__26892e3b3e602220509e37150e98faa74ffc05b4d76ba4aa83f9a06770c303f9(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__caf0a7456cc2cb5be7d8c3e69df4fc3ef672d580d28428506810642de047b566(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bd50339a74aaa105449d14784e53fae676d5e55e26b2df1adbbf57ef076d5d86(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ecaee960f9babc8037d8f5ef0f4b2a34000f99d46bf9b2917bd38034732d4abc(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9f67b532ec9b05aeb462617a043d94016236564973e752dcadc2c909f266ea31(
    audio_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__95d5cdec72aac4ad7d69ae2368ffb29e1f0e876b80006993c0264367b7804c68(
    composition_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7bbb50fef880d9eb58ab57036633f7a6158775eced74f1de3a80c58cb87f4fa4(
    model_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e8d28db5de077fb6fa3255b2988ed4f4063e296aa4e2149fe02107668725eb52(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8c4d63a4f26d0173c0064ab9fff21cc2524dbdcfdc2fff5d6e70b3de0039ba51(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1c09c4c3f7fc91dea078ce3d1e071925e70b02dce28629924fbf22759a91dd97(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d084707981d07cf03ff3e1317037260760013a68ea1b3e84b2f99aa414954cec(
    device_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__990bc94f8acfdc8a1e677c12b7351cee0fb940b8c4a01323d1e017fc232b11be(
    model_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7fa151bf7ec4d2cc0957bb7d2b3ce652185a63a6f1662fa6cc23409cbab4afd9(
    project_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6a9eba68b311c5d440ce91b82141dd2d629beebd4cd761fd7878686f2ec3ba22(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__005f124ec50841da0b92fd250d3b10085856ed4e70c358fece2a733ddd514f5a(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__78e55aeb0c9c280d65f66e2b75a9b302f7de722c46dc58bcc514c7673623f6dc(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e49ca20bd32e15a3be9b507d4e5f4b89b9637195636913175b12321f595d633c(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__000a975ad9f883fd1168e4eeb91c25c2c55979cfa9555a24bcaaa39a4acc2c14(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1ad656e390ebadb4893f7da3233e9a6dfe389e34f1c8c520d6d726b0530e907c(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__99388e7c0b2f2bf060cb8a1a31c72829a0c6a31113daa9d6cfceb66e92ea73e0(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a0e8500485a68af0f8f8944fc15b24ab4526ec61ae308dc7d71d919d2b4160c8(
    resource_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4bb06a078d669de65bfe727f86a88e4f753ed09c9a4aacacfd6591469bc003b7(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c95fd9849db3df2ce12d3f701c77c48ac92ac1aa250b3101feadcc89132fc993(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__24e94cb43c2bf6fe5b6ba640b7f9cca28a67181a5f6082271cab2ffb7d367cf4(
    resource_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6e623603e6850967f21ded139d19a5caee6adff8505e11bb0620eba9e885fc1c(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3501091fadca8c56adb52dcb274365a8a01afefb70efd8a01009ba569e6952da(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2064d750c5b18ab89f09499796fad9b37e14b70053186eeb7801bd8a29ca5bdd(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__06a87854c2199787db1f74138285e4688238151bc1eca77435be963aded4342b(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__94ad1f03d57e17000252f070c5a37194759ee64a36b881623f2bdf025057325d(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1c15614b18e421fd9b93ceb483ad3d438f750155e5476cfbd202850bbccc4ad7(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__525991265bd9643465279c1fbafa862a29eb781401e5966cab39a7b691e57818(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3674f04a03c687985ae607f8e1ce5350e41cb621326a56527372213c33e01bbe(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f22e20997f5e8cce908b8e77eccbab092d40abbf4ba6ca4127b282f1df2769a4(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dc64758bc9e05150342b368a18379630c49f5384e2dba5d8c3bb0b56ca272496(
    resource_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dd7e044744b6d4a373f3e6b6ca91ae45da09db50d17f874fb84f3467b33b1ee3(
    resource_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ec13df283ea6e71f61cdfe7317d80a6c2b04d167b75381a08efc8dc6c48dd01e(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0259f0841fa3d44403b1cf5531aac700565e906e4ab72027bebaee6205b3768a(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__aa64d25e97826d7f7210dbf1a0b20043f5438dbf577772e4f2c8aa99fce5dba0(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__959c1babd51a57831b7cf74a5d4633f52a48ea2108f2ba7821dcec3ac354c5bb(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0e1be89e9b0552e1c3e58bc0a9e47611039fd0865978eb2c1fcf0af97b9523f6(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__921ea83ac2fd332245754e5683378c40001c0f8ab6cc88c58a3b696490e9cc66(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9c831facecac675d3dfe8194b8914ea3d3cec42efacaa2b67edeaf2c81d613b8(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__046c4fb4a66a366508c97735a58d0eb97fe8287afa745c2ce4f02be1577e6074(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f4604bba7986652886b07e6e01b297f8d29f25169e4b2e1643fea880c783ed34(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__09a27416c1e8fcd246785cd5c13acdf2d0a54a5ad085082a625312f19155fe0b(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b34da811b3546d0e6342e27ab3674f691f133a04039371bf586bf731f699c8a2(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6824233d141684231a036e81aec4e6ae84828ac36caa9f0bdeeb4317d151a633(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e3bb353581b28a907584e266cb5f1f02fce0d5959869db71a348e4260b2ea886(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ce8534fafcd0b1f0506164c3c173d11ef8e0b8839d497934407d2760adee64ad(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6e50725543612e43308ec965f3fba3e4cbe3963fd657f3da52383215d2db1699(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ad8acbf77ff52796453ade9690a4c39dabff67dc769cb8cef26ae0ec7f03173f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8a72cc78e5058ec1c5d76e9e631ab667805bd66a5cba458c0aba0cb495e3e322(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fd23488436108cd216968b6a4691a6e17f546a9ad50877019d1410ac060c9936(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fe55873207da25a589a2ff5f1864bfebb4db604e261d6ce3b73645a9e8c78d3a(
    topic_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4671d64c9818ab6336b48b5eeb088df2bc14f31d3e1f43f3a370439d13bd7cb4(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__213c3daa28ac988eb5da7c13119067f4e27928c1184e3f95b45a30857f39acdc(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__529120211b32d419f5102037084fcfe34aa7b1ab91974c32779bdc425f9b8579(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f691b9047205ca972851ec4c99feef92199912eda57a8036d7dc352954638f14(
    connection_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__68130bbbd34c019af170be070722c765f2a2bc506d036283c1faa0683b51ca13(
    direct_connect_gateway_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d72411b62131f3b802058f37bac6864ddc29dc21b5102d81c25c2d44d7dbd2ff(
    lag_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1b5ceeaa5abe6ed08deb13859b3a320196e897989a34958e81871fc0214a3303(
    virtual_interface_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__da32bad7317c2c09a0e9246f1bfa40efb16949b0c7ac1643839552a6362b517a(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5bce97d9e63587f317b1470e68fafd26163e4a7ef56dd9ee3946b4b2b8c23a1f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__20a6bff56ac27c531db030923654ee47536d9940ac9c74819d394ae4eb687b92(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b947cb6dad11e51ce6db7983eff48bd65c59d7034990507e700d746fe5685ecc(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c4dc3d6e5f548a5b7841120bcac36d8c710820f09988e9bfd4bfaa1985620a14(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__73ebe5b1cf1bfd5309dd5fb2ac80cbded57b1bcf734d517e11ab653a001016c7(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1bf7b82be83e60ae987b2e01338d9882f9b78349805a5cb6fb1d4e4b83777df4(
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__34465b5527e61c2661c269488e1996c118e9c6d867cbf049a065e688e13c3365(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d1b3210d561a9f39c939c06784a235afcd5758e71efb648e3b2fef097fb645f9(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3bf3d272c38629bdbb5bfc07138aef77d2f25c19d8ff0620edd8e6f179a56827(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__50b916eb5ed1e21603764d0fb511a3cddddfa8f5a30629e6b29ceb14ee67e847(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6be78f467c3d66f498dfac0694075f148fe2e728424a38d3e0410abca9b6130a(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d4d3d77b2e78f2281b4884f80c07dacdd8a943300a2f44a3f7c42e389e188eba(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9c2a832a5a6dc0f300b60bee95160c4c6d18bad3c02debcebd748088840254e6(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8ac1b62af425892de46179a319e86a495558d2561577d40203a696acb4f58174(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__079f2c88ee4815e50ba22e13bdd7342369fb1f94e7ef290de579b6e393c77099(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__08e583036864201b47757715dcafa7baeea569da8cbc919de8537dd8bdba9f22(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__52f7e8b2c0824328949bf5298f2eb91c317e0ed3605bca26542ec5e6df65d8d7(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__76ba8bdd921aa1c51fd079b61f1b672908c9140a07cb4e26e882b6fee23628dd(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b171d3cdcf2f335f6e14d36ebec956bd605115c42e94884c4dcf44aea54ab3d5(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__69a3b0149379728d4fd89dbbde346d58e1f9f81f68ad9161b9888ba736f8071f(
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a7db434efcb75454051444eabe96e9de7794d6993a7812b1912245f10aa51b8b(
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__10502493bafa359f69977a5a146de7400b7efd353d92f081d09ddd8f7b98ecde(
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dc222a2e3547a403776fc00f8dd8f25a2544fc6f60acd79483e1965a98f75405(
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1953e96bf730a3c8378c4c242b78990e86d8151771a3b42ae927604785c85d28(
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__44a6db330647c22d252a6a1113b74e80b75ea7bc58c95d714791633cec6240b8(
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6f8d74ebed91b4e2012ac0314045ea039673c441a44c00487537928612688e72(
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__41bb5545729c62335ffef5eeaee04afdc0a0f38ef40c8f9099ab0ebac12c1460(
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1e52a84ee9f7a40b2426a09fc7aaa6b795321c3af8213a67efc43d96b36c8cd4(
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5efd068ca140dee1d47f3196b68fc165d7a17f7acc9e9f1ca30f4a468454f3f0(
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__88aee3fd000cccba33cfb482d7672718f9d03b39a4528bc55e007d44907bf82c(
    resource_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7c674e62fdc8ded7290fef216efbdd8298bd0e40870cc1d2b7bea392cba23b93(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ee07690f1135d8169152108c39c4a0578243f3894944438cf652b400adc1ee2b(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__771637d30fc844c4e5619e5d447f7aaa60e281d8afc625511ccf0fa769fdd400(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__11663c235960f713384b886ab3c7c523f41d44a868fad36be931a6380bdefb02(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9f90a27c642e3b22301ddfc5cb613566ebd4fde85850eb8a192f8d95a2a277f5(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5186b436d4f4005f3ba4bdfcc5ba1323d22bfe95b5212db45c3600404f28ad38(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7d94a4e5314dc7b3db6f85223bf64ed29a4267d6fc1a4df8cbeb6b02a40952ee(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__25ef9e5a882c0a4ed53abdb0f886085cf2ab1ea529616797ba7ad4039f76f510(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b2a5aa4f0999d137c8a20903f8f0806d14db14eecc6eeb01b5c9f2e9b1e1ac6b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e11a3675320a299247730371d164644de9d316fb1c45424e53a4b046d00844ba(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dff93b035fe826be523719bdba0fcaea7b3b6d97885be67892609d9e2169fc5f(
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dc60adc7337ead6cf1bb0e40a5d60d0ba3e78123d2000940f7333da01388a66b(
    recovery_instance_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__820805f3edc94020315d722e05e36f1240aa6f8a37e62bee0bfbda74351807fc(
    replication_configuration_template_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a2887f536e44f6804cfc70feb8cafd0f76e62ff818382c52b9bebcf1536f72f3(
    source_server_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0d1564faf309866bdc116c51591b29ebd855787bf10edb217d8ab231ee511887(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__129ac000fac8268cdbf2967f4288dda0735b00a478c9486f6ab12cb26fcbcd88(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6de901c6fbde63a6f2dce1fd8b2d7db443515a7c9b4e0acc2838c09e377152be(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f111983e10aab40f194c008e490b9619abc9278d6b0db6373b79986d98571d87(
    directory_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7efd15a8c6850a4127d84d8a9fad2280e13b1a58c58dc9fcfb306d264edc61d6(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5b954f787409468ee328eaa8a2b46097bf738e5b31fc4af8de1b55053ae70556(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e2d7c27fba4decd9872b7d3464b7f066edb6cec61a66235a38a02dffbf878463(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__12b1af39939a22dde596c99123e8f4755a5fce9c4599eebd980f09db6803907d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b25399900396d06d68cac8e5e00589175d93657c3c43805652ad4504edd1fb15(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f53cbea8b7c9d40991d2bb9f7e8c019e477e5a1ffbe6d6ea9a4d20f9c999d27c(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__566286a5856a48db5c60def00a2830ee6973f3bb0cbacb0331b88a654a4c18f2(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f94a3cf85aa1c0a0c4cedbf509c6d6b2660167ad2fcd069cb5ecdeb3d23dbd22(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c967779ede5e0cf85d53aca3e974ca5f2d6fcdad9f7a960e29844036080ac035(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9428c8daefb37e787aed6e5c64e6aef760f071c44cf71b5e34d70a9ff6e577c8(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0850a3e2ea4c29a06639cb07336d242ba4910fcf5c831fdaba7eb94c2d385eda(
    table_name: builtins.str,
    backup_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9fbbd2029e42277a27355d518d1b3c7cb43700cf020b4d826ca8be6e350935e0(
    table_name: builtins.str,
    export_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4261bd528439929fd93d0429f5aaa1adb0c640ec1658e4240928b0a53f1b96a1(
    global_table_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5945c4165006374dada84b50358314f0b54ecfb7083c1d343df40dbbb350c7c7(
    table_name: builtins.str,
    import_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__449fec7a104dee5dc407090b74bcd5cb43a4122210260f7159c64209aba274de(
    table_name: builtins.str,
    index_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__05c7d7bdce673b29219ad158068020fd54171c714a5f0c29e2a764fa80eac982(
    table_name: builtins.str,
    stream_label: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__22ce66cf3f285bab5cf62bcfd963b66151dd6d2f0f3eb66fbde101c7002d7cd5(
    table_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fbf9805c3ea2f2d70d91670a480ae001e200e3bcd557a6ff9ca509a628d69994(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__81646ac29ff92089cf684dde47a6addc85563aeeff41e3f849fabe1f6f855c7b(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f2b445b9aae32c5d9dc57ed38022613e70bad3970ce5ea9a05c83c8f0d439ce7(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5dd7e0b0582b0b68d54f3f4efb88752a90141399681835df6cc13acd258bc5f9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6fdd214ab1a9619c2ee73db68df642bf2143e1a3ac601b71d18594e8e0836d3d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d4af6b0b23af04fbf3ff66230f9da64e318ed374b779405c632f952aea60f263(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c572344ad8357863d61fca8ad10af9d2b740d19d7b0d29703f3b8f4dedb5bef2(
    snapshot_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__37e9c3a4453cb3c021601834a3720f1f2aa6fc59846022acdc2f6a3b1058861c(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b9b417f0ec8ca2c7e7d2534864b2d100d736f2bc78795947f042a368013b9df1(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__42ce36e1c60f40990ee20b9062ce5b1b091e54da4a2d29e66aa9562577ea1a13(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__75b32321b6d48f065de8866d1082053b335404d59da73db675e55cafaca1702f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5213e454e140e3e3ade2ad4766ea94a461d74a8a265b88445d5e6d8c3f9c7d2f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2ffe592f3331ae9dd87d04b2f592e1a9396d111d0f94beb2297668d2ce91d45f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__86d699f99b946009ac8bae24f768a3ef450a918982671ddfdf895204cafccba3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__40ca388cb60a5e8253b0808cad0f6d9d3df2a51ab9a3f56a9d4731d0a4720536(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4688166aeb848a0ecfad72a8a51524bf785b4f18861d1a847d6c208d7dd0ff14(
    attribute_name: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__39cc007c9c259e6c8bc79f831495bb673fa6aa432712adc714074863fb642fe5(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c530904fe904e35df031f04883066b69b4a40ac2f1f876f987ed8f34b9a81db4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1a11ee82c8e079a6878c854b445dd9bbb8d8b102177a1875cedfe8b0cbf19af3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__195cdf4b7934972e325597a59a97851790d088a86bb049a6e2f8917fe563b29f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a26c18b190a3a40c21ae9bb5a57efb9bcbaaab1bb51983fdc50290b2fb3ff70a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9ae9d7c595c1a674ee13b61363f5fd19512f1a8310f7360eef8bb01c7c7e71a2(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2840f81337b628c88a0f1e9189e2b13167d69340ddbabed426d87ad8f94bf939(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cf3fffca6b5988b05cfb9c8ebb37a8cc42cdd8e6373fb0eff527394a28c8abdc(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__84a93aab320a3f26fa79230a2110aee59ecb17cd928793f584afb41aca44599d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d70a57842be5aec760b5d129810804bc82f677bd04ed16256d9b769518842765(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4b53219d1ae601ee31dc0aeac999625a1c5e96d075046a0be8fa5244c78484bf(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d0f94f74a726c90698b28640d2437944508bc3aca1b63c4f6f6800ff7c99928b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a83fe8636a3f6b12a66f6ac6acb41f5c0cd40981ed6d1dfe3f69752b63d26683(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__334a9ac3ecd6564007ffbb505249a03d609bfa49c478ecd92560135c16f6e0cb(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__37c02bfcc718176f5c9723a871bc94bb501dc7c4cda1fb23189ad0aba27f9b24(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4ef817e26a268f6aca627a2d7f0f8e1f2a9102bb3fbb673b98ff69967e94c25e(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eb6f43d51f6c0008d65d7ef3fb0353c747cbe7701e196c81f7da46f073d95a57(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e7b36d5baea6c0494404dbb33dc0f8027aa0282498c11a3c6a2d314be1f6079a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fac32ffc3ea307805b018b0e5ee5e1a7f14b0ceb3bd616b6e35e7133e60469e7(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b856b90fb512a51624f0cb793a9bcad91bc6d17d0d572196929980cac1b9289f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f7aaaeb75f1ec9d2f6e99d457b8200cf09bb1f950ed244adb0c95a5314ceca92(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c719a52aea95a71fde31fb33862f252476b5c273b55a69c97570b9d4def9bee6(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8a61cb9fa6ede1a4b00404e9d12fd6eb7e80db4a7b591cd7af43e608d6a39ed8(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__604cd0627ae2970a4f904bda8ea2dc4040dc923569e60fa8bffa19b7256b8b55(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0570ff3142b64a309d3bd93a0f287b415074d0f3ed35588a7bb72e14613d3f98(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__27de948bc207bd7d646c5308a5d2cb49622bdb4cf6dc625d35d02f79633df16c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1682c0dc71e29ba4bc94ab7e6c399f8950bde28f7fffc73cc4fdcba43515c1ea(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3556a2bddcd8e722b26db61ad71306be1236bd7e53df1fb6ac8ed9307aed944f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0933fb2d02137e00e1b456e585388ad71886226ee1ce9089db1b95bba7f02998(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c207b62d1e107053bbfbc60cc734176a5b0e3c730d825d691c429f8960ef0e4a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3783bb22e4263f6e77907fe74d4a2dbfae08bace89c237169d5fca978869ef1f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__74d111d5b3a3b188287a5a9a2a82c70705f7546889764e446625b54cf0e45288(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__52851c17a6cdb84e1ed106f44a5cc7b9686b51514f865b508cb81a25b0eedb40(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__63dbe79c0fc928f3a8380808dfca8eebe9b5e8a14c270fba60d50c4115e1c1b4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5c4528f3b35122ea6b7e2f5f43bcd1070e0e7f05f55daab51dd88e4c1d923991(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5b9c6eb072672ad10e3710c529ca654135cc74bfaf99d4e790c6cf1d0d0feec3(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f89b316661966a632efa35a63bfb75d35de271ed445a5b8a35b60d0dc95bd5d8(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d22b193095c429a724951c0757dfb0daf0aa47d16b4b61c72be71a4bda7a8d8c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__28f6e0e791102192c1bd4a218a62e890974be87108c7435ab6b62f5db0912734(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e78c31b8acc8d6b294184ccc96ddfd91ae993a60b706ea5405204f717f05cfcc(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a93a55fa8d8f255ba3f2cfef4cd22025564d6bc4387537cacff4f72be95b6b3c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__badbe60c579f14d2a97933e50bc0f51c251d766e7528a618867076ee093e3fcd(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__86eb822544d20164a98c6a8d69699e797211d9a4b186fcfd340067767b060056(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__98aae2ecd2dbe9653eac20810e6a75bd0ae46ce43fd510e4e67cc3e48ae9ee27(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2abbc5a0627ed9a6c1e6dc73a9a1f4d45b62dd62f56d65ed9ecdf70d308b45bd(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f345a952fa1e2f8931ba587aa56a7b5c9d1c5e41ed59dea76dc48d625feadd95(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__251527bec98ea00a70f9f5a9234efedf0dbbff6f5d99a30d2ccb2f99468b8bd2(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__02ef64318331cdeb9d2130a2531a101f5e419bba4a699c0f4a9e19248d3ae9bb(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5048a69d581ae29ff14234679798366300e8b7d221fae833c0791c25d14af6a7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__136e0ff904648b9f02997025ef3d88cd856524de3a972ebb906be7dc035e2e6d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bc294072bd32c3b51fa64cfe953c54bd76564744f7b360ee7340b69b9618c01b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a402b6e143571b75c04fd5b94e1583a6760c387b61d1c9bf08ad6bd2aa6fabce(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a17da715f4ec312de94b4eebeb3dcda0907f1c8cba8d504d17dfdf2db436a8e6(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__27bc7f199f347a580e72463418c66090b13cadcde36f402eedabd44bc1b12444(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b56bbd6633366d277e9a158bd6a1be6480ff024bf68a713853c6d1ff130422f6(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__31994e975b73372a21067e2f14fd40ef916ed0c503226cafac8b684a06c20d2b(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__52ae950cf6f0b760bf317c01237fca97d12dcd44624095c819a7177fdf5b1e78(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9856c7a6d7fd5c410087129443fe73e36dea843209faf808def30b536458b524(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e9d60ea292bd33f75c19f2afc2632060245bbe06ecf473189c6515d33a041f96(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ca91be3eaae4c71cb0902bf17fd1ea79a05bf10f72c229d978bec0b68ce87ad8(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4c60369c5dce8813a268936e13b8b76a6292d1409eae2d0c0f7aca63c1065ee4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__afeb6c771b0102b3bd6701302f84cf38462bcd27a40386e25ef33058000b9bf2(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3b9ab4a9e43256a75a6ded942ef49abd3609eb6f39a98f674dd8111adb593456(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3f4c7121bd4130920924192d1d103af855b53fe8a8cff4641220800cdaebf191(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__add02c128de2a520d6474388ea49611421d4de3b78549f6ef8f72851d3f06e74(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fb8404fe2c3546399ec2c84ccced25032b4b2921ec3e9f47af82007da16c5d06(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__81f549bc640045f1cfda4e48c738c89c1d8ae5b3e3b2f0bd74ba88ae29faede5(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b947781677e2a039c582a918717b79b74131458f4570f11df2292b5e0de11c34(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__30a21d34f4314a4bea0b0cab13ac56d4ffdee644986b4482ca8637fad23eed57(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a031396abcfad7348d1b8c96f92d274179fa17c13269f100d5701dee0fe7a30d(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4977e9f7c99e431e2b6a10e12f74d57de0d2dedf1327728755a441a05de3e66c(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__728d2b696dc18b6d1d597c3472f4e7601d2858884625eaa0cae8e8ca969ec944(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__729e0117f60c1635b121bfab06254bd35c877d91270928b280a6d6b074454b6b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9c581a6b7a95384840caf15a93e67ef8f32f8252e102c541060a1309a5896c4e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2e5cb8ec38ce011cd46258253f1d062e6deb91a0a175dbd5f0007c92750cb5c5(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7678b1e1add76272c57821ee634b46d113768969ce9f38a22c88bf2eeb6f4062(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__64fd1c3e34c3d18124b0933b762d80718f0e7fba062af7e725f25b1c7aecf600(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6c6dfbc3cca77d0f5997f9b3421bd10eb935af1f3c6c662e2db00b6a4a9dec31(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ed9db975b7709c2d7806c7d4b9ae2d4b8a8ff848658871f44cc2b9730fa65a95(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ee8adf2eadd8bdab0480c3864b9fb65a13ade92e34908d8636c53548b68bf853(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ef89ebd18d2eee351060ce079b52f8f85add6e504dbbe193fbd8068657b9b84f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b23b863e5c8d510e062f08db1c2957426ef093870b5bb45add30e26764266c6c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2f585dd02b001c5ea2aae6d99330e833fb7f2fe3f89e8e513c2c2d8fcddac096(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b9c810ea8e3c846f6c593b7269647522cae6d56c2d92633140bcb714c7605721(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__46331cfd0c0c7c2d4b5d1e877062e0d4a325765cf490eeef7747f34ac47defcc(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8b76aabad97a9f11dbf6a3b9f5562bd2b299427a0229bb512af9754f25c04495(
    value: typing.Union[builtins.str, datetime.datetime, typing.Sequence[typing.Union[builtins.str, datetime.datetime]]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8688e151266968a4519d6c3aa91df68de1c398835b6fddd34cf1728dc7da58af(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0498f830912676045d0b3ea7abd6b0ea29d0de3ceef411494ae665b6e4544beb(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__11e32f05be3edd6f29908ed1ddffa69d862d0fecb6083e3a8025d169c9d54180(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5b4c9f00a19051e251ba305dc692a6318797379f8d06ae9ef64ea8ba8040617d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__66818d7aa506e176c3c616136df75b43720f85b480598ad0abdc80c3192cb486(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0492745b87adfce4594c67fef6455ff60c45eb605330c6fa347a7084837e351e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c553b20db6ea682669932cadf338ce6c0e2944df41187b452d6c3983f13dc046(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5f42b466f612860e737546e7e13aa82e0f823b7068cf140c7be69b967f12985b(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f77c4cb23f53e2e33089eb01246344d4af0f96edbf1c5ac7dc7e5f4c2b540ef6(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__08095bcd183c4f4c660db2be46dbf265ff712759ef6f29dbcc656b543123103d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9b1d701bb947e52c005656e90342e000c213cb5b17b0133b447f6dec0d83f25a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__15d3a79b329ebea11ae0c2f3d06886c896a61593597ca92bf8329b58bc9eb602(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a72c56d3d1da692ed9663e4f5a13af02df79aaf89f93be154e31021c2bf8ea56(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7a8d1e6413c5811075f442ce88802ab78216e6567fd85963874773ee1229537b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ccbc0fcf0075038072a22d71e8218fffde1080c03b07db0646a67f1d618c1ca4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0d705fb3b0a61baa6495c62618a40a04db586682475217102bdda2dba51fdc06(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__717a1e756e22dcd2a889546950c634befaef06562a6be8059e55a66f17d0312b(
    capacity_reservation_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ad1ee2a01da64f4119682fcaa626891c94fdb6c7ccb5eb38cfe9b40216fd9f4a(
    capacity_reservation_fleet_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d23d21c7b44aff5e92f7a13767520fb2e3d0cc21e6698056a40c94c447db3225(
    carrier_gateway_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3a7a4259fe21a5902002c2ef7197fb89088c0b6eae626c9ea25e374b1ad9a80e(
    certificate_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__98a6e34125079dae844e8a500ab92eb3575567aab714f968347612c78d33f2c0(
    client_vpn_endpoint_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d0417f6a83c364673196e73679d5cfc3b04637ae1a0a5e841f259cfe29f32bd6(
    ipv4_pool_coip_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__366c71feea370281be33f28fa2cfaf0a16e3e2cd5c84c00b1e59afa47ef21d92(
    customer_gateway_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ce0f1536ebc42286f0477a27a600b03aa17067949b5ef46e26682f24acaf807d(
    dedicated_host_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dc4a713632155fabb7c2e47198278b6b1c8c3eb170d900c0137d21150dac3a28(
    dhcp_options_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7a18576ad1f3beeb466944b6697aa2fc7ca2e4b02ef76e17c9efc47b7bd16005(
    egress_only_internet_gateway_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__92d5ec68f2b55ea3e8ca4cdc294282b08601373205e091d8a753873bab3279f7(
    elastic_gpu_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8e5615b69181db7cb1f79c59071c11d06d2312c77f953c0e779b661f785f9313(
    accelerator_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__30277130d8a6362872ddf625ae814b26f4290a62e3397bda9c5243baaa3eb302(
    allocation_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dfd4445bde43e077e2aeecc55f72dc6b5de874f08e210f3be258f4d199fc23fa(
    export_image_task_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b9c1c979966c26ae42da14cb81c79cc76487554135939008d3f0636e295b99a7(
    export_task_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0a7f4402d4cfbfa6699473e393d6a533664e6b1cb0986d26d6cb5d1385577a6d(
    fleet_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6942a4a688459eddf4526b7422f232c3253ee7d7e110281bdc30b4932b9404f6(
    fpga_image_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4583f995412cc0be8cb66e5fce824231971009a573c65a43367844378c415409(
    group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8e29ebe10d1beb485973b4d199175a8e653978109a5ae97e55ad91010810634b(
    host_reservation_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__846340e54d658d7190a4ff648eeaa891500fdc0d7efd04015bb8a8af634b8b11(
    image_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__05dff41b44644dabc90cb09b3ffcac81de3ce15aeab40f3b54cdcb4133ce7600(
    import_image_task_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6a56551eadf133085111101d9948ab61b8c8a507864d35306caa9805cda499c0(
    import_snapshot_task_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__155ba578f275e49c728c28ecb629609468cf08f8fe48e7777be460e0f7ccb7da(
    instance_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bf66bebacba7b9001bf53d209820c0027cc901131863032b60112a43511c16b7(
    instance_event_window_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eab662207a5d44e2b2ee50ae76f785ceacad783a2b00aa5364b8fb556213a01f(
    internet_gateway_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__20521ffacbe8d8c6c911bf004d6e6e7ea826e5ade091f546769b914ebad83982(
    ipam_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ff6b9be5b3a16b8e439304b779e14baa8acb1bac24c161a472a7a9c9d4ef76cb(
    ipam_pool_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e684f5b9ab22caaec053019dc9e1b46d239daf09d8f10ae8283c900daef2f290(
    ipam_resource_discovery_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8e5740cfff9d4d41c0de5ff7a3fc262030ecac10f82fad0a64e359050f5e77c9(
    ipam_resource_discovery_association_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f8ce1c82977366a34b4c12470f59c8ee67cd93c36e33f3c44da6736827ab8de8(
    ipam_scope_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e593933736aeaf8b360fc3457ab3c8c14db1bf6e5e3323359edfbd77f7aec2f7(
    ipv4_pool_ec2_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b9827d83845d0116249dfbc93ab40b0d99d8e9ae1d2fd31599616eec84a8f180(
    ipv6_pool_ec2_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__139b493644862a63a48bcc05b5536dedbc427c56a716136450d682c66c91a0d1(
    key_pair_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__39234178c162fb2a147e12f97838ef01a96da6640d6391ec64fa18fd0e5782cd(
    launch_template_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bbae18392b4dcacec0cb0d12e8a098ee0410f378cf79b0c0b6eaf62a05e8a595(
    license_configuration_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__216ab8a863908f4ba88705f9614569ae9cf103fc3542db03ff8ec5bfb388e53b(
    local_gateway_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1237b5134a519dbbd265c8a555c13370ea10c33c130f0633f2aa063dc957ea9b(
    local_gateway_routetable_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ee533ec719b5b5bbafa68172181a0cda7a12053b081d6c0c07844eafbb31f0b4(
    local_gateway_route_table_virtual_interface_group_association_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5ac53d99c8677d900702d88dbe29d2dd9d64147307cb0a0996cb7348e09dd322(
    local_gateway_route_table_vpc_association_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__674380f5c84e241c9c4aeaab91816e9474d26ab90f6fb69c8bf80dd04b09429f(
    local_gateway_virtual_interface_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1a9763373b25e56ae9d9fcdda672360c0b4cb85168a85f7c518b5207eb17485b(
    local_gateway_virtual_interface_group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fb841dd6e5e94efa67c638f906e56ff4bed4a7cc4a9b5bc4d7dd9dcc3886fe00(
    nat_gateway_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4fac62f149c4e5cdc584e6a7801e90e64019b2ea68392641749c1a5763302690(
    nacl_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ab52065e614fe7d13f4a993dad0e356fb8b1a4d3dc32406cc51f6f3ebcbe6555(
    network_insights_access_scope_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bd60747a1fc7a82b5f09f2acc39e06d6744f547e51ec81269aee2467d6281322(
    network_insights_access_scope_analysis_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__80db809cd18668d52c74afb8e764b10bf64d224ef2a05cd1b4782d9ea38995ae(
    network_insights_analysis_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__167d6eb403e18c28fdb50b642e4f0db9c8549df4d408f2d1ac8d46320dc3c9a9(
    network_insights_path_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0abc842d073a818566d39d338363d06c972e35f07fbe1a06fca75918f43bf301(
    network_interface_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__43a90f18262d6521b855e972936da0b630595a6dd5a8536fa8a3ce1d4b0ee078(
    placement_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fe9295e492149c61b105960627b069dfb88b486a2db200d817205ff2beaa15db(
    prefix_list_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__51e54cca3083b01983998e828602367255aa01598e200e314428d4730537c8fc(
    replace_root_volume_task_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a71085ed0c68e554124fab98f810ce589a59194b414111a26f60d90ea35e0e46(
    reservation_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8ecd5790ece1906c6076daae786421471c9e33a438c8443c17c2777a85498068(
    role_name_with_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b06b7217f2686850f66e5806947c345cde9e6efa225bb9293bdbec2d9ad69254(
    route_table_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__faff0b60832790af808f66c088b6fad045d9bc23530ac1e0a2cd643a9a4251e8(
    security_group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9eadfb413c3d00f76cea99159de933532f1dc87e4733f55ec73343cfd6e5317e(
    security_group_rule_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f14e451dd80f618c3faa11528f213b0913602d806c47083a1fc79af554ce4ec5(
    snapshot_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dae70ec2c98a7c1449d42e1ac33a29aedcc5144fbd811744d5c97b90eea1f55a(
    spot_fleet_request_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b4221864c532e0ff2f008bd7acf9a8b0ec1cff222863075dc18e0321d3ffac41(
    spot_instance_request_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__feaefd785194b53166d438c9c563c069178969e1a207b8a6b159a69397aeb462(
    subnet_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5827f664fb30515f5c15b0e2ca45a3c6f51c729ff9bef9b4e9cb45c816d770f5(
    subnet_cidr_reservation_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__54ed3cc6283a2ff20e86628ccd18327af2acad6a03bf9c1d7a06cc6a584bbde7(
    traffic_mirror_filter_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2e658428cb21c16c93fe42b3fdc30d4d6c5d73f69220978488a20314c32b91dd(
    traffic_mirror_filter_rule_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0317d68b66cab3dba3f3bc609f95bd12fc94740790fb79475000e5b0676b1f77(
    traffic_mirror_session_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c9eb4929f52ad9072e6aff5400f0d3b5c576e999c64b1c4c8f3cdff5e28afc18(
    traffic_mirror_target_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fa3ce81e4790a3c50843e8e766aef2781cca4f20e7934049648e477865735ca2(
    transit_gateway_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__83e2d7a127c28c68c7975ba3ed983aa5ee78b097a4f38419c5eb1d3187c6e5d1(
    transit_gateway_attachment_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bd48db95363b9da9d0bcb6d94118a99dfe745613516f80e57ddb73b85fb79710(
    transit_gateway_connect_peer_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__93c72275fb6ad81e3424941efda13489014be57436a70b6b1f49d3bb314ce2ed(
    transit_gateway_multicast_domain_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eca29b77fea5b244e79fc7273c572e2d6c77ac25789fc10c80e0ae010b9a1f09(
    transit_gateway_policy_table_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c54d1068dda0f3c6e7878a5cff6d3aa2680918b7386ddb2c7680d1db6fdf5f58(
    transit_gateway_route_table_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e79276e67f74be243f520408a7a26db3e6ee09864fdfb3957a15809311ebb3a4(
    transit_gateway_route_table_announcement_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9a71736479b8bf3805c8f1c9fd592b361ac7a6c2346edfb9ba82cf35ff7698bf(
    verified_access_endpoint_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f2b17f6c408268917952f00c17486cc303e50f111b7f5293fd3ca8fa4c1b38cc(
    verified_access_group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1e1e184639034da799263432efc39a4c37afae3ced7d2c8849f0017ce14d8771(
    verified_access_instance_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__64f7763fa0440a1c9f89b2cc2c12ae015f49d7db4e26b6d6e8a502ad95055075(
    verified_access_policy_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__561e5ba9aac93b5f2160c3f0fd918a1fc0925163c6d00645813cfdb35a5ab274(
    verified_access_trust_provider_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__260d813613f8a2e1f53dac1a81d1c4d503de6d454233938da8bbdacc740ac860(
    volume_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__25dd221ba3faa713e2db800c08294005de7a334063de3a8b011e3cefb51397bb(
    vpc_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__26fca99190cee2d3a8bb1921e1a9b277a0efdb66f140d0253e53a1231acd9993(
    vpc_endpoint_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d57b9579d14056f4dd8999ebd120497f509e642b997cdc740fdb4e53a18bdcdf(
    vpc_endpoint_connection_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9b7b695f5f356baf9a0aecb48e1236c31aa1d37d76f127c2a555468eee38c97c(
    vpc_endpoint_service_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ffd4a365b9cdb9f6ae08ab3d1d2fd665f30ecd4a98c028864a7aed423b2a9feb(
    vpc_endpoint_service_permission_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__22f2bc05196f7d23bbb9688410bc8d32be24907b6a1d541f39da500382f0f7ee(
    vpc_flow_log_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2b170c4599bacb72ac07f2da8c111a78b83b0bfe03942acfd68fe353d884c960(
    vpc_peering_connection_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8161e785fb5fde354236904e8d38eda76909e219705d45cb10ebcb0b8ad31091(
    vpn_connection_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e49bbf903414fce70f0ca61dc3b94c87a56b000c4aff63e0aacde55e6cae3082(
    vpn_connection_device_type_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ff487bcdc1ce41e9740b7ec81875728fca35bb262d1656197a673f48003d6bf1(
    vpn_gateway_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ff777e7d539384a605bdd56c4251967bd32ef555e5a385ad05827b764edcd2b2(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3089450c8f670bf45b35c7add21178553f26b3671fd226b16804508996c9d6e8(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1169d981c374405dd06915ff9e6de64733d0588ab1cfe5490ba5afdae96eedd0(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cd640bd3d258d34eff3f904a0ceb962ff56462b25c98137158dba770fa23d249(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e4e5205a78596436dcf92a9b23001971343f908279557188b39dfa662afad935(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__310c3fc54ff77be8ac769cfbae3bb5989fe07b9ce1af90edb0a807605407ed51(
    instance_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0b9f5e6dfca517d47b322feddc91836bab25361fb9440ca8f735d02cfa3becbf(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__51839935f4357250368ffc1e8e7957741ab3e0bb784a84a4ed023754ddb3858a(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ab6c5657f447fd27a35cf806972a6650fb79a1f3df75a259b4baca925d094d92(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__786fc2387b83f0c25131a94fb1197be9782dd36108f1beb5ae39ee5189cdd438(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bcfc93069b701c1852a7602beb6092fc3a81cb2743a02f816a2692ca28e1eab6(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d99c78b352a1e6903fff7b013676283dabb0f49830ff82f406bbc71997a993dd(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__384ccb4e5a3d25f9a51e0d5409aba44a5a03fcd09ec430bb3ef3aabbd68187a2(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__196106ad0a629752048195caa45e92018cb41eb48e01ca8c960827486c120268(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b2accb150a6da0e48f585f861699c3bc905d8a44b7ac35066352f3686b4ab10d(
    repository_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__17bfda66e4cc14a2580b5df5b0a3536bd7ffeda5c2b840065713df16abcc8c80(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dd2841111c8ea6b6f3d19a5c4bb4d20fabff507afd0837b95754597d9164e610(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__603b0dc13ce75318a43a363885345286d08166ee4b2ec1e3e859a0efb5416a41(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d411194841f415c243e8efa3aab978c456975ca602b32d82828f8ad131ad997d(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__43132fc6a7fb8ab7c5d8eb18bd353ac2879dec353e5a58ff19e1df832ff723af(
    registry_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2d60056714095fd1e2199bd5d9932c4c64963a4d5cce23a94912f71271808a42(
    repository_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6b846bdfddc4ca9b87d6d82ea0b85d421e5f87df6f90b2636b3281e5980b7464(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__73c181304a8fb513c2f0f7007e63f701ed82008bc720b8f7ddc970a3517b3722(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e435f6d1d7a06ca8afa7016090c3bbd32e233b9ae8fad4bb7ce6c2985103be2f(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2c191f0056d0efef39b1f7b47b4e4bcd4d7286b142aafede758010df738bee80(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d6ae9e056f39b8e58f6eb914539e0ba61623af277bccc41ef52aa40a9a74cc3e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d95914bd90704bf6f28215974b91db503c645d3ed222ed1dad23aa86be5c15e8(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b4c1866490f0eab5936cbe4101c331753cc6fae45f55b12af269f137ae73608f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__efca0b2c8262f6b177b913254c5eacf12c70760cfffbf43d6cc73cddfa98d1ad(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b1c6361593e93ceb4e2ddd0c352232345fe567638ee94066939dbbd78736c711(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7a3c48cb8ea513a0e91903898b9594e1d3bd1c8a240b8e58ba5c0f2ecfcd22c4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9fde84a360c6026def77647a851fbfc1589960a39b7e04dd712b5362dbe825f6(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b77672e80080fa535725599b5a53348f8b6f81eef2e4fb87d44323e42de3fd9e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2d24671bfa22ce9de8d2a0a4151ecc6ff584ea3b65016d0b4963723d56789143(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ebc04d3a22b0386355a675dc1a1c7f77b57e49b222ef543a17fc4f38f962a7c7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4a336b6f8a58ecce8fb4cf29e679d83b69ea0cfbd1f864b48263d7b003e00744(
    capacity_provider_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3558db6445a41a720234aef79378cb3e0f6a2a4a47fc364d754f5f58f4f73025(
    cluster_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f4af35c8a8737e388615332e95af180db0e81bf9b098f6b61860f17420875b89(
    cluster_name: builtins.str,
    container_instance_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__24e6e41bbab9c1abc3639a1e5eed82c653543246ccb7468cfc1bdbec0d3d27c3(
    cluster_name: builtins.str,
    service_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__217033cdab58b67977e0dd605e152ae3270fa1eda47f0dd1876cc023cc1d08fd(
    cluster_name: builtins.str,
    task_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__86a547247414eb81c090f57975210ceb77429014b456bb22a8642754b42ba7e6(
    task_definition_family_name: builtins.str,
    task_definition_revision_number: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e404b04096310adb420ad6e21e5f0d454589379ab6a83bf95d996f560b088911(
    cluster_name: builtins.str,
    service_name: builtins.str,
    task_set_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__35b76c999f917ec3f9351c064463f91587a37133d1ad1c13d767cb21f6ef0356(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__14c508649ab6b1792b7ef06896794e59c17fd4649336ccc36094f2e14274ffb8(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__558f2dfe7c079116ff214f386064be5f064f9526a8bcf6cfc4e49a56125eae21(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__182d4d9dc033f2b86a12e519fabfd5696e2acb9f155d65c42a35c670904a6029(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2e3952a86ac869f23d5d13aeed7602f2c1506ea687de490a4dd364b7cdccefe6(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__794709031dce878d784ad0894a3a81bb553f53957f178aecc89873ca7699a07b(
    cluster_name: builtins.str,
    addon_name: builtins.str,
    u_uid: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6a9e2d3eab2c93a42c584bf926afebc0e52222e4b1af29363e5b46b9151d3c86(
    cluster_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7a2487c586512d7db00a7d4c2aea68b874ab8134e518d98d4048cc4673a05beb(
    cluster_name: builtins.str,
    fargate_profile_name: builtins.str,
    u_uid: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f73a02d3b488a8d04bc82824d1dc032432e6efe2f191df231223c3179a0b9057(
    cluster_name: builtins.str,
    identity_provider_type: builtins.str,
    identity_provider_config_name: builtins.str,
    u_uid: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ae890d005e16f041afcc63f69ca2cbc85f1b43b9a14c6136068157141c830483(
    cluster_name: builtins.str,
    nodegroup_name: builtins.str,
    u_uid: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bea4502371416eb6193c2b75042cbe051fbdecd3f1f9f5be744a111c5f424303(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8298e502cc40163261e9ed26ef5c9bf0407cdf2a77810c2e77ecbd6e1fefb529(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a021d698fadadbc360231aa0db171de693094907dfcb6d3ecb65f62da69e557f(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1bcde0bd6357f19056925c20b29e56eab04e56bd230683231de3eda9b4262564(
    accelerator_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a1b5557b2cd425e802c6b94e04829297d07401f1689c483b6f9a1721be34df8d(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3647aed313e015f54e7ca1c8b96a9aecea18802e1fdb506d324d98d910d91b5f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__66d83fb86e1e6b1a36f76613dfaf9b47a1357f9a09cd5e01f68a39cb44f8aeab(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ee901fd8ad4b9e3dbe5ff8d8d351f71c15943fb6aed5ad3ff65c71deb500fc0e(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5b29c2b648c9de0e0cd2564e0813baa57a90540d89c2645fc698ae784727a3b7(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__23f8def0053af575d7cb0c02dff8af118e2241a598d83ef9c635b93f2107642e(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__afe3f42707a0026b995cf424fe889efaae70b2b4e352eecb731a9123293df433(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ab0e0668de326b7a6fffbc2cb2ab0f3d4f9332c05e2fd73a587b885191dffb82(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__009f4efc99a270b6b7cc335885bb04795168c847e5a578375c13d031b97f435f(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f0a5fc2b8f85983ad863344fb3d6230e5e64fd43d58b4209b1de518cd794b717(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f995bae47bc02f7c5ca6300ee20f681901a535b2f704b3ccf6ec735d9e2dec3b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f595992c245cb1a0dcdff40fd82342fbaac336cda346f18089df712bc104ac1c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4bd3a73a10a190b0d183ac5fd05f929bd7ce17a9a2516511c2aec2dce9da3596(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8de95110bf93fdcb7cf8ffa07f389205b96cb1d39812ffbf1d881d2d1dd2d9ee(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__838ce25de6c97386a660e68b544abdfcd54d917581a9ea149e1d3206a304d871(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8d2e46c406981553f6202d9c2a0c57682506c349a423430c76836a64c918ef7d(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4ca1c948d725f0cdb3de0ca3d6c2a153da78667885821d95d5c88a685a3751d5(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__95ff0d21e285d7835b82983d5598c1b6f00d55696a89b2fe5bd99af2339698da(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ef98cfa0e99d7d44468de87236d179fd82762556ffff69c44ec17932182f93e6(
    cache_cluster_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bdbe263a12e3079fe7c2c55245e5b4a75171f58f790ec4c755a2c083a9b45a0d(
    global_replication_group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d3f938e759ff7eaf8dffa50e0c414d7b95adec8eea85d5c1432a2c96dd314ff2(
    cache_parameter_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__338ae2c57930eabe239c1c3b112c6f98103d2904eff62f21e3c09cecf4cb2518(
    replication_group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e8fdade38e065bd8f25b65ba59d2cba42098ffe2c1d028fcc23061ffcc538d3a(
    reserved_cache_node_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__87fe33e86e28bf040b33b21e7ab5b90188b844160eeb9be5fca6443863c8dab0(
    cache_security_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__da67243006a73238503c188a45c5fd2c5c751ac5a1344b9f021a1059fb9e04ef(
    snapshot_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e51bb42f541f4ccd8d8c7db621366e71f3e6f78e2cbc1bb0263c5f1bb02e9840(
    cache_subnet_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__57c38e8b639f95ebc01a9815b00456545b3120e299fd6d1eaf7abccb65eaef4f(
    user_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c24546c62dd7f930e29bec3a4330713ec6b3b0bb64d15a88ebf596618d17bdb9(
    user_group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cac398e44d72262d1f0168db967bcc1d2afb1e5e79fabb6d91698350c5d5e605(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e25a3c3680e4644f94e13c81eb3f5ce2273210a16a138ff3024a905d4a940d53(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__333ebf52a0fc99cc9ff19875d68a73e1a01eaf0158c251a598a61184c742cd45(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d9e1e732b30bead90f3a0a80cb8bdf88d46db44ce1ef78969a3886e44b36bf6c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__650c45bade4bcc9bbc5a0956b6157653d2626fc1033ae45e5f03a37eaf5a6d27(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8f7b645c97c1a786dcaddd6290fd160cbb14cd25668e6e03ab9b2b27564d79e4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__775ed65a986c4d6110f99c4a57322b6f2880651a34ed078b14493d308edc76cd(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0426d0b9aacd55f9023de5a0e39fd943b0976b920a262c4f4bac26af63d3e386(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__16b7169b53d054594985032420a1cb9825133f949f978ec0ec6a7d0b7dbc8b5c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b4c6b9bc28457d7fc78332b7fe9668704d30a5f4b6ef9646ef8d41a29c5dc0ca(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8a42dbdc009fe76d4b76d2a21964795d36ccfa96c02b2f22db468d227906498b(
    application_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e94f11224ff7c33285919efe5be4bfcfbc8cfb3c32f8df3f2dbc4febfb91b7e1(
    application_name: builtins.str,
    version_label: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ffe3a4e84e2a4acb13fc47e913cd001d607154cb0add52bcd47003799a9f0c3e(
    application_name: builtins.str,
    template_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__afdb6e564492a4803c876d2bdb6da9da6fc3bb02d15d1dfe67deedcd61be285e(
    application_name: builtins.str,
    environment_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__38fb427ccd9a66584437ff691baf402230d5ec686ca27211566f46c0ba09cdf3(
    platform_name_with_version: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__775008d4e6a5c01e9fb4e0b2fb9146ca874cf13491ad5f3783989437016a7cdd(
    solution_stack_name: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6e50d148e2cebc81da8044ff8eb6aa6a746718c6e448117b5fdafc14b57f5507(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2f1ef070555ca6e15ac2f0b1bc00a792a4ad6efedb56791ae52691fb2a7860ed(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5d087ac0ce737ad257f9a588a74fa1d32fed335955d05655ce22380ab752aa16(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__87b9d701ee3bb362aec489f0cb88bc1652c4a07df93cceb2067521259277e03f(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9265d745cb187145036557188f0b3e766deaf36c239283601c340cf9d9c364c8(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7cbad4a961ef0ac214a21d4011fca0031160112c16101b4cb800cb2f811476b8(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f69360b5bab9e5e738c673d1c5961bd91253f9c7b54fc1cde5c609e36870e662(
    access_point_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__22221b0e8f92c5dceab3b67af39bf52f246f2d1cfca524462fbea3bd93b4895f(
    file_system_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bedca6aa4a7da682a52baaf321fa70822f53d5e926da5f2a2e4f4f3d492cd84f(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__da5c81bf3f316b47e5f3c661eb6920fbe10a16ca50dfccca5ed54a1ad85ad4d8(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d407ee39326578bd1341d87e57900cb6c2a11b186e8aa856ef544c12d08b38cb(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7d5f1b479f8a599bca2c4d04e17c7abf5d5b643f82f789b25dc1594897a893ce(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__250c118d4f1b50e74d0739fe3140cc56639942a53cc3589fbd7b94c161b80f5b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__33950b300669c27514f0b4ed09f8937e4aa3dad520f469bce71ce1802fd42cc6(
    load_balancer_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5c573343f751a5e8ad33bd0db893acd25a6a2a190ff523d70d720cdd0a669dcb(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__93aceb50f2d09107e70e955274be06ab9f12e8c7dc32efb4fd48841a0968f246(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cf5695cba8a0488026652f0a88282fc37b06b0fe4707e08e82dc6fbb108eb08f(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e2d95bd5bb3e285709cdc29901501fa68d68fa46dd6aaeea608079c172775ecc(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__575716f5fd1e8afda89c67391d6087d78b53ed3ba873e24f904e961d9409dd51(
    load_balancer_name: builtins.str,
    load_balancer_id: builtins.str,
    listener_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1e99c579c8863c95a6fb4cc3e59f745e47c6e63e3c5e728aaa3a645c43ff9391(
    load_balancer_name: builtins.str,
    load_balancer_id: builtins.str,
    listener_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__981f91fcf143ae5aee09bc5370faf3c7e7d83c4589faf56fd31f2d9822537d11(
    load_balancer_name: builtins.str,
    load_balancer_id: builtins.str,
    listener_id: builtins.str,
    listener_rule_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a76acbefec54f9f510d7008439c23cb3cfdf46c53a38885897a2e2a5b82ca50c(
    load_balancer_name: builtins.str,
    load_balancer_id: builtins.str,
    listener_id: builtins.str,
    listener_rule_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bb946903996a52fc3bf2e0214e40cfd48f4614109946b337e834b7f74b0aff5a(
    load_balancer_name: builtins.str,
    load_balancer_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__427e811350217c65084b4b5a7d984869dc23140c58e865a30124c7f6b53a6235(
    load_balancer_name: builtins.str,
    load_balancer_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__063640d45dea853ed296bbbfd8c418fac9d74e83f9e5a0fa5b47443d3b68d69d(
    target_group_name: builtins.str,
    target_group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3e67594125f183a811a67ee638a66bf28ca0d1168bc921fcf83c203bbac52a97(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3c1e8433128694d47656d0571092e2606849bfb442c47ba7111b893436342328(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d15d6e5534ff8dacf89b86959f63f4723df3e8081f324792adafe616ce33a48d(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__87b8483c5e08e3aca74db2c41bca8aeee1619492f8dd5d7cdedd6c6a38df5e88(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b7452b741ecdde6d845458569ff61b20294b765094b037f890c59572a7153caf(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4613c0ffe89fc7fb5902f0a7855116d9fe66f01d635f60e88eab38f08d02a0fb(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1f250c71bd61c2ef7d93c92779451b77326a05becd0b12cad0682b5692a83027(
    cluster_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__755b076597791aa9c03c3c215794e145753c09d97ee2d290bda3f8a31d48d201(
    editor_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0a7f012e1de313dc2930bf33519bf9664af8af7d9cd2536d1f3b120e37d83394(
    notebook_execution_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__64c79dbe25fd5e591305531a536a2c3d41d0463a2de3a4d501deae4515d16951(
    studio_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fa59a397cdd59b8f1be8b0ab64b2a5572e779fd20544052088763dc920a8ce68(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e5693035d649df2f92443ed5b4c9f3f3930cf85cfcc00c4435f8c9fb01acee05(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__64d632f8154c2b034c9b792c9e01461ac9a6b2b6e067dd2d193f4e4c8173af67(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__416d7812dd428ca0751249d3b199da5f3fd7a341000ae6a5791924431a06b93f(
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bcf7693f46edd2beaa51c8ed260b50eb4ca1bae4f2895fd32a746be1e60f0d46(
    pipeline_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__082fe7bbb3a48135ef3581480582635ee30eb7f8207b557d00978c4191d84a4a(
    preset_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bd0c0886cbf3975ecb68ae744f1158a5717215164de5a96a0c6ee71a7beef9cf(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fe289ca11c38698ecf0a405f120749e258802520882c6bbe30f014933e185058(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d785c4c44d4fd9a3666e50abae4be606476f284867e620dcea6fb9db02212f04(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6dbd370779eb0380712b7a1ca6d5fe1c5d85e6f89e99a625633935b38c35547c(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f06a952cfe374c98379e4beffcefa2c1e948675ca79dbe2f418746329b1e0909(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6de89261f66c2a40b983876d54bd24d92c095fb510dfb22405a620ca7d680c60(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9f95a72d4a975f20ee683ee0ade6e6c72e0b6e65d579aaf6f0e7c5732b073949(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5476bfab27ceed847228a1d5edca136bb990b0426d5d4dcbd292af12e780d939(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e73d1242f94c0b9ee73af3f1ce90c8f9dc06dc518ce86df82c2abcde24f615ee(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cf76c146514a4f900735b787bba48502a60521da29d87a6106fcd36b9fa9b4a0(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ade7cd7340e2af85180d12e58f0cf5297ab90d8910c4509a57c368be1f27e66e(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7cf0ae3a0bf2008672cd386a9178065ce7e99e698a27cbae780491cfec9986b5(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6d7ac67385a2c79b9d0ededd847a022f1c954ae03400bb45d978a4d6e6b3c3c5(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f3c449ce921b4742fe806cbf0bfe14408266a536fb68e92c22f9e91243ac6b62(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__48c22cd7e0a70d4ee8b2b22883d3469d11f1f3cbfcbb2a5a4903d33525d97f1b(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f74f0092bd1369629dca74fa2285be24cbea8e2e4c1bd49f22247c775a7806d4(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9bfd485bcdfe1bdf23765352220563acd594d4d3889338349485678f2096472c(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7ce77578777c9cf4c739efe62f3a6bd160e5f3ae67082cedf901a753f6f599aa(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b1344a770c75c9602f4b3ec2c2f8fca1d1e3a0350d4edb6a115e8da266d68067(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b909e392c0b74f7cc661a14bcc40e70901ccef5e5a1734472223912bbab8d404(
    virtual_cluster_id: builtins.str,
    job_run_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__debeca2898a85c3e39a3781ef502fdddcf1e7f6489692e06b8b1582791072b1f(
    job_template_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c5e06faf923b15fddd6063cfcba0c9a048c03b7089c533080f3177d50ca1938f(
    virtual_cluster_id: builtins.str,
    endpoint_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__be6331f9d1e2eade1b7bf633e05e1c310f4ad6174ebc479131b8a6de071c371d(
    virtual_cluster_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2f6dfd1a52708695d8126016cee71faf73571b01ba889c8434646813b62f8412(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6f354ae27b8cfdb67428d2a1905f38cc70fd4b318678dfdae12ebc8b3e62a29f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__56869c4694039bd42eaad567e11f41c27f98b26f319651fcf005f4ae73efc4c5(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1b71a9c32375e22d88b466b09db33b01354c45f142608023a9e823278f51527e(
    application_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5d9508ab610f4ee8f7ba990aa3534f83c214c2acc4bbff8d8b3e30aff2f9e083(
    application_id: builtins.str,
    job_run_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__20a0f64713e2c012c9b538422c62bc5e20efe1c3f275edc486ce914d4d46ff2c(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d169fbbd470a9bba5c4eb14c3162ea065cf6a233ea73f8eceb0bbd42e3426545(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b3076f5f081ef4c496dec6069430b0b5a1bd1a42d2c4f9e7425f182d7df25c53(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__672083ad4849bc2d5d4316bec54ff6c652afab322eef8bc00bc939e54b2f7f91(
    domain_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__477f228acd23a4d0a8b07dee09e63615355e2ea7873c94eb64bfe750f432caff(
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f929f6bcfe3502601182d56454ad2294596746bb1cb56e2291f35fc1cc801cb8(
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__62c7cd6837df52b7fbbb491b639c2fce08545bb937efdb76399911c268ea500b(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__62c569dfb3576284438b94ebefd72d5bb57cff11da8bb85551cbf3660a973a98(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0234133958471404a00e67da50d0a0335a15f11f7512afcc4395373719108aa7(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__54bf35abcc36e66a6e429dff9611d0716d1330b42c7626071008ddcde3fe6734(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__38c2b2c89e06bb117d393cc90522dd8a6ee7ee3100963ea2f4f6a6e553a87adf(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e9cdea83090109a7cf333710b142862dbe4fe077ad69b74e1c64c887578545f7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cc0a983da27886648ffc94d0953cde70f771009887b4ee1f5711ef8076a8bf96(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ab26cecc790113a2513525808fe664ffdb5613170c2c9785acb2240ddaaf6168(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d8af966ab092ed1ab5ca1e697285b9f638c8202b925afdb5052b46545b23d65e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6b73c79b96f05084dbeca7b7160ed8abf3dcb88ed49d020cb3e85429c8673495(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a2f060d3d07a82cb6537056ed0a52974652d1e38b68e32472c64725e43bac94f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__01ee41ff3eeb89a2e473a58a7aa7e115b4834083aa773ac14824b5da3853f9ee(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__88db65c8a375c07a35991ac609ba63e356c0847959c5e90fa2f67b873c0b392a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__504cf69f99fef33047d5bd0453b73e474cdcfb2d174eee525f540e53be181faa(
    api_destination_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__57bb3d66852f306684baa93895588b2ab02d19679fc1c78859821cb0e9fc4b44(
    archive_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__31293697cf1cc789c403250030073d8b97da223c8637f94ecc41cf82eb78b9e9(
    connection_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e86ff491ab070fe0ef19a66d6927e32e53a70dfd2353720ef9889d6be031a9e4(
    endpoint_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c3383eb8db83b406a4a2fc500c56b10b04e9fb3ea4aaf64d943f1c7f4060c581(
    event_bus_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__86b41be4294d05a554cebbffe6cfb8dd1d43870e72f9ac901a20ed47943e011a(
    event_source_name: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9daedf41411ac983570d662da664044a49a72c3ab2cac673082213c64cfbf346(
    replay_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__be98a24dfb2f20dc9d56f0948e8b416299520241b72f70deb07edb3f46cecd84(
    event_bus_name: builtins.str,
    rule_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__92017c3aee38c1fef0324212d432787f2942527abe80c187c4d3693e7a191f9f(
    rule_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__763b27f7e96ab8d45aacbd7f8a0ff6d6f0381821fde90b5092bdec1e8be0ecf3(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0a8a94a98e75d3e77b9b802ed7ee9268e5963d6caeb8b9a42969ce565243002a(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__15b75d06a15e25891523e9b0895e32217b29dbc48fdf9958fd759468d66e37f9(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f2a1268b72a19fa20d50479e0c3362887ae31387d66eb34ae9eb90096764d3b0(
    project_name: builtins.str,
    experiment_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b2f775e9a4e50734bebf9c8ec159036e555a711ce3f49d449578d72ee76dfed3(
    project_name: builtins.str,
    feature_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b08588ec1f897d27da1a58b50efdeb6fe03fd422e299be34b43a600423ecebc0(
    project_name: builtins.str,
    launch_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a1848273313397c0afc3a354a06b18a097e635ba97014c3f575680597e873169(
    project_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4d1754aa467519ee7ab24df98260b12e764fa150bc44fbfc005d7c74598ca948(
    segment_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__048de854b7cf4a63b7e9966d7438492402370540c88a439ab9d3162e9f33773b(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__522d7b07325724ae2930b3fd5a59decda11d140fd4031748cc179da7ab80c6ea(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__055283809827ec9bbcb33db5c0ce3741424a7ca4358e990e9308e7a1803736c4(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8e9d9e978b60fc666b955514b0803cff3eeb9d4667d672d2f89556470218fc2e(
    api_id: builtins.str,
    stage: builtins.str,
    method: builtins.str,
    api_specific_resource_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__180b3ab7980254ca0455ea60d9e746d17d5b64922ef2a70047a0368aff165856(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2a8e6ce742182a48a046d13580dd2649a06483d028fb3ce01356cc9455c86a7e(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e3141f53f4e2670814f18bea65f32fb909042c63b37dc5074f4d642ce196e657(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c5992d6afe1fda5c036254cbcf2519f3b18abd03cec8df6b6ee05be76fbd90db(
    environment_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9eff410e029ca4bf7b7db3a89e1fcd0703bfebed7774eb1e1a7b239082f8c7ae(
    user_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c05254bb1ae3ec3d2ba6a07beb898d07333a0bcbef6329c706b442966c25fe39(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c22a9cb8e755d2c081c25f3629f6c9ad341ec01e5fe0113d7828b04ddff35d8b(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1bbdf94eb65dcaca41126308e7cfa2339a73230dbeebaa6cf3855d5bef9b8c7f(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1bed8238c7f33e60c633812d5069cc3cb226d11c3ca59c0b5acb57f142d40608(
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__58103f9d2e8ad29484e6daca5b651219115fc1611e9a11643e773415fbd6631c(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a626ebd8f74ad461bbd0700e05761ceb99b271b06b0d3c22586e0ad0ee785a92(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4793a6f509edb17ecaf65f05cdd093c9491b858379e44a7c15288dd1a62980d6(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bbca5e8adc846d90ef9663f1bbd1e2176188db0b987fee7c3d257d13707253b1(
    delivery_stream_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b3251c7baa9b2dd0f544631fef8a177bbe2114334bc3421328f354dd12933ce5(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7a2857c4e0f0a88c90ff518ebb76c009672cd8e5c351fc68a93f89ef4281b7a5(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5c2a89fe66af6403c7bcfd272e7d3a1774916f15f694e63566c614e243064652(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6f36dbd817c98e79cdc4c7b2175e9c594d2a0be923196e2f67087b8b7ab5ceb3(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5751e30650bc56da03c635665769c03790f80003c9d613b486286a34ded936da(
    value: typing.Union[jsii.Number, typing.Sequence[jsii.Number]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3362892eaaab1c244ee1599b02c32d124e4903a1ffda4f509099e7a8a10b25f4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1199b9a534afabaa1c7d0884b140adeeac0757ac11a051a66dca5dfdb4a079f4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__36d949c366d8a5003524ff5e7397f40a690a4bfa6c58b9f87a64eef276c3d765(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e2da0642497cdfc2573e484b686a22c0e3f50ab28b5e571fb02ebec10ffc40c4(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bec3232c42d95310f08bd9725b134f9f2a87d4c2adadef9d1d75dcd8edc189e2(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1508525bc962989db82508bc2401b3273df5d8ca7df7803248b69ddba344efd0(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6c607b51374f1b353b8715f6ca9b74e28d507ed723398dd598235f9dd8f2f337(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c0b0dd1c62b7edf67563b08fc24868d3d3fd4085aba16cfcc7688e60f4e3bbf4(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__433e4ee3cf7f88ac69a2f6cf20688d3d56a0668cd10ceae544b66d963ed1c567(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__06348f3f6d190f5ade6fcaa8941f7ed30e6d0c5b676465a43ba0d377a08cdd0a(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ad17ef696a7dec66e0a970cd733f56fe5296333e4f1b0c891004b6ac34e377d2(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a5c7fb27e82d16399d1eeac33f6af33c09d495d870f22088613d5b0d42c8dcaf(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__aaa2cb56a6d04f19ff9720ae141e8cffbf0ee1ae3030aea5467c7edb53312198(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1c85a3b0836cf602d2829bff5bfbcef3d7ac1d257c971197b5903d9f6f419a57(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__31abb8af6ff80fc74e79721da36abb2beeccee4f662a48af8e00c8451b9573c5(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b38313b44742b444c5bba98c7889fcb44802558b10d3f5c29c83d4009f5bb9bc(
    resource_id: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__41212f0e591dff4d50e2c7482a1bb0a468ca944e8b1e0f4e04eea0c00600bab6(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__323abb3ae7e193d790005610c342f3502b18ef4e59dd19218a4782fa48bd76f6(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c79ddc641f305467d073778610a25444478704c6fbfe9209fdc21de2d51fc165(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5c57ab6ed390cb1326b734ab71d78a9f009f1a0d2318ca3185b8786d412125dc(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0049249649ada9099cda0c904c1b591dc57d7b0bf9e534a7c3de66bb94f5fb18(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f394abc780d2b1d9498e2c55e43a4889e1754c44f5856fb2ca9a41963e6e649c(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4d450fe3279711e791a554ebbff5823f7a39001b1a10feab88636dcd725e21da(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fe341f3a057061725e2c5afa39f7fb4731eafe2079257ef9fb37c851e9871be8(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ece8ddb4b9795738297afc88070a89c51c3a84eb3e36c4427f90809976781d58(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3abedaf81f4d751bcc94ce04227ce98589a7078513673d14254b661c94b29b06(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b98b4142dbb146a454163f904e50bf2a5f24c753e516d17b45e0000b93feb843(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f7a1260297177926928cad61df155ddd61eab072c1c290f644d60de4c4e596f5(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6408cbe1ad7f7c563c9387859ca00b493e5edd0e423a39fb09c50b9d47a19c50(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eaac8500cf9041bfbde100cc6e0ea3e5a66487ca0415578199e68407cbec4b6b(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ab929d48e5c4098950d27e7c13c2d0b93a752d17cdb880594ea1f830849479c7(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d2dfbb61b2bb1585e695f9f5cedd96c7b1ee91bd51fd9c73b8bb55f476a673fc(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__df18d3d4bdf9891629a0ed91fe265b9d84d724cc198d822c13808f59752b7c48(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4f2cabb17c3787144346019fa5d6245307ae98030096c200a73cb1b9871985f3(
    resource_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__27cfdbd2eb71649d02f74664ae467767275e7cd06150985a2c8aee8dd0923082(
    resource_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__818681785fd5b5234678a47e70e3cafea53717ccf2d3bb31ed32529f99400ceb(
    resource_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7c6bdfc304efc4e1a1eafc63052a2c7016b2373ae3cf1ef32da23d0f3d463a32(
    resource_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9477aeef6b73769fcc3a3d91a08a5814dec26d4c52c1dff03bd24d914ae79a44(
    resource_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__46d75a4d44135e2c582a11763db484538940cc96a682b8c866870b0ef3d12e56(
    resource_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bc5ad6afe214a983108f40e0d6bfbb648be01dd6bbe27eabe97c19b93f8214f8(
    resource_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__867702bc7ab6a5b7480d25d2f5e49d12544c5e211955a219b187c229a6a70458(
    resource_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8895057821b5c04108ca4c245aab33a8eb685cc5cd73f4ca82469b1b0573b149(
    resource_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0d3f5e48b96d4d12fd95f48ce29a5c908cdd1d095e6bcb32aa39f4bc6c728dc4(
    resource_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e2ffe7bbe5d304e14b24ad7a27078e20b0c436018eddaa5d2209958774dbbb92(
    resource_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__96cab6ecad0c8fd5bb2c0ca3a27dfba1fbbdc79ea97af643b8b026a92fa70151(
    resource_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__21ea759dbbf27d96fa16dcbc8d91d628dfe2c75c51910d6ae0e5f195d102a202(
    resource_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5b92b444cc41afa9af1c0a60d2959070f45064c97689e46fe5d3620b08dcbf9a(
    resource_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b0e541c97bc8cd01f830948f8806be2ef9076b690b2c84e0b4f08138c84b46d3(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__be1001806813a31f0e2f2576dc93974b454ca623f39d84753e664c58a6c31c9f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ba4b62c1ae5199d66a8a4bb8e3fa46c1c79d6beb20b4a0aed61bcab85604cccb(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5ae166b8227e68b0da05011b2f14198c710a3ff688f322927e5e7110ac86df1f(
    configuration_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9f219487dbc827ef764b910fd1be1ee78bafe32ff734bd4b147001b966d7cc35(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e56bef0618547138d03f2cdc7ea28e7e4324779f3c9f400bed7017ffd57a17a8(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c187c0b5f333f208d06532b0aa00834f040a9417b6020615e601e894ecbaf737(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__42280714c048a7cbd4ffd7157448cbfa457116a49d6eacce3c189f9ce437c029(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4ff2d595727b4272179e45023b36e95d60bd6e52dbf45525b71f166c6b77c46f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5787895e756e98a223776f5b5dfda535097c6437e4219922ad1fced39f8f5c6f(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c74ca9510291f7b2da506a4d419f04dc64260f06863454bd93cc130041c02840(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9710d3f7005bd6945f0042908f74b362b38712984c04fca80f2df9129c1d6397(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b4836b3c561a7f1089e5e2666e38761186352b8272c0a6875c95661e5affba28(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3751023a7c8b59a3867c391cec447fd5ab0764dcdced92d490ff8e91c9cf0c2e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__521ccb3d72fe676d45179758d9659ee83d815c0e7a1f4d9aa80c56e362807731(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6c8fcc4fd69ddbd8ef7ac98c6cba6e89d02da40373089c5a0e1b43f5502ffa2a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c0eda96bf143de9f90884a90ee7a999f9bd9ce530a853ef1c1f186a97d7033b9(
    file_system_id_or_file_cache_id: builtins.str,
    data_repository_association_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__02f5736683ad5719c5c67bd2a0d9c328f956271746bce4d967ec3b5db5f93c11(
    backup_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b11a29a4f8377a08f9599c7cf186f28c848b690b15c5046ee2b1756c32d7fbba(
    file_cache_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__48e8aac2af820972cb3a1438d591a581774c048b40a6676ead0e1e68f022b1f7(
    file_system_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5b6ea9d4cc2d08134ecb4720090e2be646a6d5cb32961a642c18f144cc3d27c2(
    volume_id: builtins.str,
    snapshot_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__29f8c9b5e552dff5ef92bd47d3c76f0c6043934f24c62b1103858d82bed2e011(
    file_system_id: builtins.str,
    storage_virtual_machine_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e4f7a07baaf4294668b444cafb296d38ed457bb091370137dba331f34dbd02ce(
    task_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__26e96f906d3ebf180757816147ea33059f03d1928992972a9724a10606cbb423(
    file_system_id: builtins.str,
    volume_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6b9e896466b67f5fd14c2a10b73a63f8f74a97ef3b20a042325b4ea5afbdd46f(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__08e4fec0688ee08b4f00fcd9ab72cbb4f430c35bf179585bc026d560bc1ce136(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4713fe6c80322c3f7b21b8f6977869f9c8076a5b04db9301cc3536fcf2177560(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f1031f2131a2225a959b230e3f0ac6d70278d19997b9c3900f691d1bb83ff4c5(
    alias_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__19c64e598a229047dfcf4151635b5f118968c529d5f5dae289c5910e6ad8a6a3(
    build_id: builtins.str,
    account_id: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__39f58b773706da5236a4e914c5237695ed2c01e3a35bc3810dac71fd3cc68d83(
    fleet_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f895558c8fcd47fdd1a1ba88c4e272d97d7af6c60bffb21c489d44bc443b713f(
    game_server_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__58233c160defe0d566523f5f01537c8b6ab266511bca50dd49e8d114283392a5(
    game_session_queue_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d103ca0efc6fc23e512ceadb1bd805ce81dbb0e68ac4da30b60ed9ca42b419d2(
    location_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bb88f950b51f13af22f6f649af02ad3c09567ee9efa2762b8b617b82e8ae9a73(
    matchmaking_configuration_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6a6ce5dd0fa316efb1a6558d2ac4db285c37ace043f25d9e6753f94cd37eb22d(
    matchmaking_rule_set_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8bf7bfb166a05796b2ed0958714e7f8cad1c99787dc7aac1dea9a7916926d576(
    script_id: builtins.str,
    account_id: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__124008688568ee67a20f8ea6d1d8a6b0a5db5776be9cfd05cfc9c5a46b160e58(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f05de3dbaa74711bc656a8e28d34cdadd70f38e556c66ff03a426cd13c3d279d(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__917c681c87fa20eb23c44f25e7ec7e3d367e388fed7b70de320b61bc0bdcdf17(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a9b974e55650266b31cefd8e0c6f206488978df0c458c7e3a5cc179ed58f4939(
    game_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d39d5025ee2103658b0feedee8f77bea56067017c8c593731ee3c2661a70e205(
    game_id: builtins.str,
    stage_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__672ce2b2ea1f9e33985ab75003639ce97a83857a7e7a8bb041eda9340ec55f57(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__53c73beecc1cba97d49b995f4c6446ebcd61de6bf59fd23e3dd1e19685cdd262(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f5694b02af1fd0efd6c1d966d3fc98fc4d7f5c9508b1564e952c4823eced23de(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__64104150370b867140b78377aa0326a50d856fca3705b8594241ac3cbbca31bb(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__05f3894dc45d662ac37fbb148b1ce852d6f73664dbc7b3946fe21dc2c4f9852b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eb18b1d881abfbd0f4666485bbf96ac6d78f070d5340b26325af6168e9c3bc5a(
    key_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7d8ee813c6365b497b14621d06f555ed7e33afdbfcf1ed71af2b04654715b06c(
    geofence_collection_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__066fe45e9f697dbd60d6a782b6aef8c3943f7521cd703084fcbc8b3f222c4c49(
    map_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__79ce71e37f40fe893d168ee8810e82d934f2082baaedf16c7c33c309ca26e487(
    index_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8c6d024edae3d4045981af5f62e38b302e7088d010fbd74395280dd3e25c5c26(
    calculator_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__974f7fc4a0868bc401afded64944ca8ceac92297a4b5fbcc1ea5ed1b3ad3736c(
    tracker_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__71336cc667c2ce12408fbf742dece81a908d2febe1191b7b7548d529a9653477(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3e0aef3465bd3fae93723a32817bf55f404b5ce71fda663794af3727d91baad2(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4fbfc6d084e87336a442c62a41dd5084953cd1c827b275bcd4ca9ebc78f3a63a(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__940c3e116a9166c91a3beab4314f1cfee4208db38885c5f1a010a3bde30c01e4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__aff740988e2d6eaf59818e56cadae6b7f678bd124e23523b5f2dcb309ebd2220(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ed0881d5f886235ecfd466c40d6d6feb77bf92cb0afe50e5a86c01574ed165fa(
    vault_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e24ef6b94d892038900c0d6d79038b6bfa682e3bfe465f20ea543d7c1d3c0fb1(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__df63561f082e0af7a4bfd4cfe0ba412874f38b99bc99d6506ab8d7548a47df7e(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3ef877591f8b6dad4cf105165fe95ad72ac0c9a179ce3bf194e49fd2ffbe4a60(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e82130690cc4239ffcf27ad16fb9014fe38ae61ab896088f4be8c460cb2422de(
    accelerator_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5a3aefed135b1c2d28bef99bff37b198ee496126c3d44aaf8a8d6b04eab27edc(
    accelerator_id: builtins.str,
    listener_id: builtins.str,
    endpoint_group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5513c1d2c6998a8643e3f4c83fc55eedab1ac70b4513842216692462f1856579(
    accelerator_id: builtins.str,
    listener_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d131bb1e8e5fbab406278580090ca0188f9ca992b4ab24e279fb90af06de6677(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e49aa0def079113cd00b2da1104dced042a32f0228c60c774af064f1455423c6(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6716f36572ac09275698deaca65d6b333b59359792270a3d4d51af332d10d4fc(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__38a7ed8df613fe126455f574630800b2d8717421a275db0a3efff0d55a0dacb5(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__60aa7c5050f00240e2fd2e62e9b27d70a5c80080b23493460f28a1b18b614638(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__29f6ddb5a7b03086242fc367872afb0aacdfc030fa08e0c9a86bd7babba2e10b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2dd1f37de56821a48f21775a9f40ceb237ad485637d518575466b0e91c23d873(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7cd806a065ea06337a17032e1ce9f1422e3341e0d12c5e9d15df2b8ad515cf80(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9f67f9669b958035491e6c053e7f5e40c64befe6df69ec13e64673b5d847ceeb(
    blueprint_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__21f524d1ad477c00e4d78a9540b180e469a4dbeba5da4e42a16959abf52d3fb2(
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bbd44618bbd6730cb48c0b60ea37a780eca7a27b9abd2ac487dd1ebefdc27e3d(
    connection_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__571d907baac3fe080f28967125beb3d867fb98f05c24ed3b35cfc23e7f464dcd(
    crawler_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a71c05adf94fdc784c21acccd422a65d82b5c9bdbe5494b598a2b6688f0a28e3(
    database_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8ccaf09f5914457320ee456e4be6d1dbf0994992c807fb943e3c1c95bcabfce8(
    ruleset_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__72265743de11a28b23fc11562fba464c77e22892d73b53bc52cbea9b07bc9fae(
    dev_endpoint_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c2c41964658a1d9a164647adca496f6896d5684600aa83ae24a81c6d0387d393(
    job_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1ef9c4df89377cb019b8f229ead27e8eb6027d8f98e74ce4f35923276063e5e8(
    transform_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__339121adda4d5791810cf246dad0cd5ac37983e1bfd8317bdbb69c191d00c3bb(
    registry_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__04249e9d741385a4501bb8a5e1aab8cd2bb88504eb782e14a6b4529e184e625f(
    schema_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0a8bfda6cb407ad188506ad3c1ca5ade7f094e9b484279de7ca89f41c4e78ef2(
    session_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a6872a9a1ed237f63fdeb7028e88434e60fafbbca23bbe94973fa4c1f35167a9(
    database_name: builtins.str,
    table_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__34d981007dbb7c32a62d7653e3f7e834c51657f7b6788e338a88fefea0b905f4(
    database_name: builtins.str,
    table_name: builtins.str,
    table_version_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5839bf27b6f5d4084a7b90f5a65ae2c1174f2fd7d4981193d259932a0ad2b7c4(
    trigger_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cc7b5c338af0dae0b2b352f6c03d3bc51ba4f8870142153ec02bbbebd8fb4d2c(
    database_name: builtins.str,
    user_defined_function_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5d91155e7182c071b335000f034fa36075368637804406679fc290a7b7383b3d(
    workflow_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c273dbdaed13b5ae9df3d3da8a9065e6d94e00423d3744dec6db2645b0415be5(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7eb1c565b135f5d2e132dfa7dab577f6e1527c87fb6f7f545e2efd5f5c5b642d(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7f6a9eae32d70c56303c06a42cd7ab758e3f9a0c43a0f524ba7c9cc0dca5c71c(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2743311678adda4ee2c7da213e16f9cec5f697ff17a7394e9d0c8c8edd9b3afa(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ddbfb9f21f6c007989de15cd6a618e1ab48856cf034d312525f029825e71d32f(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c3ba934107d7174391d25205837f3ba4d59612274d9f6dce2a183eafa33a7849(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__43f2884b738ead98f8ac1166052c7e733d04e2f498c6568fdbb7ee08655d1516(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e080d205cf680aebec07d4a6978d6fd2bb09fae19e1c7ca8f2d8125a8b8de82b(
    bulk_deployment_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cf5c98276013e0034457d8b0a27d4f89d0bb42f952065afa7abf33351e20afdf(
    group_id: builtins.str,
    certificate_authority_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__022a07b19edf1849ef1ec527f7d1dbb82f9e6f71e4e020dc6c08d72b93d4c822(
    thing_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__38f5bec0138a12b8fff5534f85e8a5eeb53968f5ab9f0d1a3b199231d1527e80(
    connector_definition_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4197e2dbd65cf9afae3c5a57cef8a021c5cca1c48777553c2f87cf4f9d329d75(
    connector_definition_id: builtins.str,
    version_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__51f00c4b80011deaa18cbab3c75806a5c4fe3337bda98263d9ada7ea7ee2ba20(
    core_definition_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__56fbccc34a42c2e69c182f3aa53d845bfa1e9c7c262bbf8fa08008d4c320d2f8(
    core_definition_id: builtins.str,
    version_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d6dc540c68277c688df207bd5fc631c1da08b0c4b6d5fa656efc074c04f96a57(
    group_id: builtins.str,
    deployment_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8f95d273492d6d04196881709a43c524fa8689008d6e4b8dc7846fd517079f12(
    device_definition_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2c13236146c0ea9675303531672c48fd692faf02a36ec0e2592c96a1e12966a5(
    device_definition_id: builtins.str,
    version_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a7955e4af0bbf848d653f29010dfd5b23a3e7065c7c786917c2a54f5fc998191(
    function_definition_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4e01213cdd06fd1d76fa6474cf67dec6fcc10ce0aa03ccc64a8647b7beca7e21(
    function_definition_id: builtins.str,
    version_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__25d7e398a3b044ecb2c62d473b10110476cf83b6bb795ae325a5465bc833fb89(
    group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__19775e8d3bff34edb4aa8cfd1efb559f7982169e4dbaf954ed6f86ce863d68b7(
    group_id: builtins.str,
    version_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1ed4796001aaa86bc913d75624a2e927ccfbfc7cee3dc49e4de439f7ccd4e4ac(
    logger_definition_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f8994407f91f61db9a6d343e797c2fcef9d896f367170ecc7e56a5195948297a(
    logger_definition_id: builtins.str,
    version_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b6bd157edb3f1f3e0b25d0146d26a600db09bfefc6d0c3cc62844715637e4290(
    resource_definition_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fc87fcf98ba0ed62b482180136a739da27c448e21b00aa3830ed13839b097827(
    resource_definition_id: builtins.str,
    version_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6cb60b83d953c829db590640ce1f53ca0c4f255b4f3c80c7bedf044bb77efb7c(
    subscription_definition_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__98691e81fe60996706852c7e263d2d09f67836553fe46a853b99e9c75cf8de86(
    subscription_definition_id: builtins.str,
    version_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a1f3c50c272f6ad4da21f6e5bf3c1238094211a73fd70be23c8360bff5d1c82a(
    thing_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ddcd2e079e673316e225c0e253c48871705f176c26ca39b622567513aea1f078(
    thing_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a61e88b98056daa89fb27f26dfb064170fb8fbd8f452cef66fb952b0fd357324(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__13d35ff1d4a4d0344d422aa8dd6a4b703075b189e068401cd7c61383d9cf06d3(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5fab5343d36b1a35d6387253f5a007d2bf99f597bb256449aa35a6584b3bac16(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4a9983f5766872fe9a76632ad1a7c369bfc2e79b7bb99f6e37f25fe6ec5ed786(
    component_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6484b2d4bab864e470b78f0c49cfe28b440334a9319de3f6ae12b96937207d0d(
    component_name: builtins.str,
    component_version: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5983e28cfebd2a78fbb95a0d777026f2f6b31800cde33667db848d09aa7382b5(
    thing_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8ca69e94fc24361f3d423a46c270f41a732d48cf4f712bc8db600f02a674e717(
    core_device_thing_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b7713e0f26b402263186d46f84e8b2040840b81d823c456589041d6945c212c1(
    deployment_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__86367ceb9892b29be292706fbe68e905d11ade62e1b2e59094a0923b68aada9b(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8162029af3352b2eeb9de5d8ff5773470c928351e776e7dff72bc4159ebb2c11(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3d90d49dbaa56a6c34d3a7afca77e778771317740283ec3167ff99857acce5e4(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__12d6910ee6a456197113b975e2c23cb9d9303d0f2af7851482c90983131a1004(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f68abacc8d33ae6d5b03b9da9869421a8dee749e2c7d1ab42eec13b1f01dd527(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__86390e1d2cc94923a69b896b356413f35f9bd6d986d85532a6b60c864c7c1498(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9c9b3c54e71bd52c71ee658218871673dbbdba6314260b0ce66d3a99cf20d581(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__96b0e3d5d6f504eef12f46502ca5fe483db13c165aebd0e9d5a6c0eda6ba888f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1898be7ec81f82dfa645b17c101517fb4aa7f723696be4d688ab1b6870d54cd4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bb6059df73bd204d691b4396f3afeb4c16b5981832590fb6bd0f1b9cc79987ff(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cee1ab0ec34f41b7c06fafac8e093cdee65c54be56e7f5427c36dc7a7f0f9556(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__11e1ab8eb84180e2d6c2bdfdbc1936cce969f0401937ff076bf422c3e6160699(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7c530ede65e6aa95af353ef4b51af8f7f9306bddf1d519613100d2dcdd4966f5(
    agent_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b29d3115dbe8c8996ed909029daac285ae734f167e39c36c76b72ebfa56895de(
    config_type: builtins.str,
    config_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e17db7256e74fa188798b42b185bf565490fb239deaf7dda4633e71b562e8d00(
    contact_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__81bb5e13436e1f07d3f30f315d17b17489f60f011c95c7d027d631400d7e7ba1(
    dataflow_endpoint_group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__00ef39cadf4bb96746742ecfb9cf846e3c253eb4fc5e32b8b095b6c7447c4e89(
    ephemeris_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d2109e8b06478f979f091c14c7211c0da6783ce9d32332b61402b531a637e282(
    ground_station_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7650b761f10d9d4033ad9d0aa995049143383d2a196ecd7173a98343e5f78640(
    mission_profile_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3fcfd1ec5b954ecac39bfb947a6c4cfff01a3278b1e51a31cff59cfcce640e2a(
    satellite_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ea994e4aa58ac686c88100392f855b2c2ef38c34fcfebd74f78e3e82c02ad7ca(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c19392ce02fef0fce44708a48a5433184fc95b68a215ec8eaba13f5af2348d80(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4d145ac119c5b2a07ebbe91af5a1676afc02e141d3311456fd144ae4b6e5059a(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1dd6e9c92f39679756138438005e10dabb14c359248b28657ab226a55e890661(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__987c306e8ab0326257771a524a8ef333dbd527b0ef450c9e02ac7fa63d511c2d(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fe664e298887fee32d3831e7ef685dd95b6986624f37cd79497913c2534289e7(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__57c393a06e7add75f03513e39177a006ed3052f9c805ef2365f471c110b5212d(
    detector_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f3d2eba21ee4f4a425f4aee0eb40fffde07f29f06b2488601d58455583eac804(
    detector_id: builtins.str,
    filter_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__459a3f05554b0c1b94550ba9521f0a8d9ea90aa7b62221832dbd90aa432691b8(
    detector_id: builtins.str,
    i_p_set_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__83a1b9b8ec4a95219f8dd6aed2079c0d88d30d1386c197aa702b641fbd3598ff(
    detector_id: builtins.str,
    publishing_destination_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__817abc2b0cc93ab0472c15835483e2706cc14d34ca4862f53c45d9d770b129d7(
    detector_id: builtins.str,
    threat_intel_set_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ebf67f5cb3e70917733c7fa91dcf18722b758caae20e2021569d8975a5e48e48(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__39c66728220278c9189dfff92e762f8bb564e35559af219df7e14c10d0aa8526(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b9629f18e576753c9ea8203e1c47ee1d21c6fc38d935cd78c80c3637e22779a9(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__278b44ddd5ef37c30b76a1b1b56157bdf8efa48b4c8b42d4e6ea7f312dc4e458(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2c70782d268b9d4549a0d11a3e0606e4acfebfa5866747f3f5eb5665c1ad0226(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__adfade95816eff360c0da85c16cf6dc5d8eeb8d8f31f61be5c523fbaf7547cb9(
    service: builtins.str,
    event_type_code: builtins.str,
    event_type_plus_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4905bedb4a7b89851626f8a84400a49b66c03fa78e80fe2bf926223dfd340671(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__30f823783f10d553fc7f72018d2c5b6b4f03ed7f92c8639b1e05d40bcf684b75(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d27f22f4fce3fecb9dcb0a3996a09de4a3a04c5d73d9a66ab85ee5d48d2348ad(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ffabeee9a84e42a9aac0aebf9ec946bab97b9f1d9561981b79dd334fb42b8a34(
    datastore_id: builtins.str,
    account_id: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4b1573733f0d0761fabb7bea5aa3e37f133b4ef0e766feac33a680bf37103bc8(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0ed98e31a582e847d8aded64244e9f093d66ebe777e19d5a0f79959355cf4499(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__461fae4b7a8f7d9811a1145f52359fc5ff8f60e239c127ab0f2231c4c7728b1a(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fce24f0c1a8b6e6aa1f175dd60973219f3fea5e4846b9b64d73f27fd4b530686(
    workbook_id: builtins.str,
    app_id: builtins.str,
    screen_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__854e315411ed0738482a1e4657af787b428519c5b10ee4e00229120f7b9124f8(
    workbook_id: builtins.str,
    app_id: builtins.str,
    screen_id: builtins.str,
    automation_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cb1bf0279563adb74f4b0f9d4af3791f5098259396f0b89f0edcc105b8114c02(
    workbook_id: builtins.str,
    table_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2bd5569e9008186a483c0c54f51d8eeb2f5a9e710d8eac5ec27fb61363c2a22f(
    workbook_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__da4978bae8c783de129561eec56883c55294869baa04ef8d6ba1d81533f124d2(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7ef18b0613680ea866931d1fef2db72a1068f0eace34ef38299363310aae91e5(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__baf3079436d53289d519e4399565afaf770eb4dd38b84d0813604374c6257814(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d3abcb8304ae8a10b3be8d4fbe2acb31b0726ff7912024a4aa997bbad613b21d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a9c1e8f51aa02350394bd8ca253763edb503b8f70736d93a913307a791845cca(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e3e1c7d50fd25741bf734ab02facaccb244c28f9d4586791ab846a8e0d102d11(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0c76b51e080d77d1658cb2aeeb8caa2cd86b78f32686b0b716beda7821d7e4ca(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__06252730368f41a559f564cc15e33c7fa5fa01fb7fc49f8d5e5fd3b9db9d4af9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__91ba9b4908fcfb46a926f319f0af1bcda1101791bb75f4b8239f7055f951722c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6e5ee284a77ebf99129b430db2dd047ef49af0d03dd3fb2855cc873cd1f48f3f(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7bf1f0b4cc4e959369527c74a1093ecaf61338733913b4ff0890c9f608e18df9(
    entity_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8da3eb3cd34b9b6fdff5d6ba4bba550ce3faf0fa280785e720c2a19523b7c72f(
    role_name: builtins.str,
    role_session_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6fc06bdf1d6fd139541238215cfc4141d8de7f2433eaf3e824e568899569bc10(
    user_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__283e75bef4ca8e02fcb045bb28bfc499f00002ebbcece06ba843ce4722fd56ad(
    group_name_with_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ac99417185b0816f155041a78377cd971318e97087a3059df16e9514e5f8d0e8(
    instance_profile_name_with_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2c717e87993669907a639ce3ca03e72bdf3edc8a94b2fbc049ff6e4094214076(
    mfa_token_id_with_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2f5cd8610284d6fc2da67b13323aa431dff641d9393512c847d7d10e13c8e020(
    oidc_provider_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__faed0a5d64db22b46f9556efc002769861c0921d102355ffcea3667d597ab311(
    policy_name_with_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c926ec21ba2fbd600d76ddee136a209785b4317067565ab6eac60957e2f1916f(
    role_name_with_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__31b00c173826b67a98da7cbb9803c3263931af53cde5a814e66ded5f6a061b3c(
    saml_provider_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ef668ae35be63228f0e2586570a88d619684b20f7e6800aad64bef6a45c13311(
    certificate_name_with_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a63527c24fab33902a80bd74d0d3983971e2132558696969acaa5d7aa0b3b21a(
    mfa_token_id_with_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__45963d5088b82ec49576bd873b04679fae80e5035c03558444226c58eab2af12(
    user_name_with_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ec3a25cda865b76ab319c82abdb412b2503640ddaa2f99acc53fc734cf8a7d2a(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__000dfa9ec2bb199d4dff111daed65d9dfa096f4ace84aed96166ef4a6008d1de(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__92963393e88b91438e80f593789c23a9cad8fcd36e57a687c583fefedfe31e41(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0e960d5c90e13f1fa7ad8d67d697c7e10bc74631e6a98ca4a6c5c0dc6137be94(
    sync_profile_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6eac25ae684532f35d56dd26bdb56649a419913f1ebfec83acfee204d3ccab5d(
    sync_profile_name: builtins.str,
    sync_target_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__52e374d38af76c6ddeef840dd99bac5836486dbcde76add6fc8c07f2f8fc2607(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d14e3c75ead70d8453eda57fe8c6c2a01344606d58efbd5b2bb5510a2e5bafa6(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__14034568c365e40c2cf86d188122e51c07e0dc5eec5d634a92b939c0ac9eb83e(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8504badce8011ae8a2915acbabac84ed02a6a7554c9f954ad4a4e46c03ba9d43(
    resource_name: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e23bc4ef1109dd043d6f16575d0b35d4fd36d84d6fc04272b8edd3fd5f87af13(
    resource_name: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__46bf65000a65ea37a43bcfa13441aca74d39902ba0fae42b57d60578667cf049(
    resource_name: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__545a07bae68752e4717952579d17459dde8485051ebbfd40a4344f878f9eee52(
    group_id: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a610d2c790797d64ca9980d2a45f8e558d9b27ca214da8cc5dddfa49ef82d288(
    membership_id: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5e06c55514bb1dfde8361060d958c452eedd4779313e5ca337d267081f8b1ca9(
    identity_store_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__50c66ea2c810499549eeef7142261d19d95fa8a8a4f9c1850e4a48ab2f9497f2(
    user_id: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e25b52a548fb64171fde4f15217c55e594de47671ad02e0d7870ea1f52bb3d93(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d5fe936599d716a2a331be185aa358adb07f7f28d675babd7f2cbe28112397f2(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__192947964674bff2c0af60da6c30ed09e4ca3b275fc3b89359691446924d1173(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__61cd26df4d5b4982dd422e6985ae7161d960d5e2acf617c83eb67e5352a558fb(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c17a08073f8ec123cc598dba2364bfbc8e739d29aa5ce2ecb1eafac550a18cc4(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bca688477c500c047860e0da083edc7b74ffca8a39c0243b699329b39ddbacc5(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ae36185078da0aacb6338ce55454d9870bd64151ecf9fdc02c5363cf287f0efb(
    key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__09f47415c39f792bd0987a48f1028c90cda6081696ef3120faf07b57711cdf97(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__385740f1f0c2f07b30c3395fb4cebe22f11c04479c08daffc4da62e1a852cfaf(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__349a6759200e1d1e7a42f74960249bd01ee28245dae3fe23e7769c347e2d2112(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__334306085cf209159cf99c075c5e5a43f100012c7493e8542cdbac9d6261afb0(
    component_name: builtins.str,
    component_version: builtins.str,
    component_build_version: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e8d6d6870fb4b243cf6fe85482bb5d6199904fcc08595d429bf7c2cfd4061b31(
    component_name: builtins.str,
    component_version: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__532bc6d4c97dc5544813e23421e72aebee626abc836b49825751029b739c5c03(
    container_recipe_name: builtins.str,
    container_recipe_version: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5224ad76b26e919c07c0f7b87242f218f8df20d0de0c6c7d3a33b748b2c3f76c(
    distribution_configuration_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__93e0f86180d70da809891c18a52d305974332ff6159390c7fd73f17b8e2fca0b(
    image_name: builtins.str,
    image_version: builtins.str,
    image_build_version: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4d52910595d8443af2ccd101ae4d462156f35fbd49437b8fc9f3b645a62ddbb7(
    image_pipeline_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5717bcb2e225655b7d0c3c0733a454fcdb1dff1919207e406714c1368e7e8254(
    image_recipe_name: builtins.str,
    image_recipe_version: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2000fe2b62723e7e530b434a961f57e3fbe84081f4f0c2e9a1ad86cd404fde2c(
    image_name: builtins.str,
    image_version: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__13db9ba9a2912ef466a0d628663f29da1772856dba1be9473b8368c5e0c62b52(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__de4de5f476310c7da7374ca5db1529ababfb41b16c9c91d6b0b6b3cb6706b8ae(
    key_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__da6e00cadb5c3e11a9b5d294e0fd23a5e370698ed4534a3c54a27961a83a4c7a(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e0741a1740b19325d12cd7b5a7a0bbd6d5c052adc80b7702cd021de11887379d(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f22104a286a6393282f99386d3328872fc6e0b510c8cf972e0937ab5c728a644(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cb2a54c7a7b1f0c2b3423e724c3be34157adbdcdb6f952c26e36d4ada0eaa63a(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2a434151a3aac2783a1a5caf23af2a659102f8b0ff50bbc15f8354a8eee028f9(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__db6e3e829409ebc39cf46fa695c1cf3dd32ea014f824990db3c179f37567d733(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9b7956baafb77b4bd8622da928232feef253ba8ca57901b478778276ffba99c1(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__86f45568a11dd3dd6eb50faf86f857b1c9d461c2d7407d6d97678a1633f29670(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4dd6b8785c9804318282402cb11b2dfc02ccb30567fa9f4e3940db8b209bf022(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f96972d568de99bb73cc5b5d89c5eb1b51c11d65c282c0e3ff61f3fe7697a9c4(
    owner_id: builtins.str,
    filter_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2b7a6125ea2dd82386c277cb709738f4414c58fe4b3ab5467f3c70b530d3af47(
    finding_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__20f27ed31a43d178fece9a5968391aac01b79d095150b1ef307f13de2910b472(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bc7fba0d02c4aaeac1351c2c658acd34d998e6f7250f6a5fb3299492795a44e6(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__01dccad89e053ba7b505ff39c6791ab8e0d507e53c1ec875e7cd2acac9393575(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e1ba974037f83c21efe5a3dbce539a3d33db0819297e9c21a71cc0fe8a36f118(
    monitor_name: builtins.str,
    event_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e625ffb6049ba760bffd5ff106265c4520fab6bd50a93d526eed4944c2a8fae8(
    monitor_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9750e472c7a54e01370dd1eeae9331f20468baec653d59f340c50d9176f1e03f(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5b9e4204e9f69297a6ebab0c284edd9ae6190a986631f6fbfa195b318f27e99d(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f9c838b9888dfe6cb0127dedeb3df24c9daddc77509a194da4e5ed19da5c2278(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1873d7afba852e0124ee3aa3ee4de61be3cb22a8a4d26a4a283277628511ca2f(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2a7f03fc2218156ba4eea1dcc49d97b2477f26b7787bba53cece12cb2d3694eb(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2122102ef90ca4d571705da1ea226a949064bdabc54258aa290c7fa5a3467164(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8e4844ef26c87cd752d3eb2a9fa08ebd9c2969c0fdab707068f6afc7f2a8bdf6(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__392aef392bd6c18ea4ab0451e0a55d8605f3044b7f21f0ff2d8d4793372042c0(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4d3f7eee70e44c26013bf8c915efebf37ffbbc49e476a69aad647aa4f6f9015e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1e621173316a5190a75748d07d08ac2bcc286e073f33b77b54da41df6bdc0c89(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5967e7f8af5efde5b0b0ee8f4727f7612013879b62b5b0628faec6e0476ae643(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__86a844db6473f5b6d6bba28756fcf01f446ba7fe4472d64bec52a29cd184a97c(
    authorizer_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__84deb84e6206737369b08b8ac1552d35216bf18999c27b36d6ba8ad0092cae72(
    billing_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d48d58c2308077274f0149f1e0bd1ccf099362238a1471e7a9782693589a27e0(
    c_a_certificate: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__02f6148c08d0ce53d0445d047ec2cc1cd5b87e95f71a67d31964a1a3394ee561(
    certificate: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__257d2b418ae06e66584c623f652e410fdd83b9d8f7f31c389db921c29f182396(
    client_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6e1018c7d56bd9cf3403a822a11e9cbf5ef37ca1a2023e5f7fcde9cc2fe7b23c(
    metric_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__34daedaaae9f33325db0c23e5d568615a58cce7edcccd1030d7307042d65a435(
    destination_type: builtins.str,
    uuid: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4a1c7748c4059cddba856936300f379c6719f700a67d1e622ec02414a664f924(
    dimension_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5cb97829bdcdbc63427cba20ed27d5fecf63ec0c6fc8dc1ebe2701972709ede0(
    domain_configuration_name: builtins.str,
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__657765ada3765990f1e64351a63e26b93b124ce5c4ed69f4ae1504f42d83a589(
    thing_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dff0e89387c89e4e762776965fa772eecfae4aba329db43e6ce050b905a1efcc(
    fleet_metric_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5d350e861710a59d2e03ebb43258ed153e4a08a1f966244c5aa2c5a37b39f72d(
    index_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0b4d3ffdc3f987069491281a3a4bb32f4ca8384a93c78944117db6d61bca4934(
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9d832f06578db6b9d6c08fd4d229bf5bb8009e20e63f9f08e6bacd0e4595ab79(
    job_template_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__434c905f4f09a382762d23493cb72ab9ed370faa9ecc66739a56b369b409347f(
    mitigation_action_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6e7b9fb8a81e552cd46b40ce528f6f2e20e5b1a9d0551a3c809da20d8aa40713(
    ota_update_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ffa1b8a5e324c502f499987396dda47ff091f2073646d8a6b7cd4e8e2d8e89f8(
    policy_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f7ef57c3ca1eb3127b04b1747198b80284f982afb1d5090fe4f19e20ad518fc4(
    provisioning_template: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8814d2ac683fa372a32955d529d2a4a7ce47060673845dbdc02c66c4c74f39d8(
    role_alias: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__76a4e95ee51aa3ff7023f19fed263fbaaf0307c43c500646db66de4c43edf848(
    rule_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c9a11774ec1012ce7611205caa1dcca91cd500d81f3e42364941462b95a1e06d(
    schedule_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cd76de7544221cd8365251c886654bfabc99c734dda33968f5c42a50b3ce01aa(
    security_profile_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d0b0e2d37ffe2beca1e0ca81fb2010bcda26cd873eb4183f9ec8a51307e01706(
    stream_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d1c33d6751ae7a0603b8136cf2a14b6523cf2fb81989e44627053608cf9bb7cc(
    thing_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__25fc2c77264cb8a9c43077f36cacb8fdd2451b5affd0c7f6653a47b3e6d72352(
    thing_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ff976602d02e1316828645fb121b5c8b85d443c8a9b25e9ee5261290bb8d8a51(
    thing_type_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d605240958422ba698cfef512421adde52e1ce4774da5302c62cee57bcb8a98e(
    topic_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eea7f560a491c0ccfb1301999ffbcca2725f1085900713a83feb965082f343bf(
    topic_filter: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1b5980104522a2de54ad1f4a30a361377cd133acf1b7da309d7c146d6106f8a6(
    tunnel_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c5fb46c9d94e3580214938c09fd26d2b39f01f4615c6f59726dd4f881a19499c(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e38959f5cbf0dc0875d7313e633099bce9befbab63c46c311c2ee64d604ae38c(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__06e6ee38460f6aa936c6633c3c668b4cb9f23ff7e27691285cd7dd3f9542a424(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d29ae20bba6bf86b038dd01411bf7dcc49e3378616807441600ae708f42c50fa(
    device_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7288095097d13845f87565ce4c1e7f247e343d37719722e55cb18ba8e870de29(
    project_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3deb02c6c7d8631534fbb75dfe74a5f80e7acfe9e241cb50d4a42f37cbc41ab3(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__92762ec4ae05726d43b7cfcab36ca63152b5f4f697db496fde65c484dd12929c(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d8463d34efd89d5c21fe0439699b8b011b83bc28dce3d50e7e91bfffa4540b56(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__50dbd432f1f238054818b08dde4d93f14f354870e976ba42a546f8d67d1bbcaa(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0b0af0e4cd6fa9f88e14d2d9f838524b8826561080e0a95e84df31c10b3c346f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__712989b1ec64907a1ed84153c4c49f4384ea90b58255e98e1033f888a9bc7ba2(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0c9a9a0427a8384dd5495cacb787eb5938f58d0b48a79b55e0e458b9eac518fd(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__05fa8c8a43b5d1a00c14ee7d7fe16e4c7fb106e2f6b8f4330fac7852d189524d(
    channel_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8e94892622cdd1bdc72f5e9e749b337fa525c63ee8336a14c94347059604b9b0(
    dataset_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bbc2d2a1180014413667746e3c4c8a54274ce2281d41d2441121837ccb47a146(
    datastore_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ce89bb74c114c52d636da8a18b0e5cfa89388e27f28ffd4d9dc4654af5da6ddf(
    pipeline_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__77105708dcbe4882f49a8e83879cbaa924fabaec99ae535ff6bf963171b281b1(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__03aec8a293a3e77e5581e630b93651809d2fb58fd76412d7d1f52afeabf10f28(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a46f5aa2cfdde226c0a7baa77cd1a7b7a866a834415f1d3d476c4072fb5c5b1c(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f4f9413f40bbfdb83873af6cfdc5e0a60c9efba36cd5d34ca7a3b89700e620e1(
    suite_definition_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__015f490eaab3cea5e89b1127430a03f2f24157f503837decab685e082e11d242(
    suite_definition_id: builtins.str,
    suite_run_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9af2c8c50f523ee94154920a053299466ad7c9ab7f140f1dccd2113e2e0253c1(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__48784267dc610f6b49be2212a3bbc5ab4253e8831ea1b5285587d57053dd12c9(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9bf505b77f17fb35c5c6dd5af51fa0bd6761ffce9326f56407ff763c97298cf1(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b6a9ddcd3b9a8d2fff94cd17c7abc8b5ad0ede7ba74d77c9bd3cdbb3fa0c9160(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b616a6ec36aa5775c1aedca45822832cd60d1f2cb80b3a4224fb648a2e47786a(
    alarm_model_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7736fc1dbb54f2903f4ca4e5626e549bdc1ab7a28ad4238fbb6c907dbd58c67d(
    detector_model_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__98efc9468fd8cec07e94f4df0b3702b46513eba04591acf3b92fe8e1bc9bf299(
    input_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__363cfded436398c2f33fa48ae59054cb3abd05a49cfbaedd6429287b694aec33(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c729011f174f0ff1b85f07d75358f25bf7221cd3ab2a970ed3eb1565c209f117(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__65a16171a2636881876ee610d1cf89ddde519626de192ef436a6ae9b3d8edf42(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__66604ec28faaa873feb69738b724d0c2003a07e866ced928be9d5d8d8a75ce3f(
    application_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1029e68941f0f6bcd460367744684c589b2d796af4a4662909dc0691ede6e40e(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__accb1d5551723ba4b7015f41660a14fc2a4d728672d93ec61e0a0cac2ccdb741(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__29fba8e047a04bb1e07eb3670aa6c3f19719ceda440f2007a0691e4cdf1a9b1c(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__be9f16f6e7b92e54e25f366504594ac8d4f23d3ec0e6f6b1586c6126bf88ba20(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__521d5ff8bf9157da8fcabfcc0a319091178f26639b854971b01ee58cfa246f95(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e5853132e9d8e96dc8b6ec9bcbb8614422ce0729f6eae21cf204cd2abe2e5604(
    campaign_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a2dd6e999276d99c6f5f31331a44cfb42de7282e0b43852d71d5abc8ecbd2746(
    name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6f467b889d650d5e7cbeb12a3944f43aab7e8b272ab66c2a1e59ebd9efa9a7e2(
    fleet_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4856b1bf0076f6a829949929fe06b4b69478e4e350d253d3962563897c31ee69(
    name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__91e8624852279bd7a6590feb1dec781eaf6016c3cb46a2c95b644500c13b91e0(
    name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cd27bd0c6de93f817fb8d5633300774e4018d909c2a962f17e83b46ccf0c279d(
    vehicle_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__94762b4d3d13a6cbc2236c31efb483ce6bc03dd6b68b739c8174071ab0103684(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b7f94270f87454b529ed7ae37724a7e59a210657c53603e84d24d355b294eb2a(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2dc35758f1602f522a3709e2378c863d68eaf2f0dbf03b62e8034ced8b179cb6(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d163d9de9f8de26f95d727f34ec7dd311e5b1b25f039db9204aad37936482ee9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__83b9f018268a4db891893f8884702f7317f7efaee3438776a9ed4e080ec79224(
    thing_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fe510e5b17c7f8a1c9d2f1d77496c0a54bc8da8a61ae45480b94375076b4ef94(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dcbaeaed00c72a8c3dfc0b60df2c04b2ddc829e4b77532740e026da6b72a9c15(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__81b606b3435fbe07b10a4b634fa4e46844f9860089bdb7f3c9f176b7a08ab339(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__652a3778b2ffd183434028da7b770a862148ef7f14892ccda682bc42ccd195e5(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3070565b68e0dbb069438ac27a3e6144a0606f7f8e710e33885e7bb49ae0a5c9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6737f6bb1701de694b06de4170aa55bb23f7707962d419cede2e65ec3d9b85fe(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__258a5936afa6333e89e5d099ad62176f937a4fa18feabe823779ae872f8980a7(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c2b2bc72d5d3cab94c50aeee0aa1827da2d59796480b92b3c52d8fa4145cd026(
    site_id: builtins.str,
    destination_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__233565236e54374433029f0f068de95b5d5e675b76ee23a235a3d405cbaa2d67(
    site_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ed4155e0352fd6529c62fd15484d6811a0c4cadce4191a8d79412db8cc30fd68(
    site_id: builtins.str,
    worker_fleet_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8a233d890c295acce845fd85992945431c2a2f53efd938f199ad14085091df13(
    site_id: builtins.str,
    worker_fleet_id: builtins.str,
    worker_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b89670376b8c45efc860b760dfefa3298cede4046b4eb5951c9b56f019e9c788(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6c7242cd3179d34af9df35787214be4ff7a9bfe14410990618bd2d5b926e1f33(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__993fb89bb894b532085e86754567d60130b6c41fe69c536277c3e70c95c50317(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__42a6d71a1dce0ac0bc012afa19603d0f42ce2dfdf50344710841c2288b17d728(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__84420a4dff4849568af19d5f9f9f3a2320b4956093ab8bf85a243bd994dc7a59(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__015c2bda6fb0fe38e7d2afb4cbe5d57b3072a017cd72fdbb5c1410e6321c743d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7b57937ef40713bad17396cc401d84bf99552381b5ed10edcc93af0e54dadaaf(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0c56d0a7389b35fe1ebc78478e85fa5c35e36ac4aeaa28b1c8d6cbfd0147f2a1(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7f3d5e200c6246d3d3e30062d79a98dd985c71a4e4ab35c44c4a70f551588e71(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a4ee27f892e13d9c76cdfb422454a8c50edf15e30781717fa7306bbeaeb61fa9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__56eb6529b9a41fa4434e62a2a3eea255f0796ca6903f19c725be3bacb83d0de4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dfd3f840d3816deea521dd38d6c56cc1f97524fe2e6d98e97c8cca38573baa9c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__004ae16ebb2d46edbaad4b22160007c1a27c46b82d64391c66ffc0c24d1f5dbe(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7b0a2332bbce5e47d1fcfdffa616599a0898d2fd8813c2fc02a6ebe6338dc1f4(
    access_policy_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0dbe93d8e13be6609da6cbbb87775f618bd417ad7c70cee78487a8307995985a(
    asset_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__871de8db9220e5769d63270205368e29670b8744c46887fae13c54a526efa4a9(
    asset_model_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d4ecea914fe7c8f7864112cd175627481545ce880a457146f2b6f630b6aec8d7(
    dashboard_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8c9800d95ffdf0e50e2ec7bad63acc621dac11e83345e1f02656f2ad1a76dff2(
    gateway_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4ae872e23697895c031a4e2da5f29dcb016d6d343b5341a586242cdba159795f(
    portal_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a9d7a2334778481a079fa73f9f98edd641d96de41b8ea9d14cc5095d57c8ec00(
    project_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1339810419e39bb3153752e9b591b90c809e20aacac4d696a8397c7c913f9015(
    time_series_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6db063bd4a652590d661d95c67656f14a42561018f6098f53b9688f5775d5d79(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4f4d1ddcdc4795c86bf1e200380c791a3ae47ad029103e2606db8fb76722692f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__573b1f38448dcaedd8f4fb70e551d3b5d2ac4d4f99fb8e11aebbac03d7978a3b(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__abf42c4e9b53bda31dddbe9c08d9a65bd31a1ff8160881f8fcdc6c37eeb23b05(
    workspace_id: builtins.str,
    component_type_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3e9ad3480ceca1f780c070f0a87ced2d3d7b50fb86e6fad758d2f02a09d35428(
    workspace_id: builtins.str,
    entity_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3bb25125e7a5d78be3240559a87de1a0faf931b9549d2ddc1ff4933314bb433f(
    workspace_id: builtins.str,
    scene_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fb9f626e9993c955154a7e4487a6fb0696c9b2dd0947aeea8840991218e82888(
    workspace_id: builtins.str,
    sync_job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b32250f8c66c50f6e1b6f2b3f852e4eda006275c9df3b0fd64f14bf879a82678(
    workspace_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__643b6aa80969081898e796e358eeaf493d72f581a3f077d605fc9413b79e7afd(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d979276e0d9e2ffdd9977d5f0b9fa42f2501473338a1317213cb423f7c281ef7(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ab26e8b51148bcca7ddc159d3b70ef0a0f2cfe706d250e62b3d9a65d4d6ba15b(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8798058425bd9eeae617bda8d79d091b8dd2da4b7eaddeea99800596eee67a25(
    certificate: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f8c0b96c8e997f9ebfab93067e5ea13bfc0d1bc2f84bf374669943042bdb9645(
    destination_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ce324c43f1a3074ac5ffe8442549147fa310a5a024a0d4f5c0bfc796d3b6f402(
    device_profile_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0792f5ca86032451e0c2a877142f87fe1afed99d3d5482f68cf25c32b32efd0f(
    fuota_task_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d854d11c5b5781e98e50187e573397aa3f5f85378ce00e04d3ce371ceed07f35(
    multicast_group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9ce59027807a501fb8c7f2a0590b81c18969345877cd41c0860ec274f44ffe34(
    network_analyzer_configuration_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9410d8705b8440f945e2e559613b50498c20ef25a736c9915c5bbeaaf823fb50(
    service_profile_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__32e8f2d7a6a8c526d11d19f0e5b108b9c741aa36e33652384b72b3849a8849d9(
    sidewalk_account_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0d5b164f3d42b7784860e19fa3c0f875e07533a1a5829ba4a06c5fae048986f7(
    thing_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4f69afc71a15227ad0739176c1f824752fcab5cdee77e0289ffe3f13aa15baae(
    wireless_device_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a3a5245f00cf7396d738653f58f595efc3b989ee06429f486651ce1aff1c9af1(
    wireless_device_import_task_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__199866683c883939efdf9d5bcaeb314098cc2505be977e6051d42cbac2412a32(
    wireless_gateway_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__116ecb5ef212457202869269ba976a05121a00cae3e772aaca4cd45d5740ee0d(
    wireless_gateway_task_definition_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7b6897fb6f4d019270a9bce510edb03e1bfeafb16add72ff1176478de8938736(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9b8381f3552c41dbc76819583bd663e3e23cc736350b15bb9bda5894fe76ab5e(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ffb7df82dfa02ed9a7706298388dc9d3bb07a71e83b2a7dcecfacc10681bb9be(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9bade36b7d2a41c054c853634c53440483a036b56af5f5508708f00bdbb262e4(
    attachment_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4f5ebf86de912c9705247bd16acba7cedfc943b8a08975ecc1e59385e3b5d437(
    buyer_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__de3d85865d677a03c92bcdb48deabd6ea07d918eddae32ee056ad60407c05029(
    call_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cfe87d523761f06ab9afb8a3f352417de3e18c50bfc84e78b9f00ec7d28390d0(
    company_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d9561b276cade054cf8262d672e010dedac1ade8138752df69edf208e9a0a362(
    conversation_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3833dda714ff87359f6ba861557317ea4438681c4d11c3734bd586cb5ceea0f3(
    expert_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__160412a42ae6812db3cbdd5eff99e4ae5108a69db35e6bc80b148b35dcb54b62(
    listing_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__638c6313b99fc7a0ca8eecc5608a39732442d59ffc226ea72cd0597699b19037(
    conversation_id: builtins.str,
    proposal_id: builtins.str,
    payment_request_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__026f3af517f347cdb2e7220f514b7055508236d125bb3c13f405f4f0ebfeb987(
    conversation_id: builtins.str,
    proposal_id: builtins.str,
    version_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__926fb786986fb1439b150e99b8581f921eee9dbffd928f3f09497c8e6451c61a(
    conversation_id: builtins.str,
    proposal_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__68dc2feedc238958c884fb48ea7f47b073982e387071ae66bc5770cd835d7328(
    request_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3b26e109108e40147760bc8ed381ace0b2de99f6905958768b34bf586faeda31(
    seller_aws_account_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e8fa29f04afbcc6486ace9795205d6c260d3712880a0c5145e5c05d0199907e1(
    token_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f20df699191055517186ca7c51da5434500665a3e6a4b30006eb7fb075a6e467(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__157dca5e6404bd10950b9f9e14c7b5f6ff7a63ccd34494d565fcfce56de3756f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a962936f9a7fbaef60bb67fe60b605e78a955c211eb1c599032ca6793f5e82fd(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d1c2f5b5fa32b9c028b76532ab9967989457d9c26e87177e576aab2e273a5eb8(
    permission_request_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0b4bff070707ca4a3334f02f2a1b23809b45d7edc36b4d195f11e6fa2b64dffd(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8f88ef694448d7768c7dd940afa6d2bb26440f4752038e30eb1e8005ff2797db(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__88b95d54890a3a231f46fb969988c7b90ef38b181cb1af5922fd35915c75cd2e(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f6a9b684c69afea8b1c710a3ea3cae9fc5fb165298f74abc932de4a7f465f585(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7746971ea2c468002103369817ad75cc52e4a0c926dc19172bccdc2389734b9e(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dc431d6882ee488187d83e8a02a31a73898bd608013e11a6661adbe794c5e6f8(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ea77f410a012cbb44c65d239be8bb8eade9fc59eff4bae3c1b94c9e6004a2fc5(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f52bd275ac090e8137b189d49f3d3e7f409cb0791fa62c1c4c672c81e2281415(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__52799dffe0ddf59f2c4102d792eddb90f966ecd1b429bbefb159768bc96c5c47(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__19199d235ab9976a510749908c51653ac3a7b12de1be2d096a256b9c42487073(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9fcbc5eddfcf1267dc1da680cf7e33ed7198d42dc8421e0d217672030a8f1795(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__368b2ec3f4e1d23ab7335527048c231d9ebfb1e5b89753ac89b1ac4777a1b761(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c5443d79675d1d1029bf174a9ea9471e132b8019af4db474f250e8b193c99624(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__254e98140c320812f2222268315b70fff9769b3520bdcb7c65e4e3d80031decd(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d26e0cc700ced16f620bb23451ad16048ffdc2a6b3d326ccf30460e6cb8892ab(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c526b41fa7f87b339eac08f7e988f255123529f999ab70cbb4df36aab39def8a(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5ee1396315d4b304343daea16baa35a977ed7db971854c041b8ff8c0b920e346(
    cluster_name: builtins.str,
    uuid: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__aa4f341729822cd4afae81013b479f23325c05101173b8758bb7dc1851a099e5(
    configuration_name: builtins.str,
    uuid: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ee7081e1e7b4bb0ea59308d1976b819b3fb7d13827c843ea3b4bf215c40e284d(
    cluster_name: builtins.str,
    cluster_uuid: builtins.str,
    group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f2c9a724ec96c8238e8e7c83e1f0bad32259a8de37a844bcdefe880316e66c4c(
    cluster_name: builtins.str,
    cluster_uuid: builtins.str,
    topic_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5a35a68b19046134e18e4d3072099abc5527dd95b8a5ddd13f635f429ce4a414(
    cluster_name: builtins.str,
    cluster_uuid: builtins.str,
    transactional_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__994eada0a75a8f4cd7404c872c9089a9f41a23c10a9a404ba2367bb5271f0a27(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5ae670dd4394886c4d1e50ad1d3537e0e850830d993c5a3de5883bdc0a2790d0(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__90995ba22e79775b0ca6627ebe3ec692bceed8f8561594c45eff985f48bf1401(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c9ae8212f08793c90147a1f21b88319f8e5d631ad4c66ce65bd23cf95c5c55f0(
    cluster_name: builtins.str,
    cluster_uuid: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f3779472a25bc8ce0620a1ea79a4a3fbd84c90dd8f839fdeb352cc58f18cfbc5(
    cluster_name: builtins.str,
    cluster_uuid: builtins.str,
    group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__546c8c14739d40ab72be9f25be866822bbf0f2b3c0397e25b5313e619dfa4446(
    cluster_name: builtins.str,
    cluster_uuid: builtins.str,
    topic_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cf2d8cec3c9a626e0f13271c4678ae76324fecb0501d5bcd2018bae279de07d0(
    cluster_name: builtins.str,
    cluster_uuid: builtins.str,
    transactional_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bf43cc9831d1d554d07d2098be21e65cf0f8628d05db209df486b144e60d662c(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1a6159382bfa8da4b8a5ac8d4570a3e2555394fddcd5298bb364d9998ba4bd84(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1b7e3155a82f6596490b8a8574f000d69bf8ed5a4f95d9082ff72e202042e5d0(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__79e0fadff41ae5e67c8967174515275d36cb16ee17c93316d489e21882d05407(
    connector_name: builtins.str,
    u_uid: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__912ebdf48aeb21ddd26ed2d838592ac2764192aee7aff80c1654a19dc84c3292(
    custom_plugin_name: builtins.str,
    u_uid: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7adf2786ddfb200c0ae434b70f963c963a53074b89cf71ee8bd4737acae33aac(
    worker_configuration_name: builtins.str,
    u_uid: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__45a339984eb1a0ae3196e8f8cc965d4360b86f42ab764c8ead10b4a15f26303b(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d2f5d22194420af613879c42a09ca68d7836e76616c0742eb0d7ea0e26d3fb8f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f4046cc86ec19ccce03f0f4a70a8bb7cf9f1e55d7cf71bb1de28463f4640b2e2(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__11a3b1cdbf9ed0e9ee6beb9e417b59ddb437f70b1a04351f443628bbdcff2c65(
    index_id: builtins.str,
    data_source_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d4db1189012c2cac7102cdafe71eb535f1a9ac8b32afce31ff546fd964003143(
    index_id: builtins.str,
    experience_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__690c543f96fb2f10850ac74530b1b6d5e71793d3950a51993553c9bf8a9eeb53(
    index_id: builtins.str,
    faq_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__55ae82531fddfcaebb52f1ce0f3b5b5154fa299f71899fe10cf1632ab5e9bec0(
    index_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ea75020c63efa89d06ad3bfd3ab71695b02e4eb56b66bc389c07b275ade03bd1(
    index_id: builtins.str,
    query_suggestions_block_list_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1c0c813329772255d723b1d891bfcb51baa61d66952dc3297559f383d4f347cf(
    index_id: builtins.str,
    thesaurus_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__656c1565a0537933d58ea63ba6b6b050b1d139c1a45ac2e6b27cc5bda7b6b6ea(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a0b709fdd635cd30fe034171c699cb612ec815e16e3b173f05119f35fb008547(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c113bd26ae8fac69b137c4f4601aaea8cd919ce751a76bbf17690e60f92f0106(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__09b15f53b1addf7bcd0367c4de446c149068b014daa125f7a13d74f3bc9ed251(
    rescore_execution_plan_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__62ea323e0eaef7b5f983bc5a79c3ebda2241a9ccb094b0c9a1d9464355cd7385(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6322cd4a58d6ab5892532bfdd8c1587c4919624c717d830efca18348866bd8c6(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__39fa3ddbae0c20cadda3177606cadd1e76f451431fabd547a188185259b9788b(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8dd79fe7cb651ef016eeb367c9b97942769ab737b46c204d2aaee6c4f0decd07(
    stream_type: builtins.str,
    stream_name: builtins.str,
    consumer_name: builtins.str,
    consumer_creation_timpstamp: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7ac2aa91434fdde6e9461992b77d4f7de4f2052eb30aba07300c0578552f9097(
    key_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__37ade26ebf0c35e735f3abbeec71ffe9fd87ce2c3c39cb587beb656d2c19fb7f(
    stream_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__419ad40f1445cdb7fa8fd25feb913ced8204cc0a7dcd022061da844049fff76c(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4fe7877f2ca649ceaa3ff5c86c86a31d9fde2d72e52b815f50534b1ca1c5d4ed(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cc2f78e650845b90fd90b3bb2ef703e973d4ece2d4d5083f6b2a84a7e707351f(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__beff5f9c69af64acec934e2a9f3dd12060c963a45c9a593843ef815670c70e96(
    application_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e5d0c2cbb8608069093d2f7e1f877871c33140ebc91368ba55bf0a23f714eddb(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3cad319d11fde60389919edd1adf19fc8397f8d9ef6399fc40f6fdd6e955e09c(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__76cd4824dab550ea1c13193610d632f1dc7405464f4481b25c676fa5c0a67dda(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6554e8ad6273152956dbde0684d1b72a8ccf6fc91e2e2d695923dc10ba46ad78(
    application_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__01c8105ebce963f3e95139d7ed8b91bc226ee9de7e3959b1639364c5131580cf(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0ae1b2b7d0cbccd7fc31bb670468d6658bdbe6c8880789c1c524346ee405fb52(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__77ebc077da1d0f6d52235dca9e23d122df115d68f2800426964aa55cf7153bb1(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c8f67ea670058e5aed89fd22aa7c3471f3759233287101b8405bbedcb7ef7971(
    channel_name: builtins.str,
    creation_time: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1a251601935a455bbd75e815a10ac94df7f69b262de11b8c83803e688f955745(
    stream_name: builtins.str,
    creation_time: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__38bf2cb6a9f40c5a85495fe35f813f9a4d015bbdc23bdd7a4823376537e53c28(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__698a424236128afc815c96de20288c42c3ea0ea881d7229d37591b000a37d0d0(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c1aa6ee570236293987b3df70da700d247debd3521291b6b34d08cd289037fd9(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1590d1f22d639def4172f4aa5002cc5c9804caa36d2d772fd740cb976ed04cee(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__13d80b5be3b4ba9f6da56fd68c308641baa082f88709793b9ce92afd11f7fce1(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4a42ea0c2cf8d77300dff74b0d3b6896d118a5e92b1e998d8f07ad3def7ca5ac(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a7759bc4ec89bb74f15d0dfe61b86a067b55f80458a5c2d63fdf601ce8adf651(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ab9d499f1c70537ec14b851054fba90fff57368eafcf823584f23482d4a43dfa(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__90e01794d7db8a7259884106bfaa83dc2c85f4e1d9ae5cb426a06b7fa714a9dd(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cbfeb085da1663e18153ede3ba3e697183550d57d9ebbc80b7fd7a3dcbd62470(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__72fe404b4e061b8d4806c7c3ec0db804e3f029f9f520dfecd93ed3c36e2dbc77(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__188514595dffdb5a885038b71f3ac56c1e47715a53d4d040ea47ec4991f0e758(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1ac22341b9a74ef7d911be4056dff43f05ca3192d13973c956fc35ad916af609(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3af162ef07b3656cfe5c395afd1409c3c1c502c4387f3f84b74db0532b5f1138(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__81a299c2957698b3316591e334769b82a6727877311c118407c41634f3094dd3(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__53428520346ccc25526028499a54027b4392a1d6ab94eeb29961f08e4d794267(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__23481cb561db8feb27d68baed4fb6bd3c047458955458adbf871c0d3feed0729(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4d01600747d8ef4fcf659cb54fbaea98136a2b2ac787261632e52cadc0fba6b8(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__65ea8040fdc11010ccfdf86a4613b1af747ce28f0db6a1ec00354bc5a54c7428(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__89fc9308984fe8444312c565012f9de2c25edc683d231d73485c60513d1a21bb(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eafdc89b3b621fe5fd177af8746e492da48f6b26fe4dab878d4198172372c2ec(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2c9060963aabdcc838bd69e80973b44ab69dd492f3e515092d1a3c48ce514d72(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f7e048d945666f6df238d86c5a306fadd4a379a3b72280322eafa02b72e2b444(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cc1cc0e1cde9c50861b9f90d037dbed62c60955d76423ea9b1f2db49907aa36e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e97bd2e0a93451f42957a2826bceb73c8e74679b1c5910e818a3f5505931ef90(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d2f05eacec66812e162b2549b9c51713517c9611107f598961d4aba14f09ed5a(
    value: typing.Optional[builtins.bool] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5e528aca2e734b66903907c524a1c0319edffb497680327373d8b57237832945(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8fd3786b9f5e723b214b62fe81b72f4a92160febb8bc4632e7af2df956b894d8(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__232f076fedf6eae69db40b5ce839120ffb46fa615c91ddb4bf1657d2c3f006ef(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__451427fdaeb0c883a8f10a9c0e77b9d39df966705933e017d4200657ba1441e9(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d089853f0ff5667dbe92b7dfbae2d1ab12a255f41a1f58ff6ad49554270b0ea4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a3a94e97cd0737afc82d0841b9f97bb066e6f8884bdc95d296a9d8eddf431a5c(
    value: typing.Union[builtins.str, datetime.datetime, typing.Sequence[typing.Union[builtins.str, datetime.datetime]]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b26ccd7854eab592e53b87bf0041a4abc55040e52b91bd5df5b7e9fd9c838330(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ef32b42d980940a327622227809732776a920b0562aa473622a8890b3805531b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fe3b22563e6e87e75e81135849609d051be743c2ec7e2f1d6c308a8e072c2f8a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8b56304c17bcfde39f402c9064895ed82b57a0d4affbe554bdcfdcea6659950f(
    alias: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__01b05735a35703074cde36ff31c4b0dd1edf34e939c5a56a759df1bfce352b36(
    key_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1e78f31259dbdf3c66c6aaa6221bd771de50f1b3307b539379f08c3a1e95c03a(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1ee93d10031e7e027a08df28f0cccafdfc35db80edf9c9c6d730b8295c6724d5(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6d6d68f1351c9cb81ca00bc77850cc83f4a8ceeafd68f91d6ab1dca819f41e48(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5d34e11e007cae31c209e047db4cb804b72bc16c51de9cebf57b3cc9cebc4747(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eaffb39b570f3f8778572c195e511a8822c0105d57d899e7cbfd0f878a137c7c(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cb8afeb7b0a5db6fc9e8e3e72db1c4924ba2b157cce3761dad675bbe4ed82438(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8194de58ae245295d937f1ca995e08be81e63d5d0da1d52a1a991134f0add6b2(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b5ee4fc0e400ff202e7c1fa4e6912036f3a692ceff6d4715b40b15bb00ffb13a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__77205dbf3554031030107e531d32e2edaeca6e6b25cb9e0eda8f1defaa978c0d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__db29a22d9fc884b290202a660610afbb1781a56b399286f894da4903dfa91b36(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cd49afc3212fc27c7e1d945817700f8b9635afc7e24d4402805ff5770642dbb4(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__590fdd867bba7b41db4f72031e56b029350b812fd83c1a05760b4826b588a697(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__62a695fffbf5ca8a5f4bac2a07562a7721143be337f654d70c46a245fada4c4a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__350817b42e809539cc612349e143264494d3570e6ebef016ce11f28f179fbc66(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__14e6208b702c339878d5360f8feb19cd9abc129672891fa142c4b1c611e58d31(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3f211ba50062bcc4945e1eb1de99813dce3bcaf5c6abbb5777e8b57a3972d4a4(
    code_signing_config_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__484c29b0ed6e71cefea1b08a7948718ed375c22e37ffe9a41775a2beefdaeed7(
    u_uid: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__76e71f9437e7eb794602a5230915829cf8841d7b125cc6b025e66bc883b949b0(
    function_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__844f964cb9c14511f08643e10d8dbc86afa1b1fd2228431a35fe14efb7829adb(
    function_name: builtins.str,
    alias: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5b51a4889eb1efe743aad6d7dd4c3c83e8a5924da8f7d9ffcae5ce64fd71211f(
    function_name: builtins.str,
    version: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8b9b5450e273fc7fc5af53d2d962ff79632be7b035346ead44a391949818cd50(
    layer_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bf6a03fc6f6863befa52088394424893117caa9582e1bf56355846b54cae93be(
    layer_name: builtins.str,
    layer_version: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b2e4c94194bc1e6b782f2ad5d28456bc6fed235c02e1ef4d7f7802e0d1d04403(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4ddbc6b6b15c50ff3597cfcd139cf5589f3e7127b5b13aac7efc647f5408e6fe(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a7e269380314e832d1165ee72726722d4bc18b9bc3ac913b34875a95ed7ccf71(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__48e2528e6bc098685882a6335f107a63c7c3f9c494371309ae55c8593a8682ea(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c6cd291844759229b54fd99d39928188210df0af78ef1db9d103075506b4d76d(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0ab7882a8e0f2f6113b8921a2753dd1447d71e3c566c771d3dacd0b89de5f65b(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__050c4bd7651416c62b42b80eac8e62b88e823730c4a234d7374a0265056711fe(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6729fee4c110f533a049cff4fd099d22370c4590588b2a7bbffa2c46cfc52176(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ff4e5a014979fe4ae7a76e4f1adbdb5d038e988e138b02cd13256b0f236b0349(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ae7a6a566e41da3da16d9bf89c2330b9d347705d533c0a6edd2738baf099c904(
    bot_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3a58698e67d35ab4fbddc80e9aceda4a996db7c34d3134213bccb3f9e30b1e5b(
    bot_name: builtins.str,
    bot_alias: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__88961695e77727bdd47bb9d6b4b46c14f2c26b5ea188c8d680c04b71fe4d955f(
    bot_name: builtins.str,
    bot_version: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e596475e0058e6aebccae49305c8335c845df26ece76a9933ae9bc6cf4bbe64a(
    bot_name: builtins.str,
    bot_alias: builtins.str,
    channel_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ac60c38a422caf82785eaa705ad1db020bc8699a564f409e1caf72d321597736(
    intent_name: builtins.str,
    intent_version: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e38ad56f824fc07e33e02699b0522d1649d1997a19c2b2ba96168e6a192cb96b(
    slot_name: builtins.str,
    slot_version: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8d1a146f50c61fea8c969498c1355c9e4b7b1a159651cb663f99c2253367404e(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__161b30a572e976475decd87c34ee2903661ca3a9f77fc6f605da3848125c5042(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1ff1fb41f9c226b1e90eb3b74b6f01b25d4d58b38af2268ae2c423283b207d63(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5b1062b2066b035849a480047b1e1b39865ffc343294599879910fc458493e59(
    bot_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c5707833b9c341784cbd7ee927f5486495559d0009c8b98254c9a4b7828cc3e9(
    bot_id: builtins.str,
    bot_alias_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2da92dc890a67744f80c177dd96708ec40566143612f4b2787e787c186d28773(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d6b46e05cb0b430b0d8cdf4e62655103044ab1e049d64422df09a860b523a283(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__94a7882c896e8092d85014715c4d205e92c3638c12e55ce0c87f9c5847068ce1(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f8801250f593a7c004f522bab78e709819ce6a2ffdf593999dbb947a3d1f7f83(
    tag_key: builtins.str,
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fbdcef8137dc67f0667d2ccede59a23b6ab8a62e42fb5f58c3403fbbecaad0d4(
    grant_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__34f669b697c0da4ca07a0e9c37ebf50b592461b9bf11466cea69801efc2274d1(
    license_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__91e4755e9685ab0a95eaac3e55438750a7aaaf11736c15a42fc60bc83a0c8a39(
    license_configuration_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f6b2e9d4e2519883ab2c927541790df77e851e4b0185a2fdcba9f21ebbbd5fcb(
    report_generator_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__604f64204ff65e354902be9cc2fad2ae01956a8f3d2f3366a030dbda3b8bff44(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__730769f7a22883f6d3d5613c29031eda8dff390282ddc363715d1ab077cbb7c1(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7284839c44c0d1a767726600624001905eace43c16d4a7181f5dfd436170871e(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__df634e1333011dc0f6f712cccda7ca1127c99acd52d1eebb8868acece6966704(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__738df27dc00f8bcba35baf0bebe9775f9d47c0d3ffb65e0f0cdf7c2b501f6f4b(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0d5656a8f693d63459cf050e418e8345f6423ee600124a211897976ff80fd896(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0d4597447716293216ef9fabefe3db9ea7878c8221a8fddd6ceee7ac7ed7eeda(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__18085013861282184c7345dd967e3781eab62059f4dd705d80b77622c4c8af6b(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__20186be1a0d46bc6b22cd1bd27f73885d4981f82e3cf3fd1124e414cde135bfb(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__49ea9cfa554d2eba94c82cedef04ff986b31eae6d357ddbf6700853e7dc71fb5(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6cf5ec7c0e98cbc1172c7ff6fd875b4d716d469a0ac7012050329250afb0a220(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__18cc76b0132cb4fd4754ac07c567fb354cc2a3f146778adb6bb86be51d968116(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__aefac45244b0e1a18322cbbef52c16724b8fa77534c6cff503ae3227e3c9cf39(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2aa254f28a419d5dd963c6cc4ca6086a96282b17289136f63f2845d09211cbe0(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__919850f0e9b06c72fa11806dd1fa3f1e225b99b114a92d9da3b29c93cb41b641(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__eeb31ce52f79fd243ee589dca41100d8a960be651b5633c852de6517fbf65157(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__39e2b75a42a1ce003f3aa0e671f571a040bebe8df4efca2f62b5b1eeb38546d1(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f1865ebdec10b2f778a4666a5cc56943065b6cb97f63120b3dffa36cf36c6b1b(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9a13ea42a35a226478e6e5bafca7c4b85f56f9c646baa3056f3a231d3e4257d8(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__70d81e1ef21a33340f27b13ba6d2b765ea906230b34946275621073e0b0bece6(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6feb07a5fb3353011b02dca212e55abe6ff6ecdcee9404a353acf60d06b3db4b(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3bbad275577588285b1fb0b9d1378e085472d70bc7167ff20882ed277e317179(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5fcb9b1d753ad0c5cbb068d938930f01f36af9030d6f8bc0e8d05f2d58053255(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f19670f3fb7f6bb808253bda8a695a552cac73d7eb7855138b3d3bf3b2dd0cb8(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__60c892f0b9ea18e4b8138b6cedd920c8d1b907acf269303c5289c712617251c2(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9672cb40bb6bca2abe4a2e87ea4f35411b2ed678714a7d6658be8da142606f5a(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3203196d3ceba255bcf876cd4c54cf49c4e088b5fddc40c9eddb861fca535a08(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7c80bf244f1e7f045c49c91a57d9a36c580174e394f3b3e9a1efe1d7007352d3(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d5e07b01fbb26c234e922e2bd4e3602c20abfab09b82b997ccd5d4557b03b52d(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6eb5f79129bd8ff25b7f4a09381c37b6fc278098ba62108e3de699cc42828700(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__44ca5927d61b841c74ccfd88733d26628a712c03d1806ae02bfab724142bef3b(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__234bf7d280485209f53be8da45b042bf1bb993f2be86b4880f50272a7757defa(
    destination_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2260dd3c2b82e8ce438e29fb809c165ff0ef74f2be8c2b063eeb2a3b0aadc140(
    log_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6fcb55fa4f5e803b2d0c6e51f243e4097bedbd6cbe1fcec5f29a0ed2ce8a2ed8(
    log_group_name: builtins.str,
    log_stream_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__30f31efd3151a2119a9c83d7075bc6ef1c34112b1a34fa67f8b7800799ebd7e8(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c4fba9c64f1de77e0612fa242234f95b8aca082403ae292b803cf7d98e68d50e(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9575415cf751f365080379f2a83d5cea4933f54496e4ccb617f4a4fdb7d04663(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c5a312a37f4966c9acc2828d36305d43cd34de0a17d65eadf6c5eeda41e41505(
    dataset_name: builtins.str,
    dataset_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d39677c488e15812ed37177de4b3f0971e42654b31902626d3bc11b40b835dba(
    inference_scheduler_name: builtins.str,
    inference_scheduler_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a7b62b776f4b80909f66806d5a9b04545d86de99026106fb709fe5d27bbc70e2(
    label_group_name: builtins.str,
    label_group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a0a34cd34302957ab71f1ec5a5b981df740bff826346d05f6196e5b21c31f240(
    model_name: builtins.str,
    model_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__48ae0764c6908a4e937583822498f37e2cab60aac0b74098d3255c8478636578(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5e46803297fac2b6e8e59ab877ce8578f3118eecb1e02a2546088284f52624f4(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__874571572f3e837cd4cec067649cb96c7100bf9dd37228a2bbec51479fa35824(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__351b8b5228250e57da83169ae2d4c03ed7846695534d2217d2dfaf5d55085b4d(
    alert_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6865b614510994d970050d4023dcd4ab4fb43ebda093c08fc7d67012b1046837(
    anomaly_detector_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4fb01247959da2e1b503594b2a653b2b1bad302704fd2ad43ec70eb37dda732a(
    anomaly_detector_name: builtins.str,
    metric_set_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2405798fef94234240b5ff012a26495f08babe39fd863bfe9cbd7f8a19215f29(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ee72b822a7207713b1fd1b7e6f9190852d8c337d4430f9257e5904a56f8b42dc(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4da5d1952b93d56e771645cfbbf55c563aa2a829e52dd5bc5efb71f0def9be6f(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9c3a10d554e91b855109e49d12f847cbe3dcaa0861b8c6b53e44a2ee48be400e(
    project_name: builtins.str,
    model_version: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b703e7f00963df656dff82c4e6d39371b6cf23520838aae0484ce37d3450cbc9(
    project_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cd47cdc3b9f52b3eab3aac6d506dc47e1d68c4c46c2e143f7960a330d476e130(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__674dbf490100bb21274b6b4bddf18c3167a1efdc4d2f9cbd919ca862f4a103da(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e46072ba9a31456ca604a4153cea5a28f07bb67acbf2080f1217d43f513efb95(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4c3a7d3ec2fc1f1e69b477c828a6769dc6d104393183f8d2b3d3344dcbd2b6af(
    application_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bfb09b0c683cb9a09b7b22fccf2bacf454b384fb59f94d17fef2fcb26e92a83f(
    environment_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__595bdb1ef984f2640cc5bd7bb30bf04fa15acf33547c4e8624945a4311694a4e(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__46e32e43dfac0bd9613cbc892ccd221bfab4dffe3332685f9bf6530c23a83e1d(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8523580e111b78da831b5d89a9a3630ce1f83f35088fb952f83ed2033086a240(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__540514a6089f07d4f7490450ba469ec5d813e39d107d284392fecc44cc435d9e(
    batch_prediction_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__de40daed64983fb5bfc00ac3edd08d50d0b42734c8750cffaa2b3c7e4c1a4255(
    datasource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dfa9e2f068fe3fbde1a0e857172e492f1e29ce76bf60b803365104ffce235c97(
    evaluation_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6fe159afc10ef19eeb6c5094fb030f2f915d4b8bda1fb2f639e8e1e74a72afdf(
    ml_model_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a20d8eea30c8a59f4defbbb0b6cb01ccec9f7122ca7343462b70601cc65355f8(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fb021ac19b8f4469e781483d7dc80ed3c9ec3300e85dddab09fb09c189957569(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7d85c85d0b05b2c0e9c8cc7b034513e6879a0ac576014059b6fbe760e2a9e2cf(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0f8d54593c2a18bb3058a4986ba8c1fdc61fc22ee21946420c28e02cea9abc4c(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4d8d3004a85048c4a6cd423ccbdbbdc7bbfb75d21f616ea4a974c45b7df2a150(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d0089b5b857bd616e4da0bafb67cc712794243ae03a2e2dd8538f5f74b91c6da(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7026540c6fa7ab6af3c7c6a24b08a0a323a653f0b1e6eab99e5cc67bdee3eb4c(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d38044f1d9ff558cbbce8f3bfd6f14f9f67bd46af94df82c5fea0b58028496b5(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__020d88f772c512a2132dcccc74a181063eb56b70cd403eca61dae6788a472c6f(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cb624db236a1e50f90c8f1fada977a3c9344eca5b416f3d2ef7faf501c81e80a(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8635627d2f51d0088bcfd2f394b4afebe2756a264cea4f76fb125673059e9d71(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d7be59c9211d788142b507dca6fa480b687f354f9769c3705b1a9359c103f72a(
    accessor_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__30f4c211a5a5a96bd9504566c4c7302fcf0e7e53bce0513c63467967c4e35990(
    invitation_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d8d3282ce8bc36b8e94a6523976f531749f1930c50db836a6c0718c78ef268b2(
    member_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__226aace4eb179384d759941cee29f9ecaa616d63d7081c89734b6a7e0a803882(
    network_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__afe8f7bf7926bbbba4d6c10086aaac6e55dc8a34bba7c1a7e1b4d49766ad10ee(
    node_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9832d53798bffa93e81673b409ce8ccb8c75a91d7ade9191f59e567f6f787fb6(
    proposal_id: builtins.str,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__188e29cd1e3a78424f5e0dc77843405003b867209be476eec343a505f32f0bf4(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fd9d8a2ff88bd71cb985aec822b26635f8eda65636edd4e85ba66ccde07ef73e(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c81b28f6b7c59c3ba213d34fe632063cb873e6c996084656c08ed8580712205f(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5d58abc32342f16471e8e4239ed5c1ecfc6e67adec17d20dd907e97cd08158e8(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2f8887ea2722d90d9ea975fc4cdd9457242608338cb60c0e6001859dd899a441(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3a26341c5fd04b1be92c59c7461f23fe3ad308ed615d3b9b9841795393b4f139(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a87fd26ee770b29b7cdfebdd63cf3d0f5007e5f4e7cb3c1deca32e3852a51bd2(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c0cba8153034884f8ec8f98a4b8c61d1b0ac9e06dc98f4d6a6d468d9a702030e(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__56650be382a3a69ae2b709697a4f6e448b5f3e0c8021ff45cf63f2dd159135f6(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__834925e7145e16ef7b538583a3e908be25f4bb1fb1ec16dc92937f492b12fab1(
    flow_id: builtins.str,
    entitlement_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bd30a51e2bf200238f5313994814455dd0f82900b0284ae4b8a6376a265855c7(
    flow_id: builtins.str,
    flow_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5829e77e346996b8685a58a05f8b77c43b560315a83497e55a89210bc76bb779(
    output_id: builtins.str,
    output_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4056fc2b152b883c2cd14505251fabbb009104b5483f09076458801ed315d9a2(
    source_id: builtins.str,
    source_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c3aee1e9524f40b04438af5689e94d4fb8b1502d8d5f1cc0b70e62ec3007910d(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ca3824764ca5ee8f473810962a9bd73bbb0c421a32a69851c575fc8f16ef513a(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5540ef5907815fa49d046d3afd4bdad567304e491e37ad557e33c9c1c43b6ab7(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d2ada7be15ba1dea262ff99c6d9d47e292ab3161e2ac3872ad18429798d8c32f(
    certificate_arn: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f8c0793b556d1b659d624cbdfbef0973fd7e31d6102d20d450dbccf297d1ed83(
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1ce6b32c9b2730ba7c14e8bc31dd98e142869f0355563778f1930d37ce9ff2c5(
    job_template_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__376cf9119c9118dac30dae8160d8e5168822d572a3738aaf237abd7dd38dbd48(
    preset_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7946c525eb41440356013e6bdd0fabd73bb661f83b837e84fb5ef36173fd6b8a(
    queue_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2e03a708cf8e89e464abc9f1fb1e62d1a9032107d2e69e0fe318fe56fd8c6446(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__86ab35a7e83662445f6e9c1082bd6a0b403da3b3816f7d269a8beb9ec763aa6e(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8395334cfe317051014661b7ea8e1f147cad2370cd7fb9bc599f3c55f984c02e(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__677ff29ec5a560cd3ca6eefdeccae684908fcca9e6a183d005511f456905ca05(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0e582cf0d9ad569f30fbb798faeec839ea5226c7a6c74cea4a1c72a9bce32bff(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9061cf3410064c5c1869f65c963b468d390f64707f26257e8a88bdb7bb3653a0(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__64d65dd2d1ecc1a3f9a3fed2e246b2b3d6e917c00539f54b413ef6ad48e11f73(
    channel_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9559846a17e49edce5c0cf3d5c92b0b3afcce854b0e3f2dfafff9b96ac163069(
    input_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__62f95aee8b706706610c86999699148cd0e2c3e46e728a43d4490b405285591d(
    device_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8bda018c85ac1c3a43dfeccb6b1868ac25ac7b93acb71b1cfb6cc11e26d9220a(
    input_security_group_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8b00a5495b84cb35d608243a3de1939191355b749bed96371e38d90e626aa75c(
    multiplex_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8ca33d2448559d81c09d182b22ed3d47c273862fd82eac6f708875cf9ff49863(
    offering_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dc90655d6b6773b5243b7481fe3ac9a6c193e90e9c62464a5ff8e552f34d1b29(
    reservation_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__95e7f444cb2da1990a9c52ce3775583a3dd5aea0d9124f17d446a5ce6820b59d(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4a1bb617bb2cc0325da5bc4fac174cf279e82a0b18164b0ebcc593eafb6a0ac7(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a686cc8bddaa22f6d4118cc457ba55e8a9f9d4b1ab43acdb08647ebfc7775dcf(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__492d29125644d522c441b12ae97fc7fa6873a53d271e05960c2ced1253b66e89(
    channel_identifier: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4499ed274014696bf0fb06eefa635e2369631e61f589a8e5c706189d8ecd0eb0(
    harvest_job_identifier: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5545c51254d2bc82427753ccbca676e67758ad41d94afd9e829a3b16bcc7a16f(
    origin_endpoint_identifier: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8fdb609110ffa19ac5027d4df69c2703246e92b2dc6aa82892c8db925ffe23c7(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2cbb993fd3632e5009f41fc7eec3b59977830a6660b3a0cd096190644e2d9b51(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4edd42f5eae4834613f9779578eaec50ec050d815bb5aa6a91644799567d527d(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__efd8169d4c291f5c801e6a050112dceaa4819476c2746d7be0f5b6e56597fd69(
    asset_identifier: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dc0ff65c7a15397439228e71e0e055d9215f3327a65ba974faf2606664fb8f33(
    packaging_configuration_identifier: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bd25aaeacaf01ae9e410fc92a25517e90cbc9958cc299a419641b76f537d4f2a(
    packaging_group_identifier: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__084f3150aa3f8f3d58d391e691805df1bd63b2a34e6f212084f62e41bcf8894a(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__231db539e63a0b51265cd96cbf5370066c217110518b4128e566e0ab10b5bf94(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ad76fbf577d9cd0213f59d162abb96368d553f460d5de52dd1601664ad515547(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bd2749cf263aebb862ab6d572a1c5cf5c0a913af3fc13f776656e6acb17883e4(
    container_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__06ecda77bfc81e463cdfe68a11708810c8dae196dd4c21b44fe3806f99c8607c(
    container_name: builtins.str,
    folder_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6fa3776bc3c16cb1dc465c8979772d15f3e29239ec3bd94e37581c4041c73f2c(
    container_name: builtins.str,
    object_path: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1131746f1246a72d7b623e4b17b74a2f51f717b7d8405f6b17339bcc57da0b75(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__92c0f72f6a3cdec5a72f697ad1dc01660078dd0d4dd3c53c9478109865e451bb(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__83d11e221cc42400cd8da51aa8e6970c1235976a73e8149480f17cfd0f27fd94(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3f8558408c367071365304e340e7c7e1a6b1dad96179d02f203a630de7e95b14(
    channel_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e39436e06d324450262a5746038567e1094c1925e504a66cda06ebce97d498c5(
    source_location_name: builtins.str,
    live_source_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9506504cfabc9ef221023aeab16330af8caaad6b3d41349ab76caa9335d68935(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__28c45c96003462b1df572fb64afe55ecfb72859f6592af8312dd05e9162e6772(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4637b71b2490a26e0a600dca771e263eab1ca014f04380289476161567dc539a(
    channel_name: builtins.str,
    program_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f9cd4923089b8d9b5fc9594ae336eaffb68a9d0b6d23b45957c8f0e7655c713f(
    source_location_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c72c577209d74642b04c36b701d84216961a2ce6386eef13b752515a29a83230(
    source_location_name: builtins.str,
    vod_source_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__34d0f49cf3b2df149d1a5e727e5bb6c9532fbc22007c7e48a366ebf424834fae(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7fce719193eefcf5ed0655fdfaa79331256d739c7fc06e8010fe6d3477558d91(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4932c63dd932e5eb09b4a5d94b20bae2e8b77091f3379be33bff8f534a0deba9(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b3be9ad532b1718ea0dd60969e4d5477ba82af7d68351082bf5ffc5defe832af(
    acl_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__de259ce5f3afca53a6e4e8448abd75af1b7959d76162ee766c201379989f1f3d(
    cluster_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__265b49a7cbba7bb64b8db01d19f93d10673dd8ba1c2f559aed745b61163c81ec(
    parameter_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0f5c000ce3b535c1fc5892081eeb17ca96fc79275efdbaf0e4a9e3836d259de7(
    reservation_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5dcfbc1ca9d4e2167ecb1a841a4cef2f80d254053132b9d7dec8f2febb0c3da8(
    snapshot_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__682f32a8ed06b083d623d747cd3510405d491beca5e7ed740693459365734247(
    subnet_group_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4604a409f8b4c5213d4025cadf45357407518c8d8fd034e99e4748bbdd98164b(
    user_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c6e6292ab87983529c0147e2e800ce874f9606882feb26bfde29dbe77e8bb3fa(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__761dcf473ebdede77e1841d37174582f48e48eed86eaa399b5c0f08bbdd0efe7(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1342ffdfd9d0dfe7e6157db233e8eaa926efeab808be39e5b6982887fcd965a4(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__aa398f057acb0a0c92fd220c507f1ec76e9dbfe35442536fadd85f3d751d6d9e(
    stream: builtins.str,
    task: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ec785b410397ca1114d62dd48c0f2fe7b5bb151882161039a4c71c6eeaca3e88(
    stream: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__800930f0d1ad4c2481aabb4c662e46cb3c741bbba5671af0a68ba220e210c19a(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__528055b983f861edb2275ce8692401741b9fe16dbe422462deecf989d7daef7d(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4c127079992aaf6b78a12b3a012f25710fd4f274da61362de3d21120795a3f61(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1217d5ba1f0dca80efc8e5cb4c70b61eefd61e5cac9339098086aac2ac74101f(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5fa640d7677b81dd80f4ab2b064257d764450864f53d3aeadf9aecccec0281e9(
    application_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__607185d1714b4413d94cb198badbedc7b9835321d8db7e5c23a098e8380225d5(
    export_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6af1b55538f419cbf215c454c35187ed511c6609818999cd632f4858e8047dcb(
    import_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__39fb1961f1edbe7b0304c3b66b266126850bc176b4f2e3b4c183c3cadbb50281(
    job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9a933b82ae220a7e93c968d97ce1cb3e720a8c40d754ad5cadbdda2fb6da90c6(
    launch_configuration_template_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1d18a515256df566854263d20f405668900afdbf6d6019e411ac6eb3f78a85ab(
    replication_configuration_template_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a6ed916ccf0aac149204fc7ceb2e3fca814dd0146011fe478862bac43337af16(
    source_server_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4591fc4ef576221e1d8e3e5969f165b6c5db5b62fb7c581b4c7dbe17515cfcc8(
    vcenter_client_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8baba7845a30595b61068a500bcca7927142c9543d80f3ba5a04b0766de429fc(
    wave_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__edc3e0bab791bd432e207fdd0ccb316ff367fff36041f5aa2db2882884b70e2f(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9e730ed98df723da290e51f16dd7e60505c4d38aa90005afda91a71c922e486f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bf5524cf24f5ff27e0c967e8b7d078b392f46d5fc2544f357dc9340455442590(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cb0cd65b2fb848b31c969484c49f3d05978a01fb9480367d2a377ac65cb5ad1c(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__55070982b7f04c3621a916abb1ae5a013805c7144537d3cb1cf25a01f6e8f3c1(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d9b722c7b5caca88c0062ef2e067fc16e4aae91251cb0fcea4b4bfa1650c6811(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__581cfd27302fc0ebb0313f922a21d61e5b036c029a77cdc0ab8e4028a441cb7e(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__40fb05922b40fa733c276f9eb55de5b837e6636459815aa7c152ac8c2b26df89(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__16c373cad231658f8d8deb91f750adc3320f8aa61474135913b665a67ee350e6(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__694a7efb838a692c9ecd36d2c51bc1d0469ce97008a8ec9c153238ab94f0c291(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ca8cad29493b4e66162e478a035b295ae9a74aba4be623afa5c20f8b3a2b401f(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2f7abc7855ac457dc50dd72c558da07854aa390048153ff3899c825a89656a4f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__18f71145bda6d02080a248eb7de451b8c93656fb74e847de5c55c4cb8526e249(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__83c3e7c50a83087863287258e1aa656c423626e78832c80bee9d237e90977644(
    project_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f1f34d94bafbbf38ca65da02136838515f25f937302f777f893763c064ca0518(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ee3eb84de4d4441643bb9c7dc204cd1cff46ef9b33345b397c0ea60efa6b5e6e(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__cf68a0f3389aff8b670b1bfc491fb57c07d682c904c9723e9f9010afe8b4403a(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__212c116fdd33ce3f2920719866ef51aa1fbf9478c84bb8ab3072fdcc45b9712d(
    app_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b6f2e2666ab069dd85d4fd4cc2c8723e9e3fc854125f30d73408f4b55e44a1f0(
    app_id: builtins.str,
    campaign_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__96ccc2b51efdcecbefd2445494a7c8338069d12952a5a4dd79cb7a953421fb03(
    app_id: builtins.str,
    journey_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__41d8ac4b4b0bd72360fba9abc5095076707b0ee52ffb341628aa72143df249e4(
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__83bdf14edf668a639676a3ec3ada3cdee69dcfe54386bcc13c19537d95dddddc(
    recommender_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a7f036d06afa431fe977074698290e0340b536f7c8a58f6aac2be1c5c42f3c9a(
    app_id: builtins.str,
    segment_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__586cdf71a0ef44d5fe5c742ef7ce908fb643fa95e5019c4d7692ca261be3836e(
    template_name: builtins.str,
    channel_type: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1d0c0c86343c5263f54e8a38b4828d94d037ecb806ec02244ef0ceda3ee0ba0c(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__410c563a85feaf2c8a4be3b9edb94cbb02658f0c93550da54a866d9a94661f6d(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__06fa0670b98952639fe60ee798ca9bda9b3453aee42a406d1fa1684c83998e5f(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ec7bf9c54ca07b45511a2cbf1b6c6fea72f798b5cffe5f85fcf5137df41cda7a(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b0b6854f68d2a7eee7bd0b441526dcf12cb5f61b8c0fe81680eaa05225654acc(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3c34818fd255d48c8ce0c4dfb5e6f8a9a85c5ee25ccf0ee2b5ce3758fc42c753(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f6d250574885b4b1f414a4adeac62916922dad9d164e73e9b678799d17ef32dc(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__047a5cd36ffa853fab45baadec71cfd3f7d04a009e903f8889ff3fd11cd6aa98(
    broker_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3a526cd8a9b2cdaa769bd3bb2cc3a9bbf6ce37a4972e73c2b8fc861a3b5090e0(
    configuration_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d46ecbf5daacd6fcb25247d16a2632db400bbe0b2f2ac0ea86e426dd5edd051a(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__515fa36a991a3ea0883b6093603ecc6ad93734a27dd36bd3e72da1a141353ff3(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dae208a5cce1e8478f9b260141d28847397cd945b0270092baa64b03a4fa27da(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__49841cc60f60574f9257f6be4c80767b1ecd3fa94d8a9022730c949f12be67bc(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1ea04275a27e7471ceb9371a7ccc39b625f03d5bb84212f1a0dccbda306db2ec(
    cluster: builtins.str,
    database: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f64ebed0a479c4e29185ce94e47b39d6c3995ecda28507797640db121af2c4c5(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1c90ab3a8648d0fae6a34518847ee662a3d575f73dbae4a40dbd195163d11d95(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__12f4a3a6331b82acf2363bf30dc65d2a907c7a2a2e13abf91d8607ea21ebe4db(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8f31c5027d047acf134f317a22d39907bbf21341c163602a2e46334a8935b6c4(
    name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5374d0475dc42033eb47d2fccca54dbfb1a6aa609e91825508a4fb43e3728adb(
    name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__35e19e8636642875652b5fc7bc6f604259f54a793036eeff281329be5dbae75e(
    name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b8cc276be8cb046cd020514e666c0d7202ad90f1d7931bc91ad93939e386d2df(
    name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__32969d6534c21b7f2cdf578d4977fc2c3108e304632c6413b49454c096529971(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4df44abe53fdecacc6e8b2d0e457042049dd7aec647008216cf1e7d97d3fa45f(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1b3b706c5ca1a12205a899a258e3cff3de5465ea44a6c46209112e19bf236c48(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__233dda88543ac6a3250bf9284266a244744b167c3da8487f20f67f447286dd32(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4ac83c6e67c3b3fe7a844574ab026419e9532fa6817c32a92f9eac7ca60bd2a8(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c11c75acb322e29e88673f98823613eea7286b1049bd828446d37eaa60e99c5e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7eb95d88ef2c6f9bc308080f52ade1aba2053ff21208bca2ee1c2e1c91cc17ea(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__6023174c860a60cbfee36b6703be71803a9d32582469ff120b6d8e859a486e58(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__36139926e86cfabd2b5a8b1b1f968ba6d4be80b796f49d4d31524ee406b20990(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fc706aac434aec99659bb41a713590ca673180db56c26eb2200a947364619d07(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4bd60e6598f73a9ce88db6e0e58819d125529e695111107f09991172392bff6e(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__921dcf7253706708fc1ee731a2309909f88223a420b12808630b144e7b4d3682(
    global_network_id: builtins.str,
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ecb3be62280f25fcbc1455dd47b1c5b47b40aea564c17887913b6ad83de3d0cf(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__004dcb2e380765dd2ea0a2b6db05b1ed9d354e24cbadcbaaa803a74e7a22bdc8(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__50fcd9d04b03d0e94f126d11b0805cda00a80d3ab4c366b30eedcc17109d1e70(
    global_network_id: builtins.str,
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d27d49bd3e19dfd6b58d9c424c497a7847bd8d7a45ec98d4bfc34ea31b798413(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7d291bd2fbb34e438113c892e2a63ef4bab0e6b7b093b70b118c800f10a2f843(
    global_network_id: builtins.str,
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e1cdb6f32fb1b3412b0e0c06c9e58febed933688b32e13e18bcb1ed65e8c7212(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9c9f706706c518dc0edb1237f575ae692e73344374b3df68b63b7ff8122d2a0e(
    global_network_id: builtins.str,
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b632daca5968328f2f1d620e1f816c2f36bdefedf8a0c1a886508529c31a1352(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3275858fd7afc8f2796921a4a2a15dc059c73d011db6a34d931f06a5f76b1a52(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a4ed636ee25c09eeecd5eafe87ee9a87f4453c543de00329f66773a11d04d3e2(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d860918c1a7af28ff21b9ea8d763d8dc0a3e286b68ce06d3a679be7bfd644403(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c1949b8289287cfdefe0fbaa3453cee2d2ab6b2b2a1cf37b89309ecc601f1206(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__020522bdde27b46c02b3ba425b6773be1b13c5a8239ae2c2173bfddd2ab43a7e(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__180898eeb3070cea2c0aba8c05827510cc55764acac0bc857b9d9d2fb969e110(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8a1f8c9ee13748bfeb0639c82cb4cfb0c8c909fe644930853b356fcff938df0b(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0d4c6cc5b3fab000845b790687e3e762b84cf4ad3f55d0b8c21a19279e3be1e0(
    eula_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__299edaafbf61d43a89e23cb8a48476d882c0ff7f37a43e5824ed3da0a801d073(
    eula_acceptance_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f612bfecf76b349b9caf25ca8c0efb71ea8e306abd2a45fea593a04e33fda457(
    launch_profile_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1f9c4845f21f901eacbec3aa7ab9240236539ee4dca61f0ee37d6b9161cfa0da(
    streaming_image_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f027f2826af394b91ce30c1d1042a8d20cf95b8b11df370e2dbde3017fbb1033(
    streaming_session_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__72dbaae24e8016f448feed8557243b7e2e74d9394e6a33975ed66ef422906956(
    streaming_session_backup_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__37e2c4c7c9a7f77358bcda27d15656e528e703af5db2eedcfd12cd535a90c904(
    studio_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__532ae028f24a4866cc2ed65db44614cf00048f82de842131848cc4b907ab140d(
    studio_component_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__854b7662731b4b11652120e38a026ab398c51afbf61f64711d6162b1053ba5cf(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__83cb9a03b94596f8dceae5034c4e6d7b25722c4a62cdd698d3a330c1ffa3b242(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c729369680ba8c4ad7e0269195be7970574b5fe4a9a0bed8e239eff2973f9300(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8632c5cf6d5a40519f7dd36551aeea2603fb7939dcbc0dcbf4342d4c9031b457(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ba7c05c99c71b5c2879f046187cb5f83912ef73a884f148ef80db1021953fc6b(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__48a6c49466215f8d21041f7e9aefb6a4dddf499675c5231c75c107df7e73d625(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__291a11fe41936d8006848d73afcf7265afabf27a7bf4caf3e0534baa94b5e9fd(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f83633424ac9a8674cbcd127c2b8dcc300a6f4923877bce69642698bcf2e3b2b(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1aa526bd2a84d22f4ee7cfcb42f20e744b8260f737097a1b234fb8c49e03f7fa(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1634405f92334f00da7e4661b0ea3a73f6b3a443ef606b4132acac8d898448b0(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__7cc39b7ca29932c1a11498d6e8bd600ec971193b8aaeeed0258d93770f4e2d26(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bcb86b9470afab2e39ab16c9eaa61d06e93f2f0c7f0d6bf94af6c299ace2213d(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__aff0972b2609c6cb90093cf30f755705a868099a6740ef9fb11f84a5aeb3442c(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__90236a0704572ac36a23508a0911a0a2de1436b98531c5f9e77b6a04876c29b0(
    annotation_import_job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__82bc152b928f2db973c05f894a9e41533178a7ed837a51d5800576765e4e61bd(
    annotation_store_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b4cdeba4fd5757c3904407deb7ffeffcddf9760b0c39d7b7121c6d9ba16ace57(
    sequence_store_id: builtins.str,
    read_set_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5580d0abfab3252f7d3562967f677e2532a5e377da38313958a4134e0953f20d(
    reference_store_id: builtins.str,
    reference_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__50c1684b94f904ce347b58d9964b852c122bd65e5d6bfccac93958ad12a7d664(
    reference_store_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__37646323cd06599d618211eeda67505d679c690ce1d4900e4880be32c07597a1(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e654b13a7200f207ae9a0c0e1e3007055e5b6d07d3c6f12ccdd9ed953afd7fc8(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__170506f3daf968cce22271f7672c1eab7da93616876d985752842265e7de9941(
    sequence_store_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c00229e98c829415e2d280dee8e4093d39fccf78298c728b0612156d32c63b7f(
    tag_key: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__8b61688fcc7dbc817d2bd10d20ce38780025389724f4bfdaa385b1e85e1845b2(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dec4457d67ad1f6a5b47f02e506b17299d8cef802f7b596d9850c7083d741e39(
    variant_import_job_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__bac639fb1c367d2405cff06aef9304f3974dbb5064d0cc8ad97d3ed1f511b385(
    variant_store_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__907498abd4ba9bcadda952308a00c2dd070413c4d38d333a7489c7573839bb40(
    id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d171e84efe01f1f88c2c05169d1fa4c1678b0ba1e6dcd1104cd5a7799c51a82c(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__26a2d0f5ecda053ea0c80e7710ff886e2daac314d71421929e2b6e4256882fd1(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__81e2bc410befbbdb61fc9205773ce3a84c40e40ce6e4a938b237bffb4c13b2ad(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d4897af16076cabfe9021bb5360f88db48c5ded78c450b0bd872bcd224854df0(
    stack_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a77b2ceb055e1d1999dac6138b2580accefb4483891ddd5bc2bf334dd4f15ef1(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d662d2bfef3024e5f79b7833e977ccd3ae8dc9aaafa8e9edf41e55e681f48e32(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4e780a6ebbbc92e8bc3c14c8c71372bad4669dfae01d3836ea0fde559d3d7101(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4e454d66cebe7d068a1d6608ce5ee43fd508e7f0a5e820e34bdf344c10b0c064(
    server_name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d7dc7bb87a87e9d4c4e9bf70f58280263124f6962629d645a2ef26dac1927295(
    server_name: builtins.str,
    unique_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__2b9abcf4962be1c0d9c9e95097b494fc953d818ae721f507c54bde21665496de(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__572f6497761497615496e4697a6875772f92b1717e6c4237cab9fb84527aebe6(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5d8b540d0e9938645197d5cfebf79bc6e623ec1ec26e471053577cc01f8b1c08(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b601c7fcca82be0cfceaa6c634bff7eaf55ccc7ec413afc14670ce95f99f49ee(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__fd2764f03b21b8b660e0b3f25216aea02595cb0ed4659d2da3f71a282573d40a(
    value: typing.Union[builtins.str, typing.Sequence[builtins.str]],
    operator: typing.Optional[typing.Union[builtins.str, Operator]] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__52aa62a4781948f7abe635517cc93d3156b458858bb270f4e2988eb9464ba5d0(
    organization_id: builtins.str,
    account_id: typing.Optional[builtins.str] = None,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b9d7ac662d20ed2a442b8502fc85bec6a220d5c0d068ccda253d64bb1769e452(
    policy_type: builtins.str,
    policy_id: builtins.str,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d4a63fb0c6a914a98fae572cfc6c7a83e274f4af2c03a299cc9fd21d0f5a9978(
    organization_id: builtins.str,
    handshake_type: builtins.str,
    handshake_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__44f6e81ff18407acd1f39cbc21f8065df78286c84cdf81062b8aafe90ce70182(
    organization_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__674e5f370b531a391e04910941577305c901617e06c0a8466039c02c6824e92c(
    organization_id: builtins.str,
    organizational_unit_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__03f8169fc02587a2d0160529a6b5379cd64c590f654ecfe4b0aa155aa7b09654(
    organization_id: builtins.str,
    policy_type: builtins.str,
    policy_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__dcfcf3ccc2bc2b3b7d8e3369427117db44a07ad29adc12386262bc009ab075e8(
    organization_id: builtins.str,
    resource_policy_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__903e75ab3ee880d7e87e80e7be43c529c9d4b538776400b8c5cd2454e5eae46b(
    organization_id: builtins.str,
    root_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__331ddcc1b0ebb63aa7436d1c55a9cae7814e160c8ccd1277b7d7fc020e7e3800(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__78aaeb608e441ad2c913192f8ab4f390dc4ab91a17fa6bf052dcce6bfa425530(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__98c156bcea38a1e0e095cfda15585101028a503f57b543125860b1af4b2da9c2(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__69bddb2d6bed2d611680c5f55b970537c78b7bb9a4fad19e7c5649b4bb1c9b20(
    outpost_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__ffe9d8ab5897893f72d061ff1b5f844046c3db036a7fa71422a27af5d4590aa8(
    site_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__931882eea6f6ed6f15ca5d1d3c9d058b355eee551b57d1af6b7e692c89204643(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__aa1e90a8366d6d2be4454acaf41db2a369b196fe796a0f5e868a025745c599b9(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__49510ab62fb408da87b826ed95460d2e16ce90c141f5aee06d72c218019e8124(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5ce41c6607b44cdf394d671fff9addfd70b9c6a5348b20cc1afb15c4a9019d0a(
    application_instance_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__93545fefd9beb3593acdc436519f6d49fa837f14d5a661ba3a3428c6e29ef877(
    device_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e7a1c8ce0102a894e857e6fe2509cda1b463b8fa60577c2f17a7749dd08b47e5(
    package_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__68a8b24cb36835c86be13d799127b4d212dfce2bbd8b4fc15425aee943182c78(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__23e4fb3c5ef395895bc8f2fac0113a6d35d7e4d6e5c2d16b7a8a30e60bde69fb(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b5fc72a666a32209e82fd6efd6c09e93902f6f37679612cf94729b9e2437eff5(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__29ae557b1c6bfb5f1185f73019965b621b77a52fd8b6c38668faa4ad91f4591a(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9eb02c3877d548f2dda3c59c1a5c85c725dca0a2c90145b951ae32a60a14d34e(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__e19dbb5b6540b58430244493b51e1b22be61b42a8a64289070e082290131d0b5(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0e9ecd9386ce3fd95fdeae36c017526fc9a0dbba16f4471f19c15a4f99680e70(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__f77c8051e5f4be1e3cb33a8d577f6f60cc461f9e40cdc0ec38554120f29baab8(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__38df88287f57f24e6415dece7ea6014eaee20462de5f9572b577c1d9b0f1d736(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__5a318dee946586ee0033752cc4b8e0fc154a945f7bb7259930df782e98db63fa(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__1e7499a492f81b7e1ff37d00205b0b3596ebe65bb957fb239ae994f29d47ede6(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__55ab97d93e4c67dc67f2a0db5c51af4dcbb147fb6b25330bc647fa9fc48aede6(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b0b617464e9038df1afcaa97089ef86798452c575cafbfbd9e6434a775c983ee(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__9fae2e89282de5b240114f4fba03fe27005c1ab07ca504953f8b8d512052dca9(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a21c770cea4b4903d1cc157b3ccfa0deb3102bf4bf0ba2e7f38be4f3ef226675(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c04159bf5531875014bff191d379285680ca9db88867c9dc1f39adfc8c21dd26(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__a6972aed2b82b28c516a2b6ab8cc40109bbf39de9a07c1e4a66eefa05253328d(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__172661cf7a1a733a0ab1060627f1191827af48ee2e3bd5925a34572a18ca009b(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d1d066b0bd2a4acd3c81c3097049caa2e0cdc27fad3bab566c598cac40f20e7f(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b455dd8693b726846333fd050bb5455b06c8f187fe124b59a73a1c9863eee31b(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d65f8e2f99d4d5079d4f62d2b58f7d07993b8fd4089606ce5ef2cf9a9d1c905c(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__4c4f1748612190753757c44a0ce4e39890c1d3ea03cb12947655eaa49b155633(
    resource_id: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__22a510afce28534b1543a0ce0065fc289290f9114941619b0396cf1eddd7beb4(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__c2b1a1727d54dd946e075d7ebf43056433c1e640a0a6b589275f2581710c41ef(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__d6c201b46d93d9118d9e9c9a05d537d794a8ff594f049fa2b297de522627d137(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__487cb60752d95cd12d4f1040a41ee4c25034ec997eba38200ee55bfb400ef5ca(
    service_type: builtins.str,
    identifier: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__43f4152509c7c59395f9b157d3f5b24508853f18cb70288c38215c35f3c7be95(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__0ff02e4a28281ca7fd59d357ab3bc056631df0d88c8f81b486ade01e6934fa2a(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__318c272cbfb540a2397387e424ac55f6f876fe0db94aacd45dec8d84cc189b07(
    sid: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__b52079d8ae4c83657b6234fe8af54e7db83a4e6968a15e94e1c820849aee4442(
    name: builtins.str,
    account: typing.Optional[builtins.str] = None,
    region: typing.Optional[builtins.str] = None,
    partition: typing.Optional[builtins.str] = None,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__3c617047a1bcab9601b03ee0ecc76159a589e7a306041b25148130538ebf9923(
    value: AccessLevelList,
) -> None:
    """Type checking stubs"""
    pass

def _typecheckingstub__39589764549d0d14a7feefb567114936a4c6b1d21b4886775e3ef5c6ce0efdc1(
    value: builtins.str,
) -> None:
    """Type checking stubs"""
    pass
